From f175e402c7d2b7a4caa1315310206c6434de2fb3 Mon Sep 17 00:00:00 2001
From: Riccardo Manfrin <3090891+riccardomanfrin@users.noreply.github.com>
Date: Mon, 5 Oct 2026 15:59:31 +0200
Subject: [PATCH 01/70] [client] stop offering to every peer when the relay
 transport drops (#7092)

* [client] stop offering to every peer when the relay transport drops

The relay transport is shared: one connection per relay server carries the
streams of every peer using it. When it drops, each of those peers gets a
Disconnected verdict from evalConnStatus even when ICE is still carrying its
traffic, because peerUsesRelay comes from HasRelayAddress(), which only reports
that management offered relay servers, not that we are connected to one. The
guard answers Disconnected with the aggressive retry, so every peer starts
sending offers over signal for a transport that no offer can restore: the relay
client's own guard is what reconnects it.

Feed relayManager.Ready() into the status inputs and return PartiallyConnected
when ICE is up and the missing side is the shared transport. That is the
existing "one path works, the other does not" branch, which retries three times
and then hourly instead of walking the exponential ladder forever.

Peers are not left waiting for the hourly tick: when the transport comes back,
Manager.onServerConnected notifies srWatcher, the guard resets the ticker to
800ms and iceState.reset() clears the hourly mode.

The verdict is unchanged when the transport is up but this peer is unreachable
over relay - it may have moved to another server, and only an offer carries its
new relay address - and in force-relay mode, where relay is the only transport.

* Renaming according to actual meanings

* Don't consider an in progress ICE as "partially connected"

when the relay is not..

* Aligns tests

* Address wrong comments
---
 client/internal/peer/conn.go                  | 28 ++++---
 client/internal/peer/conn_status.go           | 15 ++--
 client/internal/peer/conn_status_eval_test.go | 83 ++++++++++++++++---
 client/internal/peer/guard/guard.go           |  8 +-
 client/internal/peer/worker_relay.go          |  4 +
 5 files changed, 104 insertions(+), 34 deletions(-)

diff --git a/client/internal/peer/conn.go b/client/internal/peer/conn.go
index d73144773..17823e043 100644
--- a/client/internal/peer/conn.go
+++ b/client/internal/peer/conn.go
@@ -828,7 +828,8 @@ func (conn *Conn) evalStatus() ConnStatus {
 //
 // The result is a tri-state:
 //   - ConnStatusConnected:          all available transports are up
-//   - ConnStatusPartiallyConnected: relay is up but ICE is still pending/reconnecting
+//   - ConnStatusPartiallyConnected: one transport carries the traffic and the other does
+//     not: relay up with ICE down, or ICE up with the shared relay transport down
 //   - ConnStatusDisconnected:       no working transport
 func (conn *Conn) isConnectedOnAllWay() (status guard.ConnStatus) {
 	defer func() {
@@ -845,13 +846,14 @@ func (conn *Conn) isConnectedOnAllWay() (status guard.ConnStatus) {
 	}
 
 	return evalConnStatus(connStatusInputs{
-		forceRelay:          IsForceRelayed(),
-		peerUsesRelay:       conn.workerRelay.IsRelayConnectionSupportedWithPeer(),
-		relayConnected:      conn.statusRelay.Get() == worker.StatusConnected,
-		remoteSupportsICE:   conn.handshaker.RemoteICESupported(),
-		iceWorkerCreated:    iceWorkerCreated,
-		iceStatusConnecting: conn.statusICE.Get() != worker.StatusDisconnected,
-		iceInProgress:       iceInProgress,
+		forceRelay:              IsForceRelayed(),
+		peerUsesRelay:           conn.workerRelay.IsRelayConnectionSupportedWithPeer(),
+		relayConnected:          conn.statusRelay.Get() == worker.StatusConnected,
+		relayTransportConnected: conn.workerRelay.IsTransportConnected(),
+		remoteSupportsICE:       conn.handshaker.RemoteICESupported(),
+		iceWorkerCreated:        iceWorkerCreated,
+		iceStatusConnected:      conn.statusICE.Get() == worker.StatusConnected,
+		iceInProgress:           iceInProgress,
 	})
 }
 
@@ -1060,19 +1062,21 @@ func evalConnStatus(in connStatusInputs) guard.ConnStatus {
 		return boolToConnStatus(relayUsedAndUp)
 	}
 
-	// ICE counts as "up" when the status is anything other than Disconnected, OR
-	// when a negotiation is currently in progress (so we don't spam offers while one is in flight).
-	iceUp := in.iceStatusConnecting || in.iceInProgress
+	// ICE counts as "running" when either connected or attempting to connect.
+	iceRunning := in.iceStatusConnected || in.iceInProgress
 
 	// Relay side is acceptable if the peer doesn't rely on relay, or relay is connected.
 	relayOK := !in.peerUsesRelay || in.relayConnected
 
 	switch {
-	case iceUp && relayOK:
+	case iceRunning && relayOK:
 		return guard.ConnStatusConnected
 	case relayUsedAndUp:
 		// Relay is up but ICE is down — partially connected.
 		return guard.ConnStatusPartiallyConnected
+	case in.iceStatusConnected && !in.relayTransportConnected:
+		// ICE is up and the shared relay transport is down — offers cannot restore it.
+		return guard.ConnStatusPartiallyConnected
 	default:
 		return guard.ConnStatusDisconnected
 	}
diff --git a/client/internal/peer/conn_status.go b/client/internal/peer/conn_status.go
index d6ad37b70..acf271534 100644
--- a/client/internal/peer/conn_status.go
+++ b/client/internal/peer/conn_status.go
@@ -17,13 +17,14 @@ const (
 // tri-state connection classification. Extracted so the decision logic can be unit-tested
 // without constructing full Worker/Handshaker objects.
 type connStatusInputs struct {
-	forceRelay          bool // NB_FORCE_RELAY or JS/WASM
-	peerUsesRelay       bool // remote peer advertises relay support AND local has relay
-	relayConnected      bool // statusRelay reports Connected (independent of whether peer uses relay)
-	remoteSupportsICE   bool // remote peer sent ICE credentials
-	iceWorkerCreated    bool // local WorkerICE exists (false in force-relay mode)
-	iceStatusConnecting bool // statusICE is anything other than Disconnected
-	iceInProgress       bool // a negotiation is currently in flight
+	forceRelay              bool // NB_FORCE_RELAY or JS/WASM
+	peerUsesRelay           bool // remote peer advertises relay support AND local has relay
+	relayConnected          bool // statusRelay reports Connected (independent of whether peer uses relay)
+	relayTransportConnected bool // the relay transport shared by all peers on that server is up
+	remoteSupportsICE       bool // remote peer sent ICE credentials
+	iceWorkerCreated        bool // local WorkerICE exists (false in force-relay mode)
+	iceStatusConnected      bool // statusICE reports Connected
+	iceInProgress           bool // a negotiation is currently in flight
 }
 
 // ConnStatus describe the status of a peer's connection
diff --git a/client/internal/peer/conn_status_eval_test.go b/client/internal/peer/conn_status_eval_test.go
index 66393cafe..a239196dc 100644
--- a/client/internal/peer/conn_status_eval_test.go
+++ b/client/internal/peer/conn_status_eval_test.go
@@ -30,6 +30,21 @@ func TestEvalConnStatus_ForceRelay(t *testing.T) {
 			},
 			want: guard.ConnStatusDisconnected,
 		},
+		{
+			name: "force relay, relay up but the shared transport reports down",
+			in: connStatusInputs{
+				forceRelay:              true,
+				peerUsesRelay:           true,
+				relayConnected:          true,
+				relayTransportConnected: false,
+				// The ICE inputs are set so that the force-relay return is the only branch
+				// that can produce Connected here: without it the peer would fall through to
+				// relayUsedAndUp and report PartiallyConnected.
+				remoteSupportsICE: true,
+				iceWorkerCreated:  true,
+			},
+			want: guard.ConnStatusConnected,
+		},
 		{
 			name: "force relay, peer does NOT use relay - disconnected forever",
 			in: connStatusInputs{
@@ -123,24 +138,28 @@ func TestEvalConnStatus_FullyAvailable(t *testing.T) {
 			mutator: func(in *connStatusInputs) {
 				in.peerUsesRelay = true
 				in.relayConnected = true
-				in.iceStatusConnecting = true
+				in.relayTransportConnected = true
+				in.iceStatusConnected = true
 			},
 			want: guard.ConnStatusConnected,
 		},
 		{
-			name: "ICE connected, peer does NOT use relay",
+			name: "ICE connected, peer does NOT use relay, shared transport down",
 			mutator: func(in *connStatusInputs) {
 				in.peerUsesRelay = false
 				in.relayConnected = false
-				in.iceStatusConnecting = true
+				in.relayTransportConnected = false
+				in.iceStatusConnected = true
 			},
+			// A peer that does not rely on relay is unaffected by the shared transport:
+			// relayOK is true, so the first arm matches before the transport is considered.
 			want: guard.ConnStatusConnected,
 		},
 		{
 			name: "ICE InProgress only, peer does NOT use relay",
 			mutator: func(in *connStatusInputs) {
 				in.peerUsesRelay = false
-				in.iceStatusConnecting = false
+				in.iceStatusConnected = false
 				in.iceInProgress = true
 			},
 			want: guard.ConnStatusConnected,
@@ -150,7 +169,8 @@ func TestEvalConnStatus_FullyAvailable(t *testing.T) {
 			mutator: func(in *connStatusInputs) {
 				in.peerUsesRelay = true
 				in.relayConnected = true
-				in.iceStatusConnecting = false
+				in.relayTransportConnected = true
+				in.iceStatusConnected = false
 				in.iceInProgress = false
 			},
 			want: guard.ConnStatusPartiallyConnected,
@@ -160,21 +180,60 @@ func TestEvalConnStatus_FullyAvailable(t *testing.T) {
 			mutator: func(in *connStatusInputs) {
 				in.peerUsesRelay = false
 				in.relayConnected = false
-				in.iceStatusConnecting = false
+				in.iceStatusConnected = false
 				in.iceInProgress = false
 			},
 			want: guard.ConnStatusDisconnected,
 		},
 		{
-			name: "ICE up, peer uses relay but relay down -> partial (relay required, ICE ignored)",
+			name: "ICE connected, relay down for this peer but the shared transport is up -> disconnected",
 			mutator: func(in *connStatusInputs) {
 				in.peerUsesRelay = true
 				in.relayConnected = false
-				in.iceStatusConnecting = true
+				in.relayTransportConnected = true
+				in.iceStatusConnected = true
+			},
+			// The transport is fine, so the peer itself is unreachable over relay: it may have
+			// moved to another server, and only an offer carries its new relay address.
+			want: guard.ConnStatusDisconnected,
+		},
+		{
+			name: "ICE connected, the shared relay transport is down -> partial",
+			mutator: func(in *connStatusInputs) {
+				in.peerUsesRelay = true
+				in.relayConnected = false
+				in.relayTransportConnected = false
+				in.iceStatusConnected = true
+			},
+			// ICE carries the traffic and the relay transport is restored by the relay client's
+			// own guard, not by offers, so this must not trigger the aggressive retry.
+			want: guard.ConnStatusPartiallyConnected,
+		},
+		{
+			name: "ICE only negotiating while the shared relay transport is down -> disconnected",
+			mutator: func(in *connStatusInputs) {
+				in.peerUsesRelay = true
+				in.relayConnected = false
+				in.relayTransportConnected = false
+				in.iceStatusConnected = false
+				in.iceInProgress = true
+			},
+			// A negotiation in flight is not a working transport, so this peer has no path at
+			// all and must keep the aggressive retry. Calling it partially connected spends the
+			// ICE retry budget and parks the guard on the hourly ticker, and nothing wakes it
+			// when the negotiation then fails: onICEStateDisconnected is only reached once ICE
+			// has reached Connected (worker_ice.go onConnectionStateChange).
+			want: guard.ConnStatusDisconnected,
+		},
+		{
+			name: "ICE down and the shared relay transport is down -> disconnected",
+			mutator: func(in *connStatusInputs) {
+				in.peerUsesRelay = true
+				in.relayConnected = false
+				in.relayTransportConnected = false
+				in.iceStatusConnected = false
+				in.iceInProgress = false
 			},
-			// relayOK = false (peer uses relay but it's down), iceUp = true
-			// first switch arm fails (relayOK false), relayUsedAndUp = false (relay down),
-			// falls into default: Disconnected.
 			want: guard.ConnStatusDisconnected,
 		},
 		{
@@ -182,7 +241,7 @@ func TestEvalConnStatus_FullyAvailable(t *testing.T) {
 			mutator: func(in *connStatusInputs) {
 				in.peerUsesRelay = false
 				in.relayConnected = true // not actually used since peer doesn't rely on it
-				in.iceStatusConnecting = false
+				in.iceStatusConnected = false
 				in.iceInProgress = false
 			},
 			want: guard.ConnStatusDisconnected,
diff --git a/client/internal/peer/guard/guard.go b/client/internal/peer/guard/guard.go
index 73bab2a89..15028d91c 100644
--- a/client/internal/peer/guard/guard.go
+++ b/client/internal/peer/guard/guard.go
@@ -14,7 +14,8 @@ type ConnStatus int
 const (
 	// ConnStatusDisconnected means neither ICE nor Relay is connected.
 	ConnStatusDisconnected ConnStatus = iota
-	// ConnStatusPartiallyConnected means Relay is connected but ICE is not.
+	// ConnStatusPartiallyConnected means one transport is usable and the other is not:
+	// relay connected with ICE down, or ICE connected with the shared relay transport down.
 	ConnStatusPartiallyConnected
 	// ConnStatusConnected means all required connections are established.
 	ConnStatusConnected
@@ -87,8 +88,9 @@ func (g *Guard) SetICEConnDisconnected() {
 //   - Connected: no action, the peer is fully reachable.
 //   - Disconnected (neither ICE nor Relay): retries aggressively with exponential backoff (800ms doubling
 //     up to timeout), never gives up. This ensures rapid recovery when the peer has no connectivity at all.
-//   - PartiallyConnected (Relay up, ICE not): retries up to 3 times with exponential backoff, then switches
-//     to one attempt per hour. This limits signaling traffic when relay already provides connectivity.
+//   - PartiallyConnected (one transport usable, the other not): retries up to 3 times
+//     with exponential backoff, then switches to one attempt per hour. This limits
+//     signaling traffic while the peer still has a working path.
 //
 // External events (relay/ICE disconnect, signal/relay reconnect, candidate changes) reset the retry
 // counter and backoff ticker, giving ICE a fresh chance after network conditions change.
diff --git a/client/internal/peer/worker_relay.go b/client/internal/peer/worker_relay.go
index fc3489992..694207847 100644
--- a/client/internal/peer/worker_relay.go
+++ b/client/internal/peer/worker_relay.go
@@ -101,6 +101,10 @@ func (w *WorkerRelay) RelayIsSupportedLocally() bool {
 	return w.relayManager.HasRelayAddress()
 }
 
+func (w *WorkerRelay) IsTransportConnected() bool {
+	return w.relayManager.Ready()
+}
+
 func (w *WorkerRelay) CloseConn() {
 	w.relayLock.Lock()
 	conn := w.relayedConn

From 2b5293687f3e6aa4a6a1f070a6e95353155e21c4 Mon Sep 17 00:00:00 2001
From: Zoltan Papp <zoltan.pmail@gmail.com>
Date: Mon, 5 Oct 2026 16:31:43 +0200
Subject: [PATCH 02/70] [client] Skip late session warnings on desktop and
 schedule them in the app on Android (#7548)

* Skip session warnings that fire after their window

The warning timers run on the monotonic clock, which does not advance
while an Android device is suspended. A timer armed for T-10 or T-2 can
therefore fire long after the window it was armed for, delivering a
"session expires soon" notification once that window is already gone.

Gate both callbacks on the wall clock at fire time: the T-10 warning is
skipped once the final-warning window has been reached, and the final
warning is skipped once the deadline itself has passed. Both set their
edge guard before returning so a skipped warning cannot fire again for
the same deadline.

* Harden the late-warning guards

Clamp a non-positive final lead to zero in the T-10 guard so a disabled
final warning cannot move the cutoff past the deadline, matching how
armTimerLocked already treats it.

Strip the monotonic reading from both sides of the comparison so the
guard measures wall-clock time regardless of how the caller built the
deadline. The production deadline comes from a protobuf timestamp and
has no monotonic reading; this keeps the guard correct for callers that
derive one from time.Now.

* Log the deadline and lateness on skipped warnings

Include the deadline and how far past the cutoff the timer fired, so a
debug bundle shows how long the device was suspended.

* Inject the clock into the late-warning guard and cover it with tests

The guard read time.Now internally, so the skip paths were reachable
only through a deadline already in the past and the boundary depended
on real time. Extract the comparison into isLate and read the time
through a nowFn field, so tests can place a resume anywhere around the
deadline without sleeping.

* Send the final warning when the T-10 timer fires inside its window

A suspend between roughly eight and ten minutes long made the T-10
timer fire inside the final-warning window and the final timer fire
after the deadline, so both were skipped and a user who resumed with
time left got no warning at all. When the T-10 timer fires late but
before the deadline, send the final warning in its place and mark it
fired so the delayed final timer does not repeat it.

* Respect dismissal when promoting a late warning to the final one

fireFinal skips the final warning once the user dismissed the deadline,
but the promoted path did not, so a dismissed deadline could still get
a final warning. Check the dismissal first, and give each skip reason
its own log line so an already-fired final warning no longer logs a
negative lateness.

* Add a deadline-only mode to the session watcher

Android will schedule its own expiry warnings from the deadline, so
the engine must not arm the T-10 and T-2 timers there. NewDeadlineOnly
keeps the deadline validation, the recorder propagation and the
logging, and skips only the timers, so the status snapshot the app
reads stays correct and an out-of-range deadline is still rejected.

* Use the deadline-only watcher on Android and drop the warning callbacks

The warning timers run on the monotonic clock, which does not advance
while the device sleeps, so a warning armed for T-10 could fire long
after its window. The app now schedules the warnings itself with
WorkManager, anchored to the wall clock, from the deadline it reads
through SessionExpiresAtUnix on every OnStateChanged.

Wire the deadline-only watcher into the android build and remove the
event-driven path from the gomobile surface: OnSessionExpiring, the
event subscription behind it and DismissSessionWarning, which the app
never called.

* Describe the late-warning guard without naming Android

The guard stays for the desktop builds, where a timer can also stall
across a sleep. Android no longer arms the timers at all.
---
 client/android/client.go                      |   3 +-
 client/android/session.go                     |  91 +-------
 client/internal/auth/sessionwatch/watcher.go  |  70 ++++++-
 .../auth/sessionwatch/watcher_test.go         | 198 ++++++++++++++++++
 client/internal/engine_sessionwatch.go        |  12 +-
 .../internal/engine_sessionwatch_android.go   |  12 ++
 6 files changed, 295 insertions(+), 91 deletions(-)
 create mode 100644 client/internal/engine_sessionwatch_android.go

diff --git a/client/android/client.go b/client/android/client.go
index 6f5eaacf3..9705db8e0 100644
--- a/client/android/client.go
+++ b/client/android/client.go
@@ -104,8 +104,7 @@ type Client struct {
 
 	stateChangeMu    sync.Mutex
 	stateChangeSubID string
-	eventSub         *peer.EventSubscription
-	// Closed to stop the watch goroutines from delivering buffered items to a
+	// Closed to stop the watch goroutine from delivering buffered ticks to a
 	// listener that has been removed or replaced. See stopStateChangeWatchLocked.
 	stateChangeDone chan struct{}
 
diff --git a/client/android/session.go b/client/android/session.go
index d5da09c93..1ce97f074 100644
--- a/client/android/session.go
+++ b/client/android/session.go
@@ -6,13 +6,8 @@ import (
 	"context"
 	"fmt"
 
-	log "github.com/sirupsen/logrus"
-
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/auth"
-	"github.com/netbirdio/netbird/client/internal/auth/sessionwatch"
-	"github.com/netbirdio/netbird/client/internal/peer"
-	cProto "github.com/netbirdio/netbird/client/proto"
 )
 
 // StateChangeListener receives client state notifications.
@@ -21,16 +16,11 @@ import (
 // changed: connection state, the run-loop status label (e.g. NeedsLogin) or
 // the session deadline. It mirrors the daemon's SubscribeStatus stream
 // trigger — on each signal the consumer pulls the fresh values via
-// Status() / SessionExpiresAtUnix().
-//
-// OnSessionExpiring forwards the engine's session-expiry warnings, fired at
-// sessionwatch.WarningLead before the deadline and again at FinalWarningLead
-// (finalWarning true). The second one is suppressed when the user dismissed
-// the first via DismissSessionWarning. The daemon turns the same events into
-// its tray notification.
+// Status() / SessionExpiresAtUnix(). The engine arms no expiry-warning
+// timers on Android; the app schedules the warnings from the deadline it
+// reads here.
 type StateChangeListener interface {
 	OnStateChanged()
-	OnSessionExpiring(expiresAtUnix int64, leadMinutes int64, finalWarning bool)
 }
 
 // Status returns the connect run-loop's status label — the same value the
@@ -110,11 +100,11 @@ func (c *Client) SetStateChangeListener(listener StateChangeListener) {
 		return
 	}
 
-	// Both subscriptions are buffered (one pending tick, ten pending events),
-	// so unsubscribing is not enough to stop callbacks: the loops would drain
-	// what is already queued and deliver it to a listener the caller has
-	// already removed or replaced. Gate every callback on this registration's
-	// own signal, which is closed before unsubscribing.
+	// The subscription is buffered (one pending tick), so unsubscribing is
+	// not enough to stop callbacks: the loop would drain what is already
+	// queued and deliver it to a listener the caller has already removed or
+	// replaced. Gate every callback on this registration's own signal, which
+	// is closed before unsubscribing.
 	done := make(chan struct{})
 	c.stateChangeDone = done
 
@@ -133,9 +123,6 @@ func (c *Client) SetStateChangeListener(listener StateChangeListener) {
 			listener.OnStateChanged()
 		}
 	}()
-
-	c.eventSub = c.recorder.SubscribeToEvents()
-	go watchSessionWarnings(c.eventSub, listener, done)
 }
 
 // RemoveStateChangeListener unregisters the state notification listener.
@@ -145,21 +132,6 @@ func (c *Client) RemoveStateChangeListener() {
 	c.stopStateChangeWatchLocked()
 }
 
-// DismissSessionWarning records the user's "Dismiss" on the first expiry
-// warning and suppresses the final one for the current deadline. A refreshed
-// deadline re-arms both. No-op while the engine is not running.
-func (c *Client) DismissSessionWarning() {
-	cc := c.getConnectClient()
-	if cc == nil {
-		return
-	}
-	engine := cc.Engine()
-	if engine == nil {
-		return
-	}
-	engine.DismissSessionWarning()
-}
-
 // ExtendAuthSession runs the interactive SSO flow to obtain a fresh JWT and
 // asks the management server to extend the session deadline. The tunnel is
 // untouched: no resync, no reconnect. Async; the result arrives on the
@@ -201,8 +173,8 @@ func (c *Client) CancelExtendAuthSession() {
 }
 
 func (c *Client) stopStateChangeWatchLocked() {
-	// Signal first, unsubscribe second: closing the channels only stops new
-	// items, and the loops would still hand whatever is buffered to a listener
+	// Signal first, unsubscribe second: closing the channel only stops new
+	// items, and the loop would still hand whatever is buffered to a listener
 	// that is no longer registered.
 	if c.stateChangeDone != nil {
 		close(c.stateChangeDone)
@@ -212,49 +184,6 @@ func (c *Client) stopStateChangeWatchLocked() {
 		c.recorder.UnsubscribeFromStateChanges(c.stateChangeSubID)
 		c.stateChangeSubID = ""
 	}
-	if c.eventSub != nil {
-		// Closes the channel, which ends watchSessionWarnings.
-		c.recorder.UnsubscribeFromEvents(c.eventSub)
-		c.eventSub = nil
-	}
-}
-
-// watchSessionWarnings forwards the engine's session-expiry warnings to the
-// listener. The event stream also carries unrelated traffic — network-map
-// updates on every sync, DNS and route errors — so everything but an
-// AUTHENTICATION event carrying the session-warning marker is dropped. Exits
-// when the subscription is closed by UnsubscribeFromEvents, or earlier when
-// done is closed — the stream buffers up to ten events, and a deregistered
-// listener must not receive the ones already queued.
-func watchSessionWarnings(sub *peer.EventSubscription, listener StateChangeListener, done <-chan struct{}) {
-	for ev := range sub.Events() {
-		select {
-		case <-done:
-			return
-		default:
-		}
-		if ev.GetCategory() != cProto.SystemEvent_AUTHENTICATION {
-			continue
-		}
-		meta := ev.GetMetadata()
-		if meta[sessionwatch.MetaSessionWarning] != "true" {
-			// Other AUTHENTICATION events exist (e.g. a deadline rejected as
-			// out of range); they carry no warning marker.
-			continue
-		}
-		deadline, err := sessionwatch.ParseExpiresAt(meta[sessionwatch.MetaSessionExpiresAt])
-		if err != nil {
-			log.Warnf("session warning event with unparsable deadline: %v", err)
-			continue
-		}
-		lead, err := sessionwatch.ParseLeadMinutes(meta[sessionwatch.MetaSessionLeadMinutes])
-		if err != nil {
-			// Informational only — the deadline above is what drives the UI.
-			lead = 0
-		}
-		listener.OnSessionExpiring(deadline.Unix(), int64(lead),
-			meta[sessionwatch.MetaSessionFinal] == "true")
-	}
 }
 
 func (c *Client) beginExtend() (context.Context, error) {
diff --git a/client/internal/auth/sessionwatch/watcher.go b/client/internal/auth/sessionwatch/watcher.go
index e685c28d0..496903044 100644
--- a/client/internal/auth/sessionwatch/watcher.go
+++ b/client/internal/auth/sessionwatch/watcher.go
@@ -90,8 +90,9 @@ type StatusRecorder interface {
 // fallback T-FinalWarningLead dialog (suppressed when the user dismissed
 // the first one for the same deadline). Safe for concurrent use.
 type Watcher struct {
-	lead      time.Duration
-	finalLead time.Duration
+	lead         time.Duration
+	finalLead    time.Duration
+	deadlineOnly bool
 
 	mu           sync.Mutex
 	current      time.Time
@@ -102,6 +103,7 @@ type Watcher struct {
 	dismissedAt  time.Time // deadline value the user dismissed via Dismiss(); gates fireFinal
 	closed       bool
 	recorder     StatusRecorder
+	nowFn        func() time.Time
 }
 
 // New returns a watcher with the package defaults WarningLead and
@@ -122,9 +124,17 @@ func NewWithLeads(lead, final time.Duration, recorder StatusRecorder) *Watcher {
 		lead:      lead,
 		finalLead: final,
 		recorder:  recorder,
+		nowFn:     time.Now,
 	}
 }
 
+// NewDeadlineOnly returns a watcher that validates and records deadlines but arms no warning timers.
+func NewDeadlineOnly(recorder StatusRecorder) *Watcher {
+	w := New(recorder)
+	w.deadlineOnly = true
+	return w
+}
+
 // Update sets the latest deadline. Pass the zero time to clear (e.g. when
 // a Sync push from the server omits the field because login expiration
 // was disabled).
@@ -181,7 +191,7 @@ func (w *Watcher) Update(deadline time.Time) error {
 	w.finalFiredAt = time.Time{}
 	w.dismissedAt = time.Time{}
 
-	if deadline.After(now) {
+	if deadline.After(now) && !w.deadlineOnly {
 		w.armTimerLocked(deadline)
 	}
 	recorder := w.recorder
@@ -303,6 +313,11 @@ func (w *Watcher) fire(armedFor time.Time) {
 		w.mu.Unlock()
 		return
 	}
+	now := w.nowFn()
+	if isLate(now, armedFor, max(w.finalLead, 0)) {
+		w.fireLateLocked(armedFor, now)
+		return
+	}
 	w.firedAt = armedFor
 	recorder := w.recorder
 	w.mu.Unlock()
@@ -331,6 +346,14 @@ func (w *Watcher) fireFinal(armedFor time.Time) {
 		log.Infof("auth session final-warning skipped (dismissed by user)")
 		return
 	}
+	now := w.nowFn()
+	if isLate(now, armedFor, 0) {
+		w.finalFiredAt = armedFor
+		w.mu.Unlock()
+		log.Infof("auth session final-warning skipped for deadline %s (passed %s ago)",
+			armedFor.Format(time.RFC3339), now.Round(0).Sub(armedFor).Round(time.Second))
+		return
+	}
 	w.finalFiredAt = armedFor
 	recorder := w.recorder
 	w.mu.Unlock()
@@ -341,6 +364,39 @@ func (w *Watcher) fireFinal(armedFor time.Time) {
 	publishWarning(recorder, armedFor, true)
 }
 
+// fireLateLocked handles a T-WarningLead callback that fired inside the
+// final-warning window: it sends the final warning in its place while the
+// deadline has not passed and the user has not dismissed it, so a resume
+// with time left still warns. The caller must hold w.mu; this helper
+// releases it.
+func (w *Watcher) fireLateLocked(armedFor, now time.Time) {
+	w.firedAt = armedFor
+	switch {
+	case w.dismissedAt.Equal(armedFor):
+		w.mu.Unlock()
+		log.Infof("auth session expiry soon warning skipped (dismissed by user)")
+		return
+	case w.finalFiredAt.Equal(armedFor):
+		w.mu.Unlock()
+		log.Infof("auth session expiry soon warning skipped (final warning already fired)")
+		return
+	case isLate(now, armedFor, 0):
+		w.mu.Unlock()
+		log.Infof("auth session expiry soon warning skipped for deadline %s (passed %s ago)",
+			armedFor.Format(time.RFC3339), now.Round(0).Sub(armedFor).Round(time.Second))
+		return
+	}
+	w.finalFiredAt = armedFor
+	recorder := w.recorder
+	w.mu.Unlock()
+	if recorder == nil {
+		return
+	}
+	log.Infof("auth session expiry soon warning fired inside the final-warning window, sending final warning for deadline %s",
+		armedFor.Format(time.RFC3339))
+	publishWarning(recorder, armedFor, true)
+}
+
 // armOneShotLocked schedules cb at fireAt. When fireAt is already in the
 // past it dispatches on the next scheduler tick so a state-change recorder
 // notification (invoked after w.mu is released) lands first. Caller must
@@ -380,3 +436,11 @@ func publishWarning(recorder StatusRecorder, deadline time.Time, final bool) {
 		meta,
 	)
 }
+
+// isLate reports whether the wall clock now has already reached armedFor
+// minus cutoffLead. The timers run on the monotonic clock, which can stall
+// while the host sleeps, so a timer can fire long after the window it was
+// armed for.
+func isLate(now, armedFor time.Time, cutoffLead time.Duration) bool {
+	return !now.Round(0).Before(armedFor.Add(-cutoffLead).Round(0))
+}
diff --git a/client/internal/auth/sessionwatch/watcher_test.go b/client/internal/auth/sessionwatch/watcher_test.go
index 4b49a94b6..cb2800978 100644
--- a/client/internal/auth/sessionwatch/watcher_test.go
+++ b/client/internal/auth/sessionwatch/watcher_test.go
@@ -527,3 +527,201 @@ func TestDismissBeforeUpdateIsNoop(t *testing.T) {
 	}
 	t.Fatalf("final-warning did not publish after no-op pre-Update Dismiss, events=%+v", r.snapshot())
 }
+
+func TestIsLate(t *testing.T) {
+	armedFor := time.Date(2026, 10, 1, 12, 0, 0, 0, time.UTC)
+	lead := 2 * time.Minute
+	tests := []struct {
+		name       string
+		now        time.Time
+		cutoffLead time.Duration
+		want       bool
+	}{
+		{"before cutoff", armedFor.Add(-3 * time.Minute), lead, false},
+		{"at cutoff", armedFor.Add(-lead), lead, true},
+		{"after cutoff", armedFor.Add(-time.Minute), lead, true},
+		{"zero lead before deadline", armedFor.Add(-time.Second), 0, false},
+		{"zero lead at deadline", armedFor, 0, true},
+		{"zero lead after deadline", armedFor.Add(time.Second), 0, true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := isLate(tt.now, armedFor, tt.cutoffLead); got != tt.want {
+				t.Fatalf("isLate(%s, %s, %s) = %v, want %v", tt.now, armedFor, tt.cutoffLead, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestIsLateIgnoresMonotonicReading(t *testing.T) {
+	now := time.Now()
+	wallOnly := now.Round(0)
+	if isLate(now, wallOnly.Add(time.Second), 0) {
+		t.Fatalf("now with monotonic reading must compare as wall clock before a later wall-only deadline")
+	}
+	if !isLate(now, wallOnly, 0) {
+		t.Fatalf("now with monotonic reading must compare as wall clock at an equal wall-only deadline")
+	}
+}
+
+func TestLateTimerFiring(t *testing.T) {
+	tests := []struct {
+		name       string
+		final      bool
+		beforeDl   time.Duration
+		wantWarns  int
+		wantFinals int
+	}{
+		{"warning on resume inside window", false, 3 * time.Minute, 1, 0},
+		{"warning promoted to final inside final window", false, time.Minute, 0, 1},
+		{"warning skipped past deadline", false, -time.Minute, 0, 0},
+		{"final on resume before deadline", true, time.Minute, 0, 1},
+		{"final skipped past deadline", true, -time.Minute, 0, 0},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := &fakeRecorder{}
+			w := New(r)
+			defer w.Close()
+
+			// The deadline is an hour out so the real timers never fire
+			// during the test; the late callback is invoked directly with an
+			// injected clock that simulates a resume near the deadline.
+			d := time.Now().Add(time.Hour).Round(0)
+			w.nowFn = func() time.Time { return d.Add(-tt.beforeDl) }
+			if err := w.Update(d); err != nil {
+				t.Fatalf("Update: %v", err)
+			}
+
+			if tt.final {
+				w.fireFinal(d)
+			} else {
+				w.fire(d)
+			}
+
+			events := r.snapshot()
+			if got := countWhere(events, event.isWarning); got != tt.wantWarns {
+				t.Fatalf("expected %d warning publishes, got %d: %+v", tt.wantWarns, got, events)
+			}
+			if got := countWhere(events, event.isFinalWarning); got != tt.wantFinals {
+				t.Fatalf("expected %d final-warning publishes, got %d: %+v", tt.wantFinals, got, events)
+			}
+		})
+	}
+}
+
+func TestPromotedFinalWarningIsNotRepeated(t *testing.T) {
+	r := &fakeRecorder{}
+	w := New(r)
+	defer w.Close()
+
+	d := time.Now().Add(time.Hour).Round(0)
+	now := d.Add(-time.Minute)
+	w.nowFn = func() time.Time { return now }
+	if err := w.Update(d); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+
+	w.fire(d)
+	// The final timer was suspended too, so it fires even later than the
+	// warning timer, here still just before the deadline.
+	now = d.Add(-30 * time.Second)
+	w.fireFinal(d)
+
+	events := r.snapshot()
+	if got := countWhere(events, event.isFinalWarning); got != 1 {
+		t.Fatalf("expected exactly 1 final-warning publish, got %d: %+v", got, events)
+	}
+	if got := countWhere(events, event.isWarning); got != 0 {
+		t.Fatalf("expected no regular warning publish, got %d: %+v", got, events)
+	}
+}
+
+func TestPromotionRespectsDismiss(t *testing.T) {
+	r := &fakeRecorder{}
+	w := New(r)
+	defer w.Close()
+
+	d := time.Now().Add(time.Hour).Round(0)
+	w.nowFn = func() time.Time { return d.Add(-time.Minute) }
+	if err := w.Update(d); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+
+	w.Dismiss()
+	w.fire(d)
+
+	events := r.snapshot()
+	if got := countWhere(events, func(e event) bool { return e.kind == publish }); got != 0 {
+		t.Fatalf("expected no publish after dismiss, got %d: %+v", got, events)
+	}
+}
+
+func TestPromotionSkippedWhenFinalAlreadyFired(t *testing.T) {
+	r := &fakeRecorder{}
+	w := New(r)
+	defer w.Close()
+
+	// Both timers fall in the past after a long suspend and are dispatched
+	// with a zero delay, so the final callback can run before the warning one.
+	d := time.Now().Add(time.Hour).Round(0)
+	w.nowFn = func() time.Time { return d.Add(-time.Minute) }
+	if err := w.Update(d); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+
+	w.fireFinal(d)
+	w.fire(d)
+
+	events := r.snapshot()
+	if got := countWhere(events, event.isFinalWarning); got != 1 {
+		t.Fatalf("expected exactly 1 final-warning publish, got %d: %+v", got, events)
+	}
+	if got := countWhere(events, event.isWarning); got != 0 {
+		t.Fatalf("expected no regular warning publish, got %d: %+v", got, events)
+	}
+}
+
+func TestDeadlineOnlyRecordsDeadlineWithoutWarnings(t *testing.T) {
+	r := &fakeRecorder{}
+	w := NewDeadlineOnly(r)
+	defer w.Close()
+
+	// With the default leads this deadline would otherwise fire both
+	// timers on the next tick.
+	d := time.Now().Add(50 * time.Millisecond).Round(0)
+	if err := w.Update(d); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+	if got := r.deadline(); !got.Equal(d) {
+		t.Fatalf("expected recorder deadline %v, got %v", d, got)
+	}
+
+	time.Sleep(100 * time.Millisecond)
+
+	events := r.snapshot()
+	if got := countWhere(events, func(e event) bool { return e.kind == publish }); got != 0 {
+		t.Fatalf("expected no publish in deadline-only mode, got %d: %+v", got, events)
+	}
+	if w.timer != nil || w.finalTimer != nil {
+		t.Fatal("expected no timers armed in deadline-only mode")
+	}
+}
+
+func TestDeadlineOnlyStillRejectsOutOfRangeDeadlines(t *testing.T) {
+	r := &fakeRecorder{}
+	w := NewDeadlineOnly(r)
+	defer w.Close()
+
+	if err := w.Update(time.Now().Add(time.Hour)); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+
+	err := w.Update(time.Now().Add(-maxPastHorizon - time.Hour))
+	if !errors.Is(err, ErrDeadlineInPast) {
+		t.Fatalf("expected ErrDeadlineInPast, got %v", err)
+	}
+	if got := r.deadline(); !got.IsZero() {
+		t.Fatalf("expected recorder cleared after rejection, got %v", got)
+	}
+}
diff --git a/client/internal/engine_sessionwatch.go b/client/internal/engine_sessionwatch.go
index a46d73f87..05b46a465 100644
--- a/client/internal/engine_sessionwatch.go
+++ b/client/internal/engine_sessionwatch.go
@@ -1,4 +1,4 @@
-//go:build !js
+//go:build !js && !android
 
 package internal
 
@@ -7,10 +7,12 @@ import (
 	"github.com/netbirdio/netbird/client/internal/peer"
 )
 
-// newSessionWatcher returns the real SSO session expiry watcher for every
-// non-wasm build. The js/wasm build gets a no-op stub from
-// engine_sessionwatch_js.go so the sessionwatch package (and its timer
-// machinery) never links into the wasm binary.
+// newSessionWatcher returns the real SSO session expiry watcher. The js/wasm
+// build gets a no-op stub from engine_sessionwatch_js.go so the sessionwatch
+// package (and its timer machinery) never links into the wasm binary; the
+// android build gets a deadline-only watcher from
+// engine_sessionwatch_android.go because the app schedules the warnings
+// itself.
 func newSessionWatcher(recorder *peer.Status) sessionDeadlineWatcher {
 	return sessionwatch.New(recorder)
 }
diff --git a/client/internal/engine_sessionwatch_android.go b/client/internal/engine_sessionwatch_android.go
new file mode 100644
index 000000000..8317f9165
--- /dev/null
+++ b/client/internal/engine_sessionwatch_android.go
@@ -0,0 +1,12 @@
+//go:build android
+
+package internal
+
+import (
+	"github.com/netbirdio/netbird/client/internal/auth/sessionwatch"
+	"github.com/netbirdio/netbird/client/internal/peer"
+)
+
+func newSessionWatcher(recorder *peer.Status) sessionDeadlineWatcher {
+	return sessionwatch.NewDeadlineOnly(recorder)
+}

From eb5a98c059891a2ba78284daf5446cc8c4bfa5fd Mon Sep 17 00:00:00 2001
From: Pascal Fischer <32096965+pascal-fischer@users.noreply.github.com>
Date: Mon, 5 Oct 2026 16:48:48 +0200
Subject: [PATCH 03/70] [management] add tenant delete endpoint to openapi
 (#8054)

---
 shared/management/http/api/openapi.yml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/shared/management/http/api/openapi.yml b/shared/management/http/api/openapi.yml
index 4b7077cac..90b87462f 100644
--- a/shared/management/http/api/openapi.yml
+++ b/shared/management/http/api/openapi.yml
@@ -10625,6 +10625,28 @@ paths:
           $ref: "#/components/responses/requires_authentication"
         "500":
           $ref: "#/components/responses/internal_error"
+    delete:
+      summary: Delete MSP tenant
+      tags:
+        - MSP
+      parameters:
+        - in: path
+          name: id
+          required: true
+          schema:
+            type: string
+          description: The unique identifier of a tenant account
+      responses:
+        "200":
+          description: Successfully deleted the tenant
+        "400":
+          $ref: "#/components/responses/bad_request"
+        "403":
+          $ref: "#/components/responses/requires_authentication"
+        "404":
+          description: The tenant was not found
+        "500":
+          $ref: "#/components/responses/internal_error"
   /api/integrations/msp/tenants/{id}/unlink:
     post:
       summary: Unlink a tenant

From d6340ba0de1d1448623fe906e985fdf2a5b53bdd Mon Sep 17 00:00:00 2001
From: Nicolas Frati <nicofrati@gmail.com>
Date: Tue, 6 Oct 2026 01:04:36 +0200
Subject: [PATCH 04/70] [self-hosted] Add a UBI image variant for the combined
 server (#7953)

* [self-hosted] Add a UBI image variant for the combined server

OpenShift and other Red Hat environments expect UBI-based images that run
as an arbitrary non-root UID. The proxy and rootless client already ship
-ubi variants; this adds the same for netbird-server, published as
<version>-ubi and ubi-latest for amd64 and arm64.

* [self-hosted] Check the license output path before creating temp files

The existing-output exit ran before the cleanup trap was registered, so it
left the two mktemp files behind.

* [self-hosted] Certify the netbird-server UBI image

Adds netbird-server to the Red Hat certification components. Its Partner
Connect component ID goes in the REDHAT_CERT_ID_NETBIRD_SERVER repository
variable.
---
 .github/workflows/redhat-certify.yml |  2 +
 .goreleaser.yaml                     | 35 ++++++++++++
 combined/Dockerfile.ubi              | 31 +++++++++++
 combined/collect-licenses.sh         | 81 ++++++++++++++++++++++++++++
 4 files changed, 149 insertions(+)
 create mode 100644 combined/Dockerfile.ubi
 create mode 100644 combined/collect-licenses.sh

diff --git a/.github/workflows/redhat-certify.yml b/.github/workflows/redhat-certify.yml
index e592dabc2..fa0a87c64 100644
--- a/.github/workflows/redhat-certify.yml
+++ b/.github/workflows/redhat-certify.yml
@@ -32,6 +32,7 @@ on:
           - all
           - client-rootless
           - reverse-proxy
+          - netbird-server
       version:
         description: "Released version, e.g. v0.80.0"
         type: string
@@ -66,6 +67,7 @@ jobs:
           components=(
             "client-rootless ghcr.io/netbirdio/netbird -rootless-ubi"
             "reverse-proxy ghcr.io/netbirdio/reverse-proxy -ubi"
+            "netbird-server ghcr.io/netbirdio/netbird-server -ubi"
           )
           matrix="[]"
           missing=()
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 275c1cd7b..ba9e56a50 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -511,6 +511,41 @@ dockers_v2:
        "org.opencontainers.image.revision": "{{.FullCommit}}"
        "org.opencontainers.image.source": "{{.GitURL}}"
        "maintainer": "dev@netbird.io"
+   - id: netbird-server-ubi
+     disable: "{{ .Env.SKIP_DOCKER_PUSH }}"
+     ids:
+       - netbird-server
+     images:
+       - netbirdio/netbird-server
+       - ghcr.io/netbirdio/netbird-server
+     tags:
+       - "{{ .Version }}-ubi"
+       - "{{ if eq .Env.SKIP_PUBLISH \"false\" }}ubi-latest{{ end }}"
+     dockerfile: combined/Dockerfile.ubi
+     platforms:
+       - linux/amd64
+       - linux/arm64
+     build_args:
+       VERSION: "{{ .Version }}"
+       RELEASE: "{{ .Timestamp }}"
+     hooks:
+       pre:
+         - cmd: 'sh combined/collect-licenses.sh "{{ .ContextDir }}/licenses" amd64 arm64'
+           env:
+             - GOOS=linux
+             - CGO_ENABLED=1
+     labels:
+       "org.opencontainers.image.created": "{{.Date}}"
+       "org.opencontainers.image.version": "{{.Version}}"
+       "org.opencontainers.image.revision": "{{.FullCommit}}"
+       "org.opencontainers.image.source": "{{.GitURL}}"
+     annotations:
+       "org.opencontainers.image.created": "{{.Date}}"
+       "org.opencontainers.image.title": "{{.ProjectName}}"
+       "org.opencontainers.image.version": "{{.Version}}"
+       "org.opencontainers.image.revision": "{{.FullCommit}}"
+       "org.opencontainers.image.source": "{{.GitURL}}"
+       "maintainer": "dev@netbird.io"
    - id: netbird-proxy
      disable: "{{ .Env.SKIP_DOCKER_PUSH }}"
      ids:
diff --git a/combined/Dockerfile.ubi b/combined/Dockerfile.ubi
new file mode 100644
index 000000000..66ef55a34
--- /dev/null
+++ b/combined/Dockerfile.ubi
@@ -0,0 +1,31 @@
+FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93
+
+ARG TARGETPLATFORM
+ARG VERSION=dev
+ARG RELEASE=1
+
+LABEL name="netbird-server" \
+      maintainer="NetBird <dev@netbird.io>" \
+      vendor="NetBird GmbH" \
+      version="${VERSION}" \
+      release="${RELEASE}" \
+      summary="NetBird Server" \
+      description="NetBird Server runs the Management, Signal, Relay and STUN services of a self-hosted NetBird deployment in a single process."
+
+COPY --chmod=0555 ${TARGETPLATFORM}/netbird-server /go/bin/netbird-server
+COPY licenses/ /licenses/
+# Only the data directory shares the root group for arbitrary non-root UIDs.
+# Runtime-created keys and databases retain the application's restrictive modes.
+RUN mkdir -p /var/lib/netbird /etc/netbird && \
+    chown 1000:0 /var/lib/netbird && \
+    chmod 0770 /var/lib/netbird && \
+    chmod -R a+rX /licenses
+
+USER 1000:0
+ENV HOME=/var/lib/netbird
+# Runtimes such as OpenShift and Podman reserve ports below 1024 for root, so
+# the mounted config must set server.listenAddress to an unprivileged port.
+EXPOSE 8443 3478/udp
+STOPSIGNAL SIGTERM
+ENTRYPOINT ["/go/bin/netbird-server"]
+CMD ["--config", "/etc/netbird/config.yaml"]
diff --git a/combined/collect-licenses.sh b/combined/collect-licenses.sh
new file mode 100644
index 000000000..ae618e46b
--- /dev/null
+++ b/combined/collect-licenses.sh
@@ -0,0 +1,81 @@
+#!/bin/sh
+set -eu
+
+if [ "$#" -lt 2 ]; then
+	printf '%s\n' "usage: $0 OUTPUT_DIRECTORY GOARCH..." >&2
+	exit 2
+fi
+
+repo_root=$(CDPATH='' cd -- "$(dirname "$0")/.." && pwd)
+output_name=$(basename "$1")
+if [ -z "$output_name" ] || [ "$output_name" = . ] || [ "$output_name" = .. ] || [ "$output_name" = / ]; then
+	printf '%s\n' "OUTPUT_DIRECTORY must name a directory" >&2
+	exit 2
+fi
+output_parent=$(CDPATH='' cd -- "$(dirname "$1")" && pwd)
+output="$output_parent/$output_name"
+shift
+
+if [ -e "$output" ] || [ -L "$output" ]; then
+	printf 'output directory already exists: %s\n' "$output" >&2
+	exit 1
+fi
+modules=$(mktemp "${TMPDIR:-/tmp}/netbird-server-licenses.modules.XXXXXX")
+sorted_modules=$(mktemp "${TMPDIR:-/tmp}/netbird-server-licenses.sorted.XXXXXX")
+# Assemble beside the target and rename on success, so a failed run leaves
+# nothing behind that would block the next attempt.
+staging=$(mktemp -d "$output_parent/.$output_name.XXXXXX")
+trap 'rm -f "$modules" "$sorted_modules"; rm -rf "$staging"' EXIT HUP INT TERM
+mkdir "$staging/third_party"
+
+cp "$repo_root/combined/LICENSE" "$staging/AGPL-3.0.txt"
+cp "$repo_root/LICENSE" "$staging/BSD-3-Clause.txt"
+
+cd "$repo_root"
+for arch in "$@"; do
+	GOOS=${GOOS:-linux} GOARCH="$arch" CGO_ENABLED=${CGO_ENABLED:-1} \
+		go list -deps -f '{{with .Module}}{{if .Replace}}{{.Replace.Path}}{{"\t"}}{{.Replace.Version}}{{"\t"}}{{.Replace.Dir}}{{else}}{{.Path}}{{"\t"}}{{.Version}}{{"\t"}}{{.Dir}}{{end}}{{end}}' ./combined >>"$modules"
+done
+LC_ALL=C sort -u "$modules" >"$sorted_modules"
+
+goroot=$(go env GOROOT)
+for term in LICENSE PATENTS; do
+	if [ ! -f "$goroot/$term" ]; then
+		printf 'missing Go standard-library term: %s\n' "$goroot/$term" >&2
+		exit 1
+	fi
+	cp "$goroot/$term" "$staging/Go-$term"
+done
+
+while IFS='	' read -r module version module_dir; do
+	[ -n "$module" ] || continue
+	[ "$module" = "github.com/netbirdio/netbird" ] && continue
+
+	if [ -z "$version" ] || [ ! -d "$module_dir" ]; then
+		printf 'cannot collect terms for module %s at version %s\n' "$module" "$version" >&2
+		exit 1
+	fi
+
+	destination="$staging/third_party/$module/$version"
+	mkdir -p "$destination"
+	printf 'module: %s\nversion: %s\n' "$module" "$version" >"$destination/MODULE"
+
+	found=false
+	for term in \
+		"$module_dir"/LICENSE* "$module_dir"/License* "$module_dir"/license* \
+		"$module_dir"/LICENCE* "$module_dir"/Licence* "$module_dir"/licence* \
+		"$module_dir"/COPYING* "$module_dir"/Copying* "$module_dir"/copying* \
+		"$module_dir"/NOTICE* "$module_dir"/Notice* "$module_dir"/notice* \
+		"$module_dir"/PATENTS* "$module_dir"/Patents* "$module_dir"/patents*; do
+		[ -f "$term" ] || continue
+		cp "$term" "$destination/"
+		found=true
+	done
+
+	if [ "$found" = false ]; then
+		printf 'no root license terms found for module %s at %s\n' "$module" "$module_dir" >&2
+		exit 1
+	fi
+done <"$sorted_modules"
+
+mv "$staging" "$output"

From ab79aebd88a359da506b4443203b15808b1e6ccb Mon Sep 17 00:00:00 2001
From: Nicolas Frati <nicofrati@gmail.com>
Date: Tue, 6 Oct 2026 10:25:57 +0200
Subject: [PATCH 05/70] [misc] Share one license collection script across the
 UBI images (#8055)

* [self-hosted] Add a UBI image variant for the combined server

OpenShift and other Red Hat environments expect UBI-based images that run
as an arbitrary non-root UID. The proxy and rootless client already ship
-ubi variants; this adds the same for netbird-server, published as
<version>-ubi and ubi-latest for amd64 and arm64.

* [self-hosted] Check the license output path before creating temp files

The existing-output exit ran before the cleanup trap was registered, so it
left the two mktemp files behind.

* [self-hosted] Certify the netbird-server UBI image

Adds netbird-server to the Red Hat certification components. Its Partner
Connect component ID goes in the REDHAT_CERT_ID_NETBIRD_SERVER repository
variable.

* [misc] Share one license collection script across the UBI images

The client, proxy and combined images each carried a near-identical copy of
collect-licenses.sh, and the signal and relay variants would add two more.
The copies differed only in the Go package, build tags, component license
and the proxy's web licenses, which are now options of one script in
release_files/. The client gains the staged write the others already had.
---
 .github/workflows/release.yml                 |  2 +-
 .goreleaser.yaml                              |  6 +-
 client/collect-licenses.sh                    | 77 -----------------
 proxy/collect-licenses.sh                     | 82 -------------------
 .../collect-licenses.sh                       | 46 +++++++++--
 5 files changed, 41 insertions(+), 172 deletions(-)
 delete mode 100644 client/collect-licenses.sh
 delete mode 100644 proxy/collect-licenses.sh
 rename {combined => release_files}/collect-licenses.sh (61%)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index dee4d398d..a79357505 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -199,7 +199,7 @@ jobs:
         with:
           node-version: '22'
       - name: Install proxy web dependencies for license collection
-        # proxy/collect-licenses.sh reads the UI's license terms from node_modules.
+        # release_files/collect-licenses.sh -w reads the proxy UI's license terms from node_modules.
         working-directory: proxy/web
         run: npm ci --ignore-scripts
       - name: Set up QEMU
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index ba9e56a50..59d8274e9 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -385,7 +385,7 @@ dockers_v2:
        RELEASE: "{{ .Timestamp }}"
      hooks:
        pre:
-         - cmd: 'sh client/collect-licenses.sh "{{ .ContextDir }}/licenses" amd64 arm64'
+         - cmd: 'sh release_files/collect-licenses.sh -t load_wgnt_from_rsrc "{{ .ContextDir }}/licenses" ./client amd64 arm64'
            env:
              - GOOS=linux
              - CGO_ENABLED=0
@@ -530,7 +530,7 @@ dockers_v2:
        RELEASE: "{{ .Timestamp }}"
      hooks:
        pre:
-         - cmd: 'sh combined/collect-licenses.sh "{{ .ContextDir }}/licenses" amd64 arm64'
+         - cmd: 'sh release_files/collect-licenses.sh -l combined/LICENSE "{{ .ContextDir }}/licenses" ./combined amd64 arm64'
            env:
              - GOOS=linux
              - CGO_ENABLED=1
@@ -587,7 +587,7 @@ dockers_v2:
        RELEASE: "{{ .Timestamp }}"
      hooks:
        pre:
-         - cmd: 'sh proxy/collect-licenses.sh "{{ .ContextDir }}/licenses" amd64 arm64'
+         - cmd: 'sh release_files/collect-licenses.sh -l proxy/LICENSE -w "{{ .ContextDir }}/licenses" ./proxy/cmd/proxy amd64 arm64'
            env:
              - GOOS=linux
              - CGO_ENABLED=0
diff --git a/client/collect-licenses.sh b/client/collect-licenses.sh
deleted file mode 100644
index 7dfabada9..000000000
--- a/client/collect-licenses.sh
+++ /dev/null
@@ -1,77 +0,0 @@
-#!/bin/sh
-set -eu
-
-if [ "$#" -lt 2 ]; then
-	printf '%s\n' "usage: $0 OUTPUT_DIRECTORY GOARCH..." >&2
-	exit 2
-fi
-
-repo_root=$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)
-output_name=$(basename "$1")
-if [ -z "$output_name" ] || [ "$output_name" = "." ] ||
-	[ "$output_name" = ".." ] || [ "$output_name" = "/" ]; then
-	printf '%s\n' "OUTPUT_DIRECTORY must name a directory" >&2
-	exit 2
-fi
-output_parent=$(CDPATH= cd -- "$(dirname "$1")" && pwd)
-output="$output_parent/$output_name"
-shift
-modules=$(mktemp "${TMPDIR:-/tmp}/netbird-client-licenses.modules.XXXXXX")
-sorted_modules=$(mktemp "${TMPDIR:-/tmp}/netbird-client-licenses.sorted.XXXXXX")
-trap 'rm -f "$modules" "$sorted_modules"' EXIT HUP INT TERM
-
-if [ -e "$output" ] || [ -L "$output" ]; then
-	printf 'output directory already exists: %s\n' "$output" >&2
-	exit 1
-fi
-mkdir "$output"
-mkdir "$output/third_party"
-
-cp "$repo_root/LICENSE" "$output/BSD-3-Clause.txt"
-
-cd "$repo_root"
-for arch in "$@"; do
-	GOOS=${GOOS:-linux} GOARCH="$arch" CGO_ENABLED=${CGO_ENABLED:-0} \
-		go list -deps -f '{{with .Module}}{{if .Replace}}{{.Replace.Path}}{{"\t"}}{{.Replace.Version}}{{"\t"}}{{.Replace.Dir}}{{else}}{{.Path}}{{"\t"}}{{.Version}}{{"\t"}}{{.Dir}}{{end}}{{end}}' -tags load_wgnt_from_rsrc ./client >>"$modules"
-done
-LC_ALL=C sort -u "$modules" >"$sorted_modules"
-
-goroot=$(go env GOROOT)
-for term in LICENSE PATENTS; do
-	if [ ! -f "$goroot/$term" ]; then
-		printf 'missing Go standard-library term: %s\n' "$goroot/$term" >&2
-		exit 1
-	fi
-	cp "$goroot/$term" "$output/Go-$term"
-done
-
-while IFS='	' read -r module version module_dir; do
-	[ -n "$module" ] || continue
-	[ "$module" = "github.com/netbirdio/netbird" ] && continue
-
-	if [ -z "$version" ] || [ ! -d "$module_dir" ]; then
-		printf 'cannot collect terms for module %s at version %s\n' "$module" "$version" >&2
-		exit 1
-	fi
-
-	destination="$output/third_party/$module/$version"
-	mkdir -p "$destination"
-	printf 'module: %s\nversion: %s\n' "$module" "$version" >"$destination/MODULE"
-
-	found=false
-	for term in \
-		"$module_dir"/LICENSE* "$module_dir"/License* "$module_dir"/license* \
-		"$module_dir"/LICENCE* "$module_dir"/Licence* "$module_dir"/licence* \
-		"$module_dir"/COPYING* "$module_dir"/Copying* "$module_dir"/copying* \
-		"$module_dir"/NOTICE* "$module_dir"/Notice* "$module_dir"/notice* \
-		"$module_dir"/PATENTS* "$module_dir"/Patents* "$module_dir"/patents*; do
-		[ -f "$term" ] || continue
-		cp "$term" "$destination/"
-		found=true
-	done
-
-	if [ "$found" = false ]; then
-		printf 'no root license terms found for module %s at %s\n' "$module" "$module_dir" >&2
-		exit 1
-	fi
-done <"$sorted_modules"
diff --git a/proxy/collect-licenses.sh b/proxy/collect-licenses.sh
deleted file mode 100644
index ccf5f4dd6..000000000
--- a/proxy/collect-licenses.sh
+++ /dev/null
@@ -1,82 +0,0 @@
-#!/bin/sh
-set -eu
-
-if [ "$#" -lt 2 ]; then
-	printf '%s\n' "usage: $0 OUTPUT_DIRECTORY GOARCH..." >&2
-	exit 2
-fi
-
-repo_root=$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)
-output_name=$(basename "$1")
-if [ -z "$output_name" ] || [ "$output_name" = . ] || [ "$output_name" = .. ] || [ "$output_name" = / ]; then
-	printf '%s\n' "OUTPUT_DIRECTORY must name a directory" >&2
-	exit 2
-fi
-output_parent=$(CDPATH= cd -- "$(dirname "$1")" && pwd)
-output="$output_parent/$output_name"
-shift
-modules=$(mktemp "${TMPDIR:-/tmp}/netbird-proxy-licenses.modules.XXXXXX")
-sorted_modules=$(mktemp "${TMPDIR:-/tmp}/netbird-proxy-licenses.sorted.XXXXXX")
-
-if [ -e "$output" ] || [ -L "$output" ]; then
-	printf 'output directory already exists: %s\n' "$output" >&2
-	exit 1
-fi
-# Assemble beside the target and rename on success, so a failed run leaves
-# nothing behind that would block the next attempt.
-staging=$(mktemp -d "$output_parent/.$output_name.XXXXXX")
-trap 'rm -f "$modules" "$sorted_modules"; rm -rf "$staging"' EXIT HUP INT TERM
-mkdir "$staging/third_party"
-
-cp "$repo_root/proxy/LICENSE" "$staging/AGPL-3.0.txt"
-cp "$repo_root/LICENSE" "$staging/BSD-3-Clause.txt"
-node "$repo_root/proxy/web/scripts/third-party-licenses.mjs" >"$staging/Web-THIRD-PARTY-LICENSES"
-
-cd "$repo_root"
-for arch in "$@"; do
-	GOOS=${GOOS:-linux} GOARCH="$arch" CGO_ENABLED=${CGO_ENABLED:-0} \
-		go list -deps -f '{{with .Module}}{{if .Replace}}{{.Replace.Path}}{{"\t"}}{{.Replace.Version}}{{"\t"}}{{.Replace.Dir}}{{else}}{{.Path}}{{"\t"}}{{.Version}}{{"\t"}}{{.Dir}}{{end}}{{end}}' ./proxy/cmd/proxy >>"$modules"
-done
-LC_ALL=C sort -u "$modules" >"$sorted_modules"
-
-goroot=$(go env GOROOT)
-for term in LICENSE PATENTS; do
-	if [ ! -f "$goroot/$term" ]; then
-		printf 'missing Go standard-library term: %s\n' "$goroot/$term" >&2
-		exit 1
-	fi
-	cp "$goroot/$term" "$staging/Go-$term"
-done
-
-while IFS='	' read -r module version module_dir; do
-	[ -n "$module" ] || continue
-	[ "$module" = "github.com/netbirdio/netbird" ] && continue
-
-	if [ -z "$version" ] || [ ! -d "$module_dir" ]; then
-		printf 'cannot collect terms for module %s at version %s\n' "$module" "$version" >&2
-		exit 1
-	fi
-
-	destination="$staging/third_party/$module/$version"
-	mkdir -p "$destination"
-	printf 'module: %s\nversion: %s\n' "$module" "$version" >"$destination/MODULE"
-
-	found=false
-	for term in \
-		"$module_dir"/LICENSE* "$module_dir"/License* "$module_dir"/license* \
-		"$module_dir"/LICENCE* "$module_dir"/Licence* "$module_dir"/licence* \
-		"$module_dir"/COPYING* "$module_dir"/Copying* "$module_dir"/copying* \
-		"$module_dir"/NOTICE* "$module_dir"/Notice* "$module_dir"/notice* \
-		"$module_dir"/PATENTS* "$module_dir"/Patents* "$module_dir"/patents*; do
-		[ -f "$term" ] || continue
-		cp "$term" "$destination/"
-		found=true
-	done
-
-	if [ "$found" = false ]; then
-		printf 'no root license terms found for module %s at %s\n' "$module" "$module_dir" >&2
-		exit 1
-	fi
-done <"$sorted_modules"
-
-mv "$staging" "$output"
diff --git a/combined/collect-licenses.sh b/release_files/collect-licenses.sh
similarity index 61%
rename from combined/collect-licenses.sh
rename to release_files/collect-licenses.sh
index ae618e46b..8481c9c3e 100644
--- a/combined/collect-licenses.sh
+++ b/release_files/collect-licenses.sh
@@ -1,10 +1,32 @@
 #!/bin/sh
+#
+# Collect the license terms shipped in /licenses of the UBI images: NetBird's
+# own licenses, the Go standard library terms, and the root license files of
+# every module the Go package links on the given architectures.
+#
+#   -l FILE   component license, copied as AGPL-3.0.txt (path from repo root)
+#   -t TAGS   build tags used for the dependency walk
+#   -w        add the proxy web UI's third-party licenses (needs proxy/web/node_modules)
 set -eu
 
-if [ "$#" -lt 2 ]; then
-	printf '%s\n' "usage: $0 OUTPUT_DIRECTORY GOARCH..." >&2
+usage() {
+	printf '%s\n' "usage: $0 [-l LICENSE_FILE] [-t TAGS] [-w] OUTPUT_DIRECTORY PACKAGE GOARCH..." >&2
 	exit 2
-fi
+}
+
+component_license=""
+tags=""
+web=false
+while getopts l:t:w opt; do
+	case "$opt" in
+	l) component_license=$OPTARG ;;
+	t) tags=$OPTARG ;;
+	w) web=true ;;
+	*) usage ;;
+	esac
+done
+shift $((OPTIND - 1))
+[ "$#" -ge 3 ] || usage
 
 repo_root=$(CDPATH='' cd -- "$(dirname "$0")/.." && pwd)
 output_name=$(basename "$1")
@@ -14,27 +36,33 @@ if [ -z "$output_name" ] || [ "$output_name" = . ] || [ "$output_name" = .. ] ||
 fi
 output_parent=$(CDPATH='' cd -- "$(dirname "$1")" && pwd)
 output="$output_parent/$output_name"
-shift
+package=$2
+shift 2
 
 if [ -e "$output" ] || [ -L "$output" ]; then
 	printf 'output directory already exists: %s\n' "$output" >&2
 	exit 1
 fi
-modules=$(mktemp "${TMPDIR:-/tmp}/netbird-server-licenses.modules.XXXXXX")
-sorted_modules=$(mktemp "${TMPDIR:-/tmp}/netbird-server-licenses.sorted.XXXXXX")
+modules=$(mktemp "${TMPDIR:-/tmp}/netbird-licenses.modules.XXXXXX")
+sorted_modules=$(mktemp "${TMPDIR:-/tmp}/netbird-licenses.sorted.XXXXXX")
 # Assemble beside the target and rename on success, so a failed run leaves
 # nothing behind that would block the next attempt.
 staging=$(mktemp -d "$output_parent/.$output_name.XXXXXX")
 trap 'rm -f "$modules" "$sorted_modules"; rm -rf "$staging"' EXIT HUP INT TERM
 mkdir "$staging/third_party"
 
-cp "$repo_root/combined/LICENSE" "$staging/AGPL-3.0.txt"
+if [ -n "$component_license" ]; then
+	cp "$repo_root/$component_license" "$staging/AGPL-3.0.txt"
+fi
 cp "$repo_root/LICENSE" "$staging/BSD-3-Clause.txt"
+if [ "$web" = true ]; then
+	node "$repo_root/proxy/web/scripts/third-party-licenses.mjs" >"$staging/Web-THIRD-PARTY-LICENSES"
+fi
 
 cd "$repo_root"
 for arch in "$@"; do
-	GOOS=${GOOS:-linux} GOARCH="$arch" CGO_ENABLED=${CGO_ENABLED:-1} \
-		go list -deps -f '{{with .Module}}{{if .Replace}}{{.Replace.Path}}{{"\t"}}{{.Replace.Version}}{{"\t"}}{{.Replace.Dir}}{{else}}{{.Path}}{{"\t"}}{{.Version}}{{"\t"}}{{.Dir}}{{end}}{{end}}' ./combined >>"$modules"
+	GOOS=${GOOS:-linux} GOARCH="$arch" CGO_ENABLED=${CGO_ENABLED:-0} \
+		go list -deps -tags "$tags" -f '{{with .Module}}{{if .Replace}}{{.Replace.Path}}{{"\t"}}{{.Replace.Version}}{{"\t"}}{{.Replace.Dir}}{{else}}{{.Path}}{{"\t"}}{{.Version}}{{"\t"}}{{.Dir}}{{end}}{{end}}' "$package" >>"$modules"
 done
 LC_ALL=C sort -u "$modules" >"$sorted_modules"
 

From d622e03d4019e5ca5324530f6e150417de810c32 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Janek=20H=C3=A4rtter?=
 <108095150+janekhaertter@users.noreply.github.com>
Date: Tue, 6 Oct 2026 10:32:23 +0200
Subject: [PATCH 06/70] [misc] Use ASCII hyphens in the LICENSE header (#8065)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The first line of LICENSE spelled BSD-3-Clause with non-breaking
hyphens (U+2011). The Windows NSIS installer shows LICENSE on its
license page and reads it in the system ANSI code page, so the UTF-8
bytes rendered as "BSD‑3‑Clause". Plain hyphens also match the
SPDX identifier and keep the file ASCII-only.
---
 LICENSE | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/LICENSE b/LICENSE
index d922f155a..cea6f8f0b 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1,4 +1,4 @@
-This BSD‑3‑Clause license applies to all parts of the repository except for the directories management/, signal/, relay/ and combined/.
+This BSD-3-Clause license applies to all parts of the repository except for the directories management/, signal/, relay/ and combined/.
 Those directories are licensed under the GNU Affero General Public License version 3.0 (AGPLv3). See the respective LICENSE files inside each directory.
 
 BSD 3-Clause License

From a8dff998ef3cb38f435c1e4c9648dcd129ce48c1 Mon Sep 17 00:00:00 2001
From: Riccardo Manfrin <3090891+riccardomanfrin@users.noreply.github.com>
Date: Tue, 6 Oct 2026 11:39:22 +0200
Subject: [PATCH 07/70] [client] Gate settings updates on value, not on field
 presence (#7398)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* [client] Gate settings updates on value, not on field presence

The update-settings kill switch (--disable-update-settings /
NB_DISABLE_UPDATE_SETTINGS / the MDM DisableUpdateSettings key) forbids
changing settings, but it decided what a "change" was by looking at
whether a field was present in the request. The CLI fills the whole
config surface of SetConfigRequest and LoginRequest from its flags and
environment on every `netbird up` (setupSetConfigReq in cmd/up.go), so a
client configured by environment restates its own configuration on every
start and tripped the gate every time.

SetConfig only warned about that, but Login carries the same fields and
was gated the same way, and Login runs inside the CLI's backoff loop: the
daemon answered every attempt with codes.Unavailable, `netbird up` never
completed, and a container with NB_DISABLE_UPDATE_SETTINGS plus any
config env var (NB_MANAGEMENT_URL, for one) could not come up at all.

Both gates now compare values. Config.WouldChange is the dry-run half of
UpdateConfig: it runs the very same diff logic (Config.apply) against a
copy of the stored config, so the gate cannot drift from what an actual
update would do, nor go stale when a field is added. A request that
restates what the profile already holds changes nothing and is allowed; a
request that diverges is refused exactly as before, and a dry run that
cannot be evaluated fails closed. A profile with no config on disk yet is
judged against the config the daemon would create for it.

For Login, the compared input comes from loginOverridesInput, which
persistLoginOverrides also uses to perform the write, so the gate judges
precisely the two fields a login can persist (management URL, pre-shared
key) and no field it ignores.

Two adjacent defects surfaced while making the comparison exact:

- Config.apply compared URLs as raw strings, so the same endpoint spelled
  without its default port ("https://api.netbird.io" vs
  "https://api.netbird.io:443") counted as a new value and rewrote the
  config. It now compares the parsed forms.
- UpdateConfig did not collapse the redacted pre-shared key, unlike
  UpdateOrCreateConfig and DirectUpdateConfig, so a UI round-trip of the
  mask replaced the stored key with asterisks.

The CLI warning for a refused SetConfig said the method was not available
in the daemon, which sent people looking for a version mismatch that was
not there; it now reports the refusal.

* [client] Do not write the profile config while only reading it to decide

The update-settings gate needs the stored config to decide whether a request
changes anything, so the previous commit moved that read ahead of the refusal.
The read is not side-effect free: profilemanager.GetConfig writes the config
back whenever apply() has to fill in a default the file was missing. A request
that the gate then refuses had therefore already rewritten the profile file.

PeekConfig is GetConfig without that write-back. The returned config is still
normalized in memory, which is what the decision needs; the file is left
exactly as it was found. Every caller of storedConfigAtPath feeds a gate that
can refuse, so they all peek.

Note for reviewers: the daemon still normalizes the file on startup and on
every real update, so nothing depends on a read performing that write.

* [client] Compare service URLs as endpoints, not as strings

Three places in one request path each had their own notion of "same
management URL": the config layer compared the parsed URLs as strings, the
privileged-change gate compared scheme + host + effective port, and the MDM
conflict check compared strings after filling in the default port. Only the
middle one was right.

A string comparison answers the wrong question. "https://api.netbird.io",
"https://api.netbird.io/" and "https://API.netbird.io:443" are one endpoint
written three ways, so a client restating its own management URL with a
trailing slash — a normal way to write it — was still read as a client asking
to be repointed, and the update-settings gate refused it. The MDM check had
the same flaw against the enforced value.

profilemanager.SameServiceURL is now the single comparison: same scheme, same
host case-insensitively as DNS names are, same effective port. The config
layer, the privileged-change gate and the MDM conflict check all defer to it,
so there is one answer to "did this URL change?" instead of three.

* [client] Stop the config dry run from generating throwaway keys

The dry run's baseline for a profile with no config file yet went through
createNewConfig, and apply() generates a WireGuard and an SSH key whenever it
finds those fields empty. The baseline is compared against and discarded, so
every evaluation minted a keypair it threw away — and logged "generated new
Wireguard key". The CLI retries Login in a backoff loop, so a first `netbird up`
on a fresh profile filled the daemon log with what reads like peer-key rotation.

The baseline now starts from the shared skeleton with placeholder keys, so
apply() has nothing to generate. No ConfigInput field maps to either key, so
the comparison is unaffected.

* [client] Cover the login the update-settings gate used to refuse

The gate's decision procedure was tested directly, but no test drove the Login
RPC that the refusal actually broke: the CLI retries Login in a backoff loop,
so a refused no-op login is what kept a client configured by environment from
ever coming up. The handler-level coverage stopped at the refusal case, which
passes on the pre-fix code too.

This test fails on the pre-fix daemon with "update settings are disabled" and
passes now. Past the gate the handler does real work the test does not stand
up, so it asserts only that the refusal did not happen.

* [client] Re-take the update-settings decision under the config lock

Login checks twice on purpose: the first check refuses the ordinary case
early, and authorizeAndPrepareLogin re-takes the authoritative one under
guardedConfigMu because the first is unsynchronized against a concurrent
privileged request. The update-settings decision is now equally
value-dependent — it compares the request against the stored config — but it
was taken only in the first, unlocked check.

So a login that was a no-op when it was checked could be written after a
concurrent writer had repointed the profile, which is exactly the window the
lock exists to close. The decision is now re-taken alongside the privilege one,
which also makes it the last read before persistLoginOverrides writes.

The test drives that interleaving through the existing afterLoginPreCheck seam
and fails without the re-check.

* [client] Drop an unreachable guard and fix two stale comments

- loginOverridesInput's nil-message guard cannot be reached: Login
  dereferences the message well before it, in storedLoginConfig.
- The docstring above afterLoginPreCheck described persistLoginOverrides,
  which lives further down the file and now carries its own.
- UpdateConfig's comment named DirectUpdateConfig; the function is
  DirectUpdateOrCreateConfig.

* [client] Make config reads pure and provision the identity explicitly

Reading a config wrote it back. profilemanager.readConfig persisted whatever
apply() had filled in, and ReadConfig created and wrote the file outright when
it was absent, so every reader was quietly a writer: a gate deciding whether to
refuse a request, a UI listing profiles, a mobile getter reading one preference.
The previous commit worked around that with a PeekConfig variant, which left
two read functions with opposite side effects and the antipattern still there
for everyone else.

Only one thing in a read genuinely had to be persisted: apply() generated the
WireGuard and SSH keys when it found them empty, and a generated key cannot be
recomputed — losing it means the peer comes back with a different identity and
registers again. Everything else apply() fills in is a deterministic default
that the next read recomputes anyway.

So identity provisioning is now its own step, Config.EnsureIdentity, and the
callers that provision write the result out themselves, in the open:

- Server.getConfig, the daemon's provisioning point;
- the CLI's foreground login, which is about to dial management;
- update() / directUpdate(), the config write paths — a stored profile can
  legitimately carry no identity, since a mobile logout clears the keys in
  place, and the next write is what has to mint a new one.

ReadConfig and GetConfig no longer write anything, PeekConfig is gone, and the
dry-run baseline no longer needs placeholder keys to keep apply() from minting
real ones.

One deliberate leftover: readConfig still calls util.EnforcePermission, which
chmods a config file whose permissions are too broad. It changes no content and
is idempotent, and dropping it would leave a legacy file world-readable until
its first write.

* [client] Name the two config readers for what they do

ReadConfig and GetConfig differed in one thing — what happens when the file is
absent — and neither name said which was which:

- ReadConfig      -> ReadOrGenerateConfig  (reads it, or generates one in memory)
- GetConfig       -> GetExistingConfig     (reads it, or fails)

Three comments went with them:

- GetConfig's said "return with Config and if it was created. Errors out if it
  does not exist", which described a bool it does not return and a creation it
  never performs.
- ReadConfig's explained that it does not write, which is what a reader is
  supposed to do anyway.
- Server.getConfig's said it "errors out if it does not exist", which it does
  not — it resolves a default config, and now provisions the identity too.

* [client] Do not panic on a config with no sync message version

apply() wrote the incoming sync message version through the stored pointer,
without checking it was there: a config that carries no version yet made it
dereference nil. Reachable from the update-settings dry run, which runs inside
a request handler — where failing closed is the worst acceptable outcome, and a
panic is not one.

The field is now reassigned like every other optional one, which also means
apply() no longer mutates anything the caller still holds through a pointer, so
the dry run's copy has one less field to detach.

Reported by cubic-dev-ai on PR #7398.

* [client] Compare the client certificate paths before reporting a change

apply() assigned the incoming mTLS certificate and key paths and set updated
unconditionally, without comparing them to what the config already held. It is
the same presence-instead-of-value mistake this branch set out to fix, one
layer down: a caller restating its own certificate paths was reported as
changing them, which trips the value-aware update-settings gate.

Reported by cubic-dev-ai on PR #7398.

* [client] Address the remaining bot findings on PR #7398

- Login logged the active-profile-state error and returned the same cause; the
  repo's guidelines call for one or the other, and the wrapped error is the one
  that carries context. (CodeRabbit)
- `netbird up` reported a codes.Unavailable SetConfig failure as "the daemon
  refused the settings update", but that code also covers a daemon that became
  unreachable. It now reports what the daemon said without asserting why.
  (cubic-dev-ai)
- TestLogin_ChangingTheManagementURLIsRefused asserted the error and nothing
  else, while "refused before it can touch daemon state" is the contract. It now
  checks the stored management URL, the in-progress login and the active profile,
  matching its SetConfig counterpart. (cubic-dev-ai)

* [client] Keep the peer identity out of a read that finds no file

ReadOrGenerateConfig resolves a default config when the profile has no file
yet, and createNewConfig was minting the WireGuard and SSH keys while doing so.
That defeated the provisioning pair it was meant to serve: the CLI's foreground
login calls EnsureIdentity to find out whether it has to persist the keys, got
generated == false because the read had already generated them, and so never
wrote them out. The login then dialed management with an identity that only
existed in memory, and the next login registered a second peer.

createNewConfig no longer provisions. createProvisionedConfig is the variant
that does, and the callers whose contract is "usable as it comes back" use it:
CreateInMemoryConfig, whose callers connect with the result, and the two
create-and-write branches. A read gets a config with no identity, so the
caller's own EnsureIdentity reports the work and triggers the write.

Reported by CodeRabbit and cubic-dev-ai on PR #7398, both on the same defect.

* [client] Stop the gate test from dialing the real management server

TestLogin_RestatingTheStoredConfigPassesTheGate asserts that the gate lets a
no-op login through, and the handler then went on to do the login for real:
isLoginRequired builds an auth client when isLoginRequiredFn is unset, so the
test dialed the profile's management URL — api.netbird.io:443. It took 1.05s
locally and would hang on a runner with no egress, for a fact about the gate
that needs no network at all.

Stubbed like the login_outcome tests do. The test now runs in 0.00s.

Reported by cubic-dev-ai on PR #7398.

* [client] Keep the admin panel path part of its identity

The endpoint comparison introduced for the management URL was applied to the
admin URL too, and that one is opened in a browser rather than dialed over
gRPC: a panel served under /netbird is not the panel served at the root. So a
config whose admin URL differed only by path reported no change, and the new
path was never persisted — a custom panel URL could not be updated at all.

SameServiceURLIncludingPath adds what a URL carries past its endpoint (path,
query, fragment, userinfo) while still treating equivalent spellings as equal:
a missing path and "/" are the same root, and so is a trailing slash. The
management URL keeps the endpoint-only comparison, since only the endpoint is
ever dialed.

Ports are also normalized numerically now, so ":0443" and ":443" are one port.

Reported by cubic-dev-ai on PR #7398 (two findings).

* [client] Treat a profile with no identity as already deregistered

Two findings on the same consequence of pure reads: a profile can legitimately
carry no keys, because logging out clears them in place.

- sendLogoutRequestWithConfig went straight to wgtypes.ParseKey and failed with
  "incorrect key size: 0" on the second logout of the same profile. There is
  nothing to deregister for a peer that was never registered, so it returns
  cleanly. Before pure reads this case was hidden: the read minted a key and
  the daemon dialed management with one it had never seen.
- The mobile logout read the config with the generating reader right after
  checking the file exists. The two are not atomic, so a profile removed in
  between was resolved from the defaults and recreated by the write that
  follows. It uses the existing-file reader now.

Reported by cubic-dev-ai and CodeRabbit on PR #7398.

* [client] Fail `netbird up` when the daemon refuses the settings update

With the update-settings kill switch on, `netbird up --enable-rosenpass`
connected and said almost nothing: SetConfig refused the change, the CLI
downgraded that to a warning, and Login carries no rosenpass field to apply, so
the flag was silently dropped. The setting stayed disabled, which is the point
of the switch, but the caller was never told their request had been ignored.

The refusal now travels as codes.FailedPrecondition instead of
codes.Unavailable, and the CLI fails on it. Unavailable means "the daemon
cannot serve this call", which is why the CLI downgraded it and why
client/ui/services reads it as an unreachable daemon — both wrong for a daemon
that answered and refused. FailedPrecondition also matches what the MDM gate
already returns for a managed field, so both refusals are now one class of
error, and it is added to the login backoff's early-exit codes so a refused
login stops instead of retrying for 30s.

This does not put the container back in the deadlock: with the value-aware
gate, a client restating its own configuration is not refused at all, so
nothing reaches this path unless a real change was asked for.

* [client] Name the reader storedConfigAtPath actually calls

The purity note still said profilemanager.GetConfig, which the rename two
commits later turned into GetExistingConfig.

Reported by cubic-dev-ai on PR #7398.

* [client] Restore the gofmt alignment of the error constants

The comment added above errUpdateSettingsDisabled in the previous commit split
the const block's alignment group, so gofmt wants the two constants above it
re-aligned. CI runs gofmt, so this would have failed the lint job.

* [client] Let an unprivileged caller log out a profile with no identity

The empty-key check sat behind requirePrivilegeForDeregistration, so an
unprivileged logout of an identity-less profile was refused with
PermissionDenied instead of completing as the no-op it is. And it was refused
for most profiles, not a corner case: the gate arms whenever the SSH server is
enabled, and sshServerEnabled reads an absent ServerSSHAllowed as enabled, so
every legacy profile qualifies.

The check now runs first. What the gate protects against is handing this
machine's registered key to another management server; with no key there is
nothing to hand over and nothing to protect.

Reported by CodeRabbit and cubic-dev-ai on PR #7398, both on the same defect.

* [client] Stop `netbird login` from retrying a refusal for 30 seconds

`netbird up` and `netbird login` both run Login through the backoff cycle, and
each carried its own copy of the list of codes that end it. Only up.go learned
about codes.FailedPrecondition, so a refused `netbird login` kept retrying and
then reported "login backoff cycle failed" instead of what the daemon said.

terminalLoginError is now that list, once, next to WithBackOff — the duplicated
copies are what let the two commands disagree in the first place.

Reported by cubic-dev-ai on PR #7398.

* [client] Answer terminalLoginError's nil case on its own terms

A successful Login reaches terminalLoginError with a nil error, and nothing
covered that. It happens to work on grpc v1.80.0 — gstatus.FromError(nil)
answers (nil, true), and Status.Code tolerates a nil receiver by returning
codes.OK, which is not in the terminal set — but that is a chain of internal
details to be relying on for the common path, and none of it was asserted.

Now the nil error is handled where it is obvious, and the table covers it.

Reported by CodeRabbit on PR #7398, which called it a panic; measured on
v1.80.0 it is not one. The gap was the untested reliance, not a crash.

* [client] Treat an unset optional field as its default when diffing a config

Seven Config fields mean "the effective default" when they hold no value:
the five SSH toggles, the SSH JWT cache TTL, and the network monitor. Every
consumer already reads a nil as that default, but apply() diffed them by
presence — `config.X == nil || *input.X != *config.X` — so an input restating
the default counted as a change.

That made the update-settings gate refuse `netbird up` outright. The CLI
sends every flag whose value came from an environment variable
(SetFlagsFromEnvVars goes through pflag's FlagSet.Set, which marks the flag
Changed), and the config a plain login writes leaves all seven unset, so a
container configured with, say, NB_ENABLE_SSH_ROOT=false restated a default
the file held as null on every start and was answered with
FailedPrecondition.

apply() now resolves the seven up front, the way it already did for
ServerSSHAllowed and RemoteJobsAllowed, which also repairs such a profile on
its next write. With the values named, the comparisons below diff values
instead of presence, so their nil branches are gone.

The network monitor keeps its platform default — on for windows and darwin —
and naming it as false elsewhere is what createEngineConfig already read a
nil to be. getJWTCacheTTL reaches the same 0 through its own default, and
Android's GetEnableSSH* getters already answered nil with false.

* [client] Normalize the config before diffing it in WouldChange

apply() reports two different things through one bool: an input that changed
a value, and a field it had to fill in because the config carried none. The
update-settings gate reads that bool as "the caller asked for a change", so
any config still missing a default answered a request that asks for nothing
with a refusal.

Readers already hand out normalized configs — readConfig applies an empty
input for exactly this reason — which is why the gate got away with it. But a
handler that refuses a request must not depend on where its caller obtained
the config, and it must not start reading "this profile predates a field" as
"the caller asked for a change" the day someone adds one with a default.

WouldChange now runs the filling-in as a pass of its own and discards its
verdict, so the pass that answers the caller measures only what the input
did.

* [client] Stop the last config write that skipped normalization

Every path that creates or updates a profile config goes through apply(),
which resolves an optional field to its default — except RenameProfile,
which read the file with a bare json.Unmarshal, set the name, and wrote it
straight back. That copied whatever the file held, so a config written by a
client that stored these fields as null kept them null. It could not
introduce a null, only carry one forward, but renaming a profile is a poor
place to leave a half-resolved config behind. It now reads through
GetExistingConfig, which normalizes what it hands out.

The tests state the invariant the fix completes, over the *bool fields of
Config listed by reflection so a field added later is covered without
touching them: none may come out of apply() unset, and no write may store
one as null. An optional bool that can be nil, true or false forces every
reader to invent the meaning of nil, and makes a diff of the config compare
presence rather than value — which is exactly what refused `netbird up` for
a client restating its own defaults.

SyncMessageVersion stays a genuine three-state field and is not covered: it
is an *int whose absence means the client pins no version, and it travels to
management that way.

* [client] Refuse a serialized config that carries no peer identity

ConfigFromJSON still promised a "fully initialized" config after this PR
moved key generation out of apply() into EnsureIdentity, but identity stopped
being one of the defaults it applies. Its two callers both connect with what
they get back: the iOS SDK's Client.SetConfigFromJSON keeps it as the
preloaded config Run() uses on tvOS, and Auth.SetConfigFromJSON as the config
it authenticates with.

No caller feeds it a document without keys today — every stored document
comes from Auth.GetConfigJSON, whose config is provisioned by
DirectUpdateOrCreateConfig or CreateInMemoryConfig, and the tvOS app only
ever edits fields of a document it already has. This is a safety net for the
next caller, not a live bug.

Provisioning the identity here would be the wrong net. Neither caller can
hand a generated key back to the store the document came from — Client
exports no config at all — so the peer would connect under an identity
nothing persists and register anew on every launch, which is the failure the
EnsureIdentity split exists to prevent. A document with no identity means
nobody has logged in yet, and saying so is the only useful answer.

Both keys are required because both are dead ends when missing: an empty
WireGuard key fails the management login on its size, and an empty SSH key
fails ssh.GeneratePublicKey in ConnectClient before the engine starts.

* [client] Say that the null-on-disk fixture is synthesized, not written

The test comment described the null state in the present tense — "the config
a plain login writes leaves every one of them unset" — which was true before
this branch and is not any more: apply() now resolves those fields, so a
login writes them set. unsetOnDisk puts the null state back deliberately, to
stand in for a profile an older client wrote. Comments only.

* [client] Gather the optional-field defaults into one function

Resolving an unset optional field was spread over five places: the two
values newConfigSkeleton pre-sets, the block this branch added for the SSH
toggles, the network monitor's own if, the `else if` tails of
ServerSSHAllowed and RemoteJobsAllowed, and a trailing if for
DisableNotifications several hundred lines further down. Reading apply() left
no single answer to "what does this field default to, and who decides".

They now live in Config.resolveUnsetDefaults, which apply() calls before it
compares anything — the ordering being the point, since it is what lets
every comparison below diff values instead of presence. The comparisons for
ServerSSHAllowed, RemoteJobsAllowed and DisableNotifications lose their
`config.X == nil ||` clauses accordingly, as the other six already had.

newConfigSkeleton keeps its two, and that is the one asymmetry worth naming:
ServerSSHAllowed defaults to false for a new profile and to true for a
legacy one, and it only works because the skeleton runs first. The doc
comment says so, where before it was implied by the order of two distant
blocks.

Pure refactor. Verified as one: for the four fields whose branches moved,
plus two that did not and the JWT TTL, all 63 combinations of stored value
(nil/false/true) against input value (absent/false/true) produce byte-
identical resolved values and `updated` verdicts before and after.

* [client] Resolve the merge conflicts left in the tree

262ce8c3b landed with the conflict markers still in it, so client/server and
the iOS SDK did not compile. Four regions, resolved as follows.

client/server/mdm.go — main moved the MDM conflict-check machinery into the
mdm package (mdm.ResolveConflicts, mdm.ConflictBool, mdm.ConflictURL, ...).
This branch had edited the local copies, which are now dead: dropped, along
with the profilemanager import that only the local conflictURL needed.

client/server/server.go, Login gate — this branch's value-aware gate stays
(the point of the PR: refuse a real divergence, let a restatement through),
so main's presence-based `loginRequestHasConfigOverrides` block goes; that
helper no longer exists here anyway. Main's other change in the same lines
is real and kept: the MDM policy now comes from the daemon-owned
s.mdmLoader.Load() instead of the package-level loadMDMPolicy, which main
removed. The stale call right below the conflict was the reason the file
would not have compiled even with the markers gone.

client/server/server.go, getConfig — both sides add something and both are
needed. The identity is provisioned and persisted first, then the MDM
overlay is applied, so what reaches disk stays the profile's own config: the
overlay is runtime-only and re-derived on every load.

client/ios/NetBirdSDK/client.go — main reworked SetConfigFromJSON to store
the JSON and re-parse it on each load, which is the shape kept; the parse is
now only a validity check, and this branch's reason for it (a document with
no peer identity is refused, not just an unparseable one) moves into that
comment.

client/server/update_settings_gate_test.go — follows the sentinel constant
to its new home, mdm.PreSharedKeyRedactedSentinel.

* [client] Reuse util's service-URL comparison instead of a second copy

The endpoint-comparison rules this branch introduced now live in util (PR
#7472 moved them there so the MDM conflict check could stop comparing URLs
as strings). Keeping a copy here is what produced that bug in the first
place: two implementations of "is this the same endpoint?" drift, and the
one that drifts starts refusing a URL that addresses the very server it
already points at.

So SameServiceURL delegates the port normalization to util.ServiceURLPort
and drops the local one, and SameServiceURLIncludingPath — endpoint plus
path, for the admin panel URL, which is opened rather than dialed — is
util.SameServiceURL plus the query, fragment and userinfo it adds on top,
so the local path normalization goes too.

What stays here is the distinction util does not make: SameServiceURL is
endpoint-only, because a management URL is dialed and only its host and port
are, while util.SameServiceURL includes the path.

Pure refactor. Verified as one: all 198 pairs of a 14-spelling matrix
(default and zero-padded ports, host case, trailing slash, path, query,
fragment, userinfo, both schemes, nil operands) answer identically for both
functions before and after.

* [client] Give a newly added profile its identity (review item 1)

AddProfile writes the config it builds straight to disk, but built it with
createNewConfig, which stopped generating the peer's keys when identity
generation moved out of apply() into EnsureIdentity. The profile file landed
with an empty PrivateKey and SSHKey.

Nothing lost the keys permanently — the daemon's own getConfig provisions and
persists them on first use — but every reader that does not write got a
config that cannot connect in the meantime, which is exactly the set this
branch grew: the update-settings gate deciding whether to refuse a request,
and the mobile SDKs loading a stored profile.

createProvisionedConfig exists for callers that persist or connect, and this
is one; before the split, createNewConfig produced the keys here too.

* [client] Let a logged-out profile deserialize again (review item 2)

ConfigFromJSON refused a document with no WireGuard or SSH key. A config
legitimately has none between a logout and the next login: mobile
LogoutProfile clears both in place and writes the profile back, so the peer
re-registers on the next login instead of returning as itself.

So the refusal broke the mobile flows it was meant to protect. On iOS and
tvOS the stored JSON of a logged-out profile stopped loading through
Client.SetConfigFromJSON and Auth.SetConfigFromJSON, and copyConfig — which
round-trips a Config through JSON to take an in-memory copy before applying
the MDM overlay — failed on the same document. Where the old code silently
minted a key, this returned an error, which is worse for logout and profile
switching alike: neither is asking to connect.

The deserializer now stays out of the identity question in both directions:
it does not generate one (a read cannot hand back keys nothing will write
down) and does not refuse one that is absent. Whoever goes on to connect is
where an absent identity has to be answered — and it already is, by the
login path that provisions and persists.

ErrConfigWithoutIdentity goes with it; nothing else used it.

* [client] Fold the scheme case here too, like util does (review item 6)

profilemanager.SameServiceURL compared the scheme with ==, util.SameServiceURL
with EqualFold. No observable difference — net/url lowercases the scheme when
it parses, and both functions take parsed URLs — but two functions of the same
name with two different rules is a trap for whoever reads one and assumes the
other.

* [client] Classify the daemon's refusals in the GUI (review item 3)

FailedPrecondition reached the classifier unmatched, so a refusal showed as
"Operation failed". It is the code both of the daemon's deliberate refusals
carry: the update-settings kill switch, and a field an MDM policy manages.

Both are now named — settings_locked and settings_managed_by_mdm, matched on
the message the daemon composes — and FailedPrecondition itself falls back to
change_refused, so a refusal the daemon grows later still reads as a refusal
rather than a failure.

Only the English strings are added. Bundle.Translate falls back to the
default language for a missing key, so other locales show English until the
usual translation pass, rather than the bare "error.<code>" the classifier
would otherwise surface.

Note: the package needs GTK4/WebKit to build, which this machine has not, so
the test is type-checked (go vet, GOOS=windows) but was not executed locally;
CI's Linux job runs it.

* [client] Cover the mobile profile round trip: create, logout, reload

Both mobile regressions this branch's review turned up lived on the same
path, and neither was visible from the desktop client: a profile created
without an identity, and a logged-out profile that would no longer
deserialize. The desktop never meets the second one — it is mobile logout
that clears the peer's keys in place, so the next login registers a new peer
instead of bringing the old one back.

The test walks a profile through the round its user puts it through —
created, logged out, loaded again, switched away from and back — and loads it
at each step the way the SDKs do: read the stored config, serialize it, load
it back. That is Client.SetConfigFromJSON storing the document for tvOS,
Auth.SetConfigFromJSON authenticating with it, and copyConfig taking an
in-memory copy before the MDM overlay.

Verified to fail on each regression separately: restoring the bare
constructor in AddProfile fails it with "a new profile was written with no
identity", and restoring the identity check in ConfigFromJSON fails it at
"load the profile back".

client/mobile already had the coverage for the first one in
TestLogoutProfile_DisableProfiles — which arrived from main with the MDM
work, and which I had not been running.

* [client] Name only the refusals, not every FailedPrecondition

The classifier gained a blanket FailedPrecondition -> change_refused fallback
so a refusal would stop reading as "Operation failed". It reaches too far:
the daemon returns that code for two dozen states that are not settings
refusals — "not logged in", "client is not running", "another capture is
already running", "session can no longer be extended, log in again to
reconnect" — and errorClassifier is shared with the session and connection
services, not just the settings save.

So the user was told the service had refused their change while what they
actually had to do was log in again. The two refusals the daemon composes
stay named by their message; everything else goes back to the generic
message, which says nothing rather than something wrong.

Reported by cubic on the PR.

* [client] Say what each assertion was checking in the mobile test

AGENTS.md asks for a context message on comparison and boolean assertions,
and four of the ones added with this test had none, so a failure would have
read as a bare Empty/Equal with no hint of which step of the round trip broke.

Reported by cubic on the PR.

* [client] Translate the two new error strings into every locale

The GUI classifier gained error.settings_locked and
error.settings_managed_by_mdm, and only the English strings were added: the
bundle falls back to the default language for a missing key, so nothing would
have shown a bare "error.<code>" to a user.

CI disagrees, and it is right to: check-translations.mjs requires every
locale to carry the full English key set, so English-only fails the gate
rather than degrading quietly.

The ten locales now carry both strings. These are my translations, not a
localization pass — worth a second pass by whoever owns the language, in
particular for the phrasing of "an administrator has locked them".

The uk file also loses two lines of stray 8-space indentation, normalized by
rewriting the file; no key or value changed with it.

* [client] Persist the profile before overlaying MDM on it (review item)

`netbird login` read the config, applied the MDM policy on top, and only then
provisioned the identity and wrote the result out. On a profile with no
identity yet — a first login — that write persisted the enforced values into
the user's own config file: an MDM-managed management URL or pre-shared key
became indistinguishable from one the user set, and stayed behind once the
policy was withdrawn.

Provisioning and its write now come first, and the overlay is applied to the
in-memory config afterwards, where it belongs: it is re-derived on every load
and never meant to reach disk from here. Server.getConfig already orders the
two this way; the two paths now agree.

Reported by cubic on the PR.

* [client] Assert against the stored config, not a resolved default (review item)

The login-gate test read the profile back with ReadOrGenerateConfig, which
resolves a default config in memory when the file is missing — and that
default's management URL is the very value the assertion checks. An erased or
mislocated profile would have passed the test instead of failing it.

The file is written by the test itself, so GetExistingConfig is the right
reader: it errors when the file is gone.

Reported by cubic on the PR.

* [client] Keep the mTLS pair off the gate's dry run (review item)

WouldChange runs the real apply() against a throwaway copy, and apply() loads
the client mTLS certificate and key from disk whenever the config names them.
So every gated SetConfig and Login read the pair — twice per request, once for
the normalization pass and once for the verdict — including requests that were
about to be refused or that changed nothing, and logged an error per request
when the files were missing. The gate used to be presence-based and never
called apply(), so this was new work on a request path.

The loaded pair feeds the connection and never the comparison: nothing in
apply() reads it back, and it does not move the `updated` verdict. A config
built only to be compared against now says so, and apply() skips the load for
it.

Reported by cubic on the PR.

* Makes it explicit that RenameProfile does write on disk

* [client] Provision the peer identity under the config lock (review item)

Login took the authoritative update-settings and privilege decisions under
guardedConfigMu, then released it and called getConfig, which mints the peer's
identity and writes the config out. Between that read and that write, a
SetConfig holding the same lock could land a change and answer its caller —
and then be overwritten by the config the login had already read.

The window is narrow: getConfig only writes when the profile has no identity
or no file, so in practice a first login racing a settings change on the same
profile. It is also narrower than before this branch, where the write happened
inside the reader on every read that filled in a default.

Provisioning now runs where the decision it belongs to runs: at the end of
authorizeAndPrepareLogin, with the lock already held, next to
persistLoginOverrides, which writes there too. No lock is taken that was not
held before, so the documented guardedConfigMu-then-mutex order is untouched.

getConfig keeps its behaviour by calling the same extracted helper; on the
login path it now finds the identity already there and writes nothing. The
other callers are unchanged, and still provision outside any lock — a
concurrent SetConfig is not part of their flow.

Reported by cubic on the PR.

* [client] Declare the probe marker to the debug-bundle field check

TestAddConfig_AllFieldsCovered walks Config by reflection and fails until every
field is either rendered in the debug bundle or listed as excluded with a
reason. The probe marker added for the gate's dry run was neither, so the
client unit suite went red on every platform.

It is excluded: it marks a throwaway copy built to be compared against and
discarded, so it is never set on a config anyone runs with, and rendering it
would only ever print false.

* [client] Provision the peer identity on the iOS login path

Key generation used to happen inside apply(), so a config loaded from JSON with
no keys got them in memory on the way in, the login worked, and the app stored
the result. This branch moved generation into EnsureIdentity, and nothing in
the iOS SDK called it.

The consequence lands on the flow the mobile logout sets up: logout clears both
keys in place so the next login registers a new peer. The app then hands that
keyless JSON to Auth.SetConfigFromJSON, and the login calls auth.NewAuth with
an empty WireGuard key, which fails on key size before the SSO flow starts —
the user cannot sign back in.

Auth.setBaseConfig now provisions, which covers both entry points (NewAuth and
SetConfigFromJSON). It mints on the base config, the one GetConfigJSON returns
for the caller to persist, and writes it to disk itself when the profile has a
file — non-atomically, like NewAuth's own write, since the tvOS App Group
sandbox blocks temp-file-and-rename.

Not covered by a test: the package builds only under GOOS=ios, which the test
jobs do not run. Verified by building and vetting for GOOS=ios/arm64.

Reported by pappz in review.

* [client] Name the resolving reader for what it does, not what it makes

ReadOrGenerateConfig reads the profile config and falls back to the defaults in
memory when there is no file. "Generate" reads as "produces and stores", which
is the opposite of the property the rename it came from was meant to advertise:
the read is pure, writes nothing and mints no identity.

ReadConfigOrDefault says the same without the side effect, and pairs with
GetExistingConfig, which fails where this one falls back. Its doc comment now
states the absence of a write rather than only the fallback.

Pure rename; the two remaining mentions of the pre-branch name ReadConfig in
the tests go with it.

Reported by pappz in review.

* [client] Read an emptied NAT list as the absent one it matches

apply() compared NATExternalIPs with reflect.DeepEqual, which calls a nil
slice and an empty slice different. Both mean the same thing — no NAT
mappings — and the two meet on a perfectly ordinary start: a profile stores
the absent list as JSON null and reads it back nil, while `netbird up` sends
CleanNATExternalIPs, an empty list, whenever NB_EXTERNAL_IP_MAP is set to
nothing, which a deployment template does by default.

So the gate saw a change where nothing changed and refused the request with
FailedPrecondition. That is the same deadlock this branch exists to remove,
reached through another field: a container with the kill switch on could not
come up, and `netbird up` reported "the daemon refused the settings update".

The DNS label list next to it already used slices.Equal, which treats nil and
empty as the same list. The NAT list now does too, and the last use of
reflect in the package goes with it.

Reported by pappz in review.
---
 client/android/preferences.go                 |  34 +-
 client/cmd/login.go                           |  27 +-
 client/cmd/root.go                            |  39 ++
 client/cmd/up.go                              |  35 +-
 client/cmd/up_setconfig_refusal_test.go       |  85 +++
 client/internal/debug/debug_test.go           |   1 +
 client/internal/profilemanager/config.go      | 483 ++++++++++++----
 .../profilemanager/config_json_test.go        |  44 ++
 .../config_optional_fields_test.go            | 131 +++++
 .../profilemanager/config_probe_test.go       |  96 ++++
 client/internal/profilemanager/config_test.go |   2 +-
 .../config_would_change_test.go               | 529 ++++++++++++++++++
 client/internal/profilemanager/service.go     |  33 +-
 .../internal/profilemanager/service_test.go   |  24 +
 client/ios/NetBirdSDK/client.go               |   4 +
 client/ios/NetBirdSDK/login.go                |  29 +
 client/ios/NetBirdSDK/preferences.go          |  14 +-
 client/mobile/profile_lifecycle_test.go       |  97 ++++
 client/mobile/profile_manager.go              |   5 +-
 client/server/login_gate_test.go              |   2 +-
 client/server/login_overrides_test.go         |   8 +-
 client/server/logout_gate_test.go             |   2 +-
 client/server/mdm.go                          |  86 ---
 client/server/provision_identity_test.go      |  59 ++
 client/server/server.go                       | 204 ++++---
 client/server/setconfig_mdm_test.go           |   2 +-
 client/server/setconfig_test.go               |   2 +-
 client/server/ssh_gate.go                     |  18 +-
 client/server/update_settings_gate.go         |  55 ++
 client/server/update_settings_gate_test.go    | 390 +++++++++++++
 client/ui/i18n/locales/de/common.json         |   6 +
 client/ui/i18n/locales/en/common.json         |   8 +
 client/ui/i18n/locales/es/common.json         |   6 +
 client/ui/i18n/locales/fr/common.json         |   6 +
 client/ui/i18n/locales/hu/common.json         |   6 +
 client/ui/i18n/locales/it/common.json         |   6 +
 client/ui/i18n/locales/ja/common.json         |   6 +
 client/ui/i18n/locales/pt/common.json         |   6 +
 client/ui/i18n/locales/ru/common.json         |   6 +
 client/ui/i18n/locales/uk/common.json         |   6 +
 client/ui/i18n/locales/zh-CN/common.json      |   6 +
 client/ui/services/errors.go                  |  11 +
 client/ui/services/errors_test.go             |  23 +
 43 files changed, 2315 insertions(+), 327 deletions(-)
 create mode 100644 client/cmd/up_setconfig_refusal_test.go
 create mode 100644 client/internal/profilemanager/config_json_test.go
 create mode 100644 client/internal/profilemanager/config_optional_fields_test.go
 create mode 100644 client/internal/profilemanager/config_probe_test.go
 create mode 100644 client/internal/profilemanager/config_would_change_test.go
 create mode 100644 client/mobile/profile_lifecycle_test.go
 create mode 100644 client/server/provision_identity_test.go
 create mode 100644 client/server/update_settings_gate.go
 create mode 100644 client/server/update_settings_gate_test.go

diff --git a/client/android/preferences.go b/client/android/preferences.go
index 5ce31026c..3623de23f 100644
--- a/client/android/preferences.go
+++ b/client/android/preferences.go
@@ -46,7 +46,7 @@ func (p *Preferences) GetManagementURL() (string, error) {
 		return p.configInput.ManagementURL, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return "", err
 	}
@@ -64,7 +64,7 @@ func (p *Preferences) GetAdminURL() (string, error) {
 		return p.configInput.AdminURL, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return "", err
 	}
@@ -86,7 +86,7 @@ func (p *Preferences) HasPreSharedKey() (bool, error) {
 		return *p.configInput.PreSharedKey != "", nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -112,7 +112,7 @@ func (p *Preferences) GetRosenpassEnabled() (bool, error) {
 		return *p.configInput.RosenpassEnabled, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -133,7 +133,7 @@ func (p *Preferences) GetRosenpassPermissive() (bool, error) {
 		return *p.configInput.RosenpassPermissive, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -149,7 +149,7 @@ func (p *Preferences) GetDisableClientRoutes() (bool, error) {
 		return *p.configInput.DisableClientRoutes, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -170,7 +170,7 @@ func (p *Preferences) GetDisableServerRoutes() (bool, error) {
 		return *p.configInput.DisableServerRoutes, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -188,7 +188,7 @@ func (p *Preferences) GetDisableDNS() (bool, error) {
 		return *p.configInput.DisableDNS, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -206,7 +206,7 @@ func (p *Preferences) GetDisableFirewall() (bool, error) {
 		return *p.configInput.DisableFirewall, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -227,7 +227,7 @@ func (p *Preferences) GetServerSSHAllowed() (bool, error) {
 		return *p.configInput.ServerSSHAllowed, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -249,7 +249,7 @@ func (p *Preferences) GetEnableSSHRoot() (bool, error) {
 		return *p.configInput.EnableSSHRoot, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -271,7 +271,7 @@ func (p *Preferences) GetEnableSSHSFTP() (bool, error) {
 		return *p.configInput.EnableSSHSFTP, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -293,7 +293,7 @@ func (p *Preferences) GetEnableSSHLocalPortForwarding() (bool, error) {
 		return *p.configInput.EnableSSHLocalPortForwarding, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -315,7 +315,7 @@ func (p *Preferences) GetEnableSSHRemotePortForwarding() (bool, error) {
 		return *p.configInput.EnableSSHRemotePortForwarding, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -340,7 +340,7 @@ func (p *Preferences) GetBlockInbound() (bool, error) {
 		return *p.configInput.BlockInbound, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -358,7 +358,7 @@ func (p *Preferences) GetDisableIPv6() (bool, error) {
 		return *p.configInput.DisableIPv6, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -377,7 +377,7 @@ func (p *Preferences) GetRemoteJobsAllowed() (bool, error) {
 		return *p.configInput.RemoteJobsAllowed, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
diff --git a/client/cmd/login.go b/client/cmd/login.go
index 11867be09..1dc2d0d09 100644
--- a/client/cmd/login.go
+++ b/client/cmd/login.go
@@ -9,8 +9,6 @@ import (
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 	"golang.org/x/term"
-	"google.golang.org/grpc/codes"
-	gstatus "google.golang.org/grpc/status"
 
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/auth"
@@ -145,10 +143,7 @@ func doDaemonLogin(ctx context.Context, cmd *cobra.Command, providedSetupKey str
 	err = WithBackOff(func() error {
 		var backOffErr error
 		loginResp, backOffErr = client.Login(ctx, &loginRequest)
-		if s, ok := gstatus.FromError(backOffErr); ok && (s.Code() == codes.InvalidArgument ||
-			s.Code() == codes.PermissionDenied ||
-			s.Code() == codes.NotFound ||
-			s.Code() == codes.Unimplemented) {
+		if terminalLoginError(backOffErr) {
 			loginErr = backOffErr
 			return nil
 		}
@@ -327,10 +322,28 @@ func doForegroundLogin(ctx context.Context, cmd *cobra.Command, setupKey string,
 
 	}
 
-	config, err := profilemanager.ReadConfig(configFilePath)
+	config, err := profilemanager.ReadConfigOrDefault(configFilePath)
 	if err != nil {
 		return fmt.Errorf("read config file %s: %v", configFilePath, err)
 	}
+	// Reading a config does not provision one: this login is about to dial
+	// management with the profile's identity, so mint the keys if the profile
+	// has none yet and put them on disk — a key that stayed in memory would
+	// come back different on the next run and register a second peer.
+	//
+	// Before the MDM overlay below, on purpose: the file must keep the
+	// profile's own values. The overlay is runtime-only and re-derived on
+	// every load, so persisting it would turn an enforced management URL or
+	// pre-shared key into one the user appears to own once the policy is
+	// withdrawn.
+	if generated, err := config.EnsureIdentity(); err != nil {
+		return fmt.Errorf("ensure profile identity: %v", err)
+	} else if generated {
+		if err := profilemanager.WriteOutConfig(configFilePath, config); err != nil {
+			return fmt.Errorf("write out config file %s: %v", configFilePath, err)
+		}
+	}
+
 	// CLI standalone login: profilemanager no longer auto-applies MDM,
 	// so layer in the OS-native policy here. Desktop builds construct
 	// a Loader with no fetcher — the build-tagged loadPlatform reads
diff --git a/client/cmd/root.go b/client/cmd/root.go
index be6479440..2ca14c39c 100644
--- a/client/cmd/root.go
+++ b/client/cmd/root.go
@@ -20,6 +20,8 @@ import (
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
 
 	"github.com/netbirdio/netbird/client/anonymize"
 	daddr "github.com/netbirdio/netbird/client/internal/daemonaddr"
@@ -285,6 +287,43 @@ func DialClientGRPCServer(ctx context.Context, addr string) (*grpc.ClientConn, e
 	return grpc.DialContext(ctx, target, opts...)
 }
 
+// terminalLoginError reports whether a Login failure is final, so the backoff
+// cycle stops and the caller is told what the daemon said instead of "login
+// backoff cycle failed" thirty seconds later. Retrying cannot change any of
+// these answers: the request is malformed, the caller is not allowed, the
+// target does not exist, a precondition on the daemon refuses it (the
+// update-settings kill switch, an MDM-managed field), or the method is not
+// implemented.
+//
+// Both `netbird up` and `netbird login` run Login through the backoff, and
+// they each carried their own copy of this list — which is how one of them
+// ended up retrying a refusal the other treated as final.
+func terminalLoginError(err error) bool {
+	// A successful Login reaches here with a nil error, and that is not a
+	// terminal failure. Handled explicitly rather than left to
+	// gstatus.FromError, which answers (nil, true) for a nil error and leans on
+	// Status.Code tolerating a nil receiver to come back as codes.OK.
+	if err == nil {
+		return false
+	}
+
+	s, ok := gstatus.FromError(err)
+	if !ok {
+		return false
+	}
+
+	switch s.Code() {
+	case codes.InvalidArgument,
+		codes.PermissionDenied,
+		codes.NotFound,
+		codes.FailedPrecondition,
+		codes.Unimplemented:
+		return true
+	default:
+		return false
+	}
+}
+
 // WithBackOff execute function in backoff cycle.
 func WithBackOff(bf func() error) error {
 	return backoff.RetryNotify(bf, CLIBackOffSettings, func(err error, duration time.Duration) {
diff --git a/client/cmd/up.go b/client/cmd/up.go
index f5fac9749..120a25595 100644
--- a/client/cmd/up.go
+++ b/client/cmd/up.go
@@ -357,9 +357,17 @@ func runInDaemonMode(ctx context.Context, cmd *cobra.Command, pm *profilemanager
 	// set the new config
 	req := setupSetConfigReq(customDNSAddressConverted, cmd, activeProf.ID.String(), username.Username)
 	if _, err := client.SetConfig(ctx, req); err != nil {
-		if st, ok := gstatus.FromError(err); ok && st.Code() == codes.Unavailable {
-			log.Warnf("setConfig method is not available in the daemon: %s", st.Message())
-		} else {
+		switch reason, refused := refusedSettingsUpdate(err); {
+		case refused:
+			// Failing here is the point: carrying on would connect while
+			// silently dropping the settings the caller asked for, since
+			// nothing further down the line applies them.
+			return fmt.Errorf("the daemon refused the settings update: %s", reason)
+		case gstatus.Code(err) == codes.Unavailable:
+			// The daemon cannot serve the method at all, which is what this
+			// code means; an older daemon without it lands here.
+			log.Warnf("the daemon did not apply the settings update: %s", gstatus.Convert(err).Message())
+		default:
 			return daemonCallError("call service setConfig method", err)
 		}
 	}
@@ -400,10 +408,7 @@ func doDaemonUp(ctx context.Context, cmd *cobra.Command, client proto.DaemonServ
 	err = WithBackOff(func() error {
 		var backOffErr error
 		loginResp, backOffErr = client.Login(ctx, loginRequest)
-		if s, ok := gstatus.FromError(backOffErr); ok && (s.Code() == codes.InvalidArgument ||
-			s.Code() == codes.PermissionDenied ||
-			s.Code() == codes.NotFound ||
-			s.Code() == codes.Unimplemented) {
+		if terminalLoginError(backOffErr) {
 			loginErr = backOffErr
 			return nil
 		}
@@ -472,6 +477,22 @@ func setSSHSetConfigFields(req *proto.SetConfigRequest, cmd *cobra.Command) {
 	}
 }
 
+// refusedSettingsUpdate reports whether err is the daemon refusing the settings
+// a request carried — the update-settings kill switch, or a field an MDM policy
+// manages — and returns the reason it gave.
+//
+// The distinction that matters is against codes.Unavailable, which means the
+// daemon cannot serve the call: that one is worth a warning, because an older
+// daemon without the method lands there and the rest of `netbird up` still
+// works. A refusal is not, because the settings would be silently dropped.
+func refusedSettingsUpdate(err error) (string, bool) {
+	st, ok := gstatus.FromError(err)
+	if !ok || st.Code() != codes.FailedPrecondition {
+		return "", false
+	}
+	return st.Message(), true
+}
+
 func setupSetConfigReq(customDNSAddressConverted []byte, cmd *cobra.Command, profileName, username string) *proto.SetConfigRequest {
 	var req proto.SetConfigRequest
 	req.ProfileName = profileName
diff --git a/client/cmd/up_setconfig_refusal_test.go b/client/cmd/up_setconfig_refusal_test.go
new file mode 100644
index 000000000..fdf580102
--- /dev/null
+++ b/client/cmd/up_setconfig_refusal_test.go
@@ -0,0 +1,85 @@
+package cmd
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+)
+
+// A refused settings update has to fail `netbird up`, or a caller that asked
+// for a setting the daemon will not apply connects as if it had been applied.
+// The daemon being unable to serve the call is the case that stays a warning.
+func TestRefusedSettingsUpdate(t *testing.T) {
+	tests := []struct {
+		name        string
+		err         error
+		wantRefused bool
+	}{
+		{
+			name:        "the kill switch refused the change",
+			err:         gstatus.Errorf(codes.FailedPrecondition, "update settings are disabled, you cannot use this feature without update settings enabled"),
+			wantRefused: true,
+		},
+		{
+			name:        "an MDM policy manages the field",
+			err:         gstatus.Errorf(codes.FailedPrecondition, "fields managed by MDM policy: managementURL"),
+			wantRefused: true,
+		},
+		{
+			name:        "the daemon cannot serve the call",
+			err:         gstatus.Errorf(codes.Unavailable, "connection refused"),
+			wantRefused: false,
+		},
+		{
+			name:        "any other RPC failure",
+			err:         gstatus.Errorf(codes.Internal, "boom"),
+			wantRefused: false,
+		},
+		{
+			name:        "not a status error at all",
+			err:         errors.New("boom"),
+			wantRefused: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			reason, refused := refusedSettingsUpdate(tt.err)
+			require.Equal(t, tt.wantRefused, refused)
+			if tt.wantRefused {
+				require.Equal(t, gstatus.Convert(tt.err).Message(), reason, "the daemon's reason must reach the caller")
+			}
+		})
+	}
+}
+
+// Both `netbird up` and `netbird login` drive Login through the backoff cycle,
+// and a final answer has to stop it: retrying a refusal only replaces the
+// daemon's reason with "login backoff cycle failed" thirty seconds later.
+func TestTerminalLoginError(t *testing.T) {
+	tests := []struct {
+		name         string
+		err          error
+		wantTerminal bool
+	}{
+		{name: "settings refused by the kill switch", err: gstatus.Errorf(codes.FailedPrecondition, "update settings are disabled"), wantTerminal: true},
+		{name: "field managed by MDM", err: gstatus.Errorf(codes.FailedPrecondition, "fields managed by MDM policy: managementURL"), wantTerminal: true},
+		{name: "caller not allowed", err: gstatus.Errorf(codes.PermissionDenied, "nope"), wantTerminal: true},
+		{name: "malformed request", err: gstatus.Errorf(codes.InvalidArgument, "nope"), wantTerminal: true},
+		{name: "profile not found", err: gstatus.Errorf(codes.NotFound, "nope"), wantTerminal: true},
+		{name: "method missing on an older daemon", err: gstatus.Errorf(codes.Unimplemented, "nope"), wantTerminal: true},
+		{name: "daemon unreachable, worth retrying", err: gstatus.Errorf(codes.Unavailable, "connection refused"), wantTerminal: false},
+		{name: "transient internal failure", err: gstatus.Errorf(codes.Internal, "boom"), wantTerminal: false},
+		{name: "not a status error", err: errors.New("boom"), wantTerminal: false},
+		{name: "no error at all, the login succeeded", err: nil, wantTerminal: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			require.Equal(t, tt.wantTerminal, terminalLoginError(tt.err))
+		})
+	}
+}
diff --git a/client/internal/debug/debug_test.go b/client/internal/debug/debug_test.go
index 6a810bccc..0f74490f2 100644
--- a/client/internal/debug/debug_test.go
+++ b/client/internal/debug/debug_test.go
@@ -846,6 +846,7 @@ func TestAddConfig_AllFieldsCovered(t *testing.T) {
 		"ClientCertKeyPair":    "non-config: parsed cert pair, not serialized",
 		"Name":                 "non-config: profile name is not needed for debug purposes",
 		"policy":               "non-config: in-memory MDM policy snapshot, surfaced via Config.Policy() / GetConfigResponse.MDMManagedFields",
+		"probing":              "non-config: marks a throwaway copy built to be diffed against; never set on a config anyone runs with",
 		"DebugBundleUploadURL": "sensitive: MDM-provided upload URL may carry credentials or query tokens; kept out of the shared bundle",
 	}
 
diff --git a/client/internal/profilemanager/config.go b/client/internal/profilemanager/config.go
index 412f81b5c..ac1b90a62 100644
--- a/client/internal/profilemanager/config.go
+++ b/client/internal/profilemanager/config.go
@@ -10,7 +10,6 @@ import (
 	"os"
 	"os/user"
 	"path/filepath"
-	"reflect"
 	"runtime"
 	"slices"
 	"strings"
@@ -198,6 +197,11 @@ type Config struct {
 
 	MTU uint16
 
+	// probing marks a config that exists only to be compared against and then
+	// thrown away, so apply() can skip the work that feeds no verdict.
+	// Unexported, so it never reaches the JSON.
+	probing bool
+
 	// policy is the MDM policy that produced the currently-set values
 	// for any MDM-enforced fields. Set by ApplyMDMPolicy on every
 	// invocation. Never persisted to disk. Callers query enforcement
@@ -300,9 +304,11 @@ func fileExists(path string) (bool, error) {
 	return false, err
 }
 
-// createNewConfig creates a new config generating a new Wireguard key and saving to file
-func createNewConfig(input ConfigInput) (*Config, error) {
-	config := &Config{
+// newConfigSkeleton returns the field values a brand-new profile config starts
+// from, before apply() fills in the rest. Shared with the dry-run baseline so
+// the two cannot disagree about what "a new config" means.
+func newConfigSkeleton() *Config {
+	return &Config{
 		// defaults to false only for new (post 0.26) configurations
 		ServerSSHAllowed: util.False(),
 		// Remote jobs are an explicit opt-in and default off, including for
@@ -310,6 +316,91 @@ func createNewConfig(input ConfigInput) (*Config, error) {
 		RemoteJobsAllowed: util.False(),
 		WgPort:            iface.DefaultWgPort,
 	}
+}
+
+// resolveUnsetDefaults is the single place where an optional field that carries
+// no value gets one, and the only place that states what each of those defaults
+// is. apply() runs it before it compares anything, and that ordering is the
+// point: with the values named, every comparison below it diffs values instead
+// of presence.
+//
+// Presence-based comparison is what broke `netbird up` for a client configured
+// through the environment. These fields mean "the effective default" when they
+// hold nothing — every consumer already reads a nil as the value resolved here,
+// the SSH toggles in engine_ssh.go and the network monitor in
+// createEngineConfig — so naming them changes nothing about what runs. But
+// while they stayed nil, an input restating the default read as a change, and
+// since the CLI sends every flag whose value came from an environment variable
+// on each `netbird up`, a client with NB_ENABLE_SSH_ROOT=false restated it
+// every time and the update-settings gate refused it.
+//
+// Filling a field in is not a settings change, so a caller measuring change
+// must not read the returned bool as one: see WouldChange, which runs a pass
+// for this and discards its verdict.
+//
+// ServerSSHAllowed is the one field whose default depends on the config's age.
+// A brand-new profile gets false from newConfigSkeleton, which runs before
+// this, so what is resolved here is only the legacy case: a config written by a
+// version that had no such field keeps SSH on, for backwards compatibility.
+func (config *Config) resolveUnsetDefaults() (updated bool) {
+	// Fields that default to false on every platform.
+	for _, field := range []**bool{
+		&config.EnableSSHRoot,
+		&config.EnableSSHSFTP,
+		&config.EnableSSHLocalPortForwarding,
+		&config.EnableSSHRemotePortForwarding,
+		&config.DisableSSHAuth,
+		// Remote jobs are an explicit opt-in: unlike SSH, a pre-existing config
+		// with no value defaults to disabled rather than being turned on.
+		&config.RemoteJobsAllowed,
+	} {
+		if *field == nil {
+			*field = util.False()
+			updated = true
+		}
+	}
+
+	if config.DisableNotifications == nil {
+		log.Infof("setting notifications to disabled by default")
+		config.DisableNotifications = util.True()
+		updated = true
+	}
+
+	if config.SSHJWTCacheTTL == nil {
+		// A zero TTL disables the JWT cache, which is what no value meant.
+		config.SSHJWTCacheTTL = new(int)
+		updated = true
+	}
+
+	if config.NetworkMonitor == nil {
+		// network monitoring is on by default on windows and darwin clients
+		enabled := runtime.GOOS == "windows" || runtime.GOOS == "darwin"
+		config.NetworkMonitor = &enabled
+		updated = true
+	}
+
+	if config.ServerSSHAllowed == nil {
+		if runtime.GOOS == "android" {
+			// default to disabled SSH on Android for security
+			log.Infof("setting SSH server to false by default on Android")
+			config.ServerSSHAllowed = util.False()
+		} else {
+			// enables SSH for configs from old versions to preserve backwards compatibility
+			log.Infof("falling back to enabled SSH server for pre-existing configuration")
+			config.ServerSSHAllowed = util.True()
+		}
+		updated = true
+	}
+
+	return updated
+}
+
+// createNewConfig resolves a new config in memory, with no identity: whoever
+// needs the peer's keys calls EnsureIdentity and persists the result, so a read
+// that lands on a missing file cannot hand back a config carrying keys that
+// nothing will ever write down.
+func createNewConfig(input ConfigInput) (*Config, error) {
+	config := newConfigSkeleton()
 
 	if _, err := config.apply(input); err != nil {
 		return nil, err
@@ -318,6 +409,52 @@ func createNewConfig(input ConfigInput) (*Config, error) {
 	return config, nil
 }
 
+// createProvisionedConfig is createNewConfig plus the peer's identity, for the
+// callers that go on to persist the config or to connect with it.
+func createProvisionedConfig(input ConfigInput) (*Config, error) {
+	config, err := createNewConfig(input)
+	if err != nil {
+		return nil, err
+	}
+
+	if _, err := config.EnsureIdentity(); err != nil {
+		return nil, err
+	}
+
+	return config, nil
+}
+
+// EnsureIdentity generates the keys that identify this peer if the config does
+// not carry them yet, reporting whether it had to generate any.
+//
+// It is deliberately not part of apply(). Everything apply() fills in is a
+// default it can recompute on the next read, but a generated key is not: it
+// has to be persisted, or the peer comes back with a different WireGuard
+// identity and re-registers. Having apply() generate keys is what forced every
+// read of a config to write it back — so identity provisioning is its own step
+// now, and the callers that perform it write the result out explicitly.
+func (config *Config) EnsureIdentity() (bool, error) {
+	generated := false
+
+	if config.PrivateKey == "" {
+		log.Infof("generated new Wireguard key")
+		config.PrivateKey = generateKey()
+		generated = true
+	}
+
+	if config.SSHKey == "" {
+		log.Infof("generated new SSH key")
+		pem, err := ssh.GeneratePrivateKey(ssh.ED25519)
+		if err != nil {
+			return generated, err
+		}
+		config.SSHKey = string(pem)
+		generated = true
+	}
+
+	return generated, nil
+}
+
 func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 	if config.Name != "" {
 		sanitized, err := sanitizeDisplayName(config.Name)
@@ -329,6 +466,13 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 			updated = true
 		}
 	}
+
+	// Every optional field gets its value here, before anything below compares
+	// one. See resolveUnsetDefaults for why that ordering is the point.
+	if config.resolveUnsetDefaults() {
+		updated = true
+	}
+
 	if config.ManagementURL == nil {
 		log.Infof("using default Management URL %s", DefaultManagementURL)
 		config.ManagementURL, err = parseURL("Management URL", DefaultManagementURL)
@@ -336,20 +480,21 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 			return false, err
 		}
 	}
-	if input.ManagementURL != "" && input.ManagementURL != config.ManagementURL.String() {
-		log.Infof("new Management URL provided, updated to %#v (old value %#v)",
-			input.ManagementURL, config.ManagementURL.String())
+	// The comparison is on the endpoint the URL addresses, not on its
+	// spelling: the same endpoint can be written several ways (an implicit
+	// :443, a trailing slash, a different host case), and treating an
+	// equivalent URL as new would rewrite the config and report a settings
+	// change where the configuration does not actually change.
+	if input.ManagementURL != "" {
 		URL, err := parseURL("Management URL", input.ManagementURL)
 		if err != nil {
 			return false, err
 		}
-		config.ManagementURL = URL
-		updated = true
-	} else if config.ManagementURL == nil {
-		log.Infof("using default Management URL %s", DefaultManagementURL)
-		config.ManagementURL, err = parseURL("Management URL", DefaultManagementURL)
-		if err != nil {
-			return false, err
+		if !SameServiceURL(URL, config.ManagementURL) {
+			log.Infof("new Management URL provided, updated to %#v (old value %#v)",
+				URL.String(), config.ManagementURL.String())
+			config.ManagementURL = URL
+			updated = true
 		}
 	}
 
@@ -360,31 +505,20 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 			return false, err
 		}
 	}
-	if input.AdminURL != "" && input.AdminURL != config.AdminURL.String() {
-		log.Infof("new Admin Panel URL provided, updated to %#v (old value %#v)",
-			input.AdminURL, config.AdminURL.String())
+	// The admin panel is opened, not dialed, so unlike the Management URL its
+	// path is part of what identifies it: a panel served under /netbird is not
+	// the one served at the root.
+	if input.AdminURL != "" {
 		newURL, err := parseURL("Admin Panel URL", input.AdminURL)
 		if err != nil {
 			return updated, err
 		}
-		config.AdminURL = newURL
-		updated = true
-	}
-
-	if config.PrivateKey == "" {
-		log.Infof("generated new Wireguard key")
-		config.PrivateKey = generateKey()
-		updated = true
-	}
-
-	if config.SSHKey == "" {
-		log.Infof("generated new SSH key")
-		pem, err := ssh.GeneratePrivateKey(ssh.ED25519)
-		if err != nil {
-			return false, err
+		if !SameServiceURLIncludingPath(newURL, config.AdminURL) {
+			log.Infof("new Admin Panel URL provided, updated to %#v (old value %#v)",
+				newURL.String(), config.AdminURL.String())
+			config.AdminURL = newURL
+			updated = true
 		}
-		config.SSHKey = string(pem)
-		updated = true
 	}
 
 	if input.WireguardPort != nil && *input.WireguardPort != config.WgPort {
@@ -405,7 +539,14 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.NATExternalIPs != nil && !reflect.DeepEqual(config.NATExternalIPs, input.NATExternalIPs) {
+	// slices.Equal, not reflect.DeepEqual, and for the same reason the DNS
+	// labels below use it: DeepEqual calls a nil slice and an empty one
+	// different, while both mean "no NAT mappings". A profile stores the
+	// absent list as JSON null and reads it back nil, and `netbird up` sends
+	// CleanNATExternalIPs — an empty list — whenever NB_EXTERNAL_IP_MAP is set
+	// to nothing, so the two met on every start and the gate read a no-op as a
+	// settings change.
+	if input.NATExternalIPs != nil && !slices.Equal(config.NATExternalIPs, input.NATExternalIPs) {
 		log.Infof("updating NAT External IP [ %s ] (old value: [ %s ])",
 			strings.Join(input.NATExternalIPs, " "),
 			strings.Join(config.NATExternalIPs, " "))
@@ -443,21 +584,12 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.NetworkMonitor != nil && (config.NetworkMonitor == nil || *input.NetworkMonitor != *config.NetworkMonitor) {
+	if input.NetworkMonitor != nil && *input.NetworkMonitor != *config.NetworkMonitor {
 		log.Infof("switching Network Monitor to %t", *input.NetworkMonitor)
 		config.NetworkMonitor = input.NetworkMonitor
 		updated = true
 	}
 
-	if config.NetworkMonitor == nil {
-		// enable network monitoring by default on windows and darwin clients
-		if runtime.GOOS == "windows" || runtime.GOOS == "darwin" {
-			enabled := true
-			config.NetworkMonitor = &enabled
-			updated = true
-		}
-	}
-
 	if input.CustomDNSAddress != nil && string(input.CustomDNSAddress) != config.CustomDNSAddress {
 		log.Infof("updating custom DNS address %#v (old value %#v)",
 			string(input.CustomDNSAddress), config.CustomDNSAddress)
@@ -490,7 +622,7 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.ServerSSHAllowed != nil && (config.ServerSSHAllowed == nil || *input.ServerSSHAllowed != *config.ServerSSHAllowed) {
+	if input.ServerSSHAllowed != nil && *input.ServerSSHAllowed != *config.ServerSSHAllowed {
 		if *input.ServerSSHAllowed {
 			log.Infof("enabling SSH server")
 		} else {
@@ -498,20 +630,9 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		}
 		config.ServerSSHAllowed = input.ServerSSHAllowed
 		updated = true
-	} else if config.ServerSSHAllowed == nil {
-		if runtime.GOOS == "android" {
-			// default to disabled SSH on Android for security
-			log.Infof("setting SSH server to false by default on Android")
-			config.ServerSSHAllowed = util.False()
-		} else {
-			// enables SSH for configs from old versions to preserve backwards compatibility
-			log.Infof("falling back to enabled SSH server for pre-existing configuration")
-			config.ServerSSHAllowed = util.True()
-		}
-		updated = true
 	}
 
-	if input.RemoteJobsAllowed != nil && (config.RemoteJobsAllowed == nil || *input.RemoteJobsAllowed != *config.RemoteJobsAllowed) {
+	if input.RemoteJobsAllowed != nil && *input.RemoteJobsAllowed != *config.RemoteJobsAllowed {
 		if *input.RemoteJobsAllowed {
 			log.Infof("enabling remote jobs")
 		} else {
@@ -519,14 +640,9 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		}
 		config.RemoteJobsAllowed = input.RemoteJobsAllowed
 		updated = true
-	} else if config.RemoteJobsAllowed == nil {
-		// Remote jobs are an explicit opt-in: unlike SSH, a pre-existing config
-		// with no value defaults to disabled rather than being turned on.
-		config.RemoteJobsAllowed = util.False()
-		updated = true
 	}
 
-	if input.EnableSSHRoot != nil && (config.EnableSSHRoot == nil || *input.EnableSSHRoot != *config.EnableSSHRoot) {
+	if input.EnableSSHRoot != nil && *input.EnableSSHRoot != *config.EnableSSHRoot {
 		if *input.EnableSSHRoot {
 			log.Infof("enabling SSH root login")
 		} else {
@@ -536,7 +652,7 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.EnableSSHSFTP != nil && (config.EnableSSHSFTP == nil || *input.EnableSSHSFTP != *config.EnableSSHSFTP) {
+	if input.EnableSSHSFTP != nil && *input.EnableSSHSFTP != *config.EnableSSHSFTP {
 		if *input.EnableSSHSFTP {
 			log.Infof("enabling SSH SFTP subsystem")
 		} else {
@@ -546,7 +662,7 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.EnableSSHLocalPortForwarding != nil && (config.EnableSSHLocalPortForwarding == nil || *input.EnableSSHLocalPortForwarding != *config.EnableSSHLocalPortForwarding) {
+	if input.EnableSSHLocalPortForwarding != nil && *input.EnableSSHLocalPortForwarding != *config.EnableSSHLocalPortForwarding {
 		if *input.EnableSSHLocalPortForwarding {
 			log.Infof("enabling SSH local port forwarding")
 		} else {
@@ -556,7 +672,7 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.EnableSSHRemotePortForwarding != nil && (config.EnableSSHRemotePortForwarding == nil || *input.EnableSSHRemotePortForwarding != *config.EnableSSHRemotePortForwarding) {
+	if input.EnableSSHRemotePortForwarding != nil && *input.EnableSSHRemotePortForwarding != *config.EnableSSHRemotePortForwarding {
 		if *input.EnableSSHRemotePortForwarding {
 			log.Infof("enabling SSH remote port forwarding")
 		} else {
@@ -566,7 +682,7 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.DisableSSHAuth != nil && (config.DisableSSHAuth == nil || *input.DisableSSHAuth != *config.DisableSSHAuth) {
+	if input.DisableSSHAuth != nil && *input.DisableSSHAuth != *config.DisableSSHAuth {
 		if *input.DisableSSHAuth {
 			log.Infof("disabling SSH authentication")
 		} else {
@@ -576,7 +692,7 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.SSHJWTCacheTTL != nil && (config.SSHJWTCacheTTL == nil || *input.SSHJWTCacheTTL != *config.SSHJWTCacheTTL) {
+	if input.SSHJWTCacheTTL != nil && *input.SSHJWTCacheTTL != *config.SSHJWTCacheTTL {
 		log.Infof("updating SSH JWT cache TTL to %d seconds", *input.SSHJWTCacheTTL)
 		config.SSHJWTCacheTTL = input.SSHJWTCacheTTL
 		updated = true
@@ -659,13 +775,16 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.SyncMessageVersion != nil && *input.SyncMessageVersion != *config.SyncMessageVersion {
+	// Assigning the pointer, not writing through it: a config that carries no
+	// version yet would otherwise be a nil dereference, and a panic inside a
+	// request handler is not a way to fail.
+	if input.SyncMessageVersion != nil && (config.SyncMessageVersion == nil || *input.SyncMessageVersion != *config.SyncMessageVersion) {
 		log.Infof("setting SyncMessageVersion to %v", *input.SyncMessageVersion)
-		*config.SyncMessageVersion = *input.SyncMessageVersion
+		config.SyncMessageVersion = input.SyncMessageVersion
 		updated = true
 	}
 
-	if input.DisableNotifications != nil && (config.DisableNotifications == nil || *input.DisableNotifications != *config.DisableNotifications) {
+	if input.DisableNotifications != nil && *input.DisableNotifications != *config.DisableNotifications {
 		if *input.DisableNotifications {
 			log.Infof("disabling notifications")
 		} else {
@@ -675,24 +794,24 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if config.DisableNotifications == nil {
-		disabled := true
-		config.DisableNotifications = &disabled
-		log.Infof("setting notifications to disabled by default")
-		updated = true
-	}
-
-	if input.ClientCertKeyPath != "" {
+	// Compared, not just assigned: restating the path a config already holds
+	// changes nothing, and reporting it as an update makes a caller that
+	// re-sends its own configuration look like one asking to change it.
+	if input.ClientCertKeyPath != "" && input.ClientCertKeyPath != config.ClientCertKeyPath {
 		config.ClientCertKeyPath = input.ClientCertKeyPath
 		updated = true
 	}
 
-	if input.ClientCertPath != "" {
+	if input.ClientCertPath != "" && input.ClientCertPath != config.ClientCertPath {
 		config.ClientCertPath = input.ClientCertPath
 		updated = true
 	}
 
-	if config.ClientCertPath != "" && config.ClientCertKeyPath != "" {
+	// Not on a probe: the loaded pair feeds the connection, never the
+	// comparison, and this would otherwise run on every gated SetConfig and
+	// Login — twice per request — including those that are refused or change
+	// nothing, logging an error per request when the files are missing.
+	if !config.probing && config.ClientCertPath != "" && config.ClientCertKeyPath != "" {
 		cert, err := tls.LoadX509KeyPair(config.ClientCertPath, config.ClientCertKeyPath)
 		if err != nil {
 			log.Error("Failed to load mTLS cert/key pair: ", err)
@@ -886,6 +1005,49 @@ func ParseServiceURL(serviceName, serviceURL string) (*url.URL, error) {
 	return parseURL(serviceName, serviceURL)
 }
 
+// SameServiceURL reports whether two service URLs address the same endpoint:
+// same scheme, same host compared case-insensitively as DNS names are, and
+// same effective port, where an absent port means the scheme's default.
+//
+// This is the one comparison every caller deciding "did this URL change?" must
+// use. A string comparison answers a different question: "https://host",
+// "https://host/" and "https://HOST:443" are one endpoint written three ways,
+// and reading them as three values makes a client that restates its own
+// management URL look like a client asking to be repointed. A nil operand
+// matches only another nil one.
+//
+// The path plays no part: a management URL is dialed, and only its host and
+// port are. util.SameServiceURL is this comparison plus the path, which is
+// what SameServiceURLIncludingPath needs and delegates to.
+func SameServiceURL(a, b *url.URL) bool {
+	if a == nil || b == nil {
+		return a == b
+	}
+
+	return strings.EqualFold(a.Scheme, b.Scheme) &&
+		strings.EqualFold(a.Hostname(), b.Hostname()) &&
+		util.ServiceURLPort(a) == util.ServiceURLPort(b)
+}
+
+// SameServiceURLIncludingPath is SameServiceURL plus everything a URL carries
+// past its endpoint: path, query, fragment and userinfo.
+//
+// Use it for a URL that gets opened rather than dialed. The admin panel can
+// live under a path, so two URLs with the same endpoint and different paths are
+// two different panels — where for a URL the client dials over gRPC only the
+// endpoint is ever used. Equivalent spellings still compare equal: a missing
+// path and "/" are the same root, and so is a trailing slash on any path.
+func SameServiceURLIncludingPath(a, b *url.URL) bool {
+	if a == nil || b == nil {
+		return a == b
+	}
+
+	return util.SameServiceURL(a, b) &&
+		a.RawQuery == b.RawQuery &&
+		a.Fragment == b.Fragment &&
+		a.User.String() == b.User.String()
+}
+
 func parseURL(serviceName, serviceURL string) (*url.URL, error) {
 	parsedMgmtURL, err := url.ParseRequestURI(serviceURL)
 	if err != nil {
@@ -930,6 +1092,84 @@ func isPreSharedKeyHidden(preSharedKey *string) bool {
 	return false
 }
 
+// WouldChange reports whether applying input would modify any field the
+// config persists, leaving the receiver untouched. It is the dry-run half of
+// UpdateConfig and reuses the very same diff logic (Config.apply), so a
+// caller asking "is this a settings change?" cannot drift from what an
+// actual update would do, nor go stale when a new field is added.
+//
+// A redacted pre-shared key is collapsed to "unset" exactly as
+// UpdateOrCreateConfig does, so a UI that round-trips the mask is not read as
+// a request for a new key.
+//
+// A nil receiver means the profile holds no config yet, so the baseline is the
+// config the daemon would create for it: input values matching those defaults
+// change nothing, anything else does.
+func (config *Config) WouldChange(input ConfigInput) (bool, error) {
+	probe := config.clone()
+	if probe == nil {
+		baseline, err := newDryRunBaseline(input.ConfigPath)
+		if err != nil {
+			return true, fmt.Errorf("build default config baseline: %w", err)
+		}
+		probe = baseline
+	}
+	probe.probing = true
+
+	// Normalize before measuring. apply() reports two different things through
+	// one bool: an input that changed a value, and a field it had to fill in
+	// because the config carried none. Only the first is a settings change, so
+	// the filling-in gets a pass of its own whose verdict is discarded, and the
+	// pass that answers the caller runs against a config with nothing left to
+	// fill in.
+	//
+	// Readers already hand out normalized configs — readConfig applies an empty
+	// input for this very reason — so this is normally a no-op. But a gate that
+	// refuses a request must not depend on where its caller got the config
+	// from, and it must not start reading "this profile predates a field" as
+	// "the caller asked for a change" the day someone adds one.
+	if _, err := probe.apply(ConfigInput{ConfigPath: input.ConfigPath}); err != nil {
+		return true, fmt.Errorf("normalize the config to diff against: %w", err)
+	}
+
+	if isPreSharedKeyHidden(input.PreSharedKey) {
+		input.PreSharedKey = nil
+	}
+
+	return probe.apply(input)
+}
+
+// newDryRunBaseline builds the config a brand-new profile would start from, for
+// a dry run to compare an input against. It is createNewConfig without the
+// identity: this config exists only to be compared against and thrown away, and
+// no ConfigInput field maps to either key.
+func newDryRunBaseline(configPath string) (*Config, error) {
+	baseline := newConfigSkeleton()
+
+	if _, err := baseline.apply(ConfigInput{ConfigPath: configPath}); err != nil {
+		return nil, err
+	}
+
+	return baseline, nil
+}
+
+// clone returns a copy of the config that apply can be run against without the
+// original observing the writes, or nil for a nil receiver. Only what apply
+// mutates in place needs detaching, which is the slices it replaces or appends
+// to: every pointer field it touches is reassigned rather than written through,
+// and ClientCertKeyPair is only overwritten.
+func (config *Config) clone() *Config {
+	if config == nil {
+		return nil
+	}
+
+	probe := *config
+	probe.IFaceBlackList = slices.Clone(config.IFaceBlackList)
+	probe.NATExternalIPs = slices.Clone(config.NATExternalIPs)
+	probe.DNSLabels = slices.Clone(config.DNSLabels)
+	return &probe
+}
+
 // UpdateConfig update existing configuration according to input configuration and return with the configuration
 func UpdateConfig(input ConfigInput) (*Config, error) {
 	configExists, err := fileExists(input.ConfigPath)
@@ -940,6 +1180,14 @@ func UpdateConfig(input ConfigInput) (*Config, error) {
 		return nil, fmt.Errorf("config file %s does not exist", input.ConfigPath)
 	}
 
+	// A UI that round-trips the mask GetConfig hands it back is asking to keep
+	// the stored key, not to set the mask as the new one. UpdateOrCreateConfig
+	// and DirectUpdateOrCreateConfig already collapse it; this one did not, so
+	// the same round-trip through SetConfig replaced the key with asterisks.
+	if isPreSharedKeyHidden(input.PreSharedKey) {
+		input.PreSharedKey = nil
+	}
+
 	return update(input)
 }
 
@@ -951,7 +1199,7 @@ func UpdateOrCreateConfig(input ConfigInput) (*Config, error) {
 	}
 	if !configExists {
 		log.Infof("generating new config %s", input.ConfigPath)
-		cfg, err := createNewConfig(input)
+		cfg, err := createProvisionedConfig(input)
 		if err != nil {
 			return nil, err
 		}
@@ -976,12 +1224,20 @@ func update(input ConfigInput) (*Config, error) {
 		return nil, err
 	}
 
+	// A write path is a provisioning point: a stored profile can legitimately
+	// carry no identity (a mobile logout clears the keys in place), and the
+	// next config write is what has to mint a new one. Reads leave that alone.
+	identityGenerated, err := config.EnsureIdentity()
+	if err != nil {
+		return nil, err
+	}
+
 	updated, err := config.apply(input)
 	if err != nil {
 		return nil, err
 	}
 
-	if updated {
+	if updated || identityGenerated {
 		if err := util.WriteJson(context.Background(), input.ConfigPath, config); err != nil {
 			return nil, err
 		}
@@ -990,8 +1246,8 @@ func update(input ConfigInput) (*Config, error) {
 	return config, nil
 }
 
-// GetConfig read config file and return with Config and if it was created. Errors out if it does not exist
-func GetConfig(configPath string) (*Config, error) {
+// GetExistingConfig reads and returns the config if it exists on disk. Fails otherwise.
+func GetExistingConfig(configPath string) (*Config, error) {
 	return readConfig(configPath, false)
 }
 
@@ -1074,17 +1330,27 @@ func UpdateOldManagementURL(ctx context.Context, config *Config, configPath stri
 	return newConfig, nil
 }
 
-// CreateInMemoryConfig generate a new config but do not write out it to the store
+// CreateInMemoryConfig generate a new config but do not write out it to the store.
+// It carries an identity: callers connect with what they get back.
 func CreateInMemoryConfig(input ConfigInput) (*Config, error) {
-	return createNewConfig(input)
+	return createProvisionedConfig(input)
 }
 
-// ReadConfig read config file and return with Config. If it is not exists create a new with default values
-func ReadConfig(configPath string) (*Config, error) {
+// ReadConfigOrDefault reads the profile config at configPath, or resolves the
+// default config in memory when the file does not exist. It never writes, and
+// never mints an identity — EnsureIdentity is where that happens, so the
+// caller that provisions is also the one that persists.
+func ReadConfigOrDefault(configPath string) (*Config, error) {
 	return readConfig(configPath, true)
 }
 
-// ReadConfig read config file and return with Config. If it is not exists create a new with default values
+// readConfig reads the profile config at configPath. createIfMissing resolves a
+// default config in memory when the file is absent, rather than erroring.
+//
+// Reads are pure. This used to write the config back whenever apply() had to
+// fill in a default the file was missing, which quietly made every reader a
+// writer: a gate deciding whether to refuse a request, a UI listing profiles,
+// a mobile getter reading a single preference.
 func readConfig(configPath string, createIfMissing bool) (*Config, error) {
 	configExists, err := fileExists(configPath)
 	if err != nil {
@@ -1102,12 +1368,8 @@ func readConfig(configPath string, createIfMissing bool) (*Config, error) {
 			return nil, err
 		}
 		// initialize through apply() without changes
-		if changed, err := config.apply(ConfigInput{}); err != nil {
+		if _, err := config.apply(ConfigInput{}); err != nil {
 			return nil, err
-		} else if changed {
-			if err = WriteOutConfig(configPath, config); err != nil {
-				return nil, err
-			}
 		}
 
 		return config, nil
@@ -1115,13 +1377,7 @@ func readConfig(configPath string, createIfMissing bool) (*Config, error) {
 		return nil, fmt.Errorf("config file %s does not exist", configPath)
 	}
 
-	cfg, err := createNewConfig(ConfigInput{ConfigPath: configPath})
-	if err != nil {
-		return nil, err
-	}
-
-	err = WriteOutConfig(configPath, cfg)
-	return cfg, err
+	return createNewConfig(ConfigInput{ConfigPath: configPath})
 }
 
 // WriteOutConfig write put the prepared config to the given path
@@ -1144,7 +1400,7 @@ func DirectUpdateOrCreateConfig(input ConfigInput) (*Config, error) {
 	}
 	if !configExists {
 		log.Infof("generating new config %s", input.ConfigPath)
-		cfg, err := createNewConfig(input)
+		cfg, err := createProvisionedConfig(input)
 		if err != nil {
 			return nil, err
 		}
@@ -1171,12 +1427,18 @@ func directUpdate(input ConfigInput) (*Config, error) {
 		return nil, err
 	}
 
+	// Same provisioning point as update(); see the note there.
+	identityGenerated, err := config.EnsureIdentity()
+	if err != nil {
+		return nil, err
+	}
+
 	updated, err := config.apply(input)
 	if err != nil {
 		return nil, err
 	}
 
-	if updated {
+	if updated || identityGenerated {
 		if err := util.DirectWriteJson(context.Background(), input.ConfigPath, config); err != nil {
 			return nil, err
 		}
@@ -1198,7 +1460,16 @@ func ConfigToJSON(config *Config) (string, error) {
 
 // ConfigFromJSON deserializes a JSON string to a Config struct.
 // This is useful for restoring config from alternative storage mechanisms.
-// After unmarshaling, defaults are applied to ensure the config is fully initialized.
+// After unmarshaling, defaults are applied to ensure the config is fully
+// initialized.
+//
+// The peer identity is deliberately none of its business, in either direction.
+// It does not generate one: a read cannot hand back keys that nothing will
+// write down (see ReadConfigOrDefault). Nor does it refuse a document that
+// carries none, because a config legitimately has no identity between a logout
+// and the next login — mobile logout clears both keys in place — and this is
+// also the deserializer the iOS SDK copies a config through. Whoever goes on
+// to connect is where an absent identity has to be answered.
 func ConfigFromJSON(jsonStr string) (*Config, error) {
 	config := &Config{}
 	err := json.Unmarshal([]byte(jsonStr), config)
diff --git a/client/internal/profilemanager/config_json_test.go b/client/internal/profilemanager/config_json_test.go
new file mode 100644
index 000000000..9a6d820c4
--- /dev/null
+++ b/client/internal/profilemanager/config_json_test.go
@@ -0,0 +1,44 @@
+package profilemanager
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// The serialized form is how the tvOS SDK stores a profile and how the iOS SDK
+// copies one in memory, so it must round-trip whatever a profile legitimately
+// holds — including no identity at all, which is the state mobile logout leaves
+// behind when it clears both keys in place. Refusing that document here broke
+// logout, profile switching and the login that follows them.
+func TestConfigFromJSONRoundTripsALoggedOutProfile(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "exported.json")
+	stored, err := UpdateOrCreateConfig(ConfigInput{ConfigPath: path, ManagementURL: DefaultManagementURL})
+	require.NoError(t, err)
+	require.NotEmpty(t, stored.PrivateKey, "a provisioned config is the fixture this test starts from")
+	require.NotEmpty(t, stored.SSHKey)
+
+	exported, err := ConfigToJSON(stored)
+	require.NoError(t, err)
+
+	restored, err := ConfigFromJSON(exported)
+	require.NoError(t, err, "a config exported after a login must load")
+	require.Equal(t, stored.PrivateKey, restored.PrivateKey, "the restored peer is not the stored one")
+	require.Equal(t, stored.SSHKey, restored.SSHKey)
+
+	// What mobile logout leaves on disk.
+	loggedOut := stored.clone()
+	loggedOut.PrivateKey = ""
+	loggedOut.SSHKey = ""
+
+	document, err := ConfigToJSON(loggedOut)
+	require.NoError(t, err)
+
+	reloaded, err := ConfigFromJSON(document)
+	require.NoError(t, err, "a logged-out profile must still load")
+	require.Empty(t, reloaded.PrivateKey, "loading must not mint a key nothing will write down")
+	require.Empty(t, reloaded.SSHKey)
+	require.Equal(t, stored.ManagementURL.String(), reloaded.ManagementURL.String(),
+		"the rest of the profile survives the logout")
+}
diff --git a/client/internal/profilemanager/config_optional_fields_test.go b/client/internal/profilemanager/config_optional_fields_test.go
new file mode 100644
index 000000000..9b74e2217
--- /dev/null
+++ b/client/internal/profilemanager/config_optional_fields_test.go
@@ -0,0 +1,131 @@
+package profilemanager
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// optionalBoolFields lists the *bool fields of Config by name, derived from the
+// type so a field added later is covered without touching these tests.
+func optionalBoolFields() []string {
+	pointerToBool := reflect.TypeOf((*bool)(nil))
+
+	var fields []string
+	configType := reflect.TypeOf(Config{})
+	for i := range configType.NumField() {
+		field := configType.Field(i)
+		if field.Type == pointerToBool && field.Tag.Get("json") != "-" {
+			fields = append(fields, field.Name)
+		}
+	}
+	return fields
+}
+
+func requireNoUnsetOptionalBool(t *testing.T, config *Config, context string) {
+	t.Helper()
+
+	value := reflect.ValueOf(*config)
+	for _, name := range optionalBoolFields() {
+		require.False(t, value.FieldByName(name).IsNil(),
+			"%s left %s unset, so its readers have to invent a default and a diff of it compares presence instead of value", context, name)
+	}
+}
+
+// An optional bool must not be tristate. While one can be nil, true or false,
+// every reader has to invent the meaning of nil, and — the reason this test
+// exists — a diff of the config ends up comparing presence rather than value:
+// that is what made the update-settings gate refuse `netbird up` for a client
+// restating its own defaults. apply() is where a config becomes complete, so
+// the invariant belongs to it: no *bool may come out of apply() unset.
+func TestApplyLeavesNoOptionalBoolUnset(t *testing.T) {
+	require.NotEmpty(t, optionalBoolFields(), "the invariant is only meaningful while Config has optional bools")
+
+	t.Run("a config built from scratch", func(t *testing.T) {
+		config := newConfigSkeleton()
+		_, err := config.apply(ConfigInput{})
+		require.NoError(t, err)
+
+		requireNoUnsetOptionalBool(t, config, "apply on a new config")
+	})
+
+	t.Run("a config file that predates every optional field", func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), "legacy.json")
+		require.NoError(t, os.WriteFile(path, []byte(`{"WgIface":"wt0"}`), 0o600))
+
+		config, err := GetExistingConfig(path)
+		require.NoError(t, err)
+
+		requireNoUnsetOptionalBool(t, config, "a read of a legacy config")
+	})
+
+	t.Run("a config file that stores them as null", func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), "null.json")
+		_, err := UpdateOrCreateConfig(ConfigInput{ConfigPath: path})
+		require.NoError(t, err)
+		unsetOnDisk(t, path, optionalBoolFields()...)
+
+		config, err := GetExistingConfig(path)
+		require.NoError(t, err)
+
+		requireNoUnsetOptionalBool(t, config, "a read of a config storing nulls")
+	})
+}
+
+// The same invariant on disk: what a write leaves in the file is what the next
+// client to read it starts from, so no write may store a null.
+func TestNoWriteStoresAnUnsetOptionalBool(t *testing.T) {
+	requireNoNullOnDisk := func(t *testing.T, path string, context string) {
+		t.Helper()
+
+		raw, err := os.ReadFile(path)
+		require.NoError(t, err)
+
+		var stored map[string]json.RawMessage
+		require.NoError(t, json.Unmarshal(raw, &stored))
+
+		for _, name := range optionalBoolFields() {
+			value, present := stored[name]
+			require.True(t, present, "%s did not store %s at all", context, name)
+			require.NotEqual(t, "null", string(value), "%s stored %s as null", context, name)
+		}
+	}
+
+	t.Run("UpdateOrCreateConfig", func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), "created.json")
+		_, err := UpdateOrCreateConfig(ConfigInput{ConfigPath: path, ManagementURL: DefaultManagementURL})
+		require.NoError(t, err)
+
+		requireNoNullOnDisk(t, path, "UpdateOrCreateConfig")
+	})
+
+	t.Run("UpdateConfig over a config storing nulls", func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), "stored.json")
+		_, err := UpdateOrCreateConfig(ConfigInput{ConfigPath: path})
+		require.NoError(t, err)
+		unsetOnDisk(t, path, optionalBoolFields()...)
+
+		_, err = UpdateConfig(ConfigInput{ConfigPath: path, ManagementURL: "https://mgmt.example.com"})
+		require.NoError(t, err)
+
+		requireNoNullOnDisk(t, path, "UpdateConfig")
+	})
+
+	// Renaming used to copy the file back through a bare Unmarshal, which
+	// preserved the nulls a pre-fix client had written.
+	t.Run("RenameProfile", func(t *testing.T) {
+		withTestSM(t, func(sm *ServiceManager, username string) {
+			created, err := sm.AddProfile("work", username)
+			require.NoError(t, err)
+			unsetOnDisk(t, created.Path, optionalBoolFields()...)
+
+			require.NoError(t, sm.RenameProfile(created.ID, username, "office"))
+
+			requireNoNullOnDisk(t, created.Path, "RenameProfile")
+		})
+	})
+}
diff --git a/client/internal/profilemanager/config_probe_test.go b/client/internal/profilemanager/config_probe_test.go
new file mode 100644
index 000000000..35a179a84
--- /dev/null
+++ b/client/internal/profilemanager/config_probe_test.go
@@ -0,0 +1,96 @@
+package profilemanager
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+// writeCertPair writes a throwaway certificate and key, so apply() has
+// something real to load rather than a missing file it would only log about.
+func writeCertPair(t *testing.T) (certPath, keyPath string) {
+	t.Helper()
+
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+
+	template := x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		Subject:      pkix.Name{CommonName: "probe-test"},
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     time.Now().Add(time.Hour),
+	}
+	der, err := x509.CreateCertificate(rand.Reader, &template, &template, &key.PublicKey, key)
+	require.NoError(t, err)
+
+	keyDER, err := x509.MarshalECPrivateKey(key)
+	require.NoError(t, err)
+
+	dir := t.TempDir()
+	certPath = filepath.Join(dir, "client.crt")
+	keyPath = filepath.Join(dir, "client.key")
+	require.NoError(t, os.WriteFile(certPath, pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der}), 0o600))
+	require.NoError(t, os.WriteFile(keyPath, pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: keyDER}), 0o600))
+	return certPath, keyPath
+}
+
+// The dry run behind the update-settings gate must not read the mTLS pair off
+// disk. The loaded pair feeds the connection, never the comparison, and the
+// gate runs it on every SetConfig and Login — twice per request — including the
+// ones it refuses.
+func TestProbeDoesNotLoadTheCertificatePair(t *testing.T) {
+	certPath, keyPath := writeCertPair(t)
+
+	t.Run("a real apply loads it", func(t *testing.T) {
+		config := newConfigSkeleton()
+		config.ClientCertPath, config.ClientCertKeyPath = certPath, keyPath
+
+		_, err := config.apply(ConfigInput{})
+		require.NoError(t, err)
+		require.NotNil(t, config.ClientCertKeyPair, "the connection would have no client certificate")
+	})
+
+	t.Run("a probe does not", func(t *testing.T) {
+		config := newConfigSkeleton()
+		config.ClientCertPath, config.ClientCertKeyPath = certPath, keyPath
+		config.probing = true
+
+		_, err := config.apply(ConfigInput{})
+		require.NoError(t, err)
+		require.Nil(t, config.ClientCertKeyPair, "the dry run read the certificate off disk")
+	})
+
+	// And the verdict is the same either way, which is the only thing the gate
+	// asks of the probe.
+	t.Run("the verdict is unaffected", func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), "mtls.json")
+		_, err := UpdateOrCreateConfig(ConfigInput{
+			ConfigPath:        path,
+			ManagementURL:     DefaultManagementURL,
+			ClientCertPath:    certPath,
+			ClientCertKeyPath: keyPath,
+		})
+		require.NoError(t, err)
+
+		stored, err := GetExistingConfig(path)
+		require.NoError(t, err)
+
+		changed, err := stored.WouldChange(ConfigInput{ClientCertPath: certPath, ClientCertKeyPath: keyPath})
+		require.NoError(t, err)
+		require.False(t, changed, "restating the stored certificate paths is not a change")
+
+		changed, err = stored.WouldChange(ConfigInput{ClientCertPath: filepath.Join(t.TempDir(), "other.crt")})
+		require.NoError(t, err)
+		require.True(t, changed, "a different certificate path is a change")
+	})
+}
diff --git a/client/internal/profilemanager/config_test.go b/client/internal/profilemanager/config_test.go
index 248920b5e..a461aa71f 100644
--- a/client/internal/profilemanager/config_test.go
+++ b/client/internal/profilemanager/config_test.go
@@ -196,7 +196,7 @@ func TestWireguardPortZeroExplicit(t *testing.T) {
 	assert.Equal(t, 0, config.WgPort, "WgPort should be 0 when explicitly set by user")
 
 	// Verify it persists
-	readConfig, err := GetConfig(configPath)
+	readConfig, err := GetExistingConfig(configPath)
 	require.NoError(t, err)
 	assert.Equal(t, 0, readConfig.WgPort, "WgPort should remain 0 after reading from file")
 }
diff --git a/client/internal/profilemanager/config_would_change_test.go b/client/internal/profilemanager/config_would_change_test.go
new file mode 100644
index 000000000..6b140030f
--- /dev/null
+++ b/client/internal/profilemanager/config_would_change_test.go
@@ -0,0 +1,529 @@
+package profilemanager
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/iface"
+	"github.com/netbirdio/netbird/shared/management/domain"
+)
+
+func seededConfig(t *testing.T) *Config {
+	t.Helper()
+
+	path := filepath.Join(t.TempDir(), "seeded.json")
+	cfg, err := UpdateOrCreateConfig(ConfigInput{
+		ConfigPath:    path,
+		ManagementURL: "https://api.netbird.io:443",
+		PreSharedKey:  strPointer("stored-key"),
+	})
+	require.NoError(t, err)
+	return cfg
+}
+
+func strPointer(s string) *string { return &s }
+
+func intPtr(i int) *int { return &i }
+
+func TestWouldChange(t *testing.T) {
+	tests := []struct {
+		name  string
+		input ConfigInput
+		want  bool
+	}{
+		{name: "empty input", input: ConfigInput{}, want: false},
+		{name: "same management URL", input: ConfigInput{ManagementURL: "https://api.netbird.io:443"}, want: false},
+		{name: "management URL without its default port", input: ConfigInput{ManagementURL: "https://api.netbird.io"}, want: false},
+		{name: "different management URL", input: ConfigInput{ManagementURL: "https://other.example:443"}, want: true},
+		{name: "same pre-shared key", input: ConfigInput{PreSharedKey: strPointer("stored-key")}, want: false},
+		{name: "redacted pre-shared key", input: ConfigInput{PreSharedKey: strPointer("**********")}, want: false},
+		{name: "different pre-shared key", input: ConfigInput{PreSharedKey: strPointer("other-key")}, want: true},
+		{name: "new interface blacklist entry", input: ConfigInput{ExtraIFaceBlackList: []string{"nb-probe0"}}, want: true},
+		{name: "blacklist entry already present", input: ConfigInput{ExtraIFaceBlackList: []string{"lo"}}, want: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfg := seededConfig(t)
+
+			changed, err := cfg.WouldChange(tt.input)
+			require.NoError(t, err)
+			require.Equal(t, tt.want, changed)
+		})
+	}
+}
+
+// The dry run must not be observable on the config it is run against: it
+// decides whether a write is allowed, it does not perform one.
+func TestWouldChangeLeavesTheConfigAlone(t *testing.T) {
+	cfg := seededConfig(t)
+	blacklist := len(cfg.IFaceBlackList)
+
+	changed, err := cfg.WouldChange(ConfigInput{
+		ManagementURL:       "https://other.example:443",
+		PreSharedKey:        strPointer("other-key"),
+		ExtraIFaceBlackList: []string{"nb-probe0"},
+		DNSLabels:           domain.FromPunycodeList([]string{"probe"}),
+		NATExternalIPs:      []string{"1.2.3.4"},
+	})
+	require.NoError(t, err)
+	require.True(t, changed)
+
+	require.Equal(t, "https://api.netbird.io:443", cfg.ManagementURL.String())
+	require.Equal(t, "stored-key", cfg.PreSharedKey)
+	require.Len(t, cfg.IFaceBlackList, blacklist)
+	require.Empty(t, cfg.DNSLabels)
+	require.Empty(t, cfg.NATExternalIPs)
+}
+
+// A nil config means the profile holds nothing yet, so the baseline is what
+// the daemon would create for it.
+func TestWouldChangeWithoutAStoredConfig(t *testing.T) {
+	var cfg *Config
+
+	changed, err := cfg.WouldChange(ConfigInput{})
+	require.NoError(t, err)
+	require.False(t, changed, "a request carrying nothing cannot change anything")
+
+	changed, err = cfg.WouldChange(ConfigInput{ManagementURL: DefaultManagementURL})
+	require.NoError(t, err)
+	require.False(t, changed, "the default management URL is what would be written anyway")
+
+	changed, err = cfg.WouldChange(ConfigInput{ManagementURL: "https://other.example:443"})
+	require.NoError(t, err)
+	require.True(t, changed)
+}
+
+func TestWouldChangeReportsAnInvalidInput(t *testing.T) {
+	cfg := seededConfig(t)
+
+	_, err := cfg.WouldChange(ConfigInput{ManagementURL: "not-a-url"})
+	require.Error(t, err)
+}
+
+// Reads must not write. A config file missing a field apply() fills in (MTU,
+// here) is what used to trigger the write-back.
+func TestReadsDoNotWriteTheConfigBack(t *testing.T) {
+	denormalized := []byte(`{"WgIface":"wt0"}`)
+
+	for name, read := range map[string]func(string) (*Config, error){
+		"GetExistingConfig":   GetExistingConfig,
+		"ReadConfigOrDefault": ReadConfigOrDefault,
+	} {
+		t.Run(name, func(t *testing.T) {
+			path := filepath.Join(t.TempDir(), "profile.json")
+			require.NoError(t, os.WriteFile(path, denormalized, 0o600))
+
+			cfg, err := read(path)
+			require.NoError(t, err)
+			require.Equal(t, uint16(iface.DefaultMTU), cfg.MTU, "the returned config is still normalized in memory")
+			require.Empty(t, cfg.PrivateKey, "a read must not mint an identity either")
+
+			after, err := os.ReadFile(path)
+			require.NoError(t, err)
+			require.Equal(t, string(denormalized), string(after), "%s rewrote the config file", name)
+		})
+	}
+}
+
+// ReadConfigOrDefault resolves a default config for a profile that has no file
+// yet, and that must not create the file either.
+func TestReadConfigDoesNotCreateTheFile(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "absent.json")
+
+	cfg, err := ReadConfigOrDefault(path)
+	require.NoError(t, err)
+	require.Equal(t, DefaultManagementURL, cfg.ManagementURL.String())
+
+	_, err = os.Stat(path)
+	require.True(t, os.IsNotExist(err), "ReadConfigOrDefault created the config file")
+}
+
+// The identity is the one thing a read cannot recompute, so it is provisioned
+// on request and its caller persists it.
+func TestEnsureIdentity(t *testing.T) {
+	cfg := newConfigSkeleton()
+
+	generated, err := cfg.EnsureIdentity()
+	require.NoError(t, err)
+	require.True(t, generated)
+	require.NotEmpty(t, cfg.PrivateKey)
+	require.NotEmpty(t, cfg.SSHKey)
+
+	key := cfg.PrivateKey
+	generated, err = cfg.EnsureIdentity()
+	require.NoError(t, err)
+	require.False(t, generated, "a config that already has an identity keeps it")
+	require.Equal(t, key, cfg.PrivateKey)
+}
+
+// One endpoint written several ways is one endpoint. A gate that compared
+// spellings refused a client restating its own management URL with a trailing
+// slash, which is a normal way to write it.
+func TestSameServiceURL(t *testing.T) {
+	tests := []struct {
+		a, b string
+		want bool
+	}{
+		{a: "https://mgmt.example.com", b: "https://mgmt.example.com:443", want: true},
+		{a: "https://mgmt.example.com", b: "https://mgmt.example.com/", want: true},
+		{a: "https://mgmt.example.com/", b: "https://mgmt.example.com:443/", want: true},
+		{a: "https://MGMT.example.com", b: "https://mgmt.example.com", want: true},
+		{a: "http://mgmt.example.com", b: "http://mgmt.example.com:80", want: true},
+		{a: "https://mgmt.example.com", b: "http://mgmt.example.com", want: false},
+		{a: "https://mgmt.example.com", b: "https://mgmt.example.com:8443", want: false},
+		{a: "https://mgmt.example.com", b: "https://other.example.com", want: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.a+" vs "+tt.b, func(t *testing.T) {
+			a, err := ParseServiceURL("a", tt.a)
+			require.NoError(t, err)
+			b, err := ParseServiceURL("b", tt.b)
+			require.NoError(t, err)
+
+			require.Equal(t, tt.want, SameServiceURL(a, b))
+			require.Equal(t, tt.want, SameServiceURL(b, a), "the comparison must be symmetric")
+		})
+	}
+}
+
+// The same spellings, through the dry run the update-settings gate uses.
+func TestWouldChangeIgnoresURLSpelling(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "seeded.json")
+	_, err := UpdateOrCreateConfig(ConfigInput{
+		ConfigPath:    path,
+		ManagementURL: "https://mgmt.example.com",
+	})
+	require.NoError(t, err)
+
+	cfg, err := GetExistingConfig(path)
+	require.NoError(t, err)
+
+	for _, spelling := range []string{
+		"https://mgmt.example.com",
+		"https://mgmt.example.com/",
+		"https://mgmt.example.com:443",
+		"https://mgmt.example.com:443/",
+		"https://MGMT.example.com",
+	} {
+		changed, err := cfg.WouldChange(ConfigInput{ManagementURL: spelling})
+		require.NoError(t, err)
+		require.False(t, changed, "%q is the stored endpoint written differently", spelling)
+	}
+
+	changed, err := cfg.WouldChange(ConfigInput{ManagementURL: "https://mgmt.example.com:8443"})
+	require.NoError(t, err)
+	require.True(t, changed, "a different port is a different endpoint")
+}
+
+// The dry-run baseline exists to be compared against and discarded, so it must
+// not mint keys — the CLI's login backoff loop would otherwise log a fresh
+// "generated new Wireguard key" on every attempt.
+func TestDryRunBaselineDoesNotGenerateKeys(t *testing.T) {
+	baseline, err := newDryRunBaseline(filepath.Join(t.TempDir(), "absent.json"))
+	require.NoError(t, err)
+
+	require.Empty(t, baseline.PrivateKey, "generated a WireGuard key for a throwaway config")
+	require.Empty(t, baseline.SSHKey, "generated an SSH key for a throwaway config")
+
+	// Everything the comparison actually looks at is still the default config.
+	require.Equal(t, DefaultManagementURL, baseline.ManagementURL.String())
+	require.Equal(t, uint16(iface.DefaultMTU), baseline.MTU)
+	require.Equal(t, iface.DefaultWgPort, baseline.WgPort)
+}
+
+// A stored profile can carry no identity — a mobile logout clears the keys in
+// place — so the next config write has to mint one, which is what keeps the
+// following login from dialing management with an empty key.
+func TestUpdateConfigProvisionsAMissingIdentity(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "logged-out.json")
+	_, err := UpdateOrCreateConfig(ConfigInput{
+		ConfigPath:    path,
+		ManagementURL: "https://api.netbird.io:443",
+	})
+	require.NoError(t, err)
+
+	// Stand in for the logout, which zeroes the keys and writes the config out.
+	loggedOut, err := GetExistingConfig(path)
+	require.NoError(t, err)
+	loggedOut.PrivateKey = ""
+	loggedOut.SSHKey = ""
+	require.NoError(t, WriteOutConfig(path, loggedOut))
+
+	cfg, err := UpdateOrCreateConfig(ConfigInput{ConfigPath: path})
+	require.NoError(t, err)
+	require.NotEmpty(t, cfg.PrivateKey, "the write path did not provision an identity")
+	require.NotEmpty(t, cfg.SSHKey)
+
+	persisted, err := GetExistingConfig(path)
+	require.NoError(t, err)
+	require.Equal(t, cfg.PrivateKey, persisted.PrivateKey, "the provisioned identity was not persisted")
+}
+
+// A config that carries no sync message version must not make the dry run
+// panic: the gate runs inside a request handler, where failing closed is the
+// worst acceptable outcome.
+func TestWouldChangeWithoutAStoredSyncMessageVersion(t *testing.T) {
+	cfg := seededConfig(t)
+	require.Nil(t, cfg.SyncMessageVersion, "the fixture is only useful while the field starts out unset")
+
+	version := 2
+	changed, err := cfg.WouldChange(ConfigInput{SyncMessageVersion: &version})
+	require.NoError(t, err)
+	require.True(t, changed)
+	require.Nil(t, cfg.SyncMessageVersion, "the dry run set the version on the stored config")
+}
+
+// Restating the certificate paths a config already holds is not a change, for
+// the same reason restating any other value is not.
+func TestWouldChangeIgnoresRestatedCertificatePaths(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "mtls.json")
+	_, err := UpdateOrCreateConfig(ConfigInput{
+		ConfigPath:        path,
+		ManagementURL:     "https://api.netbird.io:443",
+		ClientCertPath:    "/etc/netbird/client.crt",
+		ClientCertKeyPath: "/etc/netbird/client.key",
+	})
+	require.NoError(t, err)
+
+	cfg, err := GetExistingConfig(path)
+	require.NoError(t, err)
+
+	changed, err := cfg.WouldChange(ConfigInput{
+		ClientCertPath:    "/etc/netbird/client.crt",
+		ClientCertKeyPath: "/etc/netbird/client.key",
+	})
+	require.NoError(t, err)
+	require.False(t, changed, "the stored certificate paths were restated")
+
+	changed, err = cfg.WouldChange(ConfigInput{ClientCertPath: "/etc/netbird/other.crt"})
+	require.NoError(t, err)
+	require.True(t, changed, "a different certificate path is a change")
+}
+
+// A read that lands on a missing file must not hand back keys: nothing would
+// write them down, so the caller would connect with an identity that changes on
+// the next run and registers a second peer.
+func TestReadConfigOrDefaultCarriesNoIdentity(t *testing.T) {
+	cfg, err := ReadConfigOrDefault(filepath.Join(t.TempDir(), "absent.json"))
+	require.NoError(t, err)
+
+	require.Empty(t, cfg.PrivateKey, "a read minted a WireGuard key")
+	require.Empty(t, cfg.SSHKey, "a read minted an SSH key")
+
+	// So the caller's own EnsureIdentity is the one that reports the work, and
+	// therefore the one that triggers the write.
+	generated, err := cfg.EnsureIdentity()
+	require.NoError(t, err)
+	require.True(t, generated, "the provisioning caller could not tell it had to persist the identity")
+}
+
+// CreateInMemoryConfig is the opposite contract: its callers connect with what
+// they get back, so it does carry an identity.
+func TestCreateInMemoryConfigCarriesAnIdentity(t *testing.T) {
+	cfg, err := CreateInMemoryConfig(ConfigInput{ManagementURL: "https://api.netbird.io:443"})
+	require.NoError(t, err)
+
+	require.NotEmpty(t, cfg.PrivateKey)
+	require.NotEmpty(t, cfg.SSHKey)
+}
+
+// The admin panel is opened, not dialed, so its path identifies it. Comparing
+// it as a bare endpoint left a custom panel URL unable to change.
+func TestAdminURLPathIsPartOfTheIdentity(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "panel.json")
+	_, err := UpdateOrCreateConfig(ConfigInput{
+		ConfigPath: path,
+		AdminURL:   "https://app.example.com/netbird",
+	})
+	require.NoError(t, err)
+
+	cfg, err := GetExistingConfig(path)
+	require.NoError(t, err)
+	require.Equal(t, "https://app.example.com:443/netbird", cfg.AdminURL.String())
+
+	// Equivalent spellings of the same panel are still not a change.
+	for _, same := range []string{
+		"https://app.example.com/netbird",
+		"https://app.example.com:443/netbird",
+		"https://app.example.com/netbird/",
+		"https://APP.example.com/netbird",
+	} {
+		changed, err := cfg.WouldChange(ConfigInput{AdminURL: same})
+		require.NoError(t, err)
+		require.False(t, changed, "%q is the stored panel written differently", same)
+	}
+
+	// A different path is a different panel, and it must be persisted.
+	changed, err := cfg.WouldChange(ConfigInput{AdminURL: "https://app.example.com/other"})
+	require.NoError(t, err)
+	require.True(t, changed, "a different panel path is a change")
+
+	updated, err := UpdateConfig(ConfigInput{ConfigPath: path, AdminURL: "https://app.example.com/other"})
+	require.NoError(t, err)
+	require.Equal(t, "https://app.example.com:443/other", updated.AdminURL.String(), "the new panel path was not persisted")
+}
+
+// unsetOnDisk rewrites the stored config so the named fields carry a JSON null,
+// which is how a profile written before apply() resolved them looks on disk.
+// It synthesizes that state: no write produces it any more.
+func unsetOnDisk(t *testing.T, path string, fields ...string) {
+	t.Helper()
+
+	raw, err := os.ReadFile(path)
+	require.NoError(t, err)
+
+	var stored map[string]json.RawMessage
+	require.NoError(t, json.Unmarshal(raw, &stored))
+
+	for _, field := range fields {
+		_, present := stored[field]
+		require.True(t, present, "%s is not a field of the stored config", field)
+		stored[field] = json.RawMessage("null")
+	}
+
+	rewritten, err := json.Marshal(stored)
+	require.NoError(t, err)
+	require.NoError(t, os.WriteFile(path, rewritten, 0600))
+}
+
+// Seven fields mean "the effective default" when they hold no value, and every
+// profile written before apply() resolved them holds them as null. Restating
+// that default is asking for no change — and the CLI restates it on every
+// `netbird up`, because a flag set through an environment variable is a flag
+// pflag reports as Changed. Judging those restatements as changes made the
+// update-settings gate refuse `netbird up` outright for a client configured
+// through the environment, which is the shape of a Kubernetes deployment.
+//
+// A login now writes those fields set, so the fixture puts the null state back
+// on disk with unsetOnDisk instead of getting it from a login.
+func TestWouldChangeIgnoresRestatedDefaultsOfUnsetFields(t *testing.T) {
+	networkMonitorDefault := runtime.GOOS == "windows" || runtime.GOOS == "darwin"
+
+	tests := []struct {
+		field       string
+		theDefault  ConfigInput
+		theOtherWay ConfigInput
+	}{
+		{"EnableSSHRoot",
+			ConfigInput{EnableSSHRoot: boolPtr(false)}, ConfigInput{EnableSSHRoot: boolPtr(true)}},
+		{"EnableSSHSFTP",
+			ConfigInput{EnableSSHSFTP: boolPtr(false)}, ConfigInput{EnableSSHSFTP: boolPtr(true)}},
+		{"EnableSSHLocalPortForwarding",
+			ConfigInput{EnableSSHLocalPortForwarding: boolPtr(false)}, ConfigInput{EnableSSHLocalPortForwarding: boolPtr(true)}},
+		{"EnableSSHRemotePortForwarding",
+			ConfigInput{EnableSSHRemotePortForwarding: boolPtr(false)}, ConfigInput{EnableSSHRemotePortForwarding: boolPtr(true)}},
+		{"DisableSSHAuth",
+			ConfigInput{DisableSSHAuth: boolPtr(false)}, ConfigInput{DisableSSHAuth: boolPtr(true)}},
+		{"SSHJWTCacheTTL",
+			ConfigInput{SSHJWTCacheTTL: intPtr(0)}, ConfigInput{SSHJWTCacheTTL: intPtr(300)}},
+		{"NetworkMonitor",
+			ConfigInput{NetworkMonitor: boolPtr(networkMonitorDefault)}, ConfigInput{NetworkMonitor: boolPtr(!networkMonitorDefault)}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.field, func(t *testing.T) {
+			path := filepath.Join(t.TempDir(), "unset.json")
+			_, err := UpdateOrCreateConfig(ConfigInput{
+				ConfigPath:    path,
+				ManagementURL: "https://api.netbird.io:443",
+			})
+			require.NoError(t, err)
+			unsetOnDisk(t, path, tt.field)
+
+			cfg, err := GetExistingConfig(path)
+			require.NoError(t, err)
+
+			changed, err := cfg.WouldChange(tt.theDefault)
+			require.NoError(t, err)
+			require.False(t, changed, "restating the default of an unset %s was judged a change", tt.field)
+
+			// The gate still has to refuse a request that does ask for something.
+			changed, err = cfg.WouldChange(tt.theOtherWay)
+			require.NoError(t, err)
+			require.True(t, changed, "asking for a non-default %s is a change", tt.field)
+		})
+	}
+}
+
+// The verdict must not depend on where the caller got the config from. Readers
+// normalize what they hand out, but apply() signals "I filled in a default"
+// through the same bool as "the input changed something", so a config that
+// never passed through a read would otherwise report a change for an input
+// that asks for nothing.
+func TestWouldChangeNormalizesBeforeMeasuring(t *testing.T) {
+	rawConfig := func(t *testing.T) *Config {
+		t.Helper()
+
+		cfg := &Config{WgIface: iface.WgInterfaceDefault}
+		require.Nil(t, cfg.ServerSSHAllowed, "the fixture is only useful while the config is not normalized")
+		require.Nil(t, cfg.EnableSSHRoot)
+		require.Empty(t, cfg.IFaceBlackList)
+		return cfg
+	}
+
+	changed, err := rawConfig(t).WouldChange(ConfigInput{})
+	require.NoError(t, err)
+	require.False(t, changed, "an input carrying nothing cannot change anything")
+
+	changed, err = rawConfig(t).WouldChange(ConfigInput{EnableSSHRoot: boolPtr(false)})
+	require.NoError(t, err)
+	require.False(t, changed, "the default of a field the config never held is not a change")
+
+	changed, err = rawConfig(t).WouldChange(ConfigInput{EnableSSHRoot: boolPtr(true)})
+	require.NoError(t, err)
+	require.True(t, changed, "a non-default value is still a change")
+}
+
+// A zero-padded port addresses the same port. The normalization itself belongs
+// to util.ServiceURLPort and is tested there; this asserts that the comparison
+// this package hands its callers inherits it.
+func TestServiceURLPortIsNormalizedNumerically(t *testing.T) {
+	padded, err := ParseServiceURL("padded", "https://mgmt.example.com:0443")
+	require.NoError(t, err)
+	plain, err := ParseServiceURL("plain", "https://mgmt.example.com:443")
+	require.NoError(t, err)
+
+	require.True(t, SameServiceURL(padded, plain))
+}
+
+// A list the profile does not have and a list the request empties are the same
+// thing: no NAT mappings, no DNS labels. The profile stores an absent list as
+// JSON null and reads it back as a nil slice, while `netbird up` sends the
+// emptied list — CleanNATExternalIPs / CleanDNSLabels — whenever the matching
+// environment variable is set to nothing, which a deployment template does by
+// default. Judging nil and empty as different made the gate refuse that start,
+// which is the very deadlock this branch exists to remove, on another field.
+func TestWouldChangeIgnoresAnEmptiedListThatWasAlreadyAbsent(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "lists.json")
+	_, err := UpdateOrCreateConfig(ConfigInput{ConfigPath: path, ManagementURL: DefaultManagementURL})
+	require.NoError(t, err)
+
+	stored, err := GetExistingConfig(path)
+	require.NoError(t, err)
+	require.Nil(t, stored.NATExternalIPs, "the fixture is only useful while the stored list is absent")
+	require.Nil(t, stored.DNSLabels)
+
+	changed, err := stored.WouldChange(ConfigInput{NATExternalIPs: make([]string, 0)})
+	require.NoError(t, err)
+	require.False(t, changed, "emptying a NAT list the profile never had is not a change")
+
+	changed, err = stored.WouldChange(ConfigInput{DNSLabels: domain.List{}})
+	require.NoError(t, err)
+	require.False(t, changed, "emptying a DNS label list the profile never had is not a change")
+
+	// A list that does hold something still moves when the request empties it.
+	withEntries, err := UpdateConfig(ConfigInput{ConfigPath: path, NATExternalIPs: []string{"1.2.3.4"}})
+	require.NoError(t, err)
+	require.Equal(t, []string{"1.2.3.4"}, withEntries.NATExternalIPs)
+
+	changed, err = withEntries.WouldChange(ConfigInput{NATExternalIPs: make([]string, 0)})
+	require.NoError(t, err)
+	require.True(t, changed, "clearing a NAT list that had an entry is a change")
+}
diff --git a/client/internal/profilemanager/service.go b/client/internal/profilemanager/service.go
index ec287f01a..e58f421fd 100644
--- a/client/internal/profilemanager/service.go
+++ b/client/internal/profilemanager/service.go
@@ -313,7 +313,11 @@ func (s *ServiceManager) AddProfile(displayName, username string) (*Profile, err
 	}
 
 	profPath := filepath.Join(configDir, id.String()+".json")
-	cfg, err := createNewConfig(ConfigInput{ConfigPath: profPath})
+	// Provisioned, not bare: this config goes straight to disk, and a profile
+	// file with no identity is one whose first reader has to mint the keys and
+	// remember to write them back. Before identity generation moved out of
+	// apply() into EnsureIdentity, createNewConfig produced them here too.
+	cfg, err := createProvisionedConfig(ConfigInput{ConfigPath: profPath})
 	if err != nil {
 		return nil, fmt.Errorf("failed to create new config: %w", err)
 	}
@@ -330,6 +334,19 @@ func (s *ServiceManager) AddProfile(displayName, username string) (*Profile, err
 	}, nil
 }
 
+// RenameProfile changes a profile's display name. It rewrites the whole
+// profile file, not just the name: the config is read through the normalizing
+// reader, so apply()'s resolved values — the optional booleans, the interface
+// blacklist, the DNS route interval — are persisted along with the new name.
+//
+// That is deliberate. A write that skipped apply() is what left profiles on
+// disk carrying null where a value was meant, and made a diff of the config
+// compare presence instead of value. Two consequences worth knowing: the
+// platform-dependent defaults resolved here are the renaming host's
+// (ServerSSHAllowed and the network monitor differ per OS), and a profile
+// whose stored name does not survive sanitizeDisplayName now fails to rename
+// rather than being rewritten — though apply() rejects such a profile on every
+// other read too, so it was already unusable.
 func (s *ServiceManager) RenameProfile(id ID, username string, newName string) error {
 	displayName, err := sanitizeDisplayName(newName)
 	if err != nil {
@@ -356,17 +373,17 @@ func (s *ServiceManager) RenameProfile(id ID, username string, newName string) e
 		return ErrProfileNotFound
 	}
 
-	data, err := os.ReadFile(target.Path)
+	// Through the reader, not a bare Unmarshal: this was the one write that
+	// skipped apply(), so it copied back whatever the file held — including an
+	// optional field left unset, which every other write resolves to its
+	// default. Renaming a profile is a poor place to leave that behind.
+	cfg, err := GetExistingConfig(target.Path)
 	if err != nil {
-		return err
-	}
-	var cfg Config
-	if err := json.Unmarshal(data, &cfg); err != nil {
-		return err
+		return fmt.Errorf("read profile config: %w", err)
 	}
 	cfg.Name = displayName
 
-	if err := util.WriteJson(context.Background(), target.Path, cfg); err != nil {
+	if err := WriteOutConfig(target.Path, cfg); err != nil {
 		return fmt.Errorf("failed to write profile name: %w", err)
 	}
 	return nil
diff --git a/client/internal/profilemanager/service_test.go b/client/internal/profilemanager/service_test.go
index 5e051b15d..d26ce746a 100644
--- a/client/internal/profilemanager/service_test.go
+++ b/client/internal/profilemanager/service_test.go
@@ -228,3 +228,27 @@ func TestRemoveProfile_DeletesStateFile(t *testing.T) {
 		assert.True(t, errors.Is(err, os.ErrNotExist), "state file should be removed")
 	})
 }
+
+// A profile file is written here and read back by whoever connects with it, so
+// it has to carry the peer's identity. While AddProfile used the bare
+// constructor, it wrote a config with no keys: the first reader had to mint
+// them, and the paths that read without writing — a gate deciding whether to
+// refuse a request, the mobile SDKs loading a stored profile — got a config
+// that cannot connect.
+func TestAddProfileWritesAnIdentity(t *testing.T) {
+	withTestSM(t, func(sm *ServiceManager, username string) {
+		created, err := sm.AddProfile("work", username)
+		require.NoError(t, err)
+
+		stored, err := GetExistingConfig(created.Path)
+		require.NoError(t, err)
+
+		require.NotEmpty(t, stored.PrivateKey, "the profile was written without a WireGuard key")
+		require.NotEmpty(t, stored.SSHKey, "the profile was written without an SSH key")
+
+		// And the identity is the one on disk, not one minted per read.
+		reread, err := GetExistingConfig(created.Path)
+		require.NoError(t, err)
+		require.Equal(t, stored.PrivateKey, reread.PrivateKey)
+	})
+}
diff --git a/client/ios/NetBirdSDK/client.go b/client/ios/NetBirdSDK/client.go
index 96c747ae4..a6315a4ab 100644
--- a/client/ios/NetBirdSDK/client.go
+++ b/client/ios/NetBirdSDK/client.go
@@ -130,6 +130,10 @@ func NewClient(cfgFile, stateFile, cacheDir, logFilePath, deviceName string, osV
 
 // SetConfigFromJSON stores the JSON config that later loads resolve instead of the config file (tvOS).
 func (c *Client) SetConfigFromJSON(jsonStr string) error {
+	// Parsed only to reject an unreadable document early; the JSON itself is
+	// what is stored, and every load re-parses it. A document carrying no peer
+	// identity is readable and accepted: that is a logged-out profile, and the
+	// login that follows provisions the keys.
 	if _, err := profilemanager.ConfigFromJSON(jsonStr); err != nil {
 		log.Errorf("SetConfigFromJSON: failed to parse config JSON: %v", err)
 		return err
diff --git a/client/ios/NetBirdSDK/login.go b/client/ios/NetBirdSDK/login.go
index 0dfff620e..6a9a6d3d0 100644
--- a/client/ios/NetBirdSDK/login.go
+++ b/client/ios/NetBirdSDK/login.go
@@ -379,6 +379,35 @@ func (a *Auth) SetConfigFromJSON(jsonStr string) error {
 }
 
 func (a *Auth) setBaseConfig(base *profilemanager.Config) error {
+	// A logged-out profile carries no keys: the mobile logout clears them in
+	// place so the next login registers a new peer instead of resurrecting the
+	// old one. This is that login, and auth.NewAuth parses the WireGuard key
+	// before the SSO flow even starts, so an absent identity fails the login on
+	// key size rather than asking the user to sign in.
+	//
+	// Minted on the base config, which is the one GetConfigJSON hands back for
+	// the caller to store — the overlaid copy below is runtime-only.
+	generated, err := base.EnsureIdentity()
+	if err != nil {
+		return fmt.Errorf("ensure profile identity: %w", err)
+	}
+	if generated {
+		if a.cfgPath != "" {
+			// Non-atomic, like NewAuth's own write: the tvOS App Group sandbox
+			// blocks the temp-file-and-rename an atomic write needs.
+			if err := profilemanager.DirectWriteOutConfig(a.cfgPath, base); err != nil {
+				return fmt.Errorf("write out profile config: %w", err)
+			}
+		} else {
+			// No file to write to — this is the tvOS path, where the profile
+			// lives in the caller's own store. It persists the new identity by
+			// calling GetConfigJSON once the login completes; until then the
+			// keys exist only here, and a login that never completes leaves
+			// nothing behind.
+			log.Infof("provisioned a peer identity for a config with no file on disk")
+		}
+	}
+
 	overlaid, err := copyConfig(base)
 	if err != nil {
 		return err
diff --git a/client/ios/NetBirdSDK/preferences.go b/client/ios/NetBirdSDK/preferences.go
index 5297920a3..642f9e160 100644
--- a/client/ios/NetBirdSDK/preferences.go
+++ b/client/ios/NetBirdSDK/preferences.go
@@ -49,7 +49,7 @@ func (p *Preferences) GetManagementURL() (string, error) {
 		return p.configInput.ManagementURL, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return "", err
 	}
@@ -67,7 +67,7 @@ func (p *Preferences) GetAdminURL() (string, error) {
 		return p.configInput.AdminURL, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return "", err
 	}
@@ -89,7 +89,7 @@ func (p *Preferences) HasPreSharedKey() (bool, error) {
 		return *p.configInput.PreSharedKey != "", nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -115,7 +115,7 @@ func (p *Preferences) GetRosenpassEnabled() (bool, error) {
 		return *p.configInput.RosenpassEnabled, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -136,7 +136,7 @@ func (p *Preferences) GetRosenpassPermissive() (bool, error) {
 		return *p.configInput.RosenpassPermissive, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -149,7 +149,7 @@ func (p *Preferences) GetDisableIPv6() (bool, error) {
 		return *p.configInput.DisableIPv6, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -168,7 +168,7 @@ func (p *Preferences) GetRemoteJobsAllowed() (bool, error) {
 		return *p.configInput.RemoteJobsAllowed, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
diff --git a/client/mobile/profile_lifecycle_test.go b/client/mobile/profile_lifecycle_test.go
new file mode 100644
index 000000000..9612f550d
--- /dev/null
+++ b/client/mobile/profile_lifecycle_test.go
@@ -0,0 +1,97 @@
+package mobile
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+)
+
+// loadAsTheMobileSDKsDo replays what the iOS SDK does with a stored profile:
+// read the config, serialize it, and load it back. Client.SetConfigFromJSON
+// stores that document for tvOS, Auth.SetConfigFromJSON authenticates with it,
+// and copyConfig round-trips a Config through the same pair to take an
+// in-memory copy before applying the MDM overlay.
+func loadAsTheMobileSDKsDo(t *testing.T, configPath string) *profilemanager.Config {
+	t.Helper()
+
+	stored, err := profilemanager.GetExistingConfig(configPath)
+	require.NoError(t, err, "read the stored profile")
+
+	document, err := profilemanager.ConfigToJSON(stored)
+	require.NoError(t, err, "serialize the stored profile")
+
+	reloaded, err := profilemanager.ConfigFromJSON(document)
+	require.NoError(t, err, "load the profile back")
+	return reloaded
+}
+
+// A profile survives the whole round its user puts it through: created, logged
+// out, loaded again, and switched away from and back.
+//
+// Logout is the step that makes this worth asserting. It clears the peer's
+// keys in place so the next login registers a new peer rather than bringing
+// the old one back, which leaves a profile that legitimately carries no
+// identity — and both mobile SDKs go on loading that profile through the
+// serialized form. A load that refused it, or a creation that never wrote an
+// identity in the first place, breaks logout and profile switching on iOS and
+// Android without any of it being visible from the desktop client.
+func TestProfileSurvivesLogoutAndReload(t *testing.T) {
+	pm := newTestProfileManager(t)
+
+	created, err := pm.AddProfile("work")
+	require.NoError(t, err)
+	require.NoError(t, pm.SwitchProfile(profilemanager.DefaultProfileName))
+
+	// Created: the profile carries the identity it will connect with.
+	require.NotEmpty(t, privateKeyOf(t, pm, created.ID), "a new profile was written with no identity")
+
+	configPath, err := pm.GetConfigPath(created.ID)
+	require.NoError(t, err)
+
+	before := loadAsTheMobileSDKsDo(t, configPath)
+	require.NotEmpty(t, before.PrivateKey)
+	managementURL := before.ManagementURL.String()
+
+	// Logged out: the identity is gone, on purpose.
+	require.NoError(t, pm.LogoutProfile(created.ID))
+	require.Empty(t, privateKeyOf(t, pm, created.ID), "logout left the peer's key behind")
+
+	// Loaded again: the profile is still readable, and loading it neither
+	// fails nor mints a key that nothing would write down.
+	after := loadAsTheMobileSDKsDo(t, configPath)
+	assert.Empty(t, after.PrivateKey, "loading a logged-out profile minted a key nothing will persist")
+	assert.Empty(t, after.SSHKey, "loading a logged-out profile minted an SSH key")
+	assert.Equal(t, managementURL, after.ManagementURL.String(), "the rest of the profile did not survive the logout")
+
+	// Switched away from and back: still the same profile, still loadable.
+	require.NoError(t, pm.SwitchProfile(created.ID))
+	require.NoError(t, pm.SwitchProfile(profilemanager.DefaultProfileName))
+	require.NoError(t, pm.SwitchProfile(created.ID))
+
+	active, err := pm.GetActiveProfile()
+	require.NoError(t, err)
+	assert.Equal(t, created.ID, active.ID, "the profile switched to is not the active one")
+
+	assert.Equal(t, managementURL, loadAsTheMobileSDKsDo(t, configPath).ManagementURL.String(),
+		"the profile did not survive the round of switches")
+}
+
+// The profile the SDKs fall back to gets the same treatment, since it is the
+// one a mobile client without an explicit profile runs on.
+func TestDefaultProfileSurvivesLogoutAndReload(t *testing.T) {
+	pm := newTestProfileManager(t)
+	require.NoError(t, pm.SwitchProfile(profilemanager.DefaultProfileName))
+
+	configPath, err := pm.GetConfigPath(profilemanager.DefaultProfileName)
+	require.NoError(t, err)
+	require.NotEmpty(t, loadAsTheMobileSDKsDo(t, configPath).PrivateKey)
+
+	require.NoError(t, pm.LogoutProfile(profilemanager.DefaultProfileName))
+
+	reloaded := loadAsTheMobileSDKsDo(t, configPath)
+	assert.Empty(t, reloaded.PrivateKey, "loading the logged-out default profile minted a key")
+	assert.NotNil(t, reloaded.ManagementURL, "the profile lost its management URL")
+}
diff --git a/client/mobile/profile_manager.go b/client/mobile/profile_manager.go
index 348b7253b..ad79d80c0 100644
--- a/client/mobile/profile_manager.go
+++ b/client/mobile/profile_manager.go
@@ -192,7 +192,10 @@ func (pm *ProfileManager) LogoutProfile(id string) error {
 		return fmt.Errorf("profile %q does not exist", id)
 	}
 
-	config, err := profilemanager.ReadConfig(configPath)
+	// The existing-file reader, not the generating one: the check above is not
+	// atomic with this read, so a profile removed in between would otherwise be
+	// resolved from the defaults here and recreated by the write below.
+	config, err := profilemanager.GetExistingConfig(configPath)
 	if err != nil {
 		return fmt.Errorf("read profile config: %w", err)
 	}
diff --git a/client/server/login_gate_test.go b/client/server/login_gate_test.go
index de62a8180..17ae3ecad 100644
--- a/client/server/login_gate_test.go
+++ b/client/server/login_gate_test.go
@@ -93,7 +93,7 @@ func TestLogin_ChangeThatBecomesPrivilegedMidRequestHasNoSideEffects(t *testing.
 	require.NoError(t, err)
 	require.Equal(t, profilemanager.ID(activeProfile), active.ID, "the refused login switched the active profile anyway")
 
-	stored, err := profilemanager.ReadConfig(targetPath)
+	stored, err := profilemanager.GetExistingConfig(targetPath)
 	require.NoError(t, err)
 	require.Equal(t, "https://api.netbird.io:443", stored.ManagementURL.String(), "the refused login moved the management URL")
 }
diff --git a/client/server/login_overrides_test.go b/client/server/login_overrides_test.go
index 5a2298764..f858c6059 100644
--- a/client/server/login_overrides_test.go
+++ b/client/server/login_overrides_test.go
@@ -7,6 +7,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/proto"
 )
 
 func TestPersistLoginOverrides(t *testing.T) {
@@ -80,10 +81,13 @@ func TestPersistLoginOverrides(t *testing.T) {
 			require.NoError(t, err, "seed config")
 
 			activeProf := &profilemanager.ActiveProfileState{ID: "default"}
-			err = persistLoginOverrides(activeProf, tt.newMgmtURL, tt.newPSK)
+			err = persistLoginOverrides(activeProf, &proto.LoginRequest{
+				ManagementUrl:        tt.newMgmtURL,
+				OptionalPreSharedKey: tt.newPSK,
+			})
 			require.NoError(t, err, "persistLoginOverrides")
 
-			cfg, err := profilemanager.ReadConfig(profilemanager.DefaultConfigPath)
+			cfg, err := profilemanager.ReadConfigOrDefault(profilemanager.DefaultConfigPath)
 			require.NoError(t, err, "read back config")
 
 			require.Equal(t, tt.wantMgmtURL, cfg.ManagementURL.String(), "management URL")
diff --git a/client/server/logout_gate_test.go b/client/server/logout_gate_test.go
index 2d84d1b6a..d88801959 100644
--- a/client/server/logout_gate_test.go
+++ b/client/server/logout_gate_test.go
@@ -129,7 +129,7 @@ func TestLogout_ForeignUserProfileDoesNotUseTheRunningConfig(t *testing.T) {
 	// refused with PermissionDenied. The namesake profile does not, so the
 	// correct path gets as far as dialing its own unreachable management URL.
 	enableSSHOnProfile(t, cfgPath)
-	running, err := profilemanager.GetConfig(cfgPath)
+	running, err := profilemanager.GetExistingConfig(cfgPath)
 	require.NoError(t, err)
 	s.config = running
 	s.connectClient = newDummyConnectClient(context.Background())
diff --git a/client/server/mdm.go b/client/server/mdm.go
index 7a47b2a57..b22c3b0a3 100644
--- a/client/server/mdm.go
+++ b/client/server/mdm.go
@@ -180,92 +180,6 @@ func mdmManagedFieldConflicts(msg *proto.SetConfigRequest, policy *mdm.Policy) [
 	})
 }
 
-// setConfigRequestHasConfigOverrides reports whether the SetConfigRequest
-// carries ANY field that would actually mutate the persisted config.
-// The CLI builds a SetConfigRequest unconditionally on every
-// `netbird up` (see setupSetConfigReq in cmd/up.go) — a plain
-// `netbird up` produces a request with every field at its zero value;
-// the gate must skip such no-op invocations or it would always fire
-// even when the user did not pass any --flag. Returns false on a nil
-// msg; true when any management/admin URL, PSK, DNS/NAT list+clean
-// flag, interface/port/MTU, or any optional bool/duration field is set.
-func setConfigRequestHasConfigOverrides(msg *proto.SetConfigRequest) bool {
-	if msg == nil {
-		return false
-	}
-	return msg.ManagementUrl != "" ||
-		msg.AdminURL != "" ||
-		msg.OptionalPreSharedKey != nil ||
-		len(msg.CustomDNSAddress) > 0 ||
-		len(msg.NatExternalIPs) > 0 || msg.CleanNATExternalIPs ||
-		len(msg.ExtraIFaceBlacklist) > 0 ||
-		len(msg.DnsLabels) > 0 || msg.CleanDNSLabels ||
-		msg.DnsRouteInterval != nil ||
-		msg.RosenpassEnabled != nil ||
-		msg.RosenpassPermissive != nil ||
-		msg.InterfaceName != nil ||
-		msg.WireguardPort != nil ||
-		msg.Mtu != nil ||
-		msg.DisableAutoConnect != nil ||
-		msg.ServerSSHAllowed != nil ||
-		msg.RemoteJobsAllowed != nil ||
-		msg.NetworkMonitor != nil ||
-		msg.DisableClientRoutes != nil ||
-		msg.DisableServerRoutes != nil ||
-		msg.DisableDns != nil ||
-		msg.DisableFirewall != nil ||
-		msg.BlockLanAccess != nil ||
-		msg.DisableNotifications != nil ||
-		msg.BlockInbound != nil ||
-		msg.DisableIpv6 != nil ||
-		msg.EnableSSHRoot != nil ||
-		msg.EnableSSHSFTP != nil ||
-		msg.EnableSSHLocalPortForwarding != nil ||
-		msg.EnableSSHRemotePortForwarding != nil ||
-		msg.DisableSSHAuth != nil ||
-		msg.SshJWTCacheTTL != nil ||
-		msg.EnableLocalMetrics != nil ||
-		msg.LocalMetricsAddress != nil
-}
-
-// loginRequestHasConfigOverrides reports whether the LoginRequest
-// carries ANY field that would mutate persisted daemon configuration
-// (as opposed to pure-auth fields like setupKey, hostname, hint,
-// profileName, username). Used by the Login handler to decide whether
-// the `--disable-update-settings` / MDM gates must run: a re-auth that
-// changes nothing about the configuration is always allowed.
-func loginRequestHasConfigOverrides(msg *proto.LoginRequest) bool {
-	if msg == nil {
-		return false
-	}
-	return msg.ManagementUrl != "" ||
-		msg.AdminURL != "" ||
-		msg.PreSharedKey != "" || //nolint:staticcheck // SA1019: legacy proto field still accepted by Login
-		msg.OptionalPreSharedKey != nil ||
-		len(msg.CustomDNSAddress) > 0 ||
-		len(msg.NatExternalIPs) > 0 || msg.CleanNATExternalIPs ||
-		msg.RosenpassEnabled != nil ||
-		msg.InterfaceName != nil ||
-		msg.WireguardPort != nil ||
-		msg.DisableAutoConnect != nil ||
-		msg.ServerSSHAllowed != nil ||
-		msg.RemoteJobsAllowed != nil ||
-		msg.RosenpassPermissive != nil ||
-		len(msg.ExtraIFaceBlacklist) > 0 ||
-		msg.NetworkMonitor != nil ||
-		msg.DnsRouteInterval != nil ||
-		msg.DisableClientRoutes != nil ||
-		msg.DisableServerRoutes != nil ||
-		msg.DisableDns != nil ||
-		msg.DisableFirewall != nil ||
-		msg.BlockLanAccess != nil ||
-		msg.DisableNotifications != nil ||
-		len(msg.DnsLabels) > 0 || msg.CleanDNSLabels ||
-		msg.BlockInbound != nil ||
-		msg.EnableLocalMetrics != nil ||
-		msg.LocalMetricsAddress != nil
-}
-
 // loginRequestMDMConflicts mirrors mdmManagedFieldConflicts but for the
 // LoginRequest surface. Same value-aware semantics: a field set to the
 // MDM-enforced value is a no-op echo, not a conflict; only a divergent
diff --git a/client/server/provision_identity_test.go b/client/server/provision_identity_test.go
new file mode 100644
index 000000000..c944cdb1a
--- /dev/null
+++ b/client/server/provision_identity_test.go
@@ -0,0 +1,59 @@
+package server
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+)
+
+// The daemon provisions the peer's identity and persists it, because a key that
+// stayed in memory would come back different on the next start and register a
+// second peer. Provisioning is idempotent: a profile that already has an
+// identity keeps the one on disk.
+func TestProvisionProfileIdentity(t *testing.T) {
+	origDir := profilemanager.DefaultConfigPathDir
+	origPath := profilemanager.DefaultConfigPath
+	t.Cleanup(func() {
+		profilemanager.DefaultConfigPathDir = origDir
+		profilemanager.DefaultConfigPath = origPath
+	})
+
+	dir := t.TempDir()
+	profilemanager.DefaultConfigPathDir = dir
+	profilemanager.DefaultConfigPath = filepath.Join(dir, "default.json")
+
+	activeProf := &profilemanager.ActiveProfileState{ID: "default"}
+
+	t.Run("a profile with no file is provisioned and written", func(t *testing.T) {
+		_, err := os.Stat(profilemanager.DefaultConfigPath)
+		require.True(t, os.IsNotExist(err), "the fixture starts without a config file")
+
+		config, existed, err := provisionProfileIdentity(activeProf)
+		require.NoError(t, err)
+		require.False(t, existed, "the file was reported as pre-existing")
+		require.NotEmpty(t, config.PrivateKey)
+
+		stored, err := profilemanager.GetExistingConfig(profilemanager.DefaultConfigPath)
+		require.NoError(t, err, "provisioning did not write the config out")
+		require.Equal(t, config.PrivateKey, stored.PrivateKey, "the persisted identity is not the one returned")
+		require.NotEmpty(t, stored.SSHKey)
+	})
+
+	t.Run("a second call keeps the identity on disk", func(t *testing.T) {
+		before, err := profilemanager.GetExistingConfig(profilemanager.DefaultConfigPath)
+		require.NoError(t, err)
+
+		config, existed, err := provisionProfileIdentity(activeProf)
+		require.NoError(t, err)
+		require.True(t, existed)
+		require.Equal(t, before.PrivateKey, config.PrivateKey, "provisioning minted a second identity")
+
+		after, err := profilemanager.GetExistingConfig(profilemanager.DefaultConfigPath)
+		require.NoError(t, err)
+		require.Equal(t, before.PrivateKey, after.PrivateKey, "provisioning rewrote the stored identity")
+	})
+}
diff --git a/client/server/server.go b/client/server/server.go
index 108aa8a41..f7f81b688 100644
--- a/client/server/server.go
+++ b/client/server/server.go
@@ -58,8 +58,13 @@ const (
 	// JWT token cache TTL for the client daemon (disabled by default)
 	defaultJWTCacheTTL = 0
 
-	errRestoreResidualState   = "failed to restore residual state: %v"
-	errProfilesDisabled       = "profiles are disabled, you cannot use this feature without profiles enabled"
+	errRestoreResidualState = "failed to restore residual state: %v"
+	errProfilesDisabled     = "profiles are disabled, you cannot use this feature without profiles enabled"
+	// errUpdateSettingsDisabled is returned with codes.FailedPrecondition, not
+	// codes.Unavailable: the daemon answered, and it refused. Unavailable means
+	// "the daemon cannot serve this", which is why the CLI downgrades it to a
+	// warning and the GUI reads it as an unreachable daemon — both wrong for a
+	// refusal the caller has to act on.
 	errUpdateSettingsDisabled = "update settings are disabled, you cannot use this feature without update settings enabled"
 	errNetworksDisabled       = "network selection is disabled by the administrator"
 )
@@ -492,16 +497,27 @@ func (s *Server) SetConfig(callerCtx context.Context, msg *proto.SetConfigReques
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
 
-	// Skip the update-settings gate when the request carries no actual
-	// overrides: the CLI builds a SetConfigRequest unconditionally on
-	// every `netbird up` (setupSetConfigReq in cmd/up.go), so a plain
-	// `netbird up` would otherwise always trip the gate and surface a
-	// misleading "setConfig method is not available" warning, even when
-	// the user did not pass any config flag.
-	if setConfigRequestHasConfigOverrides(msg) {
-		if s.checkUpdateSettingsDisabled() {
-			return nil, gstatus.Errorf(codes.Unavailable, errUpdateSettingsDisabled)
-		}
+	stored, err := s.storedProfileConfig(msg.ProfileName, msg.Username)
+	if err != nil {
+		return nil, err
+	}
+
+	config, err := s.setConfigInputFromRequest(msg)
+	if err != nil {
+		return nil, err
+	}
+
+	// Update-settings gate: refuse the request only when it would actually
+	// change a persisted setting. The CLI builds a SetConfigRequest
+	// unconditionally on every `netbird up` (setupSetConfigReq in
+	// cmd/up.go) and fills it from its flags and environment, so a service
+	// or container that restates the configuration it already runs with
+	// must pass the gate. Deciding this on field presence alone refused
+	// those callers, and — through the identical gate in Login — refused
+	// their login too, which left a client configured by environment
+	// (NB_MANAGEMENT_URL and friends) unable to come up at all.
+	if s.checkUpdateSettingsDisabled() && configChangeRequested(stored, config) {
+		return nil, gstatus.Errorf(codes.FailedPrecondition, errUpdateSettingsDisabled)
 	}
 
 	// MDM gate: refuse the whole request if any of its fields is enforced
@@ -513,19 +529,10 @@ func (s *Server) SetConfig(callerCtx context.Context, msg *proto.SetConfigReques
 		return nil, err
 	}
 
-	stored, err := s.storedProfileConfig(msg.ProfileName, msg.Username)
-	if err != nil {
-		return nil, err
-	}
 	if err := requirePrivilegeForConfigChange(callerCtx, stored, privilegedChangeFromSetConfig(msg)); err != nil {
 		return nil, err
 	}
 
-	config, err := s.setConfigInputFromRequest(msg)
-	if err != nil {
-		return nil, err
-	}
-
 	updatedConf, err := profilemanager.UpdateConfig(config)
 	if err != nil {
 		log.Errorf("failed to update profile config: %v", err)
@@ -641,37 +648,45 @@ func (s *Server) setConfigInputFromRequest(msg *proto.SetConfigRequest) (profile
 
 // Login uses setup key to prepare configuration for the daemon.
 func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*proto.LoginResponse, error) {
+	activeProf, err := s.profileManager.GetActiveProfileState()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get active profile state: %w", err)
+	}
+
+	// The stored config of the profile this request targets backs all three
+	// gates below. It is read before anything changes daemon state, so a
+	// refused login neither switches the profile nor cancels a login already
+	// in progress, and it is the profile the switch further down would
+	// activate.
+	stored, err := s.storedLoginConfig(activeProf, msg)
+	if err != nil {
+		return nil, err
+	}
+
 	// Config-override gates. LoginRequest carries the same surface as
 	// SetConfigRequest (managementUrl, PSK, ssh/rosenpass/port toggles,
 	// ...), so the same protections must apply. Without these the CLI
 	// command `netbird up --management-url=X` (which falls through to
 	// Login when SetConfig is rejected — see cmd/up.go) would silently
 	// bypass `--disable-update-settings` and any MDM policy.
-	if loginRequestHasConfigOverrides(msg) {
-		if s.checkUpdateSettingsDisabled() {
-			return nil, gstatus.Errorf(codes.Unavailable, errUpdateSettingsDisabled)
-		}
-		policy := s.mdmLoader.Load()
-		if err := rejectMDMManagedFieldConflicts(loginRequestMDMConflicts(msg, policy)); err != nil {
-			return nil, err
-		}
+	//
+	// The update-settings gate is value-aware, as in SetConfig: it looks at
+	// what a login would actually persist (loginOverridesInput) and refuses
+	// only a real divergence from the stored config. A login that restates
+	// the values already on disk changes nothing, so it must go through —
+	// that is what keeps a re-login, or a container restart carrying
+	// NB_MANAGEMENT_URL, working with the kill switch on.
+	if s.checkUpdateSettingsDisabled() && configChangeRequested(stored, loginOverridesInput(msg)) {
+		return nil, gstatus.Errorf(codes.FailedPrecondition, errUpdateSettingsDisabled)
 	}
 
-	activeProf, err := s.profileManager.GetActiveProfileState()
-	if err != nil {
-		log.Errorf("failed to get active profile state: %v", err)
-		return nil, fmt.Errorf("failed to get active profile state: %w", err)
+	policy := s.mdmLoader.Load()
+	if err := rejectMDMManagedFieldConflicts(loginRequestMDMConflicts(msg, policy)); err != nil {
+		return nil, err
 	}
 
 	// Privilege gate: same restrictions as SetConfig, since LoginRequest can carry
-	// the same fields. It runs before anything here changes daemon state, so a
-	// refused login neither switches the profile nor cancels a login already in
-	// progress, and it reads the profile the request targets, which is the one the
-	// switch below would activate.
-	stored, err := s.storedLoginConfig(activeProf, msg)
-	if err != nil {
-		return nil, err
-	}
+	// the same fields.
 	if err := requirePrivilegeForConfigChange(callerCtx, stored, privilegedChangeFromLogin(msg)); err != nil {
 		return nil, err
 	}
@@ -1174,6 +1189,10 @@ func (s *Server) storedLoginConfig(activeProf *profilemanager.ActiveProfileState
 
 // storedConfigAtPath reads a profile config file, yielding nil when it does not
 // exist yet.
+//
+// Reading it has no side effect: profilemanager.GetExistingConfig does not
+// write, so a request that the gates go on to refuse leaves the profile file as
+// it found it.
 func (s *Server) storedConfigAtPath(path string) (*profilemanager.Config, error) {
 	if _, err := os.Stat(path); err != nil {
 		if os.IsNotExist(err) {
@@ -1182,7 +1201,7 @@ func (s *Server) storedConfigAtPath(path string) (*profilemanager.Config, error)
 		return nil, fmt.Errorf("stat profile config: %w", err)
 	}
 
-	cfg, err := profilemanager.GetConfig(path)
+	cfg, err := profilemanager.GetExistingConfig(path)
 	if err != nil {
 		return nil, fmt.Errorf("read profile config: %w", err)
 	}
@@ -1485,8 +1504,16 @@ func (s *Server) handleActiveProfileLogout(ctx context.Context) (*proto.LogoutRe
 	return &proto.LogoutResponse{}, nil
 }
 
-// getConfig reads config file and returns Config and whether the config file already existed. Errors out if it does not exist
-func (s *Server) getConfig(activeProf *profilemanager.ActiveProfileState) (*profilemanager.Config, bool, error) {
+// provisionProfileIdentity resolves the active profile's config and puts the
+// keys that identify the peer on disk, reporting whether the config file
+// already existed.
+//
+// This is the daemon's provisioning point: the config resolved here is the one
+// the peer runs with, so it needs its identity, and that has to reach disk — a
+// key that stays in memory would come back different on the next start and
+// re-register the peer. Reads themselves are pure, so the write is here, in
+// the open, instead of hiding inside the reader.
+func provisionProfileIdentity(activeProf *profilemanager.ActiveProfileState) (*profilemanager.Config, bool, error) {
 	cfgPath, err := activeProf.FilePath()
 	if err != nil {
 		return nil, false, fmt.Errorf("failed to get active profile file path: %w", err)
@@ -1497,15 +1524,38 @@ func (s *Server) getConfig(activeProf *profilemanager.ActiveProfileState) (*prof
 
 	log.Infof("active profile config existed: %t, err %v", configExisted, err)
 
-	config, err := profilemanager.ReadConfig(cfgPath)
+	config, err := profilemanager.ReadConfigOrDefault(cfgPath)
 	if err != nil {
 		return nil, false, fmt.Errorf("failed to get config: %w", err)
 	}
 
-	// Apply the daemon-owned MDM policy on top of the just-resolved
-	// Config. profilemanager's apply() initialises the policy to
-	// empty — the Loader lives outside Config, so this overlay step
-	// is driven externally here.
+	generated, err := config.EnsureIdentity()
+	if err != nil {
+		return nil, false, fmt.Errorf("ensure profile identity: %w", err)
+	}
+
+	if generated || !configExisted {
+		if err := profilemanager.WriteOutConfig(cfgPath, config); err != nil {
+			return nil, false, fmt.Errorf("write out profile config: %w", err)
+		}
+	}
+
+	return config, configExisted, nil
+}
+
+// getConfig resolves the active profile's config, provisions its identity and
+// reports whether the config file already existed.
+func (s *Server) getConfig(activeProf *profilemanager.ActiveProfileState) (*profilemanager.Config, bool, error) {
+	config, configExisted, err := provisionProfileIdentity(activeProf)
+	if err != nil {
+		return nil, false, err
+	}
+
+	// Apply the daemon-owned MDM policy on top of the just-resolved Config.
+	// profilemanager's apply() initialises the policy to empty — the Loader
+	// lives outside Config, so this overlay step is driven externally here.
+	// After the write above, on purpose: the overlay is runtime-only and
+	// re-derived on every load, so the file keeps the profile's own values.
 	config.ApplyMDMPolicy(s.mdmLoader.Load())
 
 	return config, configExisted, nil
@@ -1560,7 +1610,7 @@ func (s *Server) logoutFromProfile(ctx context.Context, profile *profilemanager.
 		cfgPath = profilemanager.DefaultConfigPath
 	}
 
-	config, err := profilemanager.GetConfig(cfgPath)
+	config, err := profilemanager.GetExistingConfig(cfgPath)
 	if err != nil {
 		return fmt.Errorf("profile '%s' not found", profile.ID)
 	}
@@ -1579,6 +1629,19 @@ func (s *Server) sendLogoutRequestWithConfig(ctx context.Context, config *profil
 	// Privilege gate: deregistering frees this machine's key to be registered
 	// against another management server, which is only restricted while the SSH
 	// server makes that a privilege handover.
+	// Ahead of the privilege gate on purpose. A profile with no identity was
+	// never registered — a logout clears the keys in place, so logging the same
+	// profile out twice lands here — so there is nothing to deregister and
+	// nothing for the gate to protect: what it guards against is handing this
+	// machine's registered key to another management server. Behind the gate,
+	// an unprivileged caller would be refused instead, and for a profile whose
+	// ServerSSHAllowed is unset that is every caller, since an absent value
+	// counts as SSH enabled.
+	if config.PrivateKey == "" {
+		log.Infof("profile carries no identity, nothing to deregister")
+		return nil
+	}
+
 	if err := requirePrivilegeForDeregistration(ctx, config); err != nil {
 		return err
 	}
@@ -2196,7 +2259,7 @@ func (s *Server) GetConfig(ctx context.Context, req *proto.GetConfigRequest) (*p
 		cfgPath = profilemanager.DefaultConfigPath
 	}
 
-	cfg, err := profilemanager.GetConfig(cfgPath)
+	cfg, err := profilemanager.GetExistingConfig(cfgPath)
 	if err != nil {
 		log.Errorf("failed to get active profile config: %v", err)
 		return nil, fmt.Errorf("failed to get active profile config: %w", err)
@@ -2659,8 +2722,6 @@ func sendTerminalNotification() error {
 	return wallCmd.Wait()
 }
 
-// persistLoginOverrides writes management URL and pre-shared key from a LoginRequest to the
-// active profile config so that subsequent reads pick them up. Empty/nil values are ignored.
 // afterLoginPreCheck is a seam for tests to run a concurrent config change
 // between Login's first privilege check and the authoritative one.
 var afterLoginPreCheck func()
@@ -2691,6 +2752,15 @@ func (s *Server) authorizeAndPrepareLogin(callerCtx context.Context, msg *proto.
 		return nil, nil, err
 	}
 
+	// The update-settings decision is re-taken here for the same reason as the
+	// privilege one: Login's earlier check ran outside this lock, so the stored
+	// config it compared against could have moved since. This one is the
+	// authoritative check, and it is the last read before persistLoginOverrides
+	// writes.
+	if s.checkUpdateSettingsDisabled() && configChangeRequested(stored, loginOverridesInput(msg)) {
+		return nil, nil, gstatus.Errorf(codes.FailedPrecondition, errUpdateSettingsDisabled)
+	}
+
 	s.mutex.Lock()
 	if s.actCancel != nil {
 		s.actCancel()
@@ -2717,18 +2787,28 @@ func (s *Server) authorizeAndPrepareLogin(callerCtx context.Context, msg *proto.
 		return nil, nil, fmt.Errorf("active profile state: %w", err)
 	}
 
-	if err := persistLoginOverrides(activeProf, msg.ManagementUrl, msg.OptionalPreSharedKey); err != nil {
+	if err := persistLoginOverrides(activeProf, msg); err != nil {
 		return nil, nil, fmt.Errorf("persist login overrides: %w", err)
 	}
 
+	// Provisioning under the same lock as the decision above, and next to the
+	// write it guards. getConfig would otherwise mint the identity and persist
+	// it once this returns: between its read and its write, a SetConfig that
+	// had already answered its caller would be overwritten by the config this
+	// login read before it landed.
+	if _, _, err := provisionProfileIdentity(activeProf); err != nil {
+		return nil, nil, err
+	}
+
 	return ctx, activeProf, nil
 }
 
-func persistLoginOverrides(activeProf *profilemanager.ActiveProfileState, managementURL string, preSharedKey *string) error {
-	if preSharedKey != nil && *preSharedKey == "" {
-		preSharedKey = nil
-	}
-	if managementURL == "" && preSharedKey == nil {
+// persistLoginOverrides writes the config fields a login request is allowed to
+// carry into the active profile. It shares its input builder with the
+// update-settings gate, so the gate judges exactly the fields this writes.
+func persistLoginOverrides(activeProf *profilemanager.ActiveProfileState, msg *proto.LoginRequest) error {
+	input := loginOverridesInput(msg)
+	if input.ManagementURL == "" && input.PreSharedKey == nil {
 		return nil
 	}
 
@@ -2737,11 +2817,7 @@ func persistLoginOverrides(activeProf *profilemanager.ActiveProfileState, manage
 		return fmt.Errorf("active profile file path: %w", err)
 	}
 
-	input := profilemanager.ConfigInput{
-		ConfigPath:    cfgPath,
-		ManagementURL: managementURL,
-		PreSharedKey:  preSharedKey,
-	}
+	input.ConfigPath = cfgPath
 	if _, err := profilemanager.UpdateOrCreateConfig(input); err != nil {
 		return fmt.Errorf("update config: %w", err)
 	}
diff --git a/client/server/setconfig_mdm_test.go b/client/server/setconfig_mdm_test.go
index a392af6d3..d174dc47b 100644
--- a/client/server/setconfig_mdm_test.go
+++ b/client/server/setconfig_mdm_test.go
@@ -290,7 +290,7 @@ func TestSetConfig_MDMReject_AllOrNothing(t *testing.T) {
 
 	// Confirm RosenpassEnabled was NOT applied even though it was not
 	// in the conflict list: the request was rejected as a whole.
-	reloaded, err := profilemanager.GetConfig(cfgPath)
+	reloaded, err := profilemanager.GetExistingConfig(cfgPath)
 	require.NoError(t, err)
 	assert.False(t, reloaded.RosenpassEnabled, "non-conflicting field must not be applied when request is rejected")
 }
diff --git a/client/server/setconfig_test.go b/client/server/setconfig_test.go
index 7442b718e..d7f7b2bd5 100644
--- a/client/server/setconfig_test.go
+++ b/client/server/setconfig_test.go
@@ -125,7 +125,7 @@ func TestSetConfig_AllFieldsSaved(t *testing.T) {
 	cfgPath, err := profState.FilePath()
 	require.NoError(t, err)
 
-	cfg, err := profilemanager.GetConfig(cfgPath)
+	cfg, err := profilemanager.GetExistingConfig(cfgPath)
 	require.NoError(t, err)
 
 	require.Equal(t, "https://new-api.netbird.io:443", cfg.ManagementURL.String())
diff --git a/client/server/ssh_gate.go b/client/server/ssh_gate.go
index 01d24687e..40d66b7a5 100644
--- a/client/server/ssh_gate.go
+++ b/client/server/ssh_gate.go
@@ -331,21 +331,5 @@ func sameManagementURL(stored *url.URL, requested string) bool {
 		return false
 	}
 
-	return stored.Scheme == parsed.Scheme &&
-		stored.Hostname() == parsed.Hostname() &&
-		effectivePort(stored) == effectivePort(parsed)
-}
-
-func effectivePort(u *url.URL) string {
-	if port := u.Port(); port != "" {
-		return port
-	}
-	switch u.Scheme {
-	case "https":
-		return "443"
-	case "http":
-		return "80"
-	default:
-		return ""
-	}
+	return profilemanager.SameServiceURL(stored, parsed)
 }
diff --git a/client/server/update_settings_gate.go b/client/server/update_settings_gate.go
new file mode 100644
index 000000000..b4d32754f
--- /dev/null
+++ b/client/server/update_settings_gate.go
@@ -0,0 +1,55 @@
+package server
+
+import (
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// configChangeRequested reports whether applying input would move the target
+// profile away from the configuration it already persists. It is the decision
+// procedure of the update-settings kill switch (--disable-update-settings /
+// NB_DISABLE_UPDATE_SETTINGS / the MDM DisableUpdateSettings key): that switch
+// forbids *changing* settings, so a request that restates the stored values is
+// not a change and must not be refused.
+//
+// This has to be judged on values, not on field presence. `netbird up` rebuilds
+// the whole config surface of SetConfigRequest and LoginRequest from its flags
+// and environment on every invocation, so a service or container configured by
+// environment restates its own configuration on every start. A presence-based
+// gate refused those requests, and because Login carries the same fields it
+// refused the login too — leaving such a client unable to come up at all.
+//
+// A dry run that cannot be evaluated fails closed: the request counts as a
+// change, so a malformed field can never open the gate. The error itself is
+// reported to the caller by the real update path.
+func configChangeRequested(stored *profilemanager.Config, input profilemanager.ConfigInput) bool {
+	changed, err := stored.WouldChange(input)
+	if err != nil {
+		log.Warnf("cannot evaluate the requested config change, treating it as a change: %v", err)
+		return true
+	}
+	return changed
+}
+
+// loginOverridesInput builds the ConfigInput a login request persists. The
+// management URL and the pre-shared key are the only config fields the daemon
+// applies from a LoginRequest; everything else on that message is either pure
+// auth or ignored. An empty pre-shared key is dropped rather than written, so
+// a login cannot clear the stored key by omission.
+//
+// Both the write (persistLoginOverrides) and the update-settings gate go
+// through this builder, so the gate can neither refuse a field the write
+// ignores nor miss one it applies.
+func loginOverridesInput(msg *proto.LoginRequest) profilemanager.ConfigInput {
+	preSharedKey := msg.OptionalPreSharedKey
+	if preSharedKey != nil && *preSharedKey == "" {
+		preSharedKey = nil
+	}
+
+	return profilemanager.ConfigInput{
+		ManagementURL: msg.ManagementUrl,
+		PreSharedKey:  preSharedKey,
+	}
+}
diff --git a/client/server/update_settings_gate_test.go b/client/server/update_settings_gate_test.go
new file mode 100644
index 000000000..0d2cd8810
--- /dev/null
+++ b/client/server/update_settings_gate_test.go
@@ -0,0 +1,390 @@
+package server
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/internal"
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// The seeded profile of setupServerWithProfile is created with this management
+// URL, so a request carrying it restates what the profile already holds.
+const storedManagementURL = "https://api.netbird.io:443"
+
+// A client configured by environment re-sends its whole configuration on every
+// `netbird up`: the CLI fills the request from its flags and env regardless of
+// what changed. With the update-settings kill switch on, such a request must
+// pass — nothing about the configuration moves.
+func TestSetConfig_RestatingTheStoredConfigPassesTheGate(t *testing.T) {
+	s, ctx, profName, username, _ := setupServerWithProfile(t)
+	s.updateSettingsDisabled = true
+
+	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
+		ProfileName:   profName,
+		Username:      username,
+		ManagementUrl: storedManagementURL,
+	})
+	require.NoError(t, err, "restating the stored management URL is not a settings change")
+}
+
+// The same endpoint written without its default port is the same endpoint. A
+// gate that compared raw strings refused NB_MANAGEMENT_URL=https://host, which
+// is how the URL is normally spelled.
+func TestSetConfig_EquivalentManagementURLPassesTheGate(t *testing.T) {
+	s, ctx, profName, username, _ := setupServerWithProfile(t)
+	s.updateSettingsDisabled = true
+
+	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
+		ProfileName:   profName,
+		Username:      username,
+		ManagementUrl: "https://api.netbird.io",
+	})
+	require.NoError(t, err, "an implicit :443 is the same management URL")
+}
+
+// The kill switch still has to do its job: a request that moves a setting is
+// refused, and the profile keeps the value it had.
+func TestSetConfig_ChangingASettingIsRefused(t *testing.T) {
+	s, ctx, profName, username, cfgPath := setupServerWithProfile(t)
+	s.updateSettingsDisabled = true
+
+	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
+		ProfileName:   profName,
+		Username:      username,
+		ManagementUrl: "https://mgmt.elsewhere.example:443",
+	})
+	require.Error(t, err, "moving the management URL is a settings change")
+	require.Equal(t, codes.FailedPrecondition, gstatus.Code(err), "want the update-settings refusal, got %v", err)
+
+	cfg, err := profilemanager.GetExistingConfig(cfgPath)
+	require.NoError(t, err)
+	require.Equal(t, storedManagementURL, cfg.ManagementURL.String(), "the refused request changed the config anyway")
+}
+
+// A field whose requested value differs from the stored one is a change even
+// when the rest of the request restates the configuration.
+func TestSetConfig_SingleDivergingFieldIsRefused(t *testing.T) {
+	s, ctx, profName, username, _ := setupServerWithProfile(t)
+	s.updateSettingsDisabled = true
+
+	rosenpass := true
+	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
+		ProfileName:      profName,
+		Username:         username,
+		ManagementUrl:    storedManagementURL,
+		RosenpassEnabled: &rosenpass,
+	})
+	require.Error(t, err, "enabling Rosenpass is a settings change")
+	require.Equal(t, codes.FailedPrecondition, gstatus.Code(err), "want the update-settings refusal, got %v", err)
+}
+
+// With the switch off, the same diverging request goes through: the gate must
+// not leak into a daemon that never enabled it.
+func TestSetConfig_ChangeAllowedWhenTheSwitchIsOff(t *testing.T) {
+	s, ctx, profName, username, cfgPath := setupServerWithProfile(t)
+
+	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
+		ProfileName:   profName,
+		Username:      username,
+		ManagementUrl: "https://mgmt.elsewhere.example:443",
+	})
+	require.NoError(t, err)
+
+	cfg, err := profilemanager.GetExistingConfig(cfgPath)
+	require.NoError(t, err)
+	require.Equal(t, "https://mgmt.elsewhere.example:443", cfg.ManagementURL.String())
+}
+
+// Login carries the same config surface as SetConfig, so it is gated the same
+// way: a login that would move a protected setting is refused before it can
+// touch daemon state.
+func TestLogin_ChangingTheManagementURLIsRefused(t *testing.T) {
+	s, _, profName, username, cfgPath := setupServerWithProfile(t)
+	s.updateSettingsDisabled = true
+	s.rootCtx = internal.CtxInitState(context.Background())
+
+	cancelled := false
+	s.actCancel = func() { cancelled = true }
+
+	_, err := s.Login(userCtx(), &proto.LoginRequest{
+		Username:      &username,
+		ManagementUrl: "https://mgmt.elsewhere.example:443",
+	})
+	require.Error(t, err, "moving the management URL through Login is a settings change")
+	require.Equal(t, codes.FailedPrecondition, gstatus.Code(err), "want the update-settings refusal, got %v", err)
+
+	// "Refused before it can touch daemon state" is the contract, so check the
+	// state as well as the error.
+	cfg, err := profilemanager.GetExistingConfig(cfgPath)
+	require.NoError(t, err)
+	require.Equal(t, storedManagementURL, cfg.ManagementURL.String(), "the refused login moved the management URL")
+	require.False(t, cancelled, "the refused login cancelled the login already in progress")
+
+	active, err := s.profileManager.GetActiveProfileState()
+	require.NoError(t, err)
+	require.Equal(t, profilemanager.ID(profName), active.ID, "the refused login switched the active profile")
+}
+
+// seedProfileConfig writes a profile config carrying the given management URL
+// and pre-shared key into a temp dir, and returns its path.
+func seedProfileConfig(t *testing.T, managementURL, preSharedKey string) string {
+	t.Helper()
+
+	path := filepath.Join(t.TempDir(), "seeded.json")
+	_, err := profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
+		ConfigPath:    path,
+		ManagementURL: managementURL,
+		PreSharedKey:  &preSharedKey,
+	})
+	require.NoError(t, err, "seed profile config")
+	return path
+}
+
+// The decision procedure itself, over the fields a login actually persists.
+// A login that restates the stored values must not be refused: that is what
+// keeps a re-login, or a container restart carrying NB_MANAGEMENT_URL, working
+// with the kill switch on.
+func TestLoginGateDecision(t *testing.T) {
+	stored, err := profilemanager.GetExistingConfig(seedProfileConfig(t, storedManagementURL, "stored-key"))
+	require.NoError(t, err)
+
+	redacted := mdm.PreSharedKeyRedactedSentinel
+	empty := ""
+	sameKey := "stored-key"
+	otherKey := "other-key"
+
+	tests := []struct {
+		name        string
+		msg         *proto.LoginRequest
+		wantChanged bool
+	}{
+		{
+			name:        "pure auth carries no config",
+			msg:         &proto.LoginRequest{SetupKey: "ABC"},
+			wantChanged: false,
+		},
+		{
+			name:        "stored management URL restated",
+			msg:         &proto.LoginRequest{ManagementUrl: storedManagementURL},
+			wantChanged: false,
+		},
+		{
+			name:        "stored management URL without its default port",
+			msg:         &proto.LoginRequest{ManagementUrl: "https://api.netbird.io"},
+			wantChanged: false,
+		},
+		{
+			name:        "different management URL",
+			msg:         &proto.LoginRequest{ManagementUrl: "https://mgmt.elsewhere.example:443"},
+			wantChanged: true,
+		},
+		{
+			name:        "stored pre-shared key restated",
+			msg:         &proto.LoginRequest{OptionalPreSharedKey: &sameKey},
+			wantChanged: false,
+		},
+		{
+			name:        "redacted pre-shared key echoed back",
+			msg:         &proto.LoginRequest{OptionalPreSharedKey: &redacted},
+			wantChanged: false,
+		},
+		{
+			name:        "empty pre-shared key is not a request to clear it",
+			msg:         &proto.LoginRequest{OptionalPreSharedKey: &empty},
+			wantChanged: false,
+		},
+		{
+			name:        "different pre-shared key",
+			msg:         &proto.LoginRequest{OptionalPreSharedKey: &otherKey},
+			wantChanged: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			require.Equal(t, tt.wantChanged, configChangeRequested(stored, loginOverridesInput(tt.msg)))
+		})
+	}
+}
+
+// A profile with no config on disk yet is judged against the config the daemon
+// would create for it, so a first login that asks for the defaults is not a
+// change while one that asks for a different management URL is.
+func TestGateDecisionWithoutStoredConfig(t *testing.T) {
+	require.False(t, configChangeRequested(nil, profilemanager.ConfigInput{}),
+		"a request carrying nothing cannot change anything")
+	require.False(t, configChangeRequested(nil, profilemanager.ConfigInput{ManagementURL: profilemanager.DefaultManagementURL}),
+		"asking for the default management URL is what the daemon would write anyway")
+	require.True(t, configChangeRequested(nil, profilemanager.ConfigInput{ManagementURL: "https://mgmt.elsewhere.example:443"}),
+		"asking for a non-default management URL is a change")
+}
+
+// A dry run that cannot be evaluated must fail closed, or a malformed field
+// would open the gate.
+func TestGateDecisionFailsClosedOnAnInvalidRequest(t *testing.T) {
+	require.True(t, configChangeRequested(nil, profilemanager.ConfigInput{ManagementURL: "not-a-url"}),
+		"an unevaluable request must count as a change")
+}
+
+// The gate reads the stored config to decide, and reading it must not write it:
+// a refused request has to leave the profile file byte-for-byte as it was.
+// A config file missing a field the config layer fills in (MTU, here) is what
+// makes the normalization write fire.
+func TestSetConfig_RefusedRequestLeavesTheConfigFileUntouched(t *testing.T) {
+	s, ctx, profName, username, cfgPath := setupServerWithProfile(t)
+	s.updateSettingsDisabled = true
+
+	require.NoError(t, os.WriteFile(cfgPath, []byte(`{"WgIface":"wt0"}`), 0o600))
+	before, err := os.ReadFile(cfgPath)
+	require.NoError(t, err)
+
+	_, err = s.SetConfig(ctx, &proto.SetConfigRequest{
+		ProfileName:   profName,
+		Username:      username,
+		ManagementUrl: "https://mgmt.elsewhere.example:443",
+	})
+	require.Error(t, err)
+	require.Equal(t, codes.FailedPrecondition, gstatus.Code(err), "want the update-settings refusal, got %v", err)
+
+	after, err := os.ReadFile(cfgPath)
+	require.NoError(t, err)
+	require.Equal(t, string(before), string(after), "the refused request rewrote the profile config")
+}
+
+// The container case that the string comparison still broke: the management URL
+// supplied through the environment is the stored one, written with a trailing
+// slash.
+func TestSetConfig_ManagementURLSpellingsPassTheGate(t *testing.T) {
+	for _, spelling := range []string{
+		"https://api.netbird.io",
+		"https://api.netbird.io/",
+		"https://api.netbird.io:443/",
+		"https://API.netbird.io:443",
+	} {
+		t.Run(spelling, func(t *testing.T) {
+			s, ctx, profName, username, _ := setupServerWithProfile(t)
+			s.updateSettingsDisabled = true
+
+			_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
+				ProfileName:   profName,
+				Username:      username,
+				ManagementUrl: spelling,
+			})
+			require.NoError(t, err, "%q is the stored management URL written differently", spelling)
+		})
+	}
+}
+
+// The RPC the whole fix hangs on. Login is retried by the CLI in a backoff
+// loop, so a login that restates the stored configuration — which is what a
+// container configured by environment sends on every start — must get past the
+// gate, or the client never comes up at all.
+//
+// Past the gate the handler goes on to do real work this test does not stand
+// up, so the assertion is only that the refusal did not happen.
+func TestLogin_RestatingTheStoredConfigPassesTheGate(t *testing.T) {
+	s, _, _, username, _ := setupServerWithProfile(t)
+	s.updateSettingsDisabled = true
+	s.rootCtx = internal.CtxInitState(context.Background())
+
+	// Stand in for the management round trip the handler makes once the gate
+	// lets it through, so this test exercises the gate and not the network:
+	// without it the profile's management URL is dialed for real.
+	s.isLoginRequiredFn = func(context.Context) (bool, error) { return false, nil }
+
+	_, err := s.Login(userCtx(), &proto.LoginRequest{
+		Username:      &username,
+		ManagementUrl: storedManagementURL,
+	})
+	if err != nil {
+		require.NotEqual(t, codes.FailedPrecondition, gstatus.Code(err),
+			"the gate refused a login that changes nothing: %v", err)
+		require.NotContains(t, err.Error(), "update settings are disabled",
+			"the gate refused a login that changes nothing: %v", err)
+	}
+}
+
+// The value-aware decision has the same synchronization problem as the
+// privileged-change one: Login's first check runs outside guardedConfigMu, so
+// the stored config it compared against can move before the write. A login that
+// was a no-op when it was checked must not be written once it has become a
+// change.
+func TestLogin_ChangeThatAppearsMidRequestIsRefused(t *testing.T) {
+	s, _, _, username, _ := setupServerWithProfile(t)
+	s.updateSettingsDisabled = true
+	s.rootCtx = internal.CtxInitState(context.Background())
+
+	target := "moved-under-us"
+	targetPath := filepath.Join(profilemanager.DefaultConfigPathDir, target+".json")
+	_, err := profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
+		ConfigPath:    targetPath,
+		ManagementURL: storedManagementURL,
+	})
+	require.NoError(t, err)
+
+	cancelled := false
+	s.actCancel = func() { cancelled = true }
+
+	// Stand in for a concurrent writer that repoints the profile between the two
+	// checks, which is the interleaving the lock has to make safe. The login
+	// restates the URL the profile held when it was checked, so the first check
+	// sees a no-op and lets it through.
+	afterLoginPreCheck = func() {
+		_, err := profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
+			ConfigPath:    targetPath,
+			ManagementURL: "https://mgmt.elsewhere.example:443",
+		})
+		require.NoError(t, err)
+	}
+	t.Cleanup(func() { afterLoginPreCheck = nil })
+
+	_, err = s.Login(userCtx(), &proto.LoginRequest{
+		ProfileName:   &target,
+		Username:      &username,
+		ManagementUrl: storedManagementURL,
+	})
+	require.Error(t, err, "the login became a settings change before it was written")
+	require.Equal(t, codes.FailedPrecondition, gstatus.Code(err), "want the update-settings refusal, got %v", err)
+	require.False(t, cancelled, "the refused login cancelled the login already in progress")
+
+	stored, err := profilemanager.GetExistingConfig(targetPath)
+	require.NoError(t, err)
+	require.Equal(t, "https://mgmt.elsewhere.example:443", stored.ManagementURL.String(),
+		"the refused login wrote the management URL it was asked for")
+}
+
+// Logging out a profile that was already logged out must not fail: the logout
+// clears the keys in place, so the second attempt finds a profile with no
+// identity, which was never registered and has nothing to deregister.
+func TestLogout_ProfileWithoutAnIdentityIsANoOp(t *testing.T) {
+	s, _, _, _, cfgPath := setupServerWithProfile(t)
+
+	loggedOut, err := profilemanager.GetExistingConfig(cfgPath)
+	require.NoError(t, err)
+	loggedOut.PrivateKey = ""
+	loggedOut.SSHKey = ""
+	require.NoError(t, profilemanager.WriteOutConfig(cfgPath, loggedOut))
+
+	stored, err := profilemanager.GetExistingConfig(cfgPath)
+	require.NoError(t, err)
+	require.NoError(t, s.sendLogoutRequestWithConfig(privilegedTestCtx(), stored),
+		"logging out an identity-less profile must not fail")
+
+	// And for an unprivileged caller too: the deregistration privilege gate
+	// guards the handover of a registered key, so with no key there is nothing
+	// to guard. An unset SSH setting is what arms that gate — sshServerEnabled
+	// reads an absent value as enabled — so this stands in for every legacy
+	// profile, where behind the gate the caller would be refused.
+	stored.ServerSSHAllowed = nil
+	require.NoError(t, s.sendLogoutRequestWithConfig(userCtx(), stored),
+		"an unprivileged caller could not log out a profile with nothing to deregister")
+}
diff --git a/client/ui/i18n/locales/de/common.json b/client/ui/i18n/locales/de/common.json
index c39584992..dcce2f908 100644
--- a/client/ui/i18n/locales/de/common.json
+++ b/client/ui/i18n/locales/de/common.json
@@ -1363,6 +1363,12 @@
     "error.daemon_unreachable": {
         "message": "Der NetBird-Dienst antwortet nicht. Bitte prüfen Sie, ob der Dienst läuft."
     },
+    "error.settings_locked": {
+        "message": "Die Einstellungen können auf diesem Gerät nicht geändert werden: Ein Administrator hat sie gesperrt."
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "Diese Einstellung wird von Ihrer Organisation verwaltet und kann nicht geändert werden."
+    },
     "error.unknown": {
         "message": "Vorgang fehlgeschlagen."
     },
diff --git a/client/ui/i18n/locales/en/common.json b/client/ui/i18n/locales/en/common.json
index e9ee26de4..94d741b3e 100644
--- a/client/ui/i18n/locales/en/common.json
+++ b/client/ui/i18n/locales/en/common.json
@@ -1815,6 +1815,14 @@
         "message": "The NetBird daemon is not responding. Please check that the service is running.",
         "description": "Error: the NetBird background service isn't responding. 'daemon' = the background service."
     },
+    "error.settings_locked": {
+        "message": "Settings cannot be changed on this device: an administrator has locked them.",
+        "description": "Error: the local daemon was started with update-settings disabled, so it refuses configuration changes."
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "This setting is managed by your organization and cannot be changed.",
+        "description": "Error: the setting is enforced by an MDM policy. 'MDM' = mobile device management, the organization's device-management system."
+    },
     "error.unknown": {
         "message": "Operation failed.",
         "description": "Generic fallback error message used when no specific error applies."
diff --git a/client/ui/i18n/locales/es/common.json b/client/ui/i18n/locales/es/common.json
index 245b5aa5f..979879680 100644
--- a/client/ui/i18n/locales/es/common.json
+++ b/client/ui/i18n/locales/es/common.json
@@ -1363,6 +1363,12 @@
     "error.daemon_unreachable": {
         "message": "El daemon de NetBird no responde. Compruebe que el servicio esté en ejecución."
     },
+    "error.settings_locked": {
+        "message": "La configuración no se puede cambiar en este dispositivo: un administrador la ha bloqueado."
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "Esta configuración está gestionada por su organización y no se puede cambiar."
+    },
     "error.unknown": {
         "message": "La operación falló."
     },
diff --git a/client/ui/i18n/locales/fr/common.json b/client/ui/i18n/locales/fr/common.json
index 6da66a643..f9961d864 100644
--- a/client/ui/i18n/locales/fr/common.json
+++ b/client/ui/i18n/locales/fr/common.json
@@ -1363,6 +1363,12 @@
     "error.daemon_unreachable": {
         "message": "Le daemon NetBird ne répond pas. Veuillez vérifier que le service est en cours d’exécution."
     },
+    "error.settings_locked": {
+        "message": "Les paramètres ne peuvent pas être modifiés sur cet appareil : un administrateur les a verrouillés."
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "Ce paramètre est géré par votre organisation et ne peut pas être modifié."
+    },
     "error.unknown": {
         "message": "L’opération a échoué."
     },
diff --git a/client/ui/i18n/locales/hu/common.json b/client/ui/i18n/locales/hu/common.json
index 1b4d2fb9d..94dcb578c 100644
--- a/client/ui/i18n/locales/hu/common.json
+++ b/client/ui/i18n/locales/hu/common.json
@@ -1363,6 +1363,12 @@
     "error.daemon_unreachable": {
         "message": "A NetBird szolgáltatás nem válaszol. Kérjük, ellenőrizze, hogy fut-e a szolgáltatás."
     },
+    "error.settings_locked": {
+        "message": "A beállítások ezen az eszközön nem módosíthatók: egy rendszergazda zárolta őket."
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "Ezt a beállítást a szervezete kezeli, ezért nem módosítható."
+    },
     "error.unknown": {
         "message": "A művelet meghiúsult."
     },
diff --git a/client/ui/i18n/locales/it/common.json b/client/ui/i18n/locales/it/common.json
index 4cee0f842..8c1312535 100644
--- a/client/ui/i18n/locales/it/common.json
+++ b/client/ui/i18n/locales/it/common.json
@@ -1363,6 +1363,12 @@
     "error.daemon_unreachable": {
         "message": "Il daemon NetBird non risponde. Verifichi che il servizio sia in esecuzione."
     },
+    "error.settings_locked": {
+        "message": "Le impostazioni non possono essere modificate su questo dispositivo: un amministratore le ha bloccate."
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "Questa impostazione è gestita dalla sua organizzazione e non può essere modificata."
+    },
     "error.unknown": {
         "message": "Operazione non riuscita."
     },
diff --git a/client/ui/i18n/locales/ja/common.json b/client/ui/i18n/locales/ja/common.json
index 4fc81d283..a3138de6c 100644
--- a/client/ui/i18n/locales/ja/common.json
+++ b/client/ui/i18n/locales/ja/common.json
@@ -1363,6 +1363,12 @@
     "error.daemon_unreachable": {
         "message": "NetBird デーモンが応答していません。サービスが実行されているか確認してください。"
     },
+    "error.settings_locked": {
+        "message": "この端末では設定を変更できません。管理者によってロックされています。"
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "この設定は組織によって管理されているため、変更できません。"
+    },
     "error.unknown": {
         "message": "操作に失敗しました。"
     },
diff --git a/client/ui/i18n/locales/pt/common.json b/client/ui/i18n/locales/pt/common.json
index cb4a542d0..a75ae3dfc 100644
--- a/client/ui/i18n/locales/pt/common.json
+++ b/client/ui/i18n/locales/pt/common.json
@@ -1363,6 +1363,12 @@
     "error.daemon_unreachable": {
         "message": "O daemon do NetBird não está respondendo. Verifique se o serviço está em execução."
     },
+    "error.settings_locked": {
+        "message": "As configurações não podem ser alteradas neste dispositivo: um administrador bloqueou-as."
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "Esta configuração é gerida pela sua organização e não pode ser alterada."
+    },
     "error.unknown": {
         "message": "A operação falhou."
     },
diff --git a/client/ui/i18n/locales/ru/common.json b/client/ui/i18n/locales/ru/common.json
index 61ece03b8..e11ed26a4 100644
--- a/client/ui/i18n/locales/ru/common.json
+++ b/client/ui/i18n/locales/ru/common.json
@@ -1363,6 +1363,12 @@
     "error.daemon_unreachable": {
         "message": "Демон NetBird не отвечает. Проверьте, запущена ли служба."
     },
+    "error.settings_locked": {
+        "message": "Настройки на этом устройстве изменить нельзя: администратор заблокировал их."
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "Эта настройка управляется вашей организацией и не может быть изменена."
+    },
     "error.unknown": {
         "message": "Не удалось выполнить операцию."
     },
diff --git a/client/ui/i18n/locales/uk/common.json b/client/ui/i18n/locales/uk/common.json
index f8fe71562..01d2f4452 100644
--- a/client/ui/i18n/locales/uk/common.json
+++ b/client/ui/i18n/locales/uk/common.json
@@ -1361,6 +1361,12 @@
     "error.daemon_unreachable": {
         "message": "Служба NetBird не відповідає. Будь ласка, перевірте, чи запущена служба."
     },
+    "error.settings_locked": {
+        "message": "Налаштування на цьому пристрої змінити неможливо: адміністратор їх заблокував."
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "Це налаштування керується вашою організацією і не може бути змінене."
+    },
     "error.unknown": {
         "message": "Помилка операції."
     },
diff --git a/client/ui/i18n/locales/zh-CN/common.json b/client/ui/i18n/locales/zh-CN/common.json
index 126b11851..64725a69f 100644
--- a/client/ui/i18n/locales/zh-CN/common.json
+++ b/client/ui/i18n/locales/zh-CN/common.json
@@ -1363,6 +1363,12 @@
     "error.daemon_unreachable": {
         "message": "NetBird 守护进程无响应。请检查服务是否正在运行。"
     },
+    "error.settings_locked": {
+        "message": "此设备上的设置无法更改：管理员已将其锁定。"
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "此设置由您的组织管理，无法更改。"
+    },
     "error.unknown": {
         "message": "操作失败。"
     },
diff --git a/client/ui/services/errors.go b/client/ui/services/errors.go
index 0c6f2f20f..d193e9f02 100644
--- a/client/ui/services/errors.go
+++ b/client/ui/services/errors.go
@@ -134,8 +134,19 @@ func (c errorClassifier) classify(err error) *ClientError {
 		strings.Contains(lower, "connection refused"),
 		strings.Contains(lower, "context deadline exceeded"):
 		code = "daemon_unreachable"
+	case strings.Contains(lower, "update settings are disabled"):
+		code = "settings_locked"
+	case strings.Contains(lower, "managed by mdm"):
+		code = "settings_managed_by_mdm"
 	}
 
+	// Deliberately no blanket mapping for FailedPrecondition below: the daemon
+	// returns it for two dozen states that are not settings refusals at all —
+	// "not logged in", "client is not running", "session can no longer be
+	// extended" — and this classifier is shared with the session and connection
+	// services. Only the two refusals the daemon composes are named, by their
+	// message.
+
 	// Fall back to the gRPC status code when the message didn't match a known
 	// substring — the daemon now forwards the innermost code with a clean desc
 	// that no longer contains the English marker text.
diff --git a/client/ui/services/errors_test.go b/client/ui/services/errors_test.go
index 2f8f3d039..c2a10442f 100644
--- a/client/ui/services/errors_test.go
+++ b/client/ui/services/errors_test.go
@@ -34,6 +34,29 @@ func TestErrorClassifier_Classify(t *testing.T) {
 		require.Equal(t, "session_expired", ce.Code)
 	})
 
+	t.Run("the update-settings kill switch is a refusal, not a failure", func(t *testing.T) {
+		err := gstatus.Error(gcodes.FailedPrecondition,
+			"update settings are disabled, you cannot use this feature without update settings enabled")
+
+		ce := c.classify(err)
+		require.NotNil(t, ce)
+		require.Equal(t, "settings_locked", ce.Code)
+	})
+
+	t.Run("an MDM-managed field is named as such", func(t *testing.T) {
+		err := gstatus.Error(gcodes.FailedPrecondition,
+			"fields managed by MDM cannot be modified: [managementURL]")
+
+		require.Equal(t, "settings_managed_by_mdm", c.classify(err).Code)
+	})
+
+	t.Run("an unrelated FailedPrecondition is not called a refusal", func(t *testing.T) {
+		// The daemon uses this code for states that are not settings refusals,
+		// and this classifier is shared with the session and connection
+		// services, so only the two refusals it composes are named.
+		require.Equal(t, "unknown", c.classify(gstatus.Error(gcodes.FailedPrecondition, "not logged in")).Code)
+	})
+
 	t.Run("unavailable code maps to daemon_unreachable", func(t *testing.T) {
 		ce := c.classify(gstatus.Error(gcodes.Unavailable, "transport closing"))
 		require.Equal(t, "daemon_unreachable", ce.Code)

From f5707c348532a4b15ea39fb53264339f6045932c Mon Sep 17 00:00:00 2001
From: Eduard Gert <kontakt@eduardgert.de>
Date: Tue, 6 Oct 2026 12:08:11 +0200
Subject: [PATCH 08/70] [client] Add RTL layout support to the desktop UI
 (#8076)

* [client] Add RTL layout support to the desktop UI

<html dir> follows the active language, Radix primitives get the
matching dir, physical spacing/positioning uses logical utilities, and
directional icons, animations, arrow-key navigation and tooltip sides
flip in RTL.

* [client] Address RTL review feedback

Force LTR with isolation for monospace values, let truncated names
take their direction from their content, and keep the profile name
field in the UI direction.

* [client] Keep translated monospace labels in their own direction

The forced-LTR rule for monospace values now skips elements with an
explicit dir, translated development labels use dir=auto, and
monospace values rendered through TruncatedText opt into LTR.

---------

Co-authored-by: Edward <43848523+thomashacker@users.noreply.github.com>
---
 .../src/components/CopyToClipboard.tsx        |  6 ++--
 .../frontend/src/components/DropdownMenu.tsx  | 26 +++++++++-------
 .../src/components/LanguagePicker.tsx         | 10 +++++--
 client/ui/frontend/src/components/Tooltip.tsx | 11 ++++++-
 .../frontend/src/components/TruncatedText.tsx | 11 +++++--
 .../frontend/src/components/VerticalTabs.tsx  | 11 ++++---
 .../src/components/dialog/ConfirmModal.tsx    |  6 ++--
 .../frontend/src/components/dialog/Dialog.tsx |  2 +-
 .../components/dialog/DialogDescription.tsx   |  6 ++--
 .../src/components/dialog/DialogHeading.tsx   |  6 ++--
 .../empty-state/DaemonOutdatedOverlay.tsx     |  4 +--
 .../frontend/src/components/inputs/Input.tsx  | 19 ++++++------
 .../frontend/src/components/inputs/Select.tsx |  2 +-
 .../components/switches/FancyToggleSwitch.tsx |  8 ++---
 .../components/switches/SwitchItemGroup.tsx   |  3 ++
 .../src/components/switches/ToggleSwitch.tsx  |  6 ++--
 client/ui/frontend/src/globals.css            |  5 ++++
 client/ui/frontend/src/hooks/useDirection.ts  |  6 ++++
 .../ui/frontend/src/layouts/AppRightPanel.tsx |  7 +++--
 client/ui/frontend/src/lib/i18n.ts            |  1 +
 .../src/modules/error/ErrorDialog.tsx         |  2 +-
 .../main/MainConnectionStatusSwitch.tsx       |  9 +++---
 .../src/modules/main/MainExitNodeSwitcher.tsx | 14 ++++++---
 .../frontend/src/modules/main/MainHeader.tsx  | 20 +++++++++----
 .../ui/frontend/src/modules/main/MainPage.tsx |  4 +--
 .../src/modules/main/advanced/Navigation.tsx  | 13 +++++---
 .../main/advanced/networks/NetworkFilters.tsx |  2 +-
 .../main/advanced/networks/Networks.tsx       | 19 ++++++++----
 .../main/advanced/peers/PeerDetailPanel.tsx   | 30 +++++++++++++------
 .../main/advanced/peers/PeerFilters.tsx       |  2 +-
 .../src/modules/main/advanced/peers/Peers.tsx | 17 +++++++----
 .../modules/profiles/ProfileCreationModal.tsx |  5 ++--
 .../src/modules/profiles/ProfileDropdown.tsx  |  5 +++-
 .../src/modules/profiles/ProfilesTab.tsx      |  2 +-
 .../src/modules/settings/SettingsAbout.tsx    |  4 +--
 .../src/modules/settings/SettingsAdvanced.tsx |  2 ++
 .../src/modules/settings/SettingsGeneral.tsx  |  1 +
 .../src/modules/settings/SettingsPage.tsx     |  3 ++
 .../src/modules/settings/SettingsSection.tsx  |  2 +-
 .../settings/SettingsTroubleshooting.tsx      |  3 +-
 .../modules/welcome/WelcomeStepManagement.tsx |  7 +++--
 .../src/modules/welcome/WelcomeStepTray.tsx   |  4 +--
 42 files changed, 218 insertions(+), 108 deletions(-)
 create mode 100644 client/ui/frontend/src/hooks/useDirection.ts

diff --git a/client/ui/frontend/src/components/CopyToClipboard.tsx b/client/ui/frontend/src/components/CopyToClipboard.tsx
index 4af4ecc8f..b3d5a8715 100644
--- a/client/ui/frontend/src/components/CopyToClipboard.tsx
+++ b/client/ui/frontend/src/components/CopyToClipboard.tsx
@@ -80,7 +80,7 @@ export const CopyToClipboard = ({
             aria-label={resolvedLabel}
             aria-live={"polite"}
             className={cn(
-                "group/copy wails-no-draggable pointer-events-auto inline-flex cursor-default items-center gap-2 rounded-sm text-left outline-none",
+                "group/copy wails-no-draggable pointer-events-auto inline-flex cursor-default items-center gap-2 rounded-sm text-start outline-none",
                 "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
                 className,
             )}
@@ -97,14 +97,14 @@ export const CopyToClipboard = ({
                 <span
                     aria-hidden={"true"}
                     className={
-                        "pointer-events-none absolute bottom-0 left-0 right-0 border-b border-dashed border-transparent group-hover/copy:border-nb-gray-500"
+                        "pointer-events-none absolute inset-x-0 bottom-0 border-b border-dashed border-transparent group-hover/copy:border-nb-gray-500"
                     }
                 />
             </span>
             <span
                 aria-hidden={"true"}
                 className={cn(
-                    "relative right-[1px] top-[2px] inline-flex shrink-0",
+                    "relative end-[1px] top-[2px] inline-flex shrink-0",
                     iconAlignment === "left" ? "order-first" : "order-last",
                     iconClassName,
                 )}
diff --git a/client/ui/frontend/src/components/DropdownMenu.tsx b/client/ui/frontend/src/components/DropdownMenu.tsx
index aa3ced05f..4bedc7c8a 100644
--- a/client/ui/frontend/src/components/DropdownMenu.tsx
+++ b/client/ui/frontend/src/components/DropdownMenu.tsx
@@ -3,8 +3,12 @@ import { cva } from "class-variance-authority";
 import { Check, ChevronRight } from "lucide-react";
 import * as React from "react";
 import { cn } from "@/lib/cn";
+import { useDirection } from "@/hooks/useDirection";
 
-const DropdownMenu = DropdownMenuPrimitive.Root;
+const DropdownMenu = (props: React.ComponentProps<typeof DropdownMenuPrimitive.Root>) => {
+    const dir = useDirection();
+    return <DropdownMenuPrimitive.Root dir={dir} {...props} />;
+};
 const DropdownMenuTrigger = DropdownMenuPrimitive.Trigger;
 const DropdownMenuGroup = DropdownMenuPrimitive.Group;
 const DropdownMenuPortal = DropdownMenuPrimitive.Portal;
@@ -32,16 +36,16 @@ const DropdownMenuSubTrigger = React.forwardRef<
     <DropdownMenuPrimitive.SubTrigger
         ref={ref}
         className={cn(
-            "relative flex cursor-default select-none items-center rounded-md py-1.5 pl-3 pr-2 text-sm outline-none",
+            "relative flex cursor-default select-none items-center rounded-md py-1.5 pe-2 ps-3 text-sm outline-none",
             "transition-colors data-[disabled]:pointer-events-none data-[disabled]:opacity-50",
-            inset && "pl-8",
+            inset && "ps-8",
             menuItemVariants({ variant }),
             className,
         )}
         {...props}
     >
         {children}
-        <ChevronRight className={"ml-auto h-4 w-4"} aria-hidden={"true"} />
+        <ChevronRight className={"ms-auto h-4 w-4 rtl:-scale-x-100"} aria-hidden={"true"} />
     </DropdownMenuPrimitive.SubTrigger>
 ));
 DropdownMenuSubTrigger.displayName = DropdownMenuPrimitive.SubTrigger.displayName;
@@ -102,9 +106,9 @@ const DropdownMenuItem = React.forwardRef<
     <DropdownMenuPrimitive.Item
         ref={ref}
         className={cn(
-            "relative flex cursor-default select-none items-center rounded-md py-1.5 pl-2 pr-2 text-sm outline-none",
+            "relative flex cursor-default select-none items-center rounded-md px-2 py-1.5 text-sm outline-none",
             "transition-colors data-[disabled]:pointer-events-none data-[disabled]:opacity-50",
-            inset && "pl-8",
+            inset && "ps-8",
             menuItemVariants({ variant }),
             className,
         )}
@@ -134,7 +138,7 @@ const DropdownMenuCheckboxItem = React.forwardRef<
     <DropdownMenuPrimitive.CheckboxItem
         ref={ref}
         className={cn(
-            "relative flex cursor-default select-none items-center rounded-sm py-1.5 pl-8 pr-2 text-sm outline-none",
+            "relative flex cursor-default select-none items-center rounded-sm py-1.5 pe-2 ps-8 text-sm outline-none",
             "text-nb-gray-200 transition-colors hover:bg-nb-gray-900 hover:text-nb-gray-50 focus-visible:bg-nb-gray-900 focus-visible:text-nb-gray-50",
             "data-[disabled]:pointer-events-none data-[disabled]:opacity-50",
             className,
@@ -142,7 +146,7 @@ const DropdownMenuCheckboxItem = React.forwardRef<
         checked={checked}
         {...props}
     >
-        <span className={"absolute left-2 flex h-3.5 w-3.5 items-center justify-center"}>
+        <span className={"absolute start-2 flex h-3.5 w-3.5 items-center justify-center"}>
             <DropdownMenuPrimitive.ItemIndicator>
                 <Check className={"h-4 w-4"} />
             </DropdownMenuPrimitive.ItemIndicator>
@@ -170,7 +174,7 @@ const DropdownMenuRadioItem = React.forwardRef<
         {children}
         <span
             aria-hidden={"true"}
-            className={"ml-auto flex w-4 shrink-0 items-center justify-center"}
+            className={"ms-auto flex w-4 shrink-0 items-center justify-center"}
         >
             <DropdownMenuPrimitive.ItemIndicator>
                 <Check size={14} className={"text-netbird"} />
@@ -190,7 +194,7 @@ const DropdownMenuLabel = React.forwardRef<
         ref={ref}
         className={cn(
             "px-2 py-1.5 text-sm font-semibold text-nb-gray-200",
-            inset && "pl-8",
+            inset && "ps-8",
             className,
         )}
         {...props}
@@ -212,7 +216,7 @@ DropdownMenuSeparator.displayName = DropdownMenuPrimitive.Separator.displayName;
 
 const DropdownMenuShortcut = ({ className, ...props }: React.HTMLAttributes<HTMLSpanElement>) => (
     <span
-        className={cn("ml-auto text-xs tracking-widest text-nb-gray-100 opacity-60", className)}
+        className={cn("ms-auto text-xs tracking-widest text-nb-gray-100 opacity-60", className)}
         {...props}
     />
 );
diff --git a/client/ui/frontend/src/components/LanguagePicker.tsx b/client/ui/frontend/src/components/LanguagePicker.tsx
index d0a95906f..1e1fdb17b 100644
--- a/client/ui/frontend/src/components/LanguagePicker.tsx
+++ b/client/ui/frontend/src/components/LanguagePicker.tsx
@@ -12,6 +12,7 @@ import { useFocusVisible } from "@/hooks/useFocusVisible";
 import { loadLanguages } from "@/lib/i18n";
 import { cn } from "@/lib/cn";
 import { errorDialog, formatErrorMessage } from "@/lib/errors";
+import { useDirection } from "@/hooks/useDirection";
 
 // No flag icons: flags represent countries, not languages. https://www.flagsarenotlanguages.com/blog/
 
@@ -21,6 +22,7 @@ const labelFor = (lang: Language): string =>
         : lang.displayName;
 
 export function LanguagePicker() {
+    const dir = useDirection();
     const { t, i18n } = useTranslation();
     const [languages, setLanguages] = useState<Language[]>([]);
     const [open, setOpen] = useState(false);
@@ -112,7 +114,7 @@ export function LanguagePicker() {
                                 aria-hidden={"true"}
                                 className={"shrink-0 text-nb-gray-200"}
                             />
-                            <span className={"flex-1 truncate text-left"}>
+                            <span className={"flex-1 truncate text-start"}>
                                 {current ? labelFor(current) : "—"}
                             </span>
                             <ChevronDown
@@ -168,7 +170,11 @@ export function LanguagePicker() {
                                     </div>
                                 </div>
 
-                                <ScrollArea.Root type={"auto"} className={"-mx-1 overflow-hidden"}>
+                                <ScrollArea.Root
+                                    dir={dir}
+                                    type={"auto"}
+                                    className={"-mx-1 overflow-hidden"}
+                                >
                                     <ScrollArea.Viewport className={"max-h-64 px-1"}>
                                         <Command.List>
                                             <Command.Empty>
diff --git a/client/ui/frontend/src/components/Tooltip.tsx b/client/ui/frontend/src/components/Tooltip.tsx
index d7a85277a..86589e47f 100644
--- a/client/ui/frontend/src/components/Tooltip.tsx
+++ b/client/ui/frontend/src/components/Tooltip.tsx
@@ -1,6 +1,7 @@
 import { type ReactNode, useEffect, useRef, useState } from "react";
 import * as RTooltip from "@radix-ui/react-tooltip";
 import { cn } from "@/lib/cn";
+import { useDirection } from "@/hooks/useDirection";
 
 type Props = {
     content: ReactNode;
@@ -29,6 +30,8 @@ export const Tooltip = ({
     contentClassName,
     closeDelay = 0,
 }: Props) => {
+    const dir = useDirection();
+    const physicalSide = dir === "rtl" ? mirrorSide(side) : side;
     const [open, setOpen] = useState(false);
     const hoveringRef = useRef(false);
     const closeTimer = useRef<ReturnType<typeof setTimeout> | null>(null);
@@ -73,7 +76,7 @@ export const Tooltip = ({
                 </RTooltip.Trigger>
                 <RTooltip.Portal>
                     <RTooltip.Content
-                        side={side}
+                        side={physicalSide}
                         align={align}
                         sideOffset={sideOffset}
                         alignOffset={alignOffset}
@@ -96,3 +99,9 @@ export const Tooltip = ({
         </RTooltip.Provider>
     );
 };
+
+function mirrorSide(side: Props["side"]): Props["side"] {
+    if (side === "left") return "right";
+    if (side === "right") return "left";
+    return side;
+}
diff --git a/client/ui/frontend/src/components/TruncatedText.tsx b/client/ui/frontend/src/components/TruncatedText.tsx
index 5b2d2160c..1174a8b42 100644
--- a/client/ui/frontend/src/components/TruncatedText.tsx
+++ b/client/ui/frontend/src/components/TruncatedText.tsx
@@ -6,9 +6,16 @@ type Props = {
     className?: string;
     tooltipContent?: ReactNode;
     delayDuration?: number;
+    dir?: "ltr" | "rtl" | "auto";
 };
 
-export const TruncatedText = ({ text, className, tooltipContent, delayDuration = 600 }: Props) => {
+export const TruncatedText = ({
+    text,
+    className,
+    tooltipContent,
+    delayDuration = 600,
+    dir = "auto",
+}: Props) => {
     const ref = useRef<HTMLSpanElement>(null);
     const [overflowing, setOverflowing] = useState(false);
 
@@ -19,7 +26,7 @@ export const TruncatedText = ({ text, className, tooltipContent, delayDuration =
     }, [text]);
 
     const span = (
-        <span ref={ref} className={className}>
+        <span ref={ref} dir={dir} className={className}>
             {text}
         </span>
     );
diff --git a/client/ui/frontend/src/components/VerticalTabs.tsx b/client/ui/frontend/src/components/VerticalTabs.tsx
index 306850ee2..bd1912662 100644
--- a/client/ui/frontend/src/components/VerticalTabs.tsx
+++ b/client/ui/frontend/src/components/VerticalTabs.tsx
@@ -3,12 +3,15 @@ import * as Tabs from "@radix-ui/react-tabs";
 import { type LucideProps } from "lucide-react";
 import { cn } from "@/lib/cn";
 import { useFocusVisible } from "@/hooks/useFocusVisible";
+import { useDirection } from "@/hooks/useDirection";
 
 const Root = forwardRef<HTMLDivElement, Omit<Tabs.TabsProps, "orientation">>(
     function VerticalTabsRoot({ className, ...props }, ref) {
+        const dir = useDirection();
         return (
             <Tabs.Root
                 ref={ref}
+                dir={dir}
                 orientation={"vertical"}
                 className={cn("flex min-h-0 flex-1", className)}
                 {...props}
@@ -24,7 +27,7 @@ const List = forwardRef<HTMLDivElement, Tabs.TabsListProps>(function VerticalTab
     return (
         <Tabs.List
             ref={ref}
-            className={cn("flex w-full flex-col gap-1 p-5 pr-0", className)}
+            className={cn("flex w-full flex-col gap-1 p-5 pe-0", className)}
             {...props}
         />
     );
@@ -46,7 +49,7 @@ const Trigger = forwardRef<HTMLButtonElement, TriggerProps>(function VerticalTab
         <Tabs.Trigger
             ref={ref}
             className={cn(
-                "group flex w-full cursor-default items-center gap-3 rounded-md border border-transparent px-2 py-2.5 text-left outline-none dark:border-0",
+                "group flex w-full cursor-default items-center gap-3 rounded-md border border-transparent px-2 py-2.5 text-start outline-none dark:border-0",
                 "transition-colors duration-150",
                 "data-[state=active]:border-nb-gray-800 data-[state=active]:bg-white dark:data-[state=active]:bg-nb-gray-930",
                 "data-[state=inactive]:hover:bg-nb-gray-850 dark:data-[state=inactive]:hover:bg-nb-gray-935",
@@ -60,7 +63,7 @@ const Trigger = forwardRef<HTMLButtonElement, TriggerProps>(function VerticalTab
                 size={iconSize}
                 aria-hidden={"true"}
                 className={cn(
-                    "ml-2 shrink-0 transition-colors duration-150",
+                    "ms-2 shrink-0 transition-colors duration-150",
                     "text-nb-gray-350 dark:text-nb-gray-400",
                     "group-data-[state=active]:text-nb-gray-100",
                 )}
@@ -75,7 +78,7 @@ const Trigger = forwardRef<HTMLButtonElement, TriggerProps>(function VerticalTab
                 {title}
             </span>
             {adornment && (
-                <div aria-hidden={"true"} className={"ml-auto mr-2 shrink-0"}>
+                <div aria-hidden={"true"} className={"me-2 ms-auto shrink-0"}>
                     {adornment}
                 </div>
             )}
diff --git a/client/ui/frontend/src/components/dialog/ConfirmModal.tsx b/client/ui/frontend/src/components/dialog/ConfirmModal.tsx
index 7a8a1c906..e9c33e677 100644
--- a/client/ui/frontend/src/components/dialog/ConfirmModal.tsx
+++ b/client/ui/frontend/src/components/dialog/ConfirmModal.tsx
@@ -54,9 +54,9 @@ export const ConfirmModal = ({
                 onOpenAutoFocus={(e) => e.preventDefault()}
             >
                 <div className={"flex flex-col gap-5 px-5"}>
-                    <div className={"flex flex-col gap-1 pl-1"}>
-                        <DialogHeading align={"left"}>{title}</DialogHeading>
-                        <DialogDescription align={"left"} className={"whitespace-pre-line"}>
+                    <div className={"flex flex-col gap-1 ps-1"}>
+                        <DialogHeading align={"start"}>{title}</DialogHeading>
+                        <DialogDescription align={"start"} className={"whitespace-pre-line"}>
                             {description}
                         </DialogDescription>
                     </div>
diff --git a/client/ui/frontend/src/components/dialog/Dialog.tsx b/client/ui/frontend/src/components/dialog/Dialog.tsx
index c43c04b0b..3d0d47fc2 100644
--- a/client/ui/frontend/src/components/dialog/Dialog.tsx
+++ b/client/ui/frontend/src/components/dialog/Dialog.tsx
@@ -95,7 +95,7 @@ export const Content = forwardRef<ElementRef<typeof DialogPrimitive.Content>, Co
                         {showClose && (
                             <DialogPrimitive.Close
                                 className={cn(
-                                    "absolute right-3 top-3 z-10 rounded-md p-3 transition-colors",
+                                    "absolute end-3 top-3 z-10 rounded-md p-3 transition-colors",
                                     "text-nb-gray-300 hover:text-nb-gray-100",
                                     "focus:outline-none disabled:pointer-events-none",
                                 )}
diff --git a/client/ui/frontend/src/components/dialog/DialogDescription.tsx b/client/ui/frontend/src/components/dialog/DialogDescription.tsx
index 12c358043..3d6ecbba7 100644
--- a/client/ui/frontend/src/components/dialog/DialogDescription.tsx
+++ b/client/ui/frontend/src/components/dialog/DialogDescription.tsx
@@ -1,12 +1,12 @@
 import { type ReactNode } from "react";
 import { cn } from "@/lib/cn";
 
-type DialogAlign = "left" | "center" | "right";
+type DialogAlign = "start" | "center" | "end";
 
 const alignClass: Record<DialogAlign, string> = {
-    left: "text-left",
+    start: "text-start",
     center: "text-center",
-    right: "text-right",
+    end: "text-end",
 };
 
 type DialogDescriptionProps = {
diff --git a/client/ui/frontend/src/components/dialog/DialogHeading.tsx b/client/ui/frontend/src/components/dialog/DialogHeading.tsx
index b9dda72a9..52eb0c369 100644
--- a/client/ui/frontend/src/components/dialog/DialogHeading.tsx
+++ b/client/ui/frontend/src/components/dialog/DialogHeading.tsx
@@ -1,12 +1,12 @@
 import { type ReactNode } from "react";
 import { cn } from "@/lib/cn";
 
-type DialogAlign = "left" | "center" | "right";
+type DialogAlign = "start" | "center" | "end";
 
 const alignClass: Record<DialogAlign, string> = {
-    left: "text-left",
+    start: "text-start",
     center: "text-center",
-    right: "text-right",
+    end: "text-end",
 };
 
 type DialogHeadingProps = {
diff --git a/client/ui/frontend/src/components/empty-state/DaemonOutdatedOverlay.tsx b/client/ui/frontend/src/components/empty-state/DaemonOutdatedOverlay.tsx
index e8e7108eb..da04bb4d7 100644
--- a/client/ui/frontend/src/components/empty-state/DaemonOutdatedOverlay.tsx
+++ b/client/ui/frontend/src/components/empty-state/DaemonOutdatedOverlay.tsx
@@ -65,7 +65,7 @@ export const DaemonOutdatedOverlay = () => {
                         {clientVersion === "development" ? (
                             <span>
                                 {t("settings.about.clientName")}{" "}
-                                <span className={"font-mono text-yellow-400"}>
+                                <span dir={"auto"} className={"font-mono text-yellow-400"}>
                                     {t("settings.about.development")}
                                 </span>
                             </span>
@@ -77,7 +77,7 @@ export const DaemonOutdatedOverlay = () => {
                         {guiVersion === "development" ? (
                             <span>
                                 {t("settings.about.guiName")}{" "}
-                                <span className={"font-mono text-yellow-400"}>
+                                <span dir={"auto"} className={"font-mono text-yellow-400"}>
                                     {t("settings.about.development")}
                                 </span>
                             </span>
diff --git a/client/ui/frontend/src/components/inputs/Input.tsx b/client/ui/frontend/src/components/inputs/Input.tsx
index eada79a1f..9d82f4dad 100644
--- a/client/ui/frontend/src/components/inputs/Input.tsx
+++ b/client/ui/frontend/src/components/inputs/Input.tsx
@@ -86,13 +86,13 @@ function buildInputClassName(
         "file:border-0 file:bg-transparent file:text-sm file:font-medium",
         "focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-offset-2",
         "disabled:cursor-not-allowed disabled:opacity-40",
-        opts.hasCustomPrefix && "!rounded-l-none !border-l-0",
-        opts.hasSuffix && "!pr-9",
-        opts.hasIcon && "!pl-10",
+        opts.hasCustomPrefix && "!rounded-s-none !border-s-0",
+        opts.hasSuffix && "!pe-9",
+        opts.hasIcon && "!ps-10",
         "border",
         opts.readOnly && "!border-nb-gray-800 !bg-nb-gray-910 text-nb-gray-350",
         opts.showStepper &&
-            "!rounded-r-none [-moz-appearance:textfield] [&::-webkit-inner-spin-button]:appearance-none [&::-webkit-outer-spin-button]:appearance-none",
+            "!rounded-e-none [-moz-appearance:textfield] [&::-webkit-inner-spin-button]:appearance-none [&::-webkit-outer-spin-button]:appearance-none",
         opts.className,
     );
 }
@@ -107,7 +107,7 @@ function InputAffix({
         <div
             className={cn(
                 inputVariants({ prefixSuffixVariant: error ? "error" : "default" }),
-                "flex h-[40px] w-auto rounded-l-md bg-white px-3 py-2 text-sm",
+                "flex h-[40px] w-auto rounded-s-md bg-white px-3 py-2 text-sm",
                 "items-center whitespace-nowrap border",
                 disabled && "opacity-40",
                 className,
@@ -122,7 +122,7 @@ function InputIconSlot({ icon, disabled }: Readonly<{ icon: ReactNode; disabled?
     return (
         <div
             className={cn(
-                "absolute left-0 top-0 flex h-full items-center pl-3 text-xs leading-[0] dark:text-nb-gray-300",
+                "absolute start-0 top-0 flex h-full items-center ps-3 text-xs leading-[0] dark:text-nb-gray-300",
                 disabled && "opacity-40",
             )}
         >
@@ -138,7 +138,7 @@ function InputSuffixSlot({
     return (
         <div
             className={cn(
-                "pointer-events-none absolute right-0 top-0 flex h-full select-none items-center pr-3 text-xs leading-[0] dark:text-nb-gray-300",
+                "pointer-events-none absolute end-0 top-0 flex h-full select-none items-center pe-3 text-xs leading-[0] dark:text-nb-gray-300",
                 disabled && "opacity-30",
             )}
         >
@@ -157,7 +157,7 @@ function NumberStepper({
         <div
             className={cn(
                 "flex h-[40px] shrink-0 flex-col overflow-hidden",
-                "rounded-r-md border border-l-0",
+                "rounded-e-md border border-s-0",
                 "border-neutral-200 bg-white dark:border-nb-gray-700 dark:bg-nb-gray-900",
                 error && "dark:border-red-500",
                 disabled && "pointer-events-none opacity-40",
@@ -226,6 +226,7 @@ export const Input = forwardRef<HTMLInputElement, InputProps>(function Input(
         showPasswordToggle = false,
         copy = false,
         id,
+        dir,
         ...props
     },
     ref,
@@ -336,7 +337,7 @@ export const Input = forwardRef<HTMLInputElement, InputProps>(function Input(
     return (
         <div className={"flex w-full min-w-0 flex-col"}>
             {label && <Label htmlFor={inputId}>{label}</Label>}
-            <div className={cn("relative flex h-[40px] w-full", maxWidthClass)}>
+            <div dir={dir} className={cn("relative flex h-[40px] w-full", maxWidthClass)}>
                 {customPrefix && (
                     <InputAffix
                         content={customPrefix}
diff --git a/client/ui/frontend/src/components/inputs/Select.tsx b/client/ui/frontend/src/components/inputs/Select.tsx
index 953008455..d9c7512d2 100644
--- a/client/ui/frontend/src/components/inputs/Select.tsx
+++ b/client/ui/frontend/src/components/inputs/Select.tsx
@@ -64,7 +64,7 @@ export function Select<T extends string>({
                             className={"shrink-0 text-nb-gray-200"}
                         />
                     )}
-                    <span className={"flex-1 truncate text-left"}>{current?.label ?? "—"}</span>
+                    <span className={"flex-1 truncate text-start"}>{current?.label ?? "—"}</span>
                     <ChevronDown
                         size={12}
                         aria-hidden={"true"}
diff --git a/client/ui/frontend/src/components/switches/FancyToggleSwitch.tsx b/client/ui/frontend/src/components/switches/FancyToggleSwitch.tsx
index a63e56e69..b6331ee2d 100644
--- a/client/ui/frontend/src/components/switches/FancyToggleSwitch.tsx
+++ b/client/ui/frontend/src/components/switches/FancyToggleSwitch.tsx
@@ -42,7 +42,7 @@ export default function FancyToggleSwitch({
                 role={"status"}
                 aria-busy={"true"}
                 aria-live={"polite"}
-                className={cn("inline-block w-full text-left", className)}
+                className={cn("inline-block w-full text-start", className)}
             >
                 <div className={"flex justify-between gap-10"}>
                     <div className={cn(textWrapperClassName)}>
@@ -55,7 +55,7 @@ export default function FancyToggleSwitch({
                             </span>
                         </HelpText>
                     </div>
-                    <div className={"mt-2 pr-1"}>
+                    <div className={"mt-2 pe-1"}>
                         <div
                             aria-hidden={"true"}
                             className={
@@ -73,7 +73,7 @@ export default function FancyToggleSwitch({
             {...(disabled ? { inert: "" } : {})}
             className={cn(
                 "relative z-[1] cursor-default transition-all duration-300",
-                "inline-block w-full text-left",
+                "inline-block w-full text-start",
                 disabled && "pointer-events-none opacity-30",
                 className,
             )}
@@ -87,7 +87,7 @@ export default function FancyToggleSwitch({
                         <span id={descriptionId}>{helpText}</span>
                     </HelpText>
                 </div>
-                <div className={"mt-2 pr-1"}>
+                <div className={"mt-2 pe-1"}>
                     <ToggleSwitch
                         id={switchId}
                         checked={value}
diff --git a/client/ui/frontend/src/components/switches/SwitchItemGroup.tsx b/client/ui/frontend/src/components/switches/SwitchItemGroup.tsx
index e63d245b9..df4bac3df 100644
--- a/client/ui/frontend/src/components/switches/SwitchItemGroup.tsx
+++ b/client/ui/frontend/src/components/switches/SwitchItemGroup.tsx
@@ -1,6 +1,7 @@
 import * as RadioGroup from "@radix-ui/react-radio-group";
 import { createContext, type ReactNode, useContext, useId, useMemo } from "react";
 import { cn } from "@/lib/cn";
+import { useDirection } from "@/hooks/useDirection";
 
 type SwitchItemGroupContextValue = {
     value: string;
@@ -37,11 +38,13 @@ export const SwitchItemGroup = ({
     "aria-labelledby": ariaLabelledBy,
 }: Props) => {
     const layoutId = useId();
+    const dir = useDirection();
     const contextValue = useMemo(() => ({ value, layoutId }), [value, layoutId]);
 
     return (
         <SwitchItemGroupContext.Provider value={contextValue}>
             <RadioGroup.Root
+                dir={dir}
                 value={value}
                 onValueChange={onChange}
                 disabled={disabled}
diff --git a/client/ui/frontend/src/components/switches/ToggleSwitch.tsx b/client/ui/frontend/src/components/switches/ToggleSwitch.tsx
index f4fcfcf4b..6862f85d8 100644
--- a/client/ui/frontend/src/components/switches/ToggleSwitch.tsx
+++ b/client/ui/frontend/src/components/switches/ToggleSwitch.tsx
@@ -36,9 +36,9 @@ const switchVariants = cva("", {
         },
         "thumb-size": {
             default:
-                "h-5 w-5 data-[state=checked]:translate-x-5 data-[state=unchecked]:translate-x-0",
-            small: "h-[14px] w-[14px] data-[state=checked]:translate-x-[17px] data-[state=unchecked]:translate-x-0",
-            large: "h-[30px] w-[30px] data-[state=checked]:translate-x-[31px] data-[state=unchecked]:translate-x-[1px]",
+                "h-5 w-5 data-[state=checked]:translate-x-5 data-[state=unchecked]:translate-x-0 rtl:data-[state=checked]:-translate-x-5",
+            small: "h-[14px] w-[14px] data-[state=checked]:translate-x-[17px] data-[state=unchecked]:translate-x-0 rtl:data-[state=checked]:-translate-x-[17px]",
+            large: "h-[30px] w-[30px] data-[state=checked]:translate-x-[31px] data-[state=unchecked]:translate-x-[1px] rtl:data-[state=checked]:-translate-x-[31px] rtl:data-[state=unchecked]:-translate-x-[1px]",
         },
     },
 });
diff --git a/client/ui/frontend/src/globals.css b/client/ui/frontend/src/globals.css
index 5cf2fc25d..bfdabeb31 100644
--- a/client/ui/frontend/src/globals.css
+++ b/client/ui/frontend/src/globals.css
@@ -96,6 +96,11 @@ body {
     @apply bg-nb-gray font-sans text-nb-gray-200 antialiased;
 }
 
+[dir="rtl"] :is(.font-mono, code, kbd):not([dir]) {
+    direction: ltr;
+    unicode-bidi: isolate;
+}
+
 .wails-draggable {
     --wails-draggable: drag;
     cursor: default;
diff --git a/client/ui/frontend/src/hooks/useDirection.ts b/client/ui/frontend/src/hooks/useDirection.ts
new file mode 100644
index 000000000..4609a2ae2
--- /dev/null
+++ b/client/ui/frontend/src/hooks/useDirection.ts
@@ -0,0 +1,6 @@
+import { useTranslation } from "react-i18next";
+
+export function useDirection(): "ltr" | "rtl" {
+    const { i18n } = useTranslation();
+    return i18n.dir(i18n.language);
+}
diff --git a/client/ui/frontend/src/layouts/AppRightPanel.tsx b/client/ui/frontend/src/layouts/AppRightPanel.tsx
index 9656187e2..4e7bcb0f4 100644
--- a/client/ui/frontend/src/layouts/AppRightPanel.tsx
+++ b/client/ui/frontend/src/layouts/AppRightPanel.tsx
@@ -1,6 +1,7 @@
 import { type ReactNode } from "react";
 import { motion } from "framer-motion";
 import { cn } from "@/lib/cn.ts";
+import { useDirection } from "@/hooks/useDirection";
 
 type Props = {
     children: ReactNode;
@@ -15,17 +16,19 @@ const PANEL_TRANSITION = {
 };
 
 export const AppRightPanel = ({ children, overlay, overlayOpen = false, className }: Props) => {
+    const dir = useDirection();
+    const parallaxX = dir === "rtl" ? 48 : -48;
     return (
         <div
             className={cn(
                 "wails-no-draggable relative m-5",
                 "border border-nb-gray-800 bg-nb-gray-940 dark:border-nb-gray-920",
-                "flex min-h-0 min-w-0 flex-1 flex-col overflow-hidden rounded-xl rounded-br-2xl",
+                "flex min-h-0 min-w-0 flex-1 flex-col overflow-hidden rounded-xl rounded-ee-2xl",
                 className,
             )}
         >
             <motion.div
-                animate={{ x: overlayOpen ? -48 : 0 }}
+                animate={{ x: overlayOpen ? parallaxX : 0 }}
                 transition={PANEL_TRANSITION}
                 className={"flex min-h-0 min-w-0 flex-1 flex-col"}
                 style={{ pointerEvents: overlayOpen ? "none" : "auto" }}
diff --git a/client/ui/frontend/src/lib/i18n.ts b/client/ui/frontend/src/lib/i18n.ts
index dc7fc7902..87cc996dd 100644
--- a/client/ui/frontend/src/lib/i18n.ts
+++ b/client/ui/frontend/src/lib/i18n.ts
@@ -93,6 +93,7 @@ export async function initI18n(): Promise<void> {
 function syncDocumentLang() {
     if (typeof document !== "undefined") {
         document.documentElement.lang = i18next.language;
+        document.documentElement.dir = i18next.dir(i18next.language);
     }
 }
 
diff --git a/client/ui/frontend/src/modules/error/ErrorDialog.tsx b/client/ui/frontend/src/modules/error/ErrorDialog.tsx
index 4fbb78052..0be13b86e 100644
--- a/client/ui/frontend/src/modules/error/ErrorDialog.tsx
+++ b/client/ui/frontend/src/modules/error/ErrorDialog.tsx
@@ -66,7 +66,7 @@ export default function ErrorDialog() {
                         wrap
                         variant={"bright"}
                         className={
-                            "mt-2 w-full items-start gap-2 rounded-md bg-nb-gray-930 px-3 py-2 text-left"
+                            "mt-2 w-full items-start gap-2 rounded-md bg-nb-gray-930 px-3 py-2 text-start"
                         }
                         aria-label={t("common.copy")}
                     >
diff --git a/client/ui/frontend/src/modules/main/MainConnectionStatusSwitch.tsx b/client/ui/frontend/src/modules/main/MainConnectionStatusSwitch.tsx
index 2f4014741..df48524c1 100644
--- a/client/ui/frontend/src/modules/main/MainConnectionStatusSwitch.tsx
+++ b/client/ui/frontend/src/modules/main/MainConnectionStatusSwitch.tsx
@@ -267,12 +267,13 @@ export const MainConnectionStatusSwitch = () => {
                     tabIndex={show && fqdn ? 0 : -1}
                     className={cn(
                         "mt-1 max-h-[1em] min-h-[1em] max-w-full transition-opacity duration-300",
-                        "relative left-[0.55rem]",
+                        "relative start-[0.55rem]",
                         show && fqdn ? "opacity-100" : "pointer-events-none opacity-0",
                     )}
                 >
                     <TruncatedText
                         text={shortenDns(fqdn) || " "}
+                        dir={"ltr"}
                         className={
                             "block h-[18px] max-w-[310px] truncate font-mono text-[0.8rem] leading-tight text-nb-gray-300"
                         }
@@ -298,7 +299,7 @@ const LocalIpLine = ({ ip, ipv6, show }: { ip: string; ipv6: string; show: boole
                 tabIndex={show && ip ? 0 : -1}
                 className={cn(
                     "mt-1 max-h-[1em] min-h-[1em] transition-opacity duration-300",
-                    "relative left-[0.55rem]",
+                    "relative start-[0.55rem]",
                     show && ip ? "opacity-100" : "pointer-events-none opacity-0",
                 )}
             >
@@ -345,7 +346,7 @@ const LocalIpLine = ({ ip, ipv6, show }: { ip: string; ipv6: string; show: boole
                             size={14}
                             aria-hidden={"true"}
                             className={cn(
-                                "absolute -right-5 top-1/2 -translate-y-1/2",
+                                "absolute -end-5 top-1/2 -translate-y-1/2",
                                 "shrink-0 text-nb-gray-300 transition-colors",
                                 "group-hover:text-nb-gray-200",
                                 "group-data-[state=open]:text-nb-gray-200",
@@ -398,7 +399,7 @@ const IpRow = ({ value }: { value: string }) => {
             aria-label={`${t("common.copy")} ${value}`}
             className={cn(
                 "group/iprow relative flex items-center justify-between gap-3",
-                "rounded-md px-2 py-1.5 text-left",
+                "rounded-md px-2 py-1.5 text-start",
                 "text-nb-gray-200 hover:bg-nb-gray-900 hover:text-nb-gray-50",
                 "cursor-default outline-none transition-colors",
                 isFocusVisible &&
diff --git a/client/ui/frontend/src/modules/main/MainExitNodeSwitcher.tsx b/client/ui/frontend/src/modules/main/MainExitNodeSwitcher.tsx
index 0d6579dd7..3e6281352 100644
--- a/client/ui/frontend/src/modules/main/MainExitNodeSwitcher.tsx
+++ b/client/ui/frontend/src/modules/main/MainExitNodeSwitcher.tsx
@@ -9,10 +9,12 @@ import { TruncatedText } from "@/components/TruncatedText";
 import { useNetworks } from "@/contexts/NetworksContext";
 import { useStatus } from "@/contexts/StatusContext";
 import { useFocusVisible } from "@/hooks/useFocusVisible";
+import { useDirection } from "@/hooks/useDirection";
 
 const NONE_VALUE = "__none__";
 
 export const MainExitNodeSwitcher = () => {
+    const dir = useDirection();
     const { t } = useTranslation();
     const { status } = useStatus();
     const { exitNodes, toggleExitNode } = useNetworks();
@@ -101,7 +103,11 @@ export const MainExitNodeSwitcher = () => {
                             <NoneRow isActive={!active} onSelect={() => handleSelect(NONE_VALUE)} />
                             {hasAny && <div className={"-mx-1 my-1 h-px bg-nb-gray-910"} />}
                             {hasAny && (
-                                <ScrollArea.Root type={"auto"} className={"-mx-1 overflow-hidden"}>
+                                <ScrollArea.Root
+                                    dir={dir}
+                                    type={"auto"}
+                                    className={"-mx-1 overflow-hidden"}
+                                >
                                     <ScrollArea.Viewport className={"max-h-72 px-1"}>
                                         {exitNodes.map((n) => (
                                             <ExitNodeRow
@@ -155,7 +161,7 @@ const ExitNodeTriggerCard = forwardRef<HTMLButtonElement, TriggerProps>(
                 tabIndex={0}
                 disabled={disabled}
                 className={cn(
-                    "flex w-full items-center gap-3 rounded-xl p-2.5 pr-5 text-left outline-none",
+                    "flex w-full items-center gap-3 rounded-xl p-2.5 pe-5 text-start outline-none",
                     "border border-nb-gray-800 bg-nb-gray-940 dark:border-nb-gray-920",
                     "transition-colors duration-150",
                     "wails-no-draggable",
@@ -212,7 +218,7 @@ const NoneRow = ({ isActive, onSelect }: NoneRowProps) => {
             value={NONE_VALUE}
             onSelect={onSelect}
             className={cn(
-                "flex items-center gap-2 px-2 py-2 pr-3",
+                "flex items-center gap-2 px-2 py-2 pe-3",
                 "cursor-default rounded-md text-sm outline-none",
                 "data-[selected=true]:bg-nb-gray-900",
             )}
@@ -237,7 +243,7 @@ const ExitNodeRow = ({ id, label, isActive, onSelect }: ExitNodeRowProps) => (
         value={id}
         onSelect={onSelect}
         className={cn(
-            "flex items-center gap-2 px-2 py-2 pr-3",
+            "flex items-center gap-2 px-2 py-2 pe-3",
             "cursor-default rounded-md text-sm outline-none",
             "data-[selected=true]:bg-nb-gray-900",
         )}
diff --git a/client/ui/frontend/src/modules/main/MainHeader.tsx b/client/ui/frontend/src/modules/main/MainHeader.tsx
index d79e76cd1..6aa5b7993 100644
--- a/client/ui/frontend/src/modules/main/MainHeader.tsx
+++ b/client/ui/frontend/src/modules/main/MainHeader.tsx
@@ -25,7 +25,8 @@ import { cn } from "@/lib/cn";
 import { formatShortcut, useKeyboardShortcut } from "@/hooks/useKeyboardShortcut";
 import { useViewMode, type ViewMode } from "@/contexts/ViewModeContext";
 import { useRestrictions } from "@/contexts/RestrictionsContext";
-import { isWindows } from "@/lib/platform.ts";
+import { isMacOS, isWindows } from "@/lib/platform.ts";
+import { useDirection } from "@/hooks/useDirection";
 
 const SETTINGS_SHORTCUT = { key: ",", cmd: true } as const;
 
@@ -35,6 +36,8 @@ export const MainHeader = () => {
     const { viewMode, setViewMode } = useViewMode();
     const { updateAvailable } = useClientVersion();
     const { mdm, features } = useRestrictions();
+    const dir = useDirection();
+    const pinSettingsRight = isMacOS();
 
     const openSettings = useCallback(() => {
         setMenuOpen(false);
@@ -83,7 +86,7 @@ export const MainHeader = () => {
                     />
                 </DropdownMenuTrigger>
                 <DropdownMenuContent
-                    align={"end"}
+                    align={pinSettingsRight && dir === "rtl" ? "start" : "end"}
                     sideOffset={8}
                     className={
                         "min-w-52 select-none data-[state=closed]:!animate-none data-[state=closed]:!duration-0"
@@ -138,7 +141,7 @@ export const MainHeader = () => {
                 <span
                     aria-hidden={"true"}
                     className={
-                        "pointer-events-none absolute right-1.5 top-1.5 flex h-2.5 w-2.5 items-center justify-center"
+                        "pointer-events-none absolute end-1.5 top-1.5 flex h-2.5 w-2.5 items-center justify-center"
                     }
                 >
                     <span
@@ -168,10 +171,17 @@ export const MainHeader = () => {
                 )}
             >
                 <div />
-                <div className={"ml-4 flex justify-center"}>{profileSlot}</div>
+                <div className={"ml-4 flex justify-center rtl:ml-1"}>{profileSlot}</div>
                 <div />
             </div>
-            <div className={"absolute right-[1.3rem] top-1/2 -translate-y-1/2"}>{settingsSlot}</div>
+            <div
+                className={cn(
+                    "absolute top-1/2 -translate-y-1/2",
+                    pinSettingsRight ? "right-[1.3rem]" : "end-[1.3rem]",
+                )}
+            >
+                {settingsSlot}
+            </div>
         </header>
     );
 };
diff --git a/client/ui/frontend/src/modules/main/MainPage.tsx b/client/ui/frontend/src/modules/main/MainPage.tsx
index c05b3a025..1d8f8d1f6 100644
--- a/client/ui/frontend/src/modules/main/MainPage.tsx
+++ b/client/ui/frontend/src/modules/main/MainPage.tsx
@@ -55,7 +55,7 @@ const MainBody = () => {
             >
                 <MainConnectionStatusSwitch />
                 {!features.disableNetworks && (
-                    <div className={"wails-no-draggable absolute bottom-5 left-5 right-5"}>
+                    <div className={"wails-no-draggable absolute inset-x-5 bottom-5"}>
                         <MainExitNodeSwitcher />
                     </div>
                 )}
@@ -79,7 +79,7 @@ const AdvancedAppRightPanel = () => {
         <AppRightPanel
             overlay={<PeerDetailPanel />}
             overlayOpen={selected !== null}
-            className={"m-5 ml-0"}
+            className={"m-5 ms-0"}
         >
             <div
                 ref={(el) => {
diff --git a/client/ui/frontend/src/modules/main/advanced/Navigation.tsx b/client/ui/frontend/src/modules/main/advanced/Navigation.tsx
index dc8d7505b..1f0f527d1 100644
--- a/client/ui/frontend/src/modules/main/advanced/Navigation.tsx
+++ b/client/ui/frontend/src/modules/main/advanced/Navigation.tsx
@@ -5,6 +5,7 @@ import { cn } from "@/lib/cn";
 import { useNavSection, type NavSection } from "@/contexts/NavSectionContext";
 import { useStatus } from "@/contexts/StatusContext";
 import { useRestrictions } from "@/contexts/RestrictionsContext";
+import { useDirection } from "@/hooks/useDirection";
 
 type TabEntry = {
     value: NavSection;
@@ -48,6 +49,10 @@ export const Navigation = () => {
         requestAnimationFrame(() => tabRefs.current[value]?.focus());
     };
 
+    const dir = useDirection();
+    const forwardKey = dir === "rtl" ? "ArrowLeft" : "ArrowRight";
+    const backwardKey = dir === "rtl" ? "ArrowRight" : "ArrowLeft";
+
     const handleKeyDown = (e: KeyboardEvent<HTMLButtonElement>) => {
         const enabled = tabs.filter((t) => isConnected || t.value === section);
         if (enabled.length < 2) return;
@@ -55,10 +60,10 @@ export const Navigation = () => {
         if (currentIndex === -1) return;
         let nextIndex: number;
         switch (e.key) {
-            case "ArrowRight":
+            case forwardKey:
                 nextIndex = (currentIndex + 1) % enabled.length;
                 break;
-            case "ArrowLeft":
+            case backwardKey:
                 nextIndex = (currentIndex - 1 + enabled.length) % enabled.length;
                 break;
             case "Home":
@@ -106,8 +111,8 @@ export const Navigation = () => {
                             "group relative flex flex-1 items-center justify-center",
                             "gap-2.5 px-5 py-3.5",
                             "outline-none transition-all",
-                            isFirst && "rounded-tl-xl",
-                            isLast && "rounded-tr-xl",
+                            isFirst && "rounded-ss-xl",
+                            isLast && "rounded-se-xl",
                             "focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-nb-gray-50/60",
                             isActive ? "text-netbird" : "text-nb-gray-400 hover:text-nb-gray-300",
                             isDisabled ? "cursor-not-allowed opacity-50" : "cursor-default",
diff --git a/client/ui/frontend/src/modules/main/advanced/networks/NetworkFilters.tsx b/client/ui/frontend/src/modules/main/advanced/networks/NetworkFilters.tsx
index 0d8c9f4db..3686275f0 100644
--- a/client/ui/frontend/src/modules/main/advanced/networks/NetworkFilters.tsx
+++ b/client/ui/frontend/src/modules/main/advanced/networks/NetworkFilters.tsx
@@ -52,7 +52,7 @@ export const NetworkFilters = ({ value, onChange, counts, disabled }: Props) =>
                 <span>
                     {active.label} <span className={"tabular-nums"}>({counts[active.value]})</span>
                 </span>
-                <ChevronDown size={14} aria-hidden={"true"} className={"ml-0.5 shrink-0"} />
+                <ChevronDown size={14} aria-hidden={"true"} className={"ms-0.5 shrink-0"} />
             </DropdownMenuTrigger>
             <DropdownMenuContent align={"end"} className={"min-w-[10rem]"}>
                 {filters.map((f) => {
diff --git a/client/ui/frontend/src/modules/main/advanced/networks/Networks.tsx b/client/ui/frontend/src/modules/main/advanced/networks/Networks.tsx
index a13993aa9..da8028155 100644
--- a/client/ui/frontend/src/modules/main/advanced/networks/Networks.tsx
+++ b/client/ui/frontend/src/modules/main/advanced/networks/Networks.tsx
@@ -23,6 +23,7 @@ import { NoResults } from "@/components/empty-state/NoResults";
 import { useStatus } from "@/contexts/StatusContext";
 import { useNetworks } from "@/contexts/NetworksContext";
 import { type NetworkFilter, NetworkFilters } from "./NetworkFilters";
+import { useDirection } from "@/hooks/useDirection";
 
 // Daemon renders DNS-route prefixes (zero netip.Prefix) as "invalid Prefix".
 const INVALID_PREFIX = "invalid Prefix";
@@ -70,6 +71,7 @@ const buildOverlapMap = (
 };
 
 export const Networks = () => {
+    const dir = useDirection();
     const { t } = useTranslation();
     const { status } = useStatus();
     const isConnected = status?.status === "Connected";
@@ -175,7 +177,11 @@ export const Networks = () => {
             {filtered.length === 0 ? (
                 <NoResults />
             ) : (
-                <ScrollArea.Root type={"auto"} className={"min-h-0 flex-1 overflow-hidden"}>
+                <ScrollArea.Root
+                    dir={dir}
+                    type={"auto"}
+                    className={"min-h-0 flex-1 overflow-hidden"}
+                >
                     <ScrollArea.Viewport ref={setScrollParent} className={"h-full w-full"}>
                         {scrollParent && (
                             <NetworksList
@@ -343,7 +349,7 @@ const NetworkRow = ({ network: n, index, onKeyDown, onToggle, setRowRef }: Netwo
     return (
         <div
             className={cn(
-                "group relative flex min-w-0 items-start gap-2.5 py-3 pl-6 pr-9",
+                "group relative flex min-w-0 items-start gap-2.5 py-3 pe-9 ps-6",
                 "transition-colors hover:bg-nb-gray-900/40",
                 "wails-no-draggable",
             )}
@@ -423,6 +429,7 @@ const Subtitle = ({ network, onKeyDown }: SubtitleProps) => {
                 <CopyToClipboard message={network.range} onKeyDown={onKeyDown}>
                     <TruncatedText
                         text={network.range}
+                        dir={"ltr"}
                         className={
                             "block max-w-[300px] truncate font-mono text-xs text-nb-gray-400"
                         }
@@ -463,7 +470,7 @@ const DomainSubtitle = ({ domain, ips, onKeyDown }: DomainSubtitleProps) => {
                         contentClassName={cn(
                             "max-h-72 max-w-[18rem] overflow-auto",
                             "rounded-lg border border-nb-gray-800 bg-white dark:border-nb-gray-900 dark:bg-nb-gray-935",
-                            "p-2 pr-4",
+                            "p-2 pe-4",
                         )}
                     >
                         {span}
@@ -508,7 +515,9 @@ type ToggleProps = {
 };
 
 const NetworkToggle = ({ checked, mixed }: ToggleProps) => {
-    const checkedTranslate = checked ? "translate-x-[1.125rem]" : "translate-x-0.5";
+    const checkedTranslate = checked
+        ? "translate-x-[1.125rem] rtl:-translate-x-[1.125rem]"
+        : "translate-x-0.5 rtl:-translate-x-0.5";
     return (
         <span
             className={cn(
@@ -521,7 +530,7 @@ const NetworkToggle = ({ checked, mixed }: ToggleProps) => {
             <span
                 className={cn(
                     "inline-block h-4 w-4 rounded-full bg-white transition-transform",
-                    mixed ? "translate-x-2.5" : checkedTranslate,
+                    mixed ? "translate-x-2.5 rtl:-translate-x-2.5" : checkedTranslate,
                 )}
             />
         </span>
diff --git a/client/ui/frontend/src/modules/main/advanced/peers/PeerDetailPanel.tsx b/client/ui/frontend/src/modules/main/advanced/peers/PeerDetailPanel.tsx
index ee3de6643..e22054c68 100644
--- a/client/ui/frontend/src/modules/main/advanced/peers/PeerDetailPanel.tsx
+++ b/client/ui/frontend/src/modules/main/advanced/peers/PeerDetailPanel.tsx
@@ -43,6 +43,7 @@ import { useStatus } from "@/contexts/StatusContext";
 import { usePeerDetail } from "@/contexts/PeerDetailContext";
 import { useFocusVisible } from "@/hooks/useFocusVisible";
 import { peerStatusLabelKey } from "./Peers";
+import { useDirection } from "@/hooks/useDirection";
 
 const DEFAULT_TRANSITION: Transition = {
     duration: 0.32,
@@ -70,6 +71,8 @@ export const PeerDetailPanel = ({ transition = DEFAULT_TRANSITION }: Props) => {
     const { t } = useTranslation();
     const { selected, setSelected } = usePeerDetail();
     const { status, refresh } = useStatus();
+    const dir = useDirection();
+    const offscreenX = dir === "rtl" ? "-100%" : "100%";
 
     useEffect(() => {
         if (!selected) return;
@@ -111,7 +114,7 @@ export const PeerDetailPanel = ({ transition = DEFAULT_TRANSITION }: Props) => {
                 setSelected(null);
                 return;
             }
-            if (e.key === "ArrowLeft") {
+            if (e.key === (dir === "rtl" ? "ArrowRight" : "ArrowLeft")) {
                 const target = e.target as HTMLElement | null;
                 const tag = target?.tagName;
                 if (tag === "INPUT" || tag === "TEXTAREA" || target?.isContentEditable) return;
@@ -120,7 +123,7 @@ export const PeerDetailPanel = ({ transition = DEFAULT_TRANSITION }: Props) => {
         };
         globalThis.addEventListener("keydown", onKey);
         return () => globalThis.removeEventListener("keydown", onKey);
-    }, [selected, setSelected]);
+    }, [selected, setSelected, dir]);
 
     const dialogRef = useRef<HTMLDivElement>(null);
     const backButtonRef = useRef<HTMLButtonElement>(null);
@@ -172,9 +175,9 @@ export const PeerDetailPanel = ({ transition = DEFAULT_TRANSITION }: Props) => {
                     aria-modal={"true"}
                     aria-labelledby={"nb-peer-detail-title"}
                     onKeyDown={onDialogKeyDown}
-                    initial={{ x: "100%" }}
+                    initial={{ x: offscreenX }}
                     animate={{ x: 0 }}
-                    exit={{ x: "100%" }}
+                    exit={{ x: offscreenX }}
                     transition={transition}
                     style={{ willChange: "transform" }}
                     className={cn("absolute inset-0 z-20 flex flex-col", "bg-nb-gray-940")}
@@ -199,7 +202,11 @@ export const PeerDetailPanel = ({ transition = DEFAULT_TRANSITION }: Props) => {
                                 "wails-no-draggable",
                             )}
                         >
-                            <ArrowLeftIcon size={16} aria-hidden={"true"} />
+                            <ArrowLeftIcon
+                                size={16}
+                                aria-hidden={"true"}
+                                className={"rtl:-scale-x-100"}
+                            />
                         </button>
                         <Tooltip content={t(peerStatusLabelKey(selected.connStatus))} side={"top"}>
                             <span
@@ -248,7 +255,11 @@ export const PeerDetailPanel = ({ transition = DEFAULT_TRANSITION }: Props) => {
                             </button>
                         </Tooltip>
                     </div>
-                    <ScrollArea.Root type={"auto"} className={"min-h-0 flex-1 overflow-hidden"}>
+                    <ScrollArea.Root
+                        dir={dir}
+                        type={"auto"}
+                        className={"min-h-0 flex-1 overflow-hidden"}
+                    >
                         <ScrollArea.Viewport className={"h-full w-full"}>
                             <PeerDetails peer={selected} now={now} />
                         </ScrollArea.Viewport>
@@ -466,7 +477,7 @@ const ResourcesPopover = ({ networks }: { networks: string[] }) => {
                         "inline-flex shrink-0 items-center gap-1 rounded",
                         "bg-nb-gray-930 hover:bg-nb-gray-910/80 data-[state=open]:bg-nb-gray-910",
                         "border border-nb-gray-900",
-                        "py-1 pl-2.5 pr-2 text-xs font-medium text-nb-gray-300",
+                        "py-1 pe-2 ps-2.5 text-xs font-medium text-nb-gray-300",
                         "wails-no-draggable cursor-default outline-none transition-all",
                         "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
                     )}
@@ -526,7 +537,7 @@ const ResourceRow = ({ value }: { value: string }) => {
             aria-label={`${t("common.copy")} ${value}`}
             className={cn(
                 "group/resourcerow relative flex items-center justify-between gap-3",
-                "rounded-md px-2 py-1.5 text-left",
+                "rounded-md px-2 py-1.5 text-start",
                 "text-nb-gray-200 hover:bg-nb-gray-900 hover:text-nb-gray-50",
                 "cursor-default outline-none transition-colors",
                 isFocusVisible &&
@@ -547,6 +558,7 @@ const ResourceRow = ({ value }: { value: string }) => {
 const TruncatedRowValue = ({ value, mono }: { value: string; mono?: boolean }) => (
     <TruncatedText
         text={value}
+        dir={mono ? "ltr" : "auto"}
         className={cn(
             "inline-block min-w-0 max-w-[260px] truncate align-middle",
             mono && "font-mono",
@@ -564,7 +576,7 @@ const Row = ({ icon: Icon, iconClassName, label, children }: RowProps) => (
         <span className={"shrink-0 font-semibold text-nb-gray-200"}>{label}</span>
         <span
             className={cn(
-                "min-w-0 flex-1 pl-8 text-right",
+                "min-w-0 flex-1 ps-8 text-end",
                 "font-medium text-nb-gray-350",
                 "flex items-center justify-end",
             )}
diff --git a/client/ui/frontend/src/modules/main/advanced/peers/PeerFilters.tsx b/client/ui/frontend/src/modules/main/advanced/peers/PeerFilters.tsx
index 51dd5b04e..524bae5d4 100644
--- a/client/ui/frontend/src/modules/main/advanced/peers/PeerFilters.tsx
+++ b/client/ui/frontend/src/modules/main/advanced/peers/PeerFilters.tsx
@@ -52,7 +52,7 @@ export const PeerFilters = ({ value, onChange, counts, disabled }: Props) => {
                 <span>
                     {active.label} <span className={"tabular-nums"}>({counts[active.value]})</span>
                 </span>
-                <ChevronDown size={14} aria-hidden={"true"} className={"ml-0.5 shrink-0"} />
+                <ChevronDown size={14} aria-hidden={"true"} className={"ms-0.5 shrink-0"} />
             </DropdownMenuTrigger>
             <DropdownMenuContent align={"end"} className={"min-w-[10rem]"}>
                 {filters.map((f) => {
diff --git a/client/ui/frontend/src/modules/main/advanced/peers/Peers.tsx b/client/ui/frontend/src/modules/main/advanced/peers/Peers.tsx
index f3cb0f139..79a02a471 100644
--- a/client/ui/frontend/src/modules/main/advanced/peers/Peers.tsx
+++ b/client/ui/frontend/src/modules/main/advanced/peers/Peers.tsx
@@ -15,6 +15,7 @@ import { useStatus } from "@/contexts/StatusContext";
 import { usePeerDetail } from "@/contexts/PeerDetailContext";
 import { Tooltip } from "@/components/Tooltip";
 import { TruncatedText } from "@/components/TruncatedText";
+import { useDirection } from "@/hooks/useDirection";
 import { PeerFilters, type StatusFilter } from "./PeerFilters";
 
 const isOnline = (connStatus: string) => connStatus === "Connected";
@@ -42,6 +43,7 @@ export const peerStatusLabelKey = (connStatus: string): string => {
 };
 
 export const Peers = () => {
+    const dir = useDirection();
     const { t } = useTranslation();
     const { status } = useStatus();
     const [search, setSearch] = useState("");
@@ -135,7 +137,11 @@ export const Peers = () => {
             {filtered.length === 0 ? (
                 <NoResults />
             ) : (
-                <ScrollArea.Root type={"auto"} className={"min-h-0 flex-1 overflow-hidden"}>
+                <ScrollArea.Root
+                    dir={dir}
+                    type={"auto"}
+                    className={"min-h-0 flex-1 overflow-hidden"}
+                >
                     <ScrollArea.Viewport ref={setScrollParent} className={"h-full w-full"}>
                         {scrollParent && <PeersList data={filtered} scrollParent={scrollParent} />}
                     </ScrollArea.Viewport>
@@ -167,6 +173,7 @@ type PeersListProps = {
 
 const PeersList = ({ data, scrollParent }: PeersListProps) => {
     const { setSelected } = usePeerDetail();
+    const dir = useDirection();
     const virtuosoRef = useRef<VirtuosoHandle>(null);
     const rowRefs = useRef<Map<string, HTMLButtonElement>>(new Map());
 
@@ -200,7 +207,7 @@ const PeersList = ({ data, scrollParent }: PeersListProps) => {
                 e.preventDefault();
                 focusRow(Math.max(index - 1, 0));
                 break;
-            case "ArrowRight":
+            case dir === "rtl" ? "ArrowLeft" : "ArrowRight":
                 e.preventDefault();
                 setSelected(data[index]);
                 break;
@@ -223,7 +230,7 @@ const PeersList = ({ data, scrollParent }: PeersListProps) => {
     const ctx = useMemo<PeerRowContext>(
         () => ({ onKeyDown: handleRowKeyDown, onSelect: setSelected, setRowRef }),
         // eslint-disable-next-line react-hooks/exhaustive-deps
-        [data, setSelected],
+        [data, setSelected, dir],
     );
 
     return (
@@ -273,7 +280,7 @@ const PeerRow = ({ peer, index, onKeyDown, onSelect, setRowRef }: PeerRowProps)
     return (
         <div
             className={cn(
-                "group relative flex min-w-0 items-start gap-2.5 py-3 pl-6 pr-4",
+                "group relative flex min-w-0 items-start gap-2.5 py-3 pe-4 ps-6",
                 "transition-colors hover:bg-nb-gray-900/40",
                 "wails-no-draggable",
             )}
@@ -344,7 +351,7 @@ const PeerRow = ({ peer, index, onKeyDown, onSelect, setRowRef }: PeerRowProps)
                 size={16}
                 aria-hidden={"true"}
                 className={cn(
-                    "pointer-events-none relative shrink-0 self-center text-nb-gray-300",
+                    "pointer-events-none relative shrink-0 self-center text-nb-gray-300 rtl:-scale-x-100",
                     "opacity-0 transition-opacity group-hover:opacity-100",
                 )}
             />
diff --git a/client/ui/frontend/src/modules/profiles/ProfileCreationModal.tsx b/client/ui/frontend/src/modules/profiles/ProfileCreationModal.tsx
index 19313ccb3..487080f3d 100644
--- a/client/ui/frontend/src/modules/profiles/ProfileCreationModal.tsx
+++ b/client/ui/frontend/src/modules/profiles/ProfileCreationModal.tsx
@@ -175,7 +175,7 @@ export const ProfileCreationModal = ({ open, onOpenChange, onSubmit, initial }:
                 <form onSubmit={handleSubmit}>
                     <div className={"flex flex-col gap-6 px-7"}>
                         <div className={"flex flex-col gap-2"}>
-                            <div className={"pl-1"}>
+                            <div className={"ps-1"}>
                                 <Label htmlFor={nameId} className={"mb-0.5"}>
                                     {t("profile.dialog.nameLabel")}
                                 </Label>
@@ -200,7 +200,7 @@ export const ProfileCreationModal = ({ open, onOpenChange, onSubmit, initial }:
 
                         {!managedManagementUrl && (
                             <div className={"flex flex-col gap-2"}>
-                                <div className={"pl-1"}>
+                                <div className={"ps-1"}>
                                     <Label as={"div"} className={"mb-0.5"}>
                                         {t("settings.general.management.label")}
                                     </Label>
@@ -217,6 +217,7 @@ export const ProfileCreationModal = ({ open, onOpenChange, onSubmit, initial }:
                                     {mode === ManagementMode.SelfHosted && (
                                         <Input
                                             id={urlId}
+                                            dir={"ltr"}
                                             ref={urlRef}
                                             aria-label={t("settings.general.management.label")}
                                             placeholder={t(
diff --git a/client/ui/frontend/src/modules/profiles/ProfileDropdown.tsx b/client/ui/frontend/src/modules/profiles/ProfileDropdown.tsx
index 81da3aa29..ec70fb923 100644
--- a/client/ui/frontend/src/modules/profiles/ProfileDropdown.tsx
+++ b/client/ui/frontend/src/modules/profiles/ProfileDropdown.tsx
@@ -11,6 +11,7 @@ import { useProfile } from "@/contexts/ProfileContext";
 import { useFocusVisible } from "@/hooks/useFocusVisible";
 import { cn } from "@/lib/cn";
 import { errorDialog, formatErrorMessage } from "@/lib/errors";
+import { useDirection } from "@/hooks/useDirection";
 
 type ProfileDropdownProps = {
     onManageProfiles?: () => void;
@@ -19,6 +20,7 @@ type ProfileDropdownProps = {
 const MANAGE_VALUE = "__manage_profiles__";
 
 export const ProfileDropdown = ({ onManageProfiles }: ProfileDropdownProps) => {
+    const dir = useDirection();
     const { t } = useTranslation();
     const { activeProfile, activeProfileId, profiles, switchProfile, loaded } = useProfile();
     const [open, setOpen] = useState(false);
@@ -116,6 +118,7 @@ export const ProfileDropdown = ({ onManageProfiles }: ProfileDropdownProps) => {
                             {sortedProfiles.length > 0 && (
                                 <>
                                     <ScrollArea.Root
+                                        dir={dir}
                                         type={"auto"}
                                         className={"-mx-1 overflow-hidden"}
                                     >
@@ -252,7 +255,7 @@ const ProfileRow = ({ profile, isActive, onSelect }: ProfileRowProps) => {
             value={profile.id}
             onSelect={() => onSelect(profile.id)}
             className={cn(
-                "flex w-auto gap-2 px-2 py-2 pr-3 last:mb-1",
+                "flex w-auto gap-2 px-2 py-2 pe-3 last:mb-1",
                 "cursor-default rounded-md text-sm outline-none",
                 "data-[selected=true]:bg-nb-gray-900",
                 showEmail ? "items-start" : "items-center",
diff --git a/client/ui/frontend/src/modules/profiles/ProfilesTab.tsx b/client/ui/frontend/src/modules/profiles/ProfilesTab.tsx
index f2110fda0..509f48061 100644
--- a/client/ui/frontend/src/modules/profiles/ProfilesTab.tsx
+++ b/client/ui/frontend/src/modules/profiles/ProfilesTab.tsx
@@ -440,7 +440,7 @@ const ProfileRow = ({
                     {showEmail && <TruncatedEmail email={profile.email} />}
                 </div>
             </td>
-            <td className={"shrink-0 text-right"}>
+            <td className={"shrink-0 text-end"}>
                 <RowActions
                     canSwitch={!isActive}
                     canDeregister={!!profile.email}
diff --git a/client/ui/frontend/src/modules/settings/SettingsAbout.tsx b/client/ui/frontend/src/modules/settings/SettingsAbout.tsx
index c103d1d74..7228e2a6c 100644
--- a/client/ui/frontend/src/modules/settings/SettingsAbout.tsx
+++ b/client/ui/frontend/src/modules/settings/SettingsAbout.tsx
@@ -112,7 +112,7 @@ export function SettingsAbout() {
                     {daemonVersion === "development" ? (
                         <span>
                             {t("settings.about.clientName")}{" "}
-                            <span className={"font-mono text-yellow-400"}>
+                            <span dir={"auto"} className={"font-mono text-yellow-400"}>
                                 {t("settings.about.development")}
                             </span>
                         </span>
@@ -124,7 +124,7 @@ export function SettingsAbout() {
                     {guiVersion === "development" ? (
                         <span>
                             {t("settings.about.guiName")}{" "}
-                            <span className={"font-mono text-yellow-400"}>
+                            <span dir={"auto"} className={"font-mono text-yellow-400"}>
                                 {t("settings.about.development")}
                             </span>
                         </span>
diff --git a/client/ui/frontend/src/modules/settings/SettingsAdvanced.tsx b/client/ui/frontend/src/modules/settings/SettingsAdvanced.tsx
index 37b1932d9..6cb54d124 100644
--- a/client/ui/frontend/src/modules/settings/SettingsAdvanced.tsx
+++ b/client/ui/frontend/src/modules/settings/SettingsAdvanced.tsx
@@ -102,6 +102,7 @@ export function SettingsAdvanced() {
             <SectionGroup title={t("settings.advanced.section.interface")}>
                 <Input
                     label={t("settings.advanced.interfaceName.label")}
+                    dir={"ltr"}
                     value={values.interfaceName}
                     error={errors.interfaceName}
                     onChange={(e) => setValues((v) => ({ ...v, interfaceName: e.target.value }))}
@@ -151,6 +152,7 @@ export function SettingsAdvanced() {
                         <HelpText>{t("settings.advanced.psk.help")}</HelpText>
                         <Input
                             type={"password"}
+                            dir={"ltr"}
                             showPasswordToggle={pskInputValue !== PSK_MASK}
                             placeholder={"kQv0qF3oQpJYdgD5mC9hL7sB2xZ8nT4eU6wY1aR3jK0="}
                             value={pskInputValue}
diff --git a/client/ui/frontend/src/modules/settings/SettingsGeneral.tsx b/client/ui/frontend/src/modules/settings/SettingsGeneral.tsx
index 5e0327648..06620614e 100644
--- a/client/ui/frontend/src/modules/settings/SettingsGeneral.tsx
+++ b/client/ui/frontend/src/modules/settings/SettingsGeneral.tsx
@@ -88,6 +88,7 @@ export function SettingsGeneral() {
                             <div className={"mt-2 flex items-start gap-3"}>
                                 <Input
                                     id={managementUrlId}
+                                    dir={"ltr"}
                                     ref={inputRef}
                                     value={displayUrl}
                                     onChange={(e) => setUrl(e.target.value)}
diff --git a/client/ui/frontend/src/modules/settings/SettingsPage.tsx b/client/ui/frontend/src/modules/settings/SettingsPage.tsx
index bf0db3bec..9fb6e2129 100644
--- a/client/ui/frontend/src/modules/settings/SettingsPage.tsx
+++ b/client/ui/frontend/src/modules/settings/SettingsPage.tsx
@@ -17,6 +17,7 @@ import { SettingsAdvanced } from "@/modules/settings/SettingsAdvanced.tsx";
 import { SettingsTroubleshooting } from "@/modules/settings/SettingsTroubleshooting.tsx";
 import { SettingsAbout } from "@/modules/settings/SettingsAbout.tsx";
 import { useRestrictions } from "@/contexts/RestrictionsContext.tsx";
+import { useDirection } from "@/hooks/useDirection";
 
 const EVENT_SETTINGS_OPEN = "netbird:settings:open";
 
@@ -43,6 +44,7 @@ const TAB_CONTENT: Record<Tab, ReactNode> = {
 };
 
 export const SettingsPage = () => {
+    const dir = useDirection();
     const location = useLocation();
     const navState = location.state as { tab?: string } | null;
     const { mdm, features } = useRestrictions();
@@ -94,6 +96,7 @@ export const SettingsPage = () => {
                         <AutostartSettingsProvider>
                             <SettingsProvider>
                                 <ScrollArea.Root
+                                    dir={dir}
                                     key={active}
                                     type={"auto"}
                                     className={"min-h-0 flex-1 overflow-hidden"}
diff --git a/client/ui/frontend/src/modules/settings/SettingsSection.tsx b/client/ui/frontend/src/modules/settings/SettingsSection.tsx
index 4b67fe7eb..3a39d661f 100644
--- a/client/ui/frontend/src/modules/settings/SettingsSection.tsx
+++ b/client/ui/frontend/src/modules/settings/SettingsSection.tsx
@@ -30,7 +30,7 @@ export const SectionGroup = ({
 export const SettingsBottomBar = ({ children }: { children: ReactNode }) => (
     <>
         <div className={"h-[3.2rem] shrink-0"} aria-hidden={"true"} />
-        <div className={"absolute bottom-0 left-0 w-full"}>
+        <div className={"absolute bottom-0 start-0 w-full"}>
             <div
                 className={
                     "flex w-full justify-end gap-3 border-t border-nb-gray-800 bg-nb-gray-940 px-8 py-5 dark:border-nb-gray-920"
diff --git a/client/ui/frontend/src/modules/settings/SettingsTroubleshooting.tsx b/client/ui/frontend/src/modules/settings/SettingsTroubleshooting.tsx
index 63f5e8e3d..de7b2cba2 100644
--- a/client/ui/frontend/src/modules/settings/SettingsTroubleshooting.tsx
+++ b/client/ui/frontend/src/modules/settings/SettingsTroubleshooting.tsx
@@ -298,10 +298,11 @@ function DoneResult({
             </div>
 
             <div className={"flex w-full max-w-sm flex-col gap-3"}>
-                {showKey && <Input value={result.uploadedKey} readOnly copy />}
+                {showKey && <Input dir={"ltr"} value={result.uploadedKey} readOnly copy />}
 
                 {result.path && !showKey && (
                     <Input
+                        dir={"ltr"}
                         value={result.path}
                         readOnly
                         aria-label={t("settings.troubleshooting.done.savedTitle")}
diff --git a/client/ui/frontend/src/modules/welcome/WelcomeStepManagement.tsx b/client/ui/frontend/src/modules/welcome/WelcomeStepManagement.tsx
index 5cb04d484..0fb973122 100644
--- a/client/ui/frontend/src/modules/welcome/WelcomeStepManagement.tsx
+++ b/client/ui/frontend/src/modules/welcome/WelcomeStepManagement.tsx
@@ -90,10 +90,10 @@ export function WelcomeStepManagement({
     return (
         <>
             <div className={cn("flex flex-col items-center gap-1", isMacOS() && "mt-4")}>
-                <DialogHeading id={"nb-welcome-management-title"} align={"left"}>
+                <DialogHeading id={"nb-welcome-management-title"} align={"start"}>
                     {t("welcome.management.title")}
                 </DialogHeading>
-                <DialogDescription align={"left"}>
+                <DialogDescription align={"start"}>
                     {t("welcome.management.description")}
                 </DialogDescription>
             </div>
@@ -103,9 +103,10 @@ export function WelcomeStepManagement({
             </div>
 
             {mode === ManagementMode.SelfHosted && (
-                <div className={"wails-no-draggable w-full text-left"}>
+                <div className={"wails-no-draggable w-full text-start"}>
                     <Input
                         ref={inputRef}
+                        dir={"ltr"}
                         placeholder={t("welcome.management.urlPlaceholder")}
                         value={url}
                         onChange={(e) => setUrl(e.target.value)}
diff --git a/client/ui/frontend/src/modules/welcome/WelcomeStepTray.tsx b/client/ui/frontend/src/modules/welcome/WelcomeStepTray.tsx
index 5a8b0d015..8838e5c92 100644
--- a/client/ui/frontend/src/modules/welcome/WelcomeStepTray.tsx
+++ b/client/ui/frontend/src/modules/welcome/WelcomeStepTray.tsx
@@ -38,10 +38,10 @@ export function WelcomeStepTray({ onContinue }: Readonly<WelcomeStepTrayProps>)
             </div>
 
             <div className={"flex w-full flex-col gap-1"}>
-                <DialogHeading id={"nb-welcome-title"} align={"left"}>
+                <DialogHeading id={"nb-welcome-title"} align={"start"}>
                     {t(titleKey)}
                 </DialogHeading>
-                <DialogDescription align={"left"}>{t(descriptionKey)}</DialogDescription>
+                <DialogDescription align={"start"}>{t(descriptionKey)}</DialogDescription>
             </div>
 
             <DialogActions>

From a816acd97c416ff2f6b263a2a1a7bd47b2affc11 Mon Sep 17 00:00:00 2001
From: Pascal Fischer <32096965+pascal-fischer@users.noreply.github.com>
Date: Tue, 6 Oct 2026 14:53:16 +0200
Subject: [PATCH 09/70] [management] fix the concurrency handling within the
 update message tests (#8000)

---
 management/server/account_test.go             |   87 +-
 management/server/affected_peers_jwt_test.go  |  154 +-
 .../server/affected_peers_oldstate_test.go    |  198 +--
 .../affected_peers_router_paths_test.go       |  264 ++--
 .../server/affected_peers_router_test.go      |  508 +++----
 management/server/affected_peers_test.go      | 1320 +++++++++--------
 management/server/affected_peers_user_test.go |  238 ++-
 management/server/cache/idp.go                |   12 +-
 management/server/dns_test.go                 |  284 ++--
 management/server/group_test.go               |  635 ++++----
 management/server/nameserver_test.go          |  260 ++--
 management/server/peer_test.go                |  696 +++++----
 management/server/policy_test.go              |  552 +++----
 management/server/posture_checks_test.go      |  586 ++++----
 management/server/route_test.go               |  496 ++++---
 management/server/setupkey_test.go            |  128 +-
 management/server/user_test.go                |  266 ++--
 17 files changed, 3417 insertions(+), 3267 deletions(-)

diff --git a/management/server/account_test.go b/management/server/account_test.go
index 881ad19d7..6067b6023 100644
--- a/management/server/account_test.go
+++ b/management/server/account_test.go
@@ -13,6 +13,7 @@ import (
 	"strings"
 	"sync"
 	"testing"
+	"testing/synctest"
 	"time"
 
 	"github.com/prometheus/client_golang/prometheus/push"
@@ -40,6 +41,7 @@ import (
 	"github.com/netbirdio/netbird/management/internals/modules/zones"
 	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
 	networkmapdbfactory "github.com/netbirdio/netbird/management/internals/network_map_db/factory"
+	networkmap_sqlite "github.com/netbirdio/netbird/management/internals/network_map_db/sqlite"
 	"github.com/netbirdio/netbird/management/internals/server/config"
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
 	nbAccount "github.com/netbirdio/netbird/management/server/account"
@@ -1297,7 +1299,9 @@ func TestAccountManager_AddPeerWithUserID(t *testing.T) {
 }
 
 func TestAccountManager_NetworkUpdates_SaveGroup(t *testing.T) {
-	testAccountManager_NetworkUpdates_SaveGroup(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		testAccountManager_NetworkUpdates_SaveGroup(t)
+	})
 }
 
 func testAccountManager_NetworkUpdates_SaveGroup(t *testing.T) {
@@ -1330,6 +1334,8 @@ func testAccountManager_NetworkUpdates_SaveGroup(t *testing.T) {
 	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
 	defer updateManager.CloseChannel(context.Background(), peer1.ID)
 
+	settleAffectedUpdates(updMsg)
+
 	wg := sync.WaitGroup{}
 	wg.Add(1)
 	go func() {
@@ -1352,7 +1358,9 @@ func testAccountManager_NetworkUpdates_SaveGroup(t *testing.T) {
 }
 
 func TestAccountManager_NetworkUpdates_DeletePolicy(t *testing.T) {
-	testAccountManager_NetworkUpdates_DeletePolicy(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		testAccountManager_NetworkUpdates_DeletePolicy(t)
+	})
 }
 
 func testAccountManager_NetworkUpdates_DeletePolicy(t *testing.T) {
@@ -1361,13 +1369,7 @@ func testAccountManager_NetworkUpdates_DeletePolicy(t *testing.T) {
 	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
 	defer updateManager.CloseChannel(context.Background(), peer1.ID)
 
-	// Ensure that we do not receive an update message before the policy is deleted
-	time.Sleep(time.Second)
-	select {
-	case <-updMsg:
-		t.Logf("received addPeer update message before policy deletion")
-	default:
-	}
+	settleAffectedUpdates(updMsg)
 
 	wg := sync.WaitGroup{}
 	wg.Add(1)
@@ -1390,7 +1392,9 @@ func testAccountManager_NetworkUpdates_DeletePolicy(t *testing.T) {
 }
 
 func TestAccountManager_NetworkUpdates_SavePolicy(t *testing.T) {
-	testAccountManager_NetworkUpdates_SavePolicy(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		testAccountManager_NetworkUpdates_SavePolicy(t)
+	})
 }
 
 func testAccountManager_NetworkUpdates_SavePolicy(t *testing.T) {
@@ -1410,6 +1414,8 @@ func testAccountManager_NetworkUpdates_SavePolicy(t *testing.T) {
 	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
 	defer updateManager.CloseChannel(context.Background(), peer1.ID)
 
+	settleAffectedUpdates(updMsg)
+
 	wg := sync.WaitGroup{}
 	wg.Add(1)
 	go func() {
@@ -1443,7 +1449,9 @@ func testAccountManager_NetworkUpdates_SavePolicy(t *testing.T) {
 }
 
 func TestAccountManager_NetworkUpdates_DeletePeer(t *testing.T) {
-	testAccountManager_NetworkUpdates_DeletePeer(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		testAccountManager_NetworkUpdates_DeletePeer(t)
+	})
 }
 
 func testAccountManager_NetworkUpdates_DeletePeer(t *testing.T) {
@@ -1482,6 +1490,8 @@ func testAccountManager_NetworkUpdates_DeletePeer(t *testing.T) {
 	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
 	defer updateManager.CloseChannel(context.Background(), peer1.ID)
 
+	settleAffectedUpdates(updMsg)
+
 	wg := sync.WaitGroup{}
 	wg.Add(1)
 	go func() {
@@ -1503,7 +1513,9 @@ func testAccountManager_NetworkUpdates_DeletePeer(t *testing.T) {
 }
 
 func TestAccountManager_NetworkUpdates_DeleteGroup(t *testing.T) {
-	testAccountManager_NetworkUpdates_DeleteGroup(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		testAccountManager_NetworkUpdates_DeleteGroup(t)
+	})
 }
 
 func testAccountManager_NetworkUpdates_DeleteGroup(t *testing.T) {
@@ -1550,6 +1562,8 @@ func testAccountManager_NetworkUpdates_DeleteGroup(t *testing.T) {
 		}
 	}
 
+	settleAffectedUpdates(updMsg)
+
 	wg := sync.WaitGroup{}
 	wg.Add(1)
 	go func() {
@@ -3582,6 +3596,9 @@ func createManagerWithNetworkMapStore(t testing.TB) (*DefaultAccountManager, *up
 
 	nmdataStore, err := networkmapdbfactory.NewNetworkMapDBStore(context.Background(), types.SqliteStoreEngine, dataDir, MockIntegratedValidator{}, newSettingsMockManager(t))
 	require.NoError(t, err)
+	sqliteStore, ok := nmdataStore.Store.(*networkmap_sqlite.SqliteStore)
+	require.True(t, ok, "network map store is %T, want *networkmap_sqlite.SqliteStore", nmdataStore.Store)
+	t.Cleanup(func() { assert.NoError(t, sqliteStore.Db.Close()) })
 
 	manager, updateManager, err := buildTestManager(t, store, nmdataStore)
 	require.NoError(t, err)
@@ -3636,7 +3653,8 @@ func buildTestManager(t testing.TB, store store.Store, nmdataStore *networkmapdb
 		Return(nil).
 		AnyTimes()
 
-	cacheStore, err := cache.NewStore(ctx, 100*time.Millisecond, 300*time.Millisecond, 100)
+	// The go-cache janitor only stops via a GC finalizer and would outlive synctest bubbles.
+	cacheStore, err := cache.NewStore(ctx, 100*time.Millisecond, 0, 100)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -3648,8 +3666,11 @@ func buildTestManager(t testing.TB, store store.Store, nmdataStore *networkmapdb
 	if err != nil {
 		return nil, nil, err
 	}
+	cacheManager := manager.cacheManager
+	t.Cleanup(func() { assert.NoError(t, cacheManager.Close()) })
 
 	proxyGrpcServer := nbgrpc.NewProxyServiceServer(nil, nil, nil, nbgrpc.ProxyOIDCConfig{}, peersManager, nil, nil, proxyManager, nil)
+	t.Cleanup(proxyGrpcServer.Close)
 	proxyController, err := proxymanager.NewGRPCController(proxyGrpcServer, noop.Meter{})
 	if err != nil {
 		return nil, nil, err
@@ -3743,6 +3764,33 @@ func setupNetworkMapTest(t *testing.T) (*DefaultAccountManager, *update_channel.
 // when the channel delivers.
 const peerUpdateTimeout = 5 * time.Second
 
+// peerUpdateSettleTime bounds how far settleAffectedUpdates advances the fake clock. It must exceed
+// the account request and peer update buffer intervals.
+const peerUpdateSettleTime = time.Second
+
+// runPeerUpdateTest runs f inside synctest.Test, so the peer update helpers observe every background
+// goroutine of the test, and lets the updates still in flight when f returns finish before the bubble
+// ends, since the bubble's clock stops with it.
+func runPeerUpdateTest(t *testing.T, f func(t *testing.T)) {
+	synctest.Test(t, func(t *testing.T) {
+		defer settleAffectedUpdates()
+		f(t)
+	})
+}
+
+// settleAffectedUpdates runs the synctest bubble's fake clock past every update buffer interval until
+// all goroutines are blocked, then discards the updates already delivered to chans, so the next
+// assertion only observes updates from the action under test. It must be called inside synctest.Test.
+func settleAffectedUpdates(chans ...<-chan *network_map.UpdateMessage) {
+	time.Sleep(peerUpdateSettleTime)
+	synctest.Wait()
+	for _, ch := range chans {
+		for len(ch) > 0 {
+			<-ch
+		}
+	}
+}
+
 func drainPeerUpdates(ch <-chan *network_map.UpdateMessage) {
 	for {
 		select {
@@ -3756,6 +3804,19 @@ func drainPeerUpdates(ch <-chan *network_map.UpdateMessage) {
 	}
 }
 
+// step runs f as one named stage of a test inside synctest.Test, which forbids t.Run, and names the
+// stage when it fails the test. Stages share t, so a fatal failure ends the remaining stages as well.
+func step(t *testing.T, name string, f func(t *testing.T)) {
+	t.Helper()
+	failedBefore := t.Failed()
+	defer func() {
+		if !failedBefore && t.Failed() {
+			t.Logf("step %q failed", name)
+		}
+	}()
+	f(t)
+}
+
 func peerShouldNotReceiveUpdate(t *testing.T, updateMessage <-chan *network_map.UpdateMessage) {
 	t.Helper()
 	select {
diff --git a/management/server/affected_peers_jwt_test.go b/management/server/affected_peers_jwt_test.go
index 766745cd7..0b0eba1c4 100644
--- a/management/server/affected_peers_jwt_test.go
+++ b/management/server/affected_peers_jwt_test.go
@@ -87,93 +87,93 @@ func TestAffectedPeers_AllowedUsersChange_RefreshesSSHDestinations(t *testing.T)
 // auto-group change updates only the user's peers and the peers linked to the changed
 // group through policies, instead of fanning out to the whole account.
 func TestAffectedPeers_SyncUserJWTGroups_OnlyAffectedPeersUpdated(t *testing.T) {
-	manager, updateManager, account, _, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, _, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	key, err := wgtypes.GeneratePrivateKey()
-	require.NoError(t, err)
-	userPeer, _, _, _, err := manager.AddPeer(ctx, accountID, "", userID, &nbpeer.Peer{
-		Key:  key.PublicKey().String(),
-		Meta: nbpeer.PeerSystemMeta{Hostname: "user-peer"},
-	}, false)
-	require.NoError(t, err)
+		key, err := wgtypes.GeneratePrivateKey()
+		require.NoError(t, err)
+		userPeer, _, _, _, err := manager.AddPeer(ctx, accountID, "", userID, &nbpeer.Peer{
+			Key:  key.PublicKey().String(),
+			Meta: nbpeer.PeerSystemMeta{Hostname: "user-peer"},
+		}, false)
+		require.NoError(t, err)
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID))
-	}
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
+		require.NoError(t, err)
+		for _, p := range policies {
+			require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID))
+		}
 
-	account, err = manager.Store.GetAccount(ctx, accountID)
-	require.NoError(t, err)
-	account.Settings.JWTGroupsEnabled = true
-	account.Settings.JWTGroupsClaimName = "groups"
-	account.Settings.GroupsPropagationEnabled = true
-	require.NoError(t, manager.Store.SaveAccount(ctx, account))
+		account, err = manager.Store.GetAccount(ctx, accountID)
+		require.NoError(t, err)
+		account.Settings.JWTGroupsEnabled = true
+		account.Settings.JWTGroupsClaimName = "groups"
+		account.Settings.GroupsPropagationEnabled = true
+		require.NoError(t, manager.Store.SaveAccount(ctx, account))
 
-	require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "jwt-grp", Name: "jwt-linked", Issued: types.GroupIssuedJWT, Peers: []string{}}))
-	require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "jwt-dest", Name: "jwt-dest", Peers: []string{peer2.ID}}))
+		require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "jwt-grp", Name: "jwt-linked", Issued: types.GroupIssuedJWT, Peers: []string{}}))
+		require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "jwt-dest", Name: "jwt-dest", Peers: []string{peer2.ID}}))
 
-	_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
-			{
-				Enabled:       true,
-				Sources:       []string{"jwt-grp"},
-				Destinations:  []string{"jwt-dest"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
+		_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+			Enabled: true,
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"jwt-grp"},
+					Destinations:  []string{"jwt-dest"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
 			},
-		},
-	}, true)
-	require.NoError(t, err)
-
-	updUser := updateManager.CreateChannel(ctx, userPeer.ID)
-	upd2 := updateManager.CreateChannel(ctx, peer2.ID)
-	upd3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, userPeer.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	userAuth := auth.UserAuth{
-		AccountId: accountID,
-		UserId:    userID,
-		Groups:    []string{"jwt-linked"},
-	}
-
-	t.Run("adding JWT group updates only linked peers", func(t *testing.T) {
-		drainPeerUpdates(updUser)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
-
-		require.NoError(t, manager.SyncUserJWTGroups(ctx, userAuth))
-
-		peerShouldReceiveUpdate(t, updUser)
-		peerShouldReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
-
-		user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, userID)
+		}, true)
 		require.NoError(t, err)
-		assert.Contains(t, user.AutoGroups, "jwt-grp")
-	})
 
-	t.Run("removing JWT group updates only linked peers", func(t *testing.T) {
-		drainPeerUpdates(updUser)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
+		updUser := updateManager.CreateChannel(ctx, userPeer.ID)
+		upd2 := updateManager.CreateChannel(ctx, peer2.ID)
+		upd3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, userPeer.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
 
-		userAuth.Groups = nil
-		require.NoError(t, manager.SyncUserJWTGroups(ctx, userAuth))
+		userAuth := auth.UserAuth{
+			AccountId: accountID,
+			UserId:    userID,
+			Groups:    []string{"jwt-linked"},
+		}
 
-		peerShouldReceiveUpdate(t, updUser)
-		peerShouldReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
+		step(t, "adding JWT group updates only linked peers", func(t *testing.T) {
+			settleAffectedUpdates(updUser, upd2, upd3)
 
-		user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, userID)
-		require.NoError(t, err)
-		assert.NotContains(t, user.AutoGroups, "jwt-grp")
+			require.NoError(t, manager.SyncUserJWTGroups(ctx, userAuth))
+
+			peerShouldReceiveUpdate(t, updUser)
+			peerShouldReceiveUpdate(t, upd2)
+			peerShouldNotReceiveUpdate(t, upd3)
+
+			user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, userID)
+			require.NoError(t, err)
+			assert.Contains(t, user.AutoGroups, "jwt-grp")
+		})
+
+		step(t, "removing JWT group updates only linked peers", func(t *testing.T) {
+			drainPeerUpdates(updUser)
+			drainPeerUpdates(upd2)
+			drainPeerUpdates(upd3)
+
+			userAuth.Groups = nil
+			require.NoError(t, manager.SyncUserJWTGroups(ctx, userAuth))
+
+			peerShouldReceiveUpdate(t, updUser)
+			peerShouldReceiveUpdate(t, upd2)
+			peerShouldNotReceiveUpdate(t, upd3)
+
+			user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, userID)
+			require.NoError(t, err)
+			assert.NotContains(t, user.AutoGroups, "jwt-grp")
+		})
 	})
 }
diff --git a/management/server/affected_peers_oldstate_test.go b/management/server/affected_peers_oldstate_test.go
index bcb78a660..bfc0a51b9 100644
--- a/management/server/affected_peers_oldstate_test.go
+++ b/management/server/affected_peers_oldstate_test.go
@@ -24,120 +24,124 @@ import (
 // detaching one of them must still refresh that group's policy source peers, even
 // though the post-update resource no longer maps to it.
 func TestAffectedPeers_E2E_UpdateResource_DetachGroup_RefreshesOldGroupSources(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	// A second resource group + a second source group/peer that reaches the
-	// resource only through that second group.
-	const detachGroupID = "rs-detach-grp"
-	require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{ID: detachGroupID, Name: "rs-detach"}))
+		// A second resource group + a second source group/peer that reaches the
+		// resource only through that second group.
+		const detachGroupID = "rs-detach-grp"
+		require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{ID: detachGroupID, Name: "rs-detach"}))
 
-	const secondSourceGroupID = "rs-source-grp-2"
-	setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-detach-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
-	require.NoError(t, err)
-	secondSourcePeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
-	require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{
-		ID: secondSourceGroupID, Name: "rs-source-2", Peers: []string{secondSourcePeer.ID},
-	}))
+		const secondSourceGroupID = "rs-source-grp-2"
+		setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-detach-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
+		require.NoError(t, err)
+		secondSourcePeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
+		require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{
+			ID: secondSourceGroupID, Name: "rs-source-2", Peers: []string{secondSourcePeer.ID},
+		}))
 
-	resourcesManager, _, _ := s.managers()
+		resourcesManager, _, _ := s.managers()
 
-	// Attach the resource to the detach group as well: now in [resourceGroup, detachGroup].
-	_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
-		ID:        s.resourceID,
-		AccountID: s.accountID,
-		NetworkID: s.networkID,
-		Name:      "rs-resource-host",
-		Address:   "10.20.30.0/24",
-		GroupIDs:  []string{s.resourceGroupID, detachGroupID},
-		Enabled:   true,
+		// Attach the resource to the detach group as well: now in [resourceGroup, detachGroup].
+		_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
+			ID:        s.resourceID,
+			AccountID: s.accountID,
+			NetworkID: s.networkID,
+			Name:      "rs-resource-host",
+			Address:   "10.20.30.0/24",
+			GroupIDs:  []string{s.resourceGroupID, detachGroupID},
+			Enabled:   true,
+		})
+		require.NoError(t, err)
+
+		// Policy granting the second source group access via the detach group.
+		_, err = s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(secondSourceGroupID, detachGroupID), true)
+		require.NoError(t, err)
+
+		secondSrcCh := s.updateManager.CreateChannel(ctx, secondSourcePeer.ID)
+		t.Cleanup(func() { s.updateManager.CloseChannel(ctx, secondSourcePeer.ID) })
+		settleAffectedUpdates(secondSrcCh)
+
+		done := make(chan struct{})
+		go func() {
+			// Detaching the resource from detachGroup removes the second source's
+			// access; that source peer must be refreshed even though the post-update
+			// resource no longer maps to detachGroup.
+			peerShouldReceiveUpdate(t, secondSrcCh)
+			close(done)
+		}()
+
+		_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
+			ID:        s.resourceID,
+			AccountID: s.accountID,
+			NetworkID: s.networkID,
+			Name:      "rs-resource-host",
+			Address:   "10.20.30.0/24",
+			GroupIDs:  []string{s.resourceGroupID}, // detached detachGroup
+			Enabled:   true,
+		})
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: detaching a resource group did not refresh the old group's policy source peer")
+		}
 	})
-	require.NoError(t, err)
-
-	// Policy granting the second source group access via the detach group.
-	_, err = s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(secondSourceGroupID, detachGroupID), true)
-	require.NoError(t, err)
-
-	secondSrcCh := s.updateManager.CreateChannel(ctx, secondSourcePeer.ID)
-	t.Cleanup(func() { s.updateManager.CloseChannel(ctx, secondSourcePeer.ID) })
-	settleAffectedUpdates(secondSrcCh)
-
-	done := make(chan struct{})
-	go func() {
-		// Detaching the resource from detachGroup removes the second source's
-		// access; that source peer must be refreshed even though the post-update
-		// resource no longer maps to detachGroup.
-		peerShouldReceiveUpdate(t, secondSrcCh)
-		close(done)
-	}()
-
-	_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
-		ID:        s.resourceID,
-		AccountID: s.accountID,
-		NetworkID: s.networkID,
-		Name:      "rs-resource-host",
-		Address:   "10.20.30.0/24",
-		GroupIDs:  []string{s.resourceGroupID}, // detached detachGroup
-		Enabled:   true,
-	})
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: detaching a resource group did not refresh the old group's policy source peer")
-	}
 }
 
 // TestAffectedPeers_E2E_UpdateRouter_RepointPeer_RefreshesOldRoutingPeer:
 // changing router.Peer within the same network must still refresh the OLD routing
 // peer, which loses its routing role.
 func TestAffectedPeers_E2E_UpdateRouter_RepointPeer_RefreshesOldRoutingPeer(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
 
-	_, routersManager, _ := s.managers()
+		_, routersManager, _ := s.managers()
 
-	routers, err := s.manager.Store.GetNetworkRoutersByNetID(ctx, store.LockingStrengthNone, s.accountID, s.networkID)
-	require.NoError(t, err)
-	require.Len(t, routers, 1)
-	router := routers[0]
-	oldRoutingPeer := router.Peer
-	require.NotEmpty(t, oldRoutingPeer)
+		routers, err := s.manager.Store.GetNetworkRoutersByNetID(ctx, store.LockingStrengthNone, s.accountID, s.networkID)
+		require.NoError(t, err)
+		require.Len(t, routers, 1)
+		router := routers[0]
+		oldRoutingPeer := router.Peer
+		require.NotEmpty(t, oldRoutingPeer)
 
-	// A new peer to become the routing peer in place of the old one.
-	setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-newrouter-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
-	require.NoError(t, err)
-	newRoutingPeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
+		// A new peer to become the routing peer in place of the old one.
+		setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-newrouter-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
+		require.NoError(t, err)
+		newRoutingPeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
 
-	oldCh := s.updateManager.CreateChannel(ctx, oldRoutingPeer)
-	t.Cleanup(func() { s.updateManager.CloseChannel(ctx, oldRoutingPeer) })
-	settleAffectedUpdates(oldCh)
+		oldCh := s.updateManager.CreateChannel(ctx, oldRoutingPeer)
+		t.Cleanup(func() { s.updateManager.CloseChannel(ctx, oldRoutingPeer) })
+		settleAffectedUpdates(oldCh)
 
-	done := make(chan struct{})
-	go func() {
-		// The old routing peer stops serving the resource and must be refreshed.
-		peerShouldReceiveUpdate(t, oldCh)
-		close(done)
-	}()
+		done := make(chan struct{})
+		go func() {
+			// The old routing peer stops serving the resource and must be refreshed.
+			peerShouldReceiveUpdate(t, oldCh)
+			close(done)
+		}()
 
-	_, err = routersManager.UpdateRouter(ctx, userID, &routerTypes.NetworkRouter{
-		ID:         router.ID,
-		NetworkID:  s.networkID,
-		AccountID:  s.accountID,
-		Peer:       newRoutingPeer.ID, // repoint within the same network
-		Masquerade: true,
-		Metric:     9999,
-		Enabled:    true,
+		_, err = routersManager.UpdateRouter(ctx, userID, &routerTypes.NetworkRouter{
+			ID:         router.ID,
+			NetworkID:  s.networkID,
+			AccountID:  s.accountID,
+			Peer:       newRoutingPeer.ID, // repoint within the same network
+			Masquerade: true,
+			Metric:     9999,
+			Enabled:    true,
+		})
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: re-pointing the router peer did not refresh the old routing peer")
+		}
 	})
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: re-pointing the router peer did not refresh the old routing peer")
-	}
 }
diff --git a/management/server/affected_peers_router_paths_test.go b/management/server/affected_peers_router_paths_test.go
index d5868a5c1..185c03ddb 100644
--- a/management/server/affected_peers_router_paths_test.go
+++ b/management/server/affected_peers_router_paths_test.go
@@ -165,148 +165,154 @@ func (s *routerScenario) createPostureCheckGatedPolicy(t *testing.T, ctx context
 }
 
 func TestAffectedPeers_E2E_SavePostureCheck_RefreshesRoutingPeer(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	checkID := s.createPostureCheckGatedPolicy(t, ctx, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID))
+		checkID := s.createPostureCheckGatedPolicy(t, ctx, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID))
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
-		s.updateManager.CloseChannel(ctx, s.unrelatedPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+			s.updateManager.CloseChannel(ctx, s.unrelatedPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh, unrelatedCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			peerShouldNotReceiveUpdate(t, unrelatedCh)
+			close(done)
+		}()
+
+		_, err := s.manager.SavePostureChecks(ctx, s.accountID, userID, &posture.Checks{
+			ID:   checkID,
+			Name: "rs-min-version",
+			Checks: posture.ChecksDefinition{
+				NBVersionCheck: &posture.NBVersionCheck{MinVersion: "0.31.0"},
+			},
+		}, false)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: editing a posture check did not refresh source + routing peers")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh, unrelatedCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		peerShouldNotReceiveUpdate(t, unrelatedCh)
-		close(done)
-	}()
-
-	_, err := s.manager.SavePostureChecks(ctx, s.accountID, userID, &posture.Checks{
-		ID:   checkID,
-		Name: "rs-min-version",
-		Checks: posture.ChecksDefinition{
-			NBVersionCheck: &posture.NBVersionCheck{MinVersion: "0.31.0"},
-		},
-	}, false)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: editing a posture check did not refresh source + routing peers")
-	}
 }
 
 func TestAffectedPeers_E2E_UpdateResource_DestinationResourcePolicy_RefreshesSourcePeer(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true)
-	require.NoError(t, err)
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true)
+		require.NoError(t, err)
 
-	resourcesManager, _, _ := s.managers()
+		resourcesManager, _, _ := s.managers()
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
-		s.updateManager.CloseChannel(ctx, s.unrelatedPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+			s.updateManager.CloseChannel(ctx, s.unrelatedPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh, unrelatedCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			peerShouldNotReceiveUpdate(t, unrelatedCh)
+			close(done)
+		}()
+
+		_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
+			ID:        s.resourceID,
+			AccountID: s.accountID,
+			NetworkID: s.networkID,
+			Name:      "rs-resource-host",
+			Address:   "10.20.30.0/25",
+			GroupIDs:  []string{s.resourceGroupID},
+			Enabled:   true,
+		})
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: updating a DestinationResource-targeted resource did not refresh its policy source peer")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh, unrelatedCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		peerShouldNotReceiveUpdate(t, unrelatedCh)
-		close(done)
-	}()
-
-	_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
-		ID:        s.resourceID,
-		AccountID: s.accountID,
-		NetworkID: s.networkID,
-		Name:      "rs-resource-host",
-		Address:   "10.20.30.0/25",
-		GroupIDs:  []string{s.resourceGroupID},
-		Enabled:   true,
-	})
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: updating a DestinationResource-targeted resource did not refresh its policy source peer")
-	}
 }
 
 // A disabled sibling router routes to nobody, so updating a resource on its network
 // must NOT refresh its peer (the enabled router carries the bridge instead).
 func TestAffectedPeers_E2E_UpdateResource_DisabledSiblingRouterNotBridged(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
 
-	resourcesManager, routersManager, _ := s.managers()
+		resourcesManager, routersManager, _ := s.managers()
 
-	setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-key-disabled", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
-	require.NoError(t, err)
-	disabledRouterPeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
-	_, err = routersManager.CreateRouter(ctx, userID, &routerTypes.NetworkRouter{
-		NetworkID:  s.networkID,
-		AccountID:  s.accountID,
-		Peer:       disabledRouterPeer.ID,
-		Masquerade: true,
-		Metric:     9000,
-		Enabled:    false,
+		setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-key-disabled", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
+		require.NoError(t, err)
+		disabledRouterPeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
+		_, err = routersManager.CreateRouter(ctx, userID, &routerTypes.NetworkRouter{
+			NetworkID:  s.networkID,
+			AccountID:  s.accountID,
+			Peer:       disabledRouterPeer.ID,
+			Masquerade: true,
+			Metric:     9000,
+			Enabled:    false,
+		})
+		require.NoError(t, err)
+
+		disabledCh := s.updateManager.CreateChannel(ctx, disabledRouterPeer.ID)
+		enabledCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, disabledRouterPeer.ID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		})
+
+		settleAffectedUpdates(disabledCh, enabledCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, enabledCh)
+			peerShouldNotReceiveUpdate(t, disabledCh)
+			close(done)
+		}()
+
+		_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
+			ID:        s.resourceID,
+			AccountID: s.accountID,
+			NetworkID: s.networkID,
+			Name:      "rs-resource-host",
+			Address:   "10.20.30.0/25",
+			GroupIDs:  []string{s.resourceGroupID},
+			Enabled:   true,
+		})
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout")
+		}
 	})
-	require.NoError(t, err)
-
-	disabledCh := s.updateManager.CreateChannel(ctx, disabledRouterPeer.ID)
-	enabledCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, disabledRouterPeer.ID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
-	})
-
-	settleAffectedUpdates(disabledCh, enabledCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, enabledCh)
-		peerShouldNotReceiveUpdate(t, disabledCh)
-		close(done)
-	}()
-
-	_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
-		ID:        s.resourceID,
-		AccountID: s.accountID,
-		NetworkID: s.networkID,
-		Name:      "rs-resource-host",
-		Address:   "10.20.30.0/25",
-		GroupIDs:  []string{s.resourceGroupID},
-		Enabled:   true,
-	})
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout")
-	}
 }
 
 func TestAffectedPeers_GroupChange_RouterInOtherNetworkNotAffected(t *testing.T) {
@@ -346,8 +352,10 @@ func TestAffectedPeers_PeerChange_RouterInOtherNetworkNotAffected(t *testing.T)
 // shortcut (the denied peer's map holds no router) and the allow direction
 // depends on which meta field moved, leaving the routers with a stale map.
 func TestAffectedPeers_E2E_PostureFlip_RefreshesRoutingPeer(t *testing.T) {
-	runPostureFlipRefreshesRoutingPeer(t, func(s *routerScenario) *types.Policy {
-		return peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		runPostureFlipRefreshesRoutingPeer(t, func(s *routerScenario) *types.Policy {
+			return peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID)
+		})
 	})
 }
 
@@ -355,8 +363,10 @@ func TestAffectedPeers_E2E_PostureFlip_RefreshesRoutingPeer(t *testing.T) {
 // scenario with the source peer named directly in the rule: it must receive its posture
 // checks and have its flips detected exactly like a group member.
 func TestAffectedPeers_E2E_PostureFlip_DirectSourcePeer_RefreshesRoutingPeer(t *testing.T) {
-	runPostureFlipRefreshesRoutingPeer(t, func(s *routerScenario) *types.Policy {
-		return peerToResourcePolicyByPeer(s.sourcePeerID, s.resourceGroupID)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		runPostureFlipRefreshesRoutingPeer(t, func(s *routerScenario) *types.Policy {
+			return peerToResourcePolicyByPeer(s.sourcePeerID, s.resourceGroupID)
+		})
 	})
 }
 
diff --git a/management/server/affected_peers_router_test.go b/management/server/affected_peers_router_test.go
index 7e3f02b27..e2bdff4ad 100644
--- a/management/server/affected_peers_router_test.go
+++ b/management/server/affected_peers_router_test.go
@@ -8,7 +8,6 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/update_channel"
 	"github.com/netbirdio/netbird/management/server/affectedpeers"
 	"github.com/netbirdio/netbird/management/server/groups"
@@ -320,190 +319,189 @@ func TestAffectedPeers_PolicyToResource_UnrelatedPeerNotAffected(t *testing.T) {
 }
 
 func TestAffectedPeers_ResourceSideBridgesToRoutingPeer_DirectRouter(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	// A pre-existing policy grants the source group access to the resource.
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
+		// A pre-existing policy grants the source group access to the resource.
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
 
-	// Drive an update through the resource manager and assert the routing peer
-	// is among the affected set by observing the channel. This path walks
-	// policies whose destinations reference the resource's groups, folds in the
-	// source groups, and loads the network's routers, so it reaches both the
-	// source peer and the routing peer.
-	permissionsManager := permissions.NewManager(s.manager.Store)
-	groupsManager := groups.NewManager(s.manager.Store, permissionsManager, s.manager)
-	rm := resources.NewManager(s.manager.Store, permissionsManager, groupsManager, s.manager, s.manager.serviceManager)
+		// Drive an update through the resource manager and assert the routing peer
+		// is among the affected set by observing the channel. This path walks
+		// policies whose destinations reference the resource's groups, folds in the
+		// source groups, and loads the network's routers, so it reaches both the
+		// source peer and the routing peer.
+		permissionsManager := permissions.NewManager(s.manager.Store)
+		groupsManager := groups.NewManager(s.manager.Store, permissionsManager, s.manager)
+		rm := resources.NewManager(s.manager.Store, permissionsManager, groupsManager, s.manager, s.manager.serviceManager)
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			close(done)
+		}()
+
+		_, err = rm.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
+			ID:        s.resourceID,
+			AccountID: s.accountID,
+			NetworkID: s.networkID,
+			Name:      "rs-resource-host",
+			Address:   "10.20.30.0/24",
+			GroupIDs:  []string{s.resourceGroupID},
+			Enabled:   true,
+		})
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: resource update did not refresh source peer + routing peer")
+		}
 	})
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		close(done)
-	}()
-
-	_, err = rm.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
-		ID:        s.resourceID,
-		AccountID: s.accountID,
-		NetworkID: s.networkID,
-		Name:      "rs-resource-host",
-		Address:   "10.20.30.0/24",
-		GroupIDs:  []string{s.resourceGroupID},
-		Enabled:   true,
-	})
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: resource update did not refresh source peer + routing peer")
-	}
-}
-
-// settleAffectedUpdates waits for in-flight async updates to arrive, then drains
-// every given channel so subsequent assertions start from a clean slate.
-//
-// Setup (CreateNetwork/CreateResource/CreateRouter) fires async UpdateAffectedPeers
-// goroutines; draining first means the assertion only observes updates from the
-// action under test, not setup stragglers.
-func settleAffectedUpdates(chans ...<-chan *network_map.UpdateMessage) {
-	time.Sleep(300 * time.Millisecond)
-	for _, ch := range chans {
-		drainPeerUpdates(ch)
-	}
 }
 
 func TestAffectedPeers_E2E_CreatePolicy_RoutingPeer_DirectRouter(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
-		s.updateManager.CloseChannel(ctx, s.unrelatedPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+			s.updateManager.CloseChannel(ctx, s.unrelatedPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh, unrelatedCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			peerShouldNotReceiveUpdate(t, unrelatedCh)
+			close(done)
+		}()
+
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: creating peer->resource policy did not refresh the routing peer")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh, unrelatedCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		peerShouldNotReceiveUpdate(t, unrelatedCh)
-		close(done)
-	}()
-
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: creating peer->resource policy did not refresh the routing peer")
-	}
 }
 
 func TestAffectedPeers_E2E_CreatePolicy_RoutingPeer_RouterPeerGroups(t *testing.T) {
-	s := setupRouterScenario(t, false)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, false)
+		ctx := context.Background()
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerGroupPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerGroupPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerGroupPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerGroupPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			close(done)
+		}()
+
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: routing peer (PeerGroups) not refreshed on policy create")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		close(done)
-	}()
-
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: routing peer (PeerGroups) not refreshed on policy create")
-	}
 }
 
 func TestAffectedPeers_E2E_DestResource_RoutingPeer(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			close(done)
+		}()
+
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: routing peer not refreshed when policy targets DestinationResource")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		close(done)
-	}()
-
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: routing peer not refreshed when policy targets DestinationResource")
-	}
 }
 
 func TestAffectedPeers_E2E_DeletePolicy_RoutingPeer(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
+		policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			close(done)
+		}()
+
+		require.NoError(t, s.manager.DeletePolicy(ctx, s.accountID, policy.ID, userID))
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: deleting peer->resource policy did not refresh the routing peer")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		close(done)
-	}()
-
-	require.NoError(t, s.manager.DeletePolicy(ctx, s.accountID, policy.ID, userID))
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: deleting peer->resource policy did not refresh the routing peer")
-	}
 }
 
 func (s *routerScenario) managers() (resources.Manager, routers.Manager, networks.Manager) {
@@ -572,113 +570,119 @@ func (s *routerScenario) addSecondTopology(t *testing.T, suffix string) secondTo
 }
 
 func TestAffectedPeers_E2E_UpdatePolicy_BothRoutingPeers(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	second := s.addSecondTopology(t, "b")
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		second := s.addSecondTopology(t, "b")
+		ctx := context.Background()
 
-	policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
+		policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerACh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	routerBCh := s.updateManager.CreateChannel(ctx, second.routerPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
-		s.updateManager.CloseChannel(ctx, second.routerPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerACh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		routerBCh := s.updateManager.CreateChannel(ctx, second.routerPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+			s.updateManager.CloseChannel(ctx, second.routerPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerACh, routerBCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerACh)
+			peerShouldReceiveUpdate(t, routerBCh)
+			close(done)
+		}()
+
+		policy.Rules[0].Destinations = []string{second.resourceGroupID}
+		_, err = s.manager.SavePolicy(ctx, s.accountID, userID, policy, false)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: re-pointing the policy destination did not refresh both routing peers")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerACh, routerBCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerACh)
-		peerShouldReceiveUpdate(t, routerBCh)
-		close(done)
-	}()
-
-	policy.Rules[0].Destinations = []string{second.resourceGroupID}
-	_, err = s.manager.SavePolicy(ctx, s.accountID, userID, policy, false)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: re-pointing the policy destination did not refresh both routing peers")
-	}
 }
 
 func TestAffectedPeers_E2E_UpdatePolicy_AddSource(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	const secondSourceGroupID = "rs-source-grp-2"
-	setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-key-2", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
-	require.NoError(t, err)
-	secondSourcePeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
-	require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{
-		ID: secondSourceGroupID, Name: "rs-source-2", Peers: []string{secondSourcePeer.ID},
-	}))
+		const secondSourceGroupID = "rs-source-grp-2"
+		setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-key-2", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
+		require.NoError(t, err)
+		secondSourcePeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
+		require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{
+			ID: secondSourceGroupID, Name: "rs-source-2", Peers: []string{secondSourcePeer.ID},
+		}))
 
-	policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
+		policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
 
-	newSrcCh := s.updateManager.CreateChannel(ctx, secondSourcePeer.ID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, secondSourcePeer.ID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		newSrcCh := s.updateManager.CreateChannel(ctx, secondSourcePeer.ID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, secondSourcePeer.ID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		})
+
+		settleAffectedUpdates(newSrcCh, routerCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, newSrcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			close(done)
+		}()
+
+		policy.Rules[0].Sources = []string{s.sourceGroupID, secondSourceGroupID}
+		_, err = s.manager.SavePolicy(ctx, s.accountID, userID, policy, false)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: adding a source group did not refresh the new source peer + routing peer")
+		}
 	})
-
-	settleAffectedUpdates(newSrcCh, routerCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, newSrcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		close(done)
-	}()
-
-	policy.Rules[0].Sources = []string{s.sourceGroupID, secondSourceGroupID}
-	_, err = s.manager.SavePolicy(ctx, s.accountID, userID, policy, false)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: adding a source group did not refresh the new source peer + routing peer")
-	}
 }
 
 func TestAffectedPeers_E2E_DestResource_RouterPeerGroups(t *testing.T) {
-	s := setupRouterScenario(t, false)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, false)
+		ctx := context.Background()
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerGroupPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerGroupPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerGroupPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerGroupPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			close(done)
+		}()
+
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: DestinationResource policy with PeerGroups router did not refresh the routing peer")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		close(done)
-	}()
-
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: DestinationResource policy with PeerGroups router did not refresh the routing peer")
-	}
 }
 
 func TestAffectedPeers_AllRoutingPeers_Network(t *testing.T) {
diff --git a/management/server/affected_peers_test.go b/management/server/affected_peers_test.go
index 235128693..90408f70a 100644
--- a/management/server/affected_peers_test.go
+++ b/management/server/affected_peers_test.go
@@ -955,73 +955,77 @@ func TestAffectedPeers_IsolatedRouteAndPolicy(t *testing.T) {
 }
 
 func TestAffectedPeers_GroupUpdateOnlyAffectsLinkedPeers(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
-	}
-
-	for _, g := range []*types.Group{
-		{ID: "ap-grpA", Name: "AP-A", Peers: []string{peer1.ID}},
-		{ID: "ap-grpB", Name: "AP-B", Peers: []string{peer2.ID}},
-		{ID: "ap-grpC", Name: "AP-C", Peers: []string{peer3.ID}},
-	} {
-		err := manager.CreateGroup(ctx, accountID, userID, g)
-		require.NoError(t, err)
-	}
-
-	_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
-			{
-				Enabled:       true,
-				Sources:       []string{"ap-grpA"},
-				Destinations:  []string{"ap-grpB"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
-			},
-		},
-	}, true)
-	require.NoError(t, err)
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	result := manager.resolveAffectedPeersForPeerChanges(ctx, manager.Store, accountID, []string{peer1.ID})
-	assert.ElementsMatch(t, []string{peer1.ID, peer2.ID}, result)
-
-	t.Run("group change updates all peers in policy groups", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			peerShouldReceiveUpdate(t, updMsg2)
-			peerShouldReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		err := manager.UpdateGroup(ctx, accountID, userID, &types.Group{
-			ID:    "ap-grpA",
-			Name:  "AP-A",
-			Peers: []string{peer1.ID, peer3.ID},
-		})
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
 		}
+
+		for _, g := range []*types.Group{
+			{ID: "ap-grpA", Name: "AP-A", Peers: []string{peer1.ID}},
+			{ID: "ap-grpB", Name: "AP-B", Peers: []string{peer2.ID}},
+			{ID: "ap-grpC", Name: "AP-C", Peers: []string{peer3.ID}},
+		} {
+			err := manager.CreateGroup(ctx, accountID, userID, g)
+			require.NoError(t, err)
+		}
+
+		_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+			Enabled: true,
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"ap-grpA"},
+					Destinations:  []string{"ap-grpB"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
+			},
+		}, true)
+		require.NoError(t, err)
+
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		result := manager.resolveAffectedPeersForPeerChanges(ctx, manager.Store, accountID, []string{peer1.ID})
+		assert.ElementsMatch(t, []string{peer1.ID, peer2.ID}, result)
+
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "group change updates all peers in policy groups", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				peerShouldReceiveUpdate(t, updMsg2)
+				peerShouldReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			err := manager.UpdateGroup(ctx, accountID, userID, &types.Group{
+				ID:    "ap-grpA",
+				Name:  "AP-A",
+				Peers: []string{peer1.ID, peer3.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
@@ -1037,243 +1041,259 @@ func TestAffectedPeers_UnlinkedPeerChange_RefreshesSelfOnly(t *testing.T) {
 // TestAffectedPeers_PolicyChange_UnrelatedPeerNoUpdate verifies that creating/deleting a
 // policy only sends updates to peers in the policy's groups, not to unrelated peers.
 func TestAffectedPeers_PolicyChange_UnrelatedPeerNoUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
-	}
-
-	for _, g := range []*types.Group{
-		{ID: "pol-grpA", Name: "Pol-A", Peers: []string{peer1.ID}},
-		{ID: "pol-grpB", Name: "Pol-B", Peers: []string{peer2.ID}},
-		{ID: "pol-grpC", Name: "Pol-C", Peers: []string{peer3.ID}},
-	} {
-		err := manager.CreateGroup(ctx, accountID, userID, g)
-		require.NoError(t, err)
-	}
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("create policy only affects linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			peerShouldReceiveUpdate(t, updMsg2)
-			peerShouldNotReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		_, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-			Enabled: true,
-			Rules: []*types.PolicyRule{
-				{
-					Enabled:       true,
-					Sources:       []string{"pol-grpA"},
-					Destinations:  []string{"pol-grpB"},
-					Bidirectional: true,
-					Action:        types.PolicyTrafficActionAccept,
-				},
-			},
-		}, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
 		}
+
+		for _, g := range []*types.Group{
+			{ID: "pol-grpA", Name: "Pol-A", Peers: []string{peer1.ID}},
+			{ID: "pol-grpB", Name: "Pol-B", Peers: []string{peer2.ID}},
+			{ID: "pol-grpC", Name: "Pol-C", Peers: []string{peer3.ID}},
+		} {
+			err := manager.CreateGroup(ctx, accountID, userID, g)
+			require.NoError(t, err)
+		}
+
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "create policy only affects linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				peerShouldReceiveUpdate(t, updMsg2)
+				peerShouldNotReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			_, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+				Enabled: true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"pol-grpA"},
+						Destinations:  []string{"pol-grpB"},
+						Bidirectional: true,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+			}, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
 // TestAffectedPeers_RouteChange_UnrelatedPeerNoUpdate verifies that creating a route
 // only sends updates to peers in the route's groups, not to unrelated peers.
 func TestAffectedPeers_RouteChange_UnrelatedPeerNoUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
-	}
-
-	for _, g := range []*types.Group{
-		{ID: "rt-grpA", Name: "Rt-A", Peers: []string{peer1.ID}},
-		{ID: "rt-grpB", Name: "Rt-B", Peers: []string{peer2.ID}},
-		{ID: "rt-grpC", Name: "Rt-C", Peers: []string{peer3.ID}},
-	} {
-		err := manager.CreateGroup(ctx, accountID, userID, g)
-		require.NoError(t, err)
-	}
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("create route only affects linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			peerShouldReceiveUpdate(t, updMsg2)
-			peerShouldNotReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		_, err := manager.CreateRoute(ctx, accountID,
-			netip.MustParsePrefix("10.10.0.0/24"),
-			route.IPv4Network,
-			nil,
-			"",
-			[]string{"rt-grpA"},
-			"test route",
-			"routenoaffect",
-			false,
-			9999,
-			[]string{"rt-grpB"},
-			nil,
-			true,
-			userID,
-			false,
-			false,
-		)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
 		}
+
+		for _, g := range []*types.Group{
+			{ID: "rt-grpA", Name: "Rt-A", Peers: []string{peer1.ID}},
+			{ID: "rt-grpB", Name: "Rt-B", Peers: []string{peer2.ID}},
+			{ID: "rt-grpC", Name: "Rt-C", Peers: []string{peer3.ID}},
+		} {
+			err := manager.CreateGroup(ctx, accountID, userID, g)
+			require.NoError(t, err)
+		}
+
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "create route only affects linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				peerShouldReceiveUpdate(t, updMsg2)
+				peerShouldNotReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			_, err := manager.CreateRoute(ctx, accountID,
+				netip.MustParsePrefix("10.10.0.0/24"),
+				route.IPv4Network,
+				nil,
+				"",
+				[]string{"rt-grpA"},
+				"test route",
+				"routenoaffect",
+				false,
+				9999,
+				[]string{"rt-grpB"},
+				nil,
+				true,
+				userID,
+				false,
+				false,
+			)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
 // TestAffectedPeers_NameServerChange_UnrelatedPeerNoUpdate verifies that creating a
 // nameserver group only sends updates to peers in its groups, not to unrelated peers.
 func TestAffectedPeers_NameServerChange_UnrelatedPeerNoUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
-	}
-
-	for _, g := range []*types.Group{
-		{ID: "ns-grpA", Name: "NS-A", Peers: []string{peer1.ID}},
-		{ID: "ns-grpB", Name: "NS-B", Peers: []string{peer2.ID}},
-	} {
-		err := manager.CreateGroup(ctx, accountID, userID, g)
-		require.NoError(t, err)
-	}
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("create nameserver group only affects linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			peerShouldNotReceiveUpdate(t, updMsg2)
-			peerShouldNotReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		_, err := manager.CreateNameServerGroup(ctx, accountID, "ns-unrelated", "NS Unrelated",
-			[]nbdns.NameServer{{
-				IP:     netip.MustParseAddr("1.1.1.1"),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			}},
-			[]string{"ns-grpA"},
-			true, nil, true, userID, false,
-		)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
 		}
+
+		for _, g := range []*types.Group{
+			{ID: "ns-grpA", Name: "NS-A", Peers: []string{peer1.ID}},
+			{ID: "ns-grpB", Name: "NS-B", Peers: []string{peer2.ID}},
+		} {
+			err := manager.CreateGroup(ctx, accountID, userID, g)
+			require.NoError(t, err)
+		}
+
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "create nameserver group only affects linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				peerShouldNotReceiveUpdate(t, updMsg2)
+				peerShouldNotReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			_, err := manager.CreateNameServerGroup(ctx, accountID, "ns-unrelated", "NS Unrelated",
+				[]nbdns.NameServer{{
+					IP:     netip.MustParseAddr("1.1.1.1"),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				}},
+				[]string{"ns-grpA"},
+				true, nil, true, userID, false,
+			)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
 // TestAffectedPeers_DNSSettingsChange_UnrelatedPeerNoUpdate verifies that changing DNS
 // settings only sends updates to peers in the affected groups, not to unrelated peers.
 func TestAffectedPeers_DNSSettingsChange_UnrelatedPeerNoUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
-	}
-
-	for _, g := range []*types.Group{
-		{ID: "dns-grpA", Name: "DNS-A", Peers: []string{peer1.ID}},
-		{ID: "dns-grpB", Name: "DNS-B", Peers: []string{peer2.ID}},
-	} {
-		err := manager.CreateGroup(ctx, accountID, userID, g)
-		require.NoError(t, err)
-	}
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("dns settings change only affects linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			peerShouldNotReceiveUpdate(t, updMsg2)
-			peerShouldNotReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		err := manager.SaveDNSSettings(ctx, accountID, userID, &types.DNSSettings{
-			DisabledManagementGroups: []string{"dns-grpA"},
-		})
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
 		}
+
+		for _, g := range []*types.Group{
+			{ID: "dns-grpA", Name: "DNS-A", Peers: []string{peer1.ID}},
+			{ID: "dns-grpB", Name: "DNS-B", Peers: []string{peer2.ID}},
+		} {
+			err := manager.CreateGroup(ctx, accountID, userID, g)
+			require.NoError(t, err)
+		}
+
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "dns settings change only affects linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				peerShouldNotReceiveUpdate(t, updMsg2)
+				peerShouldNotReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			err := manager.SaveDNSSettings(ctx, accountID, userID, &types.DNSSettings{
+				DisabledManagementGroups: []string{"dns-grpA"},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
@@ -1281,429 +1301,451 @@ func TestAffectedPeers_DNSSettingsChange_UnrelatedPeerNoUpdate(t *testing.T) {
 // updating a group that is NOT referenced by any policy/route/ns/dns should not send
 // updates to any peer.
 func TestAffectedPeers_UnlinkedGroupChange_NoUpdateIntegration(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
-	}
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
+		}
 
-	err = manager.CreateGroup(ctx, accountID, userID, &types.Group{
-		ID:    "unlinked-grp",
-		Name:  "Unlinked",
-		Peers: []string{peer1.ID},
-	})
-	require.NoError(t, err)
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("updating unlinked group sends no peer updates", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg1)
-			peerShouldNotReceiveUpdate(t, updMsg2)
-			peerShouldNotReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		err := manager.UpdateGroup(ctx, accountID, userID, &types.Group{
+		err = manager.CreateGroup(ctx, accountID, userID, &types.Group{
 			ID:    "unlinked-grp",
 			Name:  "Unlinked",
-			Peers: []string{peer1.ID, peer2.ID},
+			Peers: []string{peer1.ID},
 		})
-		assert.NoError(t, err)
+		require.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
-		}
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "updating unlinked group sends no peer updates", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg1)
+				peerShouldNotReceiveUpdate(t, updMsg2)
+				peerShouldNotReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			err := manager.UpdateGroup(ctx, accountID, userID, &types.Group{
+				ID:    "unlinked-grp",
+				Name:  "Unlinked",
+				Peers: []string{peer1.ID, peer2.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
 // TestAffectedPeers_NetworkRouterUnlinkedPeerNoUpdate: a network router with peer
 // groups updates only those groups' peers (and resource policy sources), not others.
 func TestAffectedPeers_NetworkRouterUnlinkedPeerNoUpdate(t *testing.T) {
-	// Delete the default policy before adding peers so AddPeer schedules no async
-	// update that races with the test.
-	manager, updateManager, err := createManager(t)
-	require.NoError(t, err)
-
-	ctx := context.Background()
-
-	account, err := createAccount(manager, "nr_test_account", userID, "")
-	require.NoError(t, err)
-	accountID := account.Id
-
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		// Delete the default policy before adding peers so AddPeer schedules no async
+		// update that races with the test.
+		manager, updateManager, err := createManager(t)
 		require.NoError(t, err)
-	}
 
-	setupKey, err := manager.CreateSetupKey(ctx, accountID, "test-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
-	require.NoError(t, err)
+		ctx := context.Background()
 
-	peer1 := addPeerToAccount(t, manager, accountID, setupKey.Key)
-	peer2 := addPeerToAccount(t, manager, accountID, setupKey.Key)
-	peer3 := addPeerToAccount(t, manager, accountID, setupKey.Key)
-
-	for _, g := range []*types.Group{
-		{ID: "nr-grpA", Name: "NR-A", Peers: []string{peer1.ID}},
-		{ID: "nr-grpB", Name: "NR-B", Peers: []string{peer2.ID}},
-	} {
-		err := manager.CreateGroup(ctx, accountID, userID, g)
+		account, err := createAccount(manager, "nr_test_account", userID, "")
 		require.NoError(t, err)
-	}
+		accountID := account.Id
 
-	net1 := &networkTypes.Network{
-		ID:        "nr-net-test",
-		AccountID: accountID,
-		Name:      "nr-test-network",
-	}
-	err = manager.Store.SaveNetwork(ctx, net1)
-	require.NoError(t, err)
-
-	err = manager.Store.CreateNetworkRouter(ctx, &routerTypes.NetworkRouter{
-		ID:         "nr-router-test",
-		NetworkID:  net1.ID,
-		AccountID:  accountID,
-		PeerGroups: []string{"nr-grpA"},
-		Enabled:    true,
-	})
-	require.NoError(t, err)
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("network router group change only affects linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			peerShouldNotReceiveUpdate(t, updMsg2)
-			peerShouldReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		err = manager.UpdateGroup(ctx, accountID, userID, &types.Group{
-			ID:    "nr-grpA",
-			Name:  "NR-A",
-			Peers: []string{peer1.ID, peer3.ID},
-		})
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
+		require.NoError(t, err)
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
 		}
+
+		setupKey, err := manager.CreateSetupKey(ctx, accountID, "test-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
+		require.NoError(t, err)
+
+		peer1 := addPeerToAccount(t, manager, accountID, setupKey.Key)
+		peer2 := addPeerToAccount(t, manager, accountID, setupKey.Key)
+		peer3 := addPeerToAccount(t, manager, accountID, setupKey.Key)
+
+		for _, g := range []*types.Group{
+			{ID: "nr-grpA", Name: "NR-A", Peers: []string{peer1.ID}},
+			{ID: "nr-grpB", Name: "NR-B", Peers: []string{peer2.ID}},
+		} {
+			err := manager.CreateGroup(ctx, accountID, userID, g)
+			require.NoError(t, err)
+		}
+
+		net1 := &networkTypes.Network{
+			ID:        "nr-net-test",
+			AccountID: accountID,
+			Name:      "nr-test-network",
+		}
+		err = manager.Store.SaveNetwork(ctx, net1)
+		require.NoError(t, err)
+
+		err = manager.Store.CreateNetworkRouter(ctx, &routerTypes.NetworkRouter{
+			ID:         "nr-router-test",
+			NetworkID:  net1.ID,
+			AccountID:  accountID,
+			PeerGroups: []string{"nr-grpA"},
+			Enabled:    true,
+		})
+		require.NoError(t, err)
+
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "network router group change only affects linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				peerShouldNotReceiveUpdate(t, updMsg2)
+				peerShouldReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			err = manager.UpdateGroup(ctx, accountID, userID, &types.Group{
+				ID:    "nr-grpA",
+				Name:  "NR-A",
+				Peers: []string{peer1.ID, peer3.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
 // TestAffectedPeers_IsolatedEntitiesOnlyAffectTheirPeers: with a policy (peer1<->peer2)
 // and a separate route (peer3), changing one entity's groups affects only its peers.
 func TestAffectedPeers_IsolatedEntitiesOnlyAffectTheirPeers(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
-	}
-
-	for _, g := range []*types.Group{
-		{ID: "iso-grpA", Name: "ISO-A", Peers: []string{peer1.ID}},
-		{ID: "iso-grpB", Name: "ISO-B", Peers: []string{peer2.ID}},
-		{ID: "iso-grpC", Name: "ISO-C", Peers: []string{peer3.ID}},
-	} {
-		err := manager.CreateGroup(ctx, accountID, userID, g)
-		require.NoError(t, err)
-	}
-
-	_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
-			{
-				Enabled:       true,
-				Sources:       []string{"iso-grpA"},
-				Destinations:  []string{"iso-grpB"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
-			},
-		},
-	}, true)
-	require.NoError(t, err)
-
-	_, err = manager.CreateRoute(ctx, accountID,
-		netip.MustParsePrefix("10.20.0.0/24"),
-		route.IPv4Network,
-		nil,
-		"",
-		[]string{"iso-grpC"},
-		"isolated route",
-		"isonet2",
-		false,
-		9999,
-		[]string{"iso-grpC"},
-		nil,
-		true,
-		userID,
-		false,
-		false,
-	)
-	require.NoError(t, err)
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	// The setup policy/route above dispatch affected-peer updates asynchronously;
-	// drain any in-flight ones so the assertions only observe the UpdateGroup below.
-	settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
-
-	t.Run("policy group change does not affect route-only peer", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			peerShouldReceiveUpdate(t, updMsg2)
-			peerShouldNotReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		err := manager.UpdateGroup(ctx, accountID, userID, &types.Group{
-			ID:    "iso-grpA",
-			Name:  "ISO-A-updated",
-			Peers: []string{peer1.ID},
-		})
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
 		}
+
+		for _, g := range []*types.Group{
+			{ID: "iso-grpA", Name: "ISO-A", Peers: []string{peer1.ID}},
+			{ID: "iso-grpB", Name: "ISO-B", Peers: []string{peer2.ID}},
+			{ID: "iso-grpC", Name: "ISO-C", Peers: []string{peer3.ID}},
+		} {
+			err := manager.CreateGroup(ctx, accountID, userID, g)
+			require.NoError(t, err)
+		}
+
+		_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+			Enabled: true,
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"iso-grpA"},
+					Destinations:  []string{"iso-grpB"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
+			},
+		}, true)
+		require.NoError(t, err)
+
+		_, err = manager.CreateRoute(ctx, accountID,
+			netip.MustParsePrefix("10.20.0.0/24"),
+			route.IPv4Network,
+			nil,
+			"",
+			[]string{"iso-grpC"},
+			"isolated route",
+			"isonet2",
+			false,
+			9999,
+			[]string{"iso-grpC"},
+			nil,
+			true,
+			userID,
+			false,
+			false,
+		)
+		require.NoError(t, err)
+
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		// The setup policy/route above dispatch affected-peer updates asynchronously;
+		// drain any in-flight ones so the assertions only observe the UpdateGroup below.
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "policy group change does not affect route-only peer", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				peerShouldReceiveUpdate(t, updMsg2)
+				peerShouldNotReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			err := manager.UpdateGroup(ctx, accountID, userID, &types.Group{
+				ID:    "iso-grpA",
+				Name:  "ISO-A-updated",
+				Peers: []string{peer1.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
 // TestAffectedPeers_DeleteRoute_UnrelatedPeerNoUpdate verifies that deleting a route
 // only sends updates to peers in the route's groups.
 func TestAffectedPeers_DeleteRoute_UnrelatedPeerNoUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
-	}
-
-	for _, g := range []*types.Group{
-		{ID: "del-rt-grpA", Name: "Del-Rt-A", Peers: []string{peer1.ID}},
-		{ID: "del-rt-grpB", Name: "Del-Rt-B", Peers: []string{peer2.ID}},
-	} {
-		err := manager.CreateGroup(ctx, accountID, userID, g)
-		require.NoError(t, err)
-	}
-
-	newRoute, err := manager.CreateRoute(ctx, accountID,
-		netip.MustParsePrefix("10.30.0.0/24"),
-		route.IPv4Network,
-		nil,
-		"",
-		[]string{"del-rt-grpA"},
-		"deletable route",
-		"delnet",
-		false,
-		9999,
-		[]string{"del-rt-grpB"},
-		nil,
-		true,
-		userID,
-		false,
-		false,
-	)
-	require.NoError(t, err)
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("delete route only affects linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			peerShouldReceiveUpdate(t, updMsg2)
-			peerShouldNotReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		err := manager.DeleteRoute(ctx, accountID, newRoute.ID, userID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
 		}
+
+		for _, g := range []*types.Group{
+			{ID: "del-rt-grpA", Name: "Del-Rt-A", Peers: []string{peer1.ID}},
+			{ID: "del-rt-grpB", Name: "Del-Rt-B", Peers: []string{peer2.ID}},
+		} {
+			err := manager.CreateGroup(ctx, accountID, userID, g)
+			require.NoError(t, err)
+		}
+
+		newRoute, err := manager.CreateRoute(ctx, accountID,
+			netip.MustParsePrefix("10.30.0.0/24"),
+			route.IPv4Network,
+			nil,
+			"",
+			[]string{"del-rt-grpA"},
+			"deletable route",
+			"delnet",
+			false,
+			9999,
+			[]string{"del-rt-grpB"},
+			nil,
+			true,
+			userID,
+			false,
+			false,
+		)
+		require.NoError(t, err)
+
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "delete route only affects linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				peerShouldReceiveUpdate(t, updMsg2)
+				peerShouldNotReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			err := manager.DeleteRoute(ctx, accountID, newRoute.ID, userID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
 // TestAffectedPeers_DeletePolicy_UnrelatedPeerNoUpdate verifies that deleting a policy
 // only sends updates to peers in the policy's groups.
 func TestAffectedPeers_DeletePolicy_UnrelatedPeerNoUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
-	}
-
-	for _, g := range []*types.Group{
-		{ID: "del-pol-grpA", Name: "Del-Pol-A", Peers: []string{peer1.ID}},
-		{ID: "del-pol-grpB", Name: "Del-Pol-B", Peers: []string{peer2.ID}},
-	} {
-		err := manager.CreateGroup(ctx, accountID, userID, g)
-		require.NoError(t, err)
-	}
-
-	policy, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
-			{
-				Enabled:       true,
-				Sources:       []string{"del-pol-grpA"},
-				Destinations:  []string{"del-pol-grpB"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
-			},
-		},
-	}, true)
-	require.NoError(t, err)
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("delete policy only affects linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			peerShouldReceiveUpdate(t, updMsg2)
-			peerShouldNotReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		err := manager.DeletePolicy(ctx, accountID, policy.ID, userID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
 		}
+
+		for _, g := range []*types.Group{
+			{ID: "del-pol-grpA", Name: "Del-Pol-A", Peers: []string{peer1.ID}},
+			{ID: "del-pol-grpB", Name: "Del-Pol-B", Peers: []string{peer2.ID}},
+		} {
+			err := manager.CreateGroup(ctx, accountID, userID, g)
+			require.NoError(t, err)
+		}
+
+		policy, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+			Enabled: true,
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"del-pol-grpA"},
+					Destinations:  []string{"del-pol-grpB"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
+			},
+		}, true)
+		require.NoError(t, err)
+
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "delete policy only affects linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				peerShouldReceiveUpdate(t, updMsg2)
+				peerShouldNotReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			err := manager.DeletePolicy(ctx, accountID, policy.ID, userID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
 // TestAffectedPeers_DeleteNameServer_UnrelatedPeerNoUpdate verifies that deleting a
 // nameserver group only sends updates to peers in its groups.
 func TestAffectedPeers_DeleteNameServer_UnrelatedPeerNoUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
-	}
-
-	err = manager.CreateGroup(ctx, accountID, userID, &types.Group{
-		ID:    "del-ns-grpA",
-		Name:  "Del-NS-A",
-		Peers: []string{peer1.ID},
-	})
-	require.NoError(t, err)
-
-	nsGroup, err := manager.CreateNameServerGroup(ctx, accountID, "del-ns", "Del NS",
-		[]nbdns.NameServer{{
-			IP:     netip.MustParseAddr("8.8.4.4"),
-			NSType: nbdns.UDPNameServerType,
-			Port:   nbdns.DefaultDNSPort,
-		}},
-		[]string{"del-ns-grpA"},
-		true, nil, true, userID, false,
-	)
-	require.NoError(t, err)
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("delete nameserver group only affects linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			peerShouldNotReceiveUpdate(t, updMsg2)
-			peerShouldNotReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		err := manager.DeleteNameServerGroup(ctx, accountID, nsGroup.ID, userID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
 		}
+
+		err = manager.CreateGroup(ctx, accountID, userID, &types.Group{
+			ID:    "del-ns-grpA",
+			Name:  "Del-NS-A",
+			Peers: []string{peer1.ID},
+		})
+		require.NoError(t, err)
+
+		nsGroup, err := manager.CreateNameServerGroup(ctx, accountID, "del-ns", "Del NS",
+			[]nbdns.NameServer{{
+				IP:     netip.MustParseAddr("8.8.4.4"),
+				NSType: nbdns.UDPNameServerType,
+				Port:   nbdns.DefaultDNSPort,
+			}},
+			[]string{"del-ns-grpA"},
+			true, nil, true, userID, false,
+		)
+		require.NoError(t, err)
+
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "delete nameserver group only affects linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				peerShouldNotReceiveUpdate(t, updMsg2)
+				peerShouldNotReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			err := manager.DeleteNameServerGroup(ctx, accountID, nsGroup.ID, userID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
diff --git a/management/server/affected_peers_user_test.go b/management/server/affected_peers_user_test.go
index 3d73bbed0..3f4658de4 100644
--- a/management/server/affected_peers_user_test.go
+++ b/management/server/affected_peers_user_test.go
@@ -17,156 +17,152 @@ import (
 // A user update refreshes only the peers its auto-group change reaches, and a user
 // update that changes no group membership refreshes nobody.
 func TestAffectedPeers_SaveUser_OnlyAffectedPeersUpdated(t *testing.T) {
-	manager, updateManager, account, _, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, _, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	const targetUserID = "target-user"
-	require.NoError(t, manager.Store.SaveUser(ctx, &types.User{
-		Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
-	}))
+		const targetUserID = "target-user"
+		require.NoError(t, manager.Store.SaveUser(ctx, &types.User{
+			Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
+		}))
 
-	key, err := wgtypes.GeneratePrivateKey()
-	require.NoError(t, err)
-	targetPeer, _, _, _, err := manager.AddPeer(ctx, accountID, "", targetUserID, &nbpeer.Peer{
-		Key:  key.PublicKey().String(),
-		Meta: nbpeer.PeerSystemMeta{Hostname: "target-peer"},
-	}, false)
-	require.NoError(t, err)
+		key, err := wgtypes.GeneratePrivateKey()
+		require.NoError(t, err)
+		targetPeer, _, _, _, err := manager.AddPeer(ctx, accountID, "", targetUserID, &nbpeer.Peer{
+			Key:  key.PublicKey().String(),
+			Meta: nbpeer.PeerSystemMeta{Hostname: "target-peer"},
+		}, false)
+		require.NoError(t, err)
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID))
-	}
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
+		require.NoError(t, err)
+		for _, p := range policies {
+			require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID))
+		}
 
-	account, err = manager.Store.GetAccount(ctx, accountID)
-	require.NoError(t, err)
-	account.Settings.GroupsPropagationEnabled = true
-	require.NoError(t, manager.Store.SaveAccount(ctx, account))
+		account, err = manager.Store.GetAccount(ctx, accountID)
+		require.NoError(t, err)
+		account.Settings.GroupsPropagationEnabled = true
+		require.NoError(t, manager.Store.SaveAccount(ctx, account))
 
-	require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-linked", Name: "ug-linked"}))
-	require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-dest", Name: "ug-dest", Peers: []string{peer2.ID}}))
+		require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-linked", Name: "ug-linked"}))
+		require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-dest", Name: "ug-dest", Peers: []string{peer2.ID}}))
 
-	_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
-			{
-				Enabled:       true,
-				Sources:       []string{"ug-linked"},
-				Destinations:  []string{"ug-dest"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
+		_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+			Enabled: true,
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"ug-linked"},
+					Destinations:  []string{"ug-dest"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
 			},
-		},
-	}, true)
-	require.NoError(t, err)
+		}, true)
+		require.NoError(t, err)
 
-	updTarget := updateManager.CreateChannel(ctx, targetPeer.ID)
-	upd2 := updateManager.CreateChannel(ctx, peer2.ID)
-	upd3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, targetPeer.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("auto group change updates only linked peers", func(t *testing.T) {
-		drainPeerUpdates(updTarget)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
-
-		_, err := manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
-			Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
-			AutoGroups: []string{"ug-linked"},
+		updTarget := updateManager.CreateChannel(ctx, targetPeer.ID)
+		upd2 := updateManager.CreateChannel(ctx, peer2.ID)
+		upd3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, targetPeer.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
 		})
-		require.NoError(t, err)
 
-		peerShouldReceiveUpdate(t, updTarget)
-		peerShouldReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
-	})
+		step(t, "auto group change updates only linked peers", func(t *testing.T) {
+			settleAffectedUpdates(updTarget, upd2, upd3)
 
-	t.Run("update without group changes refreshes nobody", func(t *testing.T) {
-		drainPeerUpdates(updTarget)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
+			_, err := manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
+				Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
+				AutoGroups: []string{"ug-linked"},
+			})
+			require.NoError(t, err)
 
-		_, err := manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
-			Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
-			AutoGroups: []string{"ug-linked"}, Name: "renamed",
+			peerShouldReceiveUpdate(t, updTarget)
+			peerShouldReceiveUpdate(t, upd2)
+			peerShouldNotReceiveUpdate(t, upd3)
 		})
-		require.NoError(t, err)
 
-		peerShouldNotReceiveUpdate(t, updTarget)
-		peerShouldNotReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
+		step(t, "update without group changes refreshes nobody", func(t *testing.T) {
+			drainPeerUpdates(updTarget)
+			drainPeerUpdates(upd2)
+			drainPeerUpdates(upd3)
 
-		user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, targetUserID)
-		require.NoError(t, err)
-		assert.Equal(t, "renamed", user.Name)
-	})
+			_, err := manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
+				Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
+				AutoGroups: []string{"ug-linked"}, Name: "renamed",
+			})
+			require.NoError(t, err)
 
-	t.Run("auto group change reassigning IPv6 refreshes the changed peers and their observers", func(t *testing.T) {
-		require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-v6", Name: "ug-v6"}))
-		// Apply through the settings API so the reconciliation that strips the other
+			peerShouldNotReceiveUpdate(t, updTarget)
+			peerShouldNotReceiveUpdate(t, upd2)
+			peerShouldNotReceiveUpdate(t, upd3)
+
+			user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, targetUserID)
+			require.NoError(t, err)
+			assert.Equal(t, "renamed", user.Name)
+		})
+
+		step(t, "auto group change reassigning IPv6 refreshes the changed peers and their observers", func(t *testing.T) {
+
+			require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-v6", Name: "ug-v6"}))// Apply through the settings API so the reconciliation that strips the other
 		// peers' addresses happens here, leaving the target as the only peer the
 		// user update reassigns.
 		updateIPv6TestSettings(t, manager, accountID, func(s *types.Settings) {
 			s.IPv6EnabledGroups = []string{"ug-v6"}
 		})
 
-		drainPeerUpdates(updTarget)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
+			settleAffectedUpdates(updTarget, upd2, upd3)
 
-		_, err = manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
-			Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
-			AutoGroups: []string{"ug-linked", "ug-v6"}, Name: "renamed",
+			_, err = manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
+				Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
+				AutoGroups: []string{"ug-linked", "ug-v6"}, Name: "renamed",
+			})
+			require.NoError(t, err)
+
+			// The reassigned peer refreshes with everyone it can reach: peer2 via the
+			// policy, but not peer3, which shares no group or policy with it.
+			peerShouldReceiveUpdate(t, updTarget)
+			peerShouldReceiveUpdate(t, upd2)
+			peerShouldNotReceiveUpdate(t, upd3)
 		})
-		require.NoError(t, err)
 
-		// The reassigned peer refreshes with everyone it can reach: peer2 via the
-		// policy, but not peer3, which shares no group or policy with it.
-		peerShouldReceiveUpdate(t, updTarget)
-		peerShouldReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
-	})
+		step(t, "unblocking a user refreshes only the SSH rule destinations", func(t *testing.T) {
+			// An SSH rule that authorizes no group of its own ships the account's
+			// allowed-user set to its destinations, so those are the peers an unblock
+			// reaches — not the whole account.
+			_, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+				Enabled: true,
+				Rules: []*types.PolicyRule{{
+					Enabled:      true,
+					Sources:      []string{"ug-linked"},
+					Destinations: []string{"ug-dest"},
+					Protocol:     types.PolicyRuleProtocolNetbirdSSH,
+					Action:       types.PolicyTrafficActionAccept,
+				}},
+			}, true)
+			require.NoError(t, err)
 
-	t.Run("unblocking a user refreshes only the SSH rule destinations", func(t *testing.T) {
-		// An SSH rule that authorizes no group of its own ships the account's
-		// allowed-user set to its destinations, so those are the peers an unblock
-		// reaches — not the whole account.
-		_, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-			Enabled: true,
-			Rules: []*types.PolicyRule{{
-				Enabled:      true,
-				Sources:      []string{"ug-linked"},
-				Destinations: []string{"ug-dest"},
-				Protocol:     types.PolicyRuleProtocolNetbirdSSH,
-				Action:       types.PolicyTrafficActionAccept,
-			}},
-		}, true)
-		require.NoError(t, err)
+			blocked, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, targetUserID)
+			require.NoError(t, err)
+			blocked.Blocked = true
+			require.NoError(t, manager.Store.SaveUser(ctx, blocked))
 
-		blocked, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, targetUserID)
-		require.NoError(t, err)
-		blocked.Blocked = true
-		require.NoError(t, manager.Store.SaveUser(ctx, blocked))
+			settleAffectedUpdates(updTarget, upd2, upd3)
 
-		drainPeerUpdates(updTarget)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
+			// Same auto-groups as the previous subtest left them, so no group change and
+			// no IPv6 reconciliation interferes: the unblock alone drives the refresh.
+			_, err = manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
+				Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
+				AutoGroups: []string{"ug-linked", "ug-v6"}, Name: "renamed",
+			})
+			require.NoError(t, err)
 
-		// Same auto-groups as the previous subtest left them, so no group change and
-		// no IPv6 reconciliation interferes: the unblock alone drives the refresh.
-		_, err = manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
-			Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
-			AutoGroups: []string{"ug-linked", "ug-v6"}, Name: "renamed",
+			peerShouldReceiveUpdate(t, upd2)
+			peerShouldNotReceiveUpdate(t, upd3)
 		})
-		require.NoError(t, err)
-
-		peerShouldReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
 	})
 }
diff --git a/management/server/cache/idp.go b/management/server/cache/idp.go
index 6ec42e217..ec2684d6f 100644
--- a/management/server/cache/idp.go
+++ b/management/server/cache/idp.go
@@ -88,7 +88,8 @@ func NewUserDataCache(store store.StoreInterface) *UserDataCacheImpl {
 
 // AccountUserDataCache wraps the basic Get, Set and Delete methods for []*idp.UserData objects.
 type AccountUserDataCache struct {
-	cache Marshaler
+	cache    Marshaler
+	loadable *cache.LoadableCache[any]
 }
 
 func (a *AccountUserDataCache) Get(ctx context.Context, key string) ([]*idp.UserData, error) {
@@ -127,13 +128,18 @@ func (a *AccountUserDataCache) Delete(ctx context.Context, key string) error {
 	return a.cache.Delete(ctx, key)
 }
 
+// Close stops the goroutine that stores loaded values. The cache must not be used afterwards.
+func (a *AccountUserDataCache) Close() error {
+	return a.loadable.Close()
+}
+
 // NewAccountUserDataCache creates a new AccountUserDataCache object.
 func NewAccountUserDataCache(loadableFunc cache.LoadFunction[any], store store.StoreInterface) *AccountUserDataCache {
 	simpleCache := cache.New[any](store)
 	loadable := cache.NewLoadable[any](loadableFunc, simpleCache)
 	if store.GetType() == redis.RedisType {
 		m := marshaler.New(loadable)
-		return &AccountUserDataCache{cache: m}
+		return &AccountUserDataCache{cache: m, loadable: loadable}
 	}
-	return &AccountUserDataCache{cache: &marshalerWraper{loadable}}
+	return &AccountUserDataCache{cache: &marshalerWraper{loadable}, loadable: loadable}
 }
diff --git a/management/server/dns_test.go b/management/server/dns_test.go
index 25bef664c..d21864cbb 100644
--- a/management/server/dns_test.go
+++ b/management/server/dns_test.go
@@ -6,8 +6,8 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
 	"github.com/stretchr/testify/assert"
+	"go.uber.org/mock/gomock"
 
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller"
@@ -363,163 +363,167 @@ func initTestDNSAccount(t *testing.T, am *DefaultAccountManager) (*types.Account
 }
 
 func TestDNSAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	err := manager.CreateGroups(context.Background(), account.Id, userID, []*types.Group{
-		{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{},
-		},
-	})
-	assert.NoError(t, err)
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	// Saving DNS settings with groups that have no peers should not trigger updates to account peers or send peer updates
-	t.Run("saving dns setting with unused groups", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
-			DisabledManagementGroups: []string{"groupA"},
+		err := manager.CreateGroups(context.Background(), account.Id, userID, []*types.Group{
+			{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{},
+			},
+			{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{},
+			},
 		})
 		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Creating DNS settings with groups that have no peers should not update account peers or send peer update
-	t.Run("creating dns setting with unused groups", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err = manager.CreateNameServerGroup(
-			context.Background(), account.Id, "ns-group", "ns-group", []nbdns.NameServer{{
-				IP:     netip.MustParseAddr(peer1.IP.String()),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			}},
-			[]string{"groupB"},
-			true, []string{}, true, userID, false,
-		)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Creating DNS settings with groups that have peers should update account peers and send peer update
-	t.Run("creating dns setting with used groups", func(t *testing.T) {
-		err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
 		})
-		assert.NoError(t, err)
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		// Saving DNS settings with groups that have no peers should not trigger updates to account peers or send peer updates
+		step(t, "saving dns setting with unused groups", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
 
-		_, err = manager.CreateNameServerGroup(
-			context.Background(), account.Id, "ns-group-1", "ns-group-1", []nbdns.NameServer{{
-				IP:     netip.MustParseAddr(peer1.IP.String()),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			}},
-			[]string{"groupA"},
-			true, []string{}, true, userID, false,
-		)
-		assert.NoError(t, err)
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+			err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
+				DisabledManagementGroups: []string{"groupA"},
+			})
+			assert.NoError(t, err)
 
-	// Saving DNS settings with groups that have peers should update account peers and send peer update
-	t.Run("saving dns setting with used groups", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
-			DisabledManagementGroups: []string{"groupA", "groupB"},
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// Creating DNS settings with groups that have no peers should not update account peers or send peer update
+		step(t, "creating dns setting with unused groups", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	// Removing group with no peers from DNS settings  should not trigger updates to account peers or send peer updates
-	t.Run("removing group with no peers from dns settings", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			_, err = manager.CreateNameServerGroup(
+				context.Background(), account.Id, "ns-group", "ns-group", []nbdns.NameServer{{
+					IP:     netip.MustParseAddr(peer1.IP.String()),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				}},
+				[]string{"groupB"},
+				true, []string{}, true, userID, false,
+			)
+			assert.NoError(t, err)
 
-		err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
-			DisabledManagementGroups: []string{"groupA"},
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+		// Creating DNS settings with groups that have peers should update account peers and send peer update
+		step(t, "creating dns setting with used groups", func(t *testing.T) {
+			err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+			})
+			assert.NoError(t, err)
 
-	// Removing group with peers from DNS settings should trigger updates to account peers and send peer updates
-	t.Run("removing group with peers from dns settings", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
-			DisabledManagementGroups: []string{},
+			_, err = manager.CreateNameServerGroup(
+				context.Background(), account.Id, "ns-group-1", "ns-group-1", []nbdns.NameServer{{
+					IP:     netip.MustParseAddr(peer1.IP.String()),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				}},
+				[]string{"groupA"},
+				true, []string{}, true, userID, false,
+			)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
+		// Saving DNS settings with groups that have peers should update account peers and send peer update
+		step(t, "saving dns setting with used groups", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
+				DisabledManagementGroups: []string{"groupA", "groupB"},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Removing group with no peers from DNS settings  should not trigger updates to account peers or send peer updates
+		step(t, "removing group with no peers from dns settings", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
+				DisabledManagementGroups: []string{"groupA"},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Removing group with peers from DNS settings should trigger updates to account peers and send peer updates
+		step(t, "removing group with peers from dns settings", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
+				DisabledManagementGroups: []string{},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 	})
 }
diff --git a/management/server/group_test.go b/management/server/group_test.go
index fa351a43e..f0ccd385c 100644
--- a/management/server/group_test.go
+++ b/management/server/group_test.go
@@ -23,6 +23,7 @@ import (
 	"github.com/netbirdio/netbird/management/server/groups"
 	"github.com/netbirdio/netbird/management/server/networks"
 	"github.com/netbirdio/netbird/management/server/networks/resources"
+	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	"github.com/netbirdio/netbird/management/server/networks/routers"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
 	networkTypes "github.com/netbirdio/netbird/management/server/networks/types"
@@ -685,342 +686,368 @@ func initTestGroupAccount(am *DefaultAccountManager) (*DefaultAccountManager, *t
 }
 
 func TestGroupAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	g := []*types.Group{
-		{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer2.ID},
-		},
-		{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupC",
-			Name:  "GroupC",
-			Peers: []string{peer1.ID, peer3.ID},
-		},
-		{
-			ID:    "groupD",
-			Name:  "GroupD",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupE",
-			Name:  "GroupE",
-			Peers: []string{peer2.ID},
-		},
-	}
-	for _, group := range g {
-		err := manager.CreateGroup(context.Background(), account.Id, userID, group)
-		assert.NoError(t, err)
-	}
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	// Saving a group that is not linked to any resource should not update account peers
-	t.Run("saving unlinked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{peer1.ID, peer2.ID},
-		})
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Adding a peer to a group that is not linked to any resource should not update account peers
-	// and not send peer update
-	t.Run("adding peer to unlinked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.GroupAddPeer(context.Background(), account.Id, "groupB", peer3.ID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Removing a peer from a group that is not linked to any resource should not update account peers
-	// and not send peer update
-	t.Run("removing peer from unliked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.GroupDeletePeer(context.Background(), account.Id, "groupB", peer3.ID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Deleting group should not update account peers and not send peer update
-	t.Run("deleting group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.DeleteGroup(context.Background(), account.Id, userID, "groupB")
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// adding a group to policy
-	_, err := manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
+		g := []*types.Group{
 			{
-				Enabled:       true,
-				Sources:       []string{"groupA"},
-				Destinations:  []string{"groupA"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer2.ID},
+			},
+			{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{},
+			},
+			{
+				ID:    "groupC",
+				Name:  "GroupC",
+				Peers: []string{peer1.ID, peer3.ID},
+			},
+			{
+				ID:    "groupD",
+				Name:  "GroupD",
+				Peers: []string{},
+			},
+			{
+				ID:    "groupE",
+				Name:  "GroupE",
+				Peers: []string{peer2.ID},
 			},
-		},
-	}, true)
-	assert.NoError(t, err)
-
-	// Saving a group linked to policy should update account peers and send peer update
-	t.Run("saving linked group to policy", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer2.ID},
-		})
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
 		}
-	})
-
-	// adding peer to a used group should update account peers and send peer update
-	t.Run("adding peer to linked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.GroupAddPeer(context.Background(), account.Id, "groupA", peer3.ID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
+		for _, group := range g {
+			err := manager.CreateGroup(context.Background(), account.Id, userID, group)
+			assert.NoError(t, err)
 		}
-	})
 
-	// removing peer from a linked group should update account peers and send peer update
-	t.Run("removing peer from linked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
+		})
 
-		err := manager.GroupDeletePeer(context.Background(), account.Id, "groupA", peer3.ID)
+		// Saving a group that is not linked to any resource should not update account peers
+		step(t, "saving unlinked group", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{peer1.ID, peer2.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Adding a peer to a group that is not linked to any resource should not update account peers
+		// and not send peer update
+		step(t, "adding peer to unlinked group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.GroupAddPeer(context.Background(), account.Id, "groupB", peer3.ID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Removing a peer from a group that is not linked to any resource should not update account peers
+		// and not send peer update
+		step(t, "removing peer from unliked group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.GroupDeletePeer(context.Background(), account.Id, "groupB", peer3.ID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Deleting group should not update account peers and not send peer update
+		step(t, "deleting group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.DeleteGroup(context.Background(), account.Id, userID, "groupB")
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// adding a group to policy
+		_, err := manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+			Enabled: true,
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"groupA"},
+					Destinations:  []string{"groupA"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
+			},
+		}, true)
 		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// Saving a group linked to policy should update account peers and send peer update
+		step(t, "saving linked group to policy", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
 
-	// Saving a group linked to name server group should update account peers and send peer update
-	t.Run("saving group linked to name server group", func(t *testing.T) {
-		_, err = manager.CreateNameServerGroup(
-			context.Background(), account.Id, "nsGroup", "nsGroup", []nbdns.NameServer{{
-				IP:     netip.MustParseAddr("1.1.1.1"),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			}},
-			[]string{"groupC"},
-			true, nil, true, userID, false,
-		)
-		assert.NoError(t, err)
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer2.ID},
+			})
+			assert.NoError(t, err)
 
-		err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupC",
-			Name:  "GroupC",
-			Peers: []string{peer1.ID, peer3.ID},
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// adding peer to a used group should update account peers and send peer update
+		step(t, "adding peer to linked group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	// Saving a group linked to route should update account peers and send peer update
-	t.Run("saving group linked to route", func(t *testing.T) {
-		newRoute := route.Route{
-			ID:          "route",
-			Network:     netip.MustParsePrefix("192.168.0.0/16"),
-			NetID:       "superNet",
-			NetworkType: route.IPv4Network,
-			PeerGroups:  []string{"groupA"},
-			Description: "super",
-			Masquerade:  false,
-			Metric:      9999,
-			Enabled:     true,
-			Groups:      []string{"groupC"},
-		}
-		_, err := manager.CreateRoute(
-			context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer,
-			newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric,
-			newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, newRoute.SkipAutoApply,
-		)
-		require.NoError(t, err)
+			err := manager.GroupAddPeer(context.Background(), account.Id, "groupA", peer3.ID)
+			assert.NoError(t, err)
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// removing peer from a linked group should update account peers and send peer update
+		step(t, "removing peer from linked group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	// Saving a group linked to dns settings should update account peers and send peer update
-	t.Run("saving group linked to dns settings", func(t *testing.T) {
-		err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
-			DisabledManagementGroups: []string{"groupD"},
+			err := manager.GroupDeletePeer(context.Background(), account.Id, "groupA", peer3.ID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		// Saving a group linked to name server group should update account peers and send peer update
+		step(t, "saving group linked to name server group", func(t *testing.T) {
+			_, err = manager.CreateNameServerGroup(
+				context.Background(), account.Id, "nsGroup", "nsGroup", []nbdns.NameServer{{
+					IP:     netip.MustParseAddr("1.1.1.1"),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				}},
+				[]string{"groupC"},
+				true, nil, true, userID, false,
+			)
+			assert.NoError(t, err)
 
-		err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupD",
-			Name:  "GroupD",
-			Peers: []string{peer1.ID},
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupC",
+				Name:  "GroupC",
+				Peers: []string{peer1.ID, peer3.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// Saving a group linked to route should update account peers and send peer update
+		step(t, "saving group linked to route", func(t *testing.T) {
+			newRoute := route.Route{
+				ID:          "route",
+				Network:     netip.MustParsePrefix("192.168.0.0/16"),
+				NetID:       "superNet",
+				NetworkType: route.IPv4Network,
+				PeerGroups:  []string{"groupA"},
+				Description: "super",
+				Masquerade:  false,
+				Metric:      9999,
+				Enabled:     true,
+				Groups:      []string{"groupC"},
+			}
+			_, err := manager.CreateRoute(
+				context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer,
+				newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric,
+				newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, newRoute.SkipAutoApply,
+			)
+			require.NoError(t, err)
 
-	// Saving a group linked to network router should update account peers and send peer update
-	t.Run("saving group linked to network router", func(t *testing.T) {
-		permissionsManager := permissions.NewManager(manager.Store)
-		groupsManager := groups.NewManager(manager.Store, permissionsManager, manager)
-		resourcesManager := resources.NewManager(manager.Store, permissionsManager, groupsManager, manager, manager.serviceManager)
-		routersManager := routers.NewManager(manager.Store, permissionsManager, manager)
-		networksManager := networks.NewManager(manager.Store, permissionsManager, resourcesManager, routersManager, manager)
+			settleAffectedUpdates(updMsg)
 
-		network, err := networksManager.CreateNetwork(context.Background(), userID, &networkTypes.Network{
-			ID:          "network_test",
-			AccountID:   account.Id,
-			Name:        "network_test",
-			Description: "",
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		require.NoError(t, err)
 
-		_, err = routersManager.CreateRouter(context.Background(), userID, &routerTypes.NetworkRouter{
-			ID:         "router_test",
-			NetworkID:  network.ID,
-			AccountID:  account.Id,
-			PeerGroups: []string{"groupE"},
-			Masquerade: true,
-			Metric:     9999,
-			Enabled:    true,
+		// Saving a group linked to dns settings should update account peers and send peer update
+		step(t, "saving group linked to dns settings", func(t *testing.T) {
+			err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
+				DisabledManagementGroups: []string{"groupD"},
+			})
+			assert.NoError(t, err)
+
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupD",
+				Name:  "GroupD",
+				Peers: []string{peer1.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		require.NoError(t, err)
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		// Saving a group linked to network router should update account peers and send peer update
+		step(t, "saving group linked to network router", func(t *testing.T) {
+			permissionsManager := permissions.NewManager(manager.Store)
+			groupsManager := groups.NewManager(manager.Store, permissionsManager, manager)
+			resourcesManager := resources.NewManager(manager.Store, permissionsManager, groupsManager, manager, manager.serviceManager)
+			routersManager := routers.NewManager(manager.Store, permissionsManager, manager)
+			networksManager := networks.NewManager(manager.Store, permissionsManager, resourcesManager, routersManager, manager)
 
-		err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupE",
-			Name:  "GroupE",
-			Peers: []string{peer2.ID, peer3.ID},
+			network, err := networksManager.CreateNetwork(context.Background(), userID, &networkTypes.Network{
+				ID:          "network_test",
+				AccountID:   account.Id,
+				Name:        "network_test",
+				Description: "",
+			})
+			require.NoError(t, err)
+
+			_, err = routersManager.CreateRouter(context.Background(), userID, &routerTypes.NetworkRouter{
+				ID:         "router_test",
+				NetworkID:  network.ID,
+				AccountID:  account.Id,
+				PeerGroups: []string{"groupE"},
+				Masquerade: true,
+				Metric:     9999,
+				Enabled:    true,
+			})
+			require.NoError(t, err)
+
+			resource, err := resourcesManager.CreateResource(context.Background(), userID, &resourceTypes.NetworkResource{
+				AccountID: account.Id,
+				NetworkID: network.ID,
+				Name:      "resource_test",
+				Address:   "10.20.30.0/24",
+				Enabled:   true,
+			})
+			require.NoError(t, err)
+
+			_, err = manager.SavePolicy(context.Background(), account.Id, userID, peerToResourcePolicyByResource("groupA", resource.ID), true)
+			require.NoError(t, err)
+
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupE",
+				Name:  "GroupE",
+				Peers: []string{peer2.ID, peer3.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
 	})
 }
 
diff --git a/management/server/nameserver_test.go b/management/server/nameserver_test.go
index deed9c34f..1460893cf 100644
--- a/management/server/nameserver_test.go
+++ b/management/server/nameserver_test.go
@@ -6,9 +6,9 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller"
@@ -966,147 +966,151 @@ func TestValidateDomain(t *testing.T) {
 }
 
 func TestNameServerAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	var newNameServerGroupA *nbdns.NameServerGroup
-	var newNameServerGroupB *nbdns.NameServerGroup
+		var newNameServerGroupA *nbdns.NameServerGroup
+		var newNameServerGroupB *nbdns.NameServerGroup
 
-	err := manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
-		ID:    "groupA",
-		Name:  "GroupA",
-		Peers: []string{},
-	})
-	assert.NoError(t, err)
-
-	err = manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
-		ID:    "groupB",
-		Name:  "GroupB",
-		Peers: []string{peer1.ID, peer2.ID, peer3.ID},
-	})
-	assert.NoError(t, err)
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	// Creating a nameserver group with a distribution group no peers should not update account peers
-	// and not send peer update
-	t.Run("creating nameserver group with distribution group no peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		newNameServerGroupA, err = manager.CreateNameServerGroup(
-			context.Background(), account.Id, "nsGroupA", "nsGroupA", []nbdns.NameServer{{
-				IP:     netip.MustParseAddr("1.1.1.1"),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			}},
-			[]string{"groupA"},
-			true, []string{}, true, userID, false,
-		)
+		err := manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
+			ID:    "groupA",
+			Name:  "GroupA",
+			Peers: []string{},
+		})
 		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// saving a nameserver group with a distribution group with no peers should not update account peers
-	// and not send peer update
-	t.Run("saving nameserver group with distribution group no peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err = manager.SaveNameServerGroup(context.Background(), account.Id, userID, newNameServerGroupA)
+		err = manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
+			ID:    "groupB",
+			Name:  "GroupB",
+			Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+		})
 		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
+		})
 
-	// Creating a nameserver group with a distribution group no peers should update account peers and send peer update
-	t.Run("creating nameserver group with distribution group has peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		// Creating a nameserver group with a distribution group no peers should not update account peers
+		// and not send peer update
+		step(t, "creating nameserver group with distribution group no peers", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
 
-		newNameServerGroupB, err = manager.CreateNameServerGroup(
-			context.Background(), account.Id, "nsGroupB", "nsGroupB", []nbdns.NameServer{{
-				IP:     netip.MustParseAddr("1.1.1.1"),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			}},
-			[]string{"groupB"},
-			true, []string{}, true, userID, false,
-		)
-		assert.NoError(t, err)
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+			newNameServerGroupA, err = manager.CreateNameServerGroup(
+				context.Background(), account.Id, "nsGroupA", "nsGroupA", []nbdns.NameServer{{
+					IP:     netip.MustParseAddr("1.1.1.1"),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				}},
+				[]string{"groupA"},
+				true, []string{}, true, userID, false,
+			)
+			assert.NoError(t, err)
 
-	// saving a nameserver group with a distribution group with peers should update account peers and send peer update
-	t.Run("saving nameserver group with distribution group has peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
 
-		newNameServerGroupB.NameServers = []nbdns.NameServer{
-			{
-				IP:     netip.MustParseAddr("1.1.1.2"),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			},
-			{
-				IP:     netip.MustParseAddr("8.8.8.8"),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			},
-		}
-		err = manager.SaveNameServerGroup(context.Background(), account.Id, userID, newNameServerGroupB)
-		assert.NoError(t, err)
+		// saving a nameserver group with a distribution group with no peers should not update account peers
+		// and not send peer update
+		step(t, "saving nameserver group with distribution group no peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+			err = manager.SaveNameServerGroup(context.Background(), account.Id, userID, newNameServerGroupA)
+			assert.NoError(t, err)
 
-	// Deleting a nameserver group should update account peers and send peer update
-	t.Run("deleting nameserver group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
 
-		err = manager.DeleteNameServerGroup(context.Background(), account.Id, newNameServerGroupB.ID, userID)
-		assert.NoError(t, err)
+		// Creating a nameserver group with a distribution group no peers should update account peers and send peer update
+		step(t, "creating nameserver group with distribution group has peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
+			newNameServerGroupB, err = manager.CreateNameServerGroup(
+				context.Background(), account.Id, "nsGroupB", "nsGroupB", []nbdns.NameServer{{
+					IP:     netip.MustParseAddr("1.1.1.1"),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				}},
+				[]string{"groupB"},
+				true, []string{}, true, userID, false,
+			)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// saving a nameserver group with a distribution group with peers should update account peers and send peer update
+		step(t, "saving nameserver group with distribution group has peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			newNameServerGroupB.NameServers = []nbdns.NameServer{
+				{
+					IP:     netip.MustParseAddr("1.1.1.2"),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				},
+				{
+					IP:     netip.MustParseAddr("8.8.8.8"),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				},
+			}
+			err = manager.SaveNameServerGroup(context.Background(), account.Id, userID, newNameServerGroupB)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Deleting a nameserver group should update account peers and send peer update
+		step(t, "deleting nameserver group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.DeleteNameServerGroup(context.Background(), account.Id, newNameServerGroupB.ID, userID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 	})
 }
diff --git a/management/server/peer_test.go b/management/server/peer_test.go
index 5c3e02af5..5307300d6 100644
--- a/management/server/peer_test.go
+++ b/management/server/peer_test.go
@@ -1844,374 +1844,336 @@ func Test_LoginPeer(t *testing.T) {
 }
 
 func TestPeerAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	err := manager.DeletePolicy(context.Background(), account.Id, account.Policies[0].ID, userID)
-	require.NoError(t, err)
-
-	g := []*types.Group{
-		{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer2.ID, peer3.ID},
-		},
-		{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupC",
-			Name:  "GroupC",
-			Peers: []string{},
-		},
-	}
-	for _, group := range g {
-		err = manager.CreateGroup(context.Background(), account.Id, userID, group)
-		require.NoError(t, err)
-	}
-
-	// create a user with auto groups
-	_, err = manager.SaveOrAddUsers(context.Background(), account.Id, userID, []*types.User{
-		{
-			Id:         "regularUser1",
-			AccountID:  account.Id,
-			Role:       types.UserRoleAdmin,
-			Issued:     types.UserIssuedAPI,
-			AutoGroups: []string{"groupA"},
-		},
-		{
-			Id:         "regularUser2",
-			AccountID:  account.Id,
-			Role:       types.UserRoleAdmin,
-			Issued:     types.UserIssuedAPI,
-			AutoGroups: []string{"groupB"},
-		},
-		{
-			Id:         "regularUser3",
-			AccountID:  account.Id,
-			Role:       types.UserRoleAdmin,
-			Issued:     types.UserIssuedAPI,
-			AutoGroups: []string{"groupC"},
-		},
-	}, true)
-	require.NoError(t, err)
-
-	var peer4 *nbpeer.Peer
-	var peer5 *nbpeer.Peer
-	var peer6 *nbpeer.Peer
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	// Updating not expired peer and peer expiration is enabled should not update account peers and not send peer update
-	t.Run("updating not expired peer and peer expiration is enabled", func(t *testing.T) {
-		t.Skip("Currently all updates will trigger a network map")
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err := manager.UpdatePeer(context.Background(), account.Id, userID, peer2)
+		err := manager.DeletePolicy(context.Background(), account.Id, account.Policies[0].ID, userID)
 		require.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+		g := []*types.Group{
+			{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+			},
+			{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{},
+			},
+			{
+				ID:    "groupC",
+				Name:  "GroupC",
+				Peers: []string{},
+			},
 		}
-	})
-
-	// Adding peer to unlinked group should not update account peers and not send peer update
-	t.Run("adding peer to unlinked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		key, err := wgtypes.GeneratePrivateKey()
-		require.NoError(t, err)
-
-		expectedPeerKey := key.PublicKey().String()
-		peer4, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser1", &nbpeer.Peer{
-			Key:  expectedPeerKey,
-			Meta: nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
-		}, false)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Deleting peer with unlinked group should not update account peers and not send peer update
-	t.Run("deleting peer with unlinked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err = manager.DeletePeer(context.Background(), account.Id, peer4.ID, userID)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Updating peer label should update account peers and send peer update
-	t.Run("updating peer label", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		peer1.Name = "peer-1"
-		_, err = manager.UpdatePeer(context.Background(), account.Id, userID, peer1)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	t.Run("validator requires update", func(t *testing.T) {
-		requireUpdateFunc := func(_ context.Context, update *nbpeer.Peer, peer *nbpeer.Peer, userID string, accountID string, dnsDomain string, peersGroup []string, extraSettings *types.ExtraSettings) (*nbpeer.Peer, bool, error) {
-			return update, true, nil
+		for _, group := range g {
+			err = manager.CreateGroup(context.Background(), account.Id, userID, group)
+			require.NoError(t, err)
 		}
 
-		manager.integratedPeerValidator = MockIntegratedValidator{ValidatePeerFunc: requireUpdateFunc}
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err = manager.UpdatePeer(context.Background(), account.Id, userID, peer1)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	t.Run("validator requires no update", func(t *testing.T) {
-		t.Skip("Currently all updates will trigger a network map")
-
-		requireNoUpdateFunc := func(_ context.Context, update *nbpeer.Peer, peer *nbpeer.Peer, userID string, accountID string, dnsDomain string, peersGroup []string, extraSettings *types.ExtraSettings) (*nbpeer.Peer, bool, error) {
-			return update, false, nil
-		}
-
-		manager.integratedPeerValidator = MockIntegratedValidator{ValidatePeerFunc: requireNoUpdateFunc}
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err = manager.UpdatePeer(context.Background(), account.Id, userID, peer1)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Adding peer to group linked with policy should update account peers and send peer update
-	t.Run("adding peer to group linked with policy", func(t *testing.T) {
-		_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-			AccountID: account.Id,
-			Enabled:   true,
-			Rules: []*types.PolicyRule{
-				{
-					Enabled:       true,
-					Sources:       []string{"groupA"},
-					Destinations:  []string{"groupA"},
-					Bidirectional: true,
-					Action:        types.PolicyTrafficActionAccept,
-				},
+		// create a user with auto groups
+		_, err = manager.SaveOrAddUsers(context.Background(), account.Id, userID, []*types.User{
+			{
+				Id:         "regularUser1",
+				AccountID:  account.Id,
+				Role:       types.UserRoleAdmin,
+				Issued:     types.UserIssuedAPI,
+				AutoGroups: []string{"groupA"},
+			},
+			{
+				Id:         "regularUser2",
+				AccountID:  account.Id,
+				Role:       types.UserRoleAdmin,
+				Issued:     types.UserIssuedAPI,
+				AutoGroups: []string{"groupB"},
+			},
+			{
+				Id:         "regularUser3",
+				AccountID:  account.Id,
+				Role:       types.UserRoleAdmin,
+				Issued:     types.UserIssuedAPI,
+				AutoGroups: []string{"groupC"},
 			},
 		}, true)
 		require.NoError(t, err)
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		var peer4 *nbpeer.Peer
+		var peer5 *nbpeer.Peer
+		var peer6 *nbpeer.Peer
 
-		key, err := wgtypes.GeneratePrivateKey()
-		require.NoError(t, err)
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
+		})
 
-		expectedPeerKey := key.PublicKey().String()
-		peer4, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser1", &nbpeer.Peer{
-			Key:                    expectedPeerKey,
-			LoginExpirationEnabled: true,
-			Meta:                   nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
-		}, false)
-		require.NoError(t, err)
+		// Adding peer to unlinked group should not update account peers and not send peer update
+		step(t, "adding peer to unlinked group", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+			key, err := wgtypes.GeneratePrivateKey()
+			require.NoError(t, err)
 
-	// Deleting peer with linked group to policy should update account peers and send peer update
-	t.Run("deleting peer with linked group to policy", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			expectedPeerKey := key.PublicKey().String()
+			peer4, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser1", &nbpeer.Peer{
+				Key:  expectedPeerKey,
+				Meta: nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
+			}, false)
+			require.NoError(t, err)
 
-		err = manager.DeletePeer(context.Background(), account.Id, peer4.ID, userID)
-		require.NoError(t, err)
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// Deleting peer with unlinked group should not update account peers and not send peer update
+		step(t, "deleting peer with unlinked group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	// drain any buffered updates from previous subtests
-	drainPeerUpdates(updMsg)
+			err = manager.DeletePeer(context.Background(), account.Id, peer4.ID, userID)
+			require.NoError(t, err)
 
-	// Adding peer to group linked with route should update peers in that group, not unrelated peers
-	t.Run("adding peer to group linked with route", func(t *testing.T) {
-		route := nbroute.Route{
-			ID:          "testingRoute1",
-			Network:     netip.MustParsePrefix("100.65.250.202/32"),
-			NetID:       "superNet",
-			NetworkType: nbroute.IPv4Network,
-			PeerGroups:  []string{"groupB"},
-			Description: "super",
-			Masquerade:  false,
-			Metric:      9999,
-			Enabled:     true,
-			Groups:      []string{"groupB"},
-		}
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
 
-		_, err := manager.CreateRoute(
-			context.Background(), account.Id, route.Network, route.NetworkType, route.Domains, route.Peer,
-			route.PeerGroups, route.Description, route.NetID, route.Masquerade, route.Metric,
-			route.Groups, []string{}, true, userID, route.KeepRoute, route.SkipAutoApply,
-		)
-		require.NoError(t, err)
+		// Updating peer label should update account peers and send peer update
+		step(t, "updating peer label", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			peer1.Name = "peer-1"
+			_, err = manager.UpdatePeer(context.Background(), account.Id, userID, peer1)
+			require.NoError(t, err)
 
-		key, err := wgtypes.GeneratePrivateKey()
-		require.NoError(t, err)
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 
-		expectedPeerKey := key.PublicKey().String()
-		peer5, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser2", &nbpeer.Peer{
-			Key:                    expectedPeerKey,
-			LoginExpirationEnabled: true,
-			Meta:                   nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
-		}, false)
-		require.NoError(t, err)
+		step(t, "validator requires update", func(t *testing.T) {
+			requireUpdateFunc := func(_ context.Context, update *nbpeer.Peer, peer *nbpeer.Peer, userID string, accountID string, dnsDomain string, peersGroup []string, extraSettings *types.ExtraSettings) (*nbpeer.Peer, bool, error) {
+				return update, true, nil
+			}
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+			manager.integratedPeerValidator = MockIntegratedValidator{ValidatePeerFunc: requireUpdateFunc}
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	// Deleting peer with linked group to route should update peers in that group, not unrelated peers
-	t.Run("deleting peer with linked group to route", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			_, err = manager.UpdatePeer(context.Background(), account.Id, userID, peer1)
+			require.NoError(t, err)
 
-		err = manager.DeletePeer(context.Background(), account.Id, peer5.ID, userID)
-		require.NoError(t, err)
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+		// Adding peer to group linked with policy should update account peers and send peer update
+		step(t, "adding peer to group linked with policy", func(t *testing.T) {
+			_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				AccountID: account.Id,
+				Enabled:   true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupA"},
+						Destinations:  []string{"groupA"},
+						Bidirectional: true,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+			}, true)
+			require.NoError(t, err)
 
-	// Adding peer to group linked with name server group should update peers in that group, not unrelated peers
-	t.Run("adding peer to group linked with name server group", func(t *testing.T) {
-		_, err = manager.CreateNameServerGroup(
-			context.Background(), account.Id, "nsGroup", "nsGroup", []nbdns.NameServer{{
-				IP:     netip.MustParseAddr("1.1.1.1"),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			}},
-			[]string{"groupC"},
-			true, []string{}, true, userID, false,
-		)
-		require.NoError(t, err)
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			key, err := wgtypes.GeneratePrivateKey()
+			require.NoError(t, err)
 
-		key, err := wgtypes.GeneratePrivateKey()
-		require.NoError(t, err)
+			expectedPeerKey := key.PublicKey().String()
+			peer4, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser1", &nbpeer.Peer{
+				Key:                    expectedPeerKey,
+				LoginExpirationEnabled: true,
+				Meta:                   nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
+			}, false)
+			require.NoError(t, err)
 
-		expectedPeerKey := key.PublicKey().String()
-		peer6, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser3", &nbpeer.Peer{
-			Key:                    expectedPeerKey,
-			LoginExpirationEnabled: true,
-			Meta:                   nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
-		}, false)
-		require.NoError(t, err)
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+		// Deleting peer with linked group to policy should update account peers and send peer update
+		step(t, "deleting peer with linked group to policy", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	// Deleting peer with linked group to name server group should update peers in that group, not unrelated peers
-	t.Run("deleting peer with linked group to route", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			err = manager.DeletePeer(context.Background(), account.Id, peer4.ID, userID)
+			require.NoError(t, err)
 
-		err = manager.DeletePeer(context.Background(), account.Id, peer6.ID, userID)
-		require.NoError(t, err)
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
+		// drain any buffered updates from previous subtests
+		drainPeerUpdates(updMsg)
+
+		// Adding peer to group linked with route should update peers in that group, not unrelated peers
+		step(t, "adding peer to group linked with route", func(t *testing.T) {
+			route := nbroute.Route{
+				ID:          "testingRoute1",
+				Network:     netip.MustParsePrefix("100.65.250.202/32"),
+				NetID:       "superNet",
+				NetworkType: nbroute.IPv4Network,
+				PeerGroups:  []string{"groupB"},
+				Description: "super",
+				Masquerade:  false,
+				Metric:      9999,
+				Enabled:     true,
+				Groups:      []string{"groupB"},
+			}
+
+			_, err := manager.CreateRoute(
+				context.Background(), account.Id, route.Network, route.NetworkType, route.Domains, route.Peer,
+				route.PeerGroups, route.Description, route.NetID, route.Masquerade, route.Metric,
+				route.Groups, []string{}, true, userID, route.KeepRoute, route.SkipAutoApply,
+			)
+			require.NoError(t, err)
+
+			settleAffectedUpdates(updMsg)
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			key, err := wgtypes.GeneratePrivateKey()
+			require.NoError(t, err)
+
+			expectedPeerKey := key.PublicKey().String()
+			peer5, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser2", &nbpeer.Peer{
+				Key:                    expectedPeerKey,
+				LoginExpirationEnabled: true,
+				Meta:                   nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
+			}, false)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Deleting peer with linked group to route should update peers in that group, not unrelated peers
+		step(t, "deleting peer with linked group to route", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.DeletePeer(context.Background(), account.Id, peer5.ID, userID)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Adding peer to group linked with name server group should update peers in that group, not unrelated peers
+		step(t, "adding peer to group linked with name server group", func(t *testing.T) {
+			_, err = manager.CreateNameServerGroup(
+				context.Background(), account.Id, "nsGroup", "nsGroup", []nbdns.NameServer{{
+					IP:     netip.MustParseAddr("1.1.1.1"),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				}},
+				[]string{"groupC"},
+				true, []string{}, true, userID, false,
+			)
+			require.NoError(t, err)
+
+			settleAffectedUpdates(updMsg)
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			key, err := wgtypes.GeneratePrivateKey()
+			require.NoError(t, err)
+
+			expectedPeerKey := key.PublicKey().String()
+			peer6, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser3", &nbpeer.Peer{
+				Key:                    expectedPeerKey,
+				LoginExpirationEnabled: true,
+				Meta:                   nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
+			}, false)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Deleting peer with linked group to name server group should update peers in that group, not unrelated peers
+		step(t, "deleting peer with linked group to name server group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.DeletePeer(context.Background(), account.Id, peer6.ID, userID)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
 	})
 }
 
@@ -2859,45 +2821,47 @@ func TestPeerWillHaveIPv6(t *testing.T) {
 // flipping --disable-ipv6) without bumping its WtVersion, other account peers
 // receive a fresh network map so their AAAA records for it become unstale.
 func TestSyncPeer_IPv6CapabilityChangePropagates(t *testing.T) {
-	manager, updateManager, _, peer1, peer2, _ := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, _, peer1, peer2, _ := setupNetworkMapTest(t)
 
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
+		})
 
-	// Drain any initial updates from setup.
-	drain := func() {
-		for {
-			select {
-			case <-updMsg:
-			case <-time.After(200 * time.Millisecond):
-				return
+		// Drain any initial updates from setup.
+		drain := func() {
+			for {
+				select {
+				case <-updMsg:
+				case <-time.After(200 * time.Millisecond):
+					return
+				}
 			}
 		}
-	}
-	drain()
+		drain()
 
-	t.Run("no propagation when capabilities are unchanged", func(t *testing.T) {
-		_, _, _, _, err := manager.SyncPeer(context.Background(), types.PeerSync{
-			WireGuardPubKey: peer2.Key,
-			Meta:            peer2.Meta,
-		}, peer2.AccountID)
-		require.NoError(t, err)
-		peerShouldNotReceiveUpdate(t, updMsg)
-	})
+		step(t, "no propagation when capabilities are unchanged", func(t *testing.T) {
+			_, _, _, _, err := manager.SyncPeer(context.Background(), types.PeerSync{
+				WireGuardPubKey: peer2.Key,
+				Meta:            peer2.Meta,
+			}, peer2.AccountID)
+			require.NoError(t, err)
+			peerShouldNotReceiveUpdate(t, updMsg)
+		})
 
-	t.Run("propagation when IPv6 capability is added", func(t *testing.T) {
-		newMeta := peer2.Meta
-		newMeta.Capabilities = append([]int32{}, peer2.Meta.Capabilities...)
-		newMeta.Capabilities = append(newMeta.Capabilities, nbpeer.PeerCapabilityIPv6Overlay)
+		step(t, "propagation when IPv6 capability is added", func(t *testing.T) {
+			newMeta := peer2.Meta
+			newMeta.Capabilities = append([]int32{}, peer2.Meta.Capabilities...)
+			newMeta.Capabilities = append(newMeta.Capabilities, nbpeer.PeerCapabilityIPv6Overlay)
 
-		_, _, _, _, err := manager.SyncPeer(context.Background(), types.PeerSync{
-			WireGuardPubKey: peer2.Key,
-			Meta:            newMeta,
-		}, peer2.AccountID)
-		require.NoError(t, err)
-		peerShouldReceiveUpdate(t, updMsg)
+			_, _, _, _, err := manager.SyncPeer(context.Background(), types.PeerSync{
+				WireGuardPubKey: peer2.Key,
+				Meta:            newMeta,
+			}, peer2.AccountID)
+			require.NoError(t, err)
+			peerShouldReceiveUpdate(t, updMsg)
+		})
 	})
 }
 
diff --git a/management/server/policy_test.go b/management/server/policy_test.go
index 6fb573b9e..7607a7567 100644
--- a/management/server/policy_test.go
+++ b/management/server/policy_test.go
@@ -1135,287 +1135,291 @@ func sortFunc() func(a *types.FirewallRule, b *types.FirewallRule) int {
 }
 
 func TestPolicyAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	g := []*types.Group{
-		{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer3.ID},
-		},
-		{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupC",
-			Name:  "GroupC",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupD",
-			Name:  "GroupD",
-			Peers: []string{peer1.ID, peer2.ID},
-		},
-	}
-	for _, group := range g {
-		err := manager.CreateGroup(context.Background(), account.Id, userID, group)
-		assert.NoError(t, err)
-	}
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	var policyWithGroupRulesNoPeers *types.Policy
-	var policyWithDestinationPeersOnly *types.Policy
-	var policyWithSourceAndDestinationPeers *types.Policy
-	var err error
-
-	// Saving policy with rule groups with no peers should not update account's peers and not send peer update
-	t.Run("saving policy with rule groups with no peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policyWithGroupRulesNoPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-			AccountID: account.Id,
-			Enabled:   true,
-			Rules: []*types.PolicyRule{
-				{
-					Enabled:       true,
-					Sources:       []string{"groupB"},
-					Destinations:  []string{"groupC"},
-					Bidirectional: true,
-					Action:        types.PolicyTrafficActionAccept,
-				},
+		g := []*types.Group{
+			{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer3.ID},
 			},
-		}, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Saving policy with source group containing peers, but destination group without peers should
-	// update account's peers and send peer update
-	t.Run("saving policy where source has peers but destination does not", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-			AccountID: account.Id,
-			Enabled:   true,
-			Rules: []*types.PolicyRule{
-				{
-					Enabled:       true,
-					Sources:       []string{"groupA"},
-					Destinations:  []string{"groupB"},
-					Protocol:      types.PolicyRuleProtocolTCP,
-					Bidirectional: true,
-					Action:        types.PolicyTrafficActionAccept,
-				},
+			{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{},
 			},
-		}, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Saving policy with destination group containing peers, but source group without peers should
-	// update account's peers and send peer update
-	t.Run("saving policy where destination has peers but source does not", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policyWithDestinationPeersOnly, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-			AccountID: account.Id,
-			Enabled:   true,
-			Rules: []*types.PolicyRule{
-				{
-					Enabled:       true,
-					Sources:       []string{"groupC"},
-					Destinations:  []string{"groupD"},
-					Bidirectional: true,
-					Protocol:      types.PolicyRuleProtocolTCP,
-					Action:        types.PolicyTrafficActionAccept,
-				},
+			{
+				ID:    "groupC",
+				Name:  "GroupC",
+				Peers: []string{},
 			},
-		}, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Saving policy with destination and source groups containing peers should update account's peers
-	// and send peer update
-	t.Run("saving policy with source and destination groups with peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-			AccountID: account.Id,
-			Enabled:   true,
-			Rules: []*types.PolicyRule{
-				{
-					Enabled:       true,
-					Sources:       []string{"groupA"},
-					Destinations:  []string{"groupD"},
-					Bidirectional: true,
-					Action:        types.PolicyTrafficActionAccept,
-				},
+			{
+				ID:    "groupD",
+				Name:  "GroupD",
+				Peers: []string{peer1.ID, peer2.ID},
 			},
-		}, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
 		}
-	})
-
-	// Disabling policy with destination and source groups containing peers should update account's peers
-	// and send peer update
-	t.Run("disabling policy with source and destination groups with peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policyWithSourceAndDestinationPeers.Enabled = false
-		policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, policyWithSourceAndDestinationPeers, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Updating disabled policy with destination and source groups containing peers should still update account's peers
-	// because affected peer resolution does not filter by policy enabled state
-	t.Run("updating disabled policy with source and destination groups with peers", func(t *testing.T) {
-		drainPeerUpdates(updMsg)
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policyWithSourceAndDestinationPeers.Description = "updated description"
-		policyWithSourceAndDestinationPeers.Rules[0].Destinations = []string{"groupA"}
-		policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, policyWithSourceAndDestinationPeers, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Enabling policy with destination and source groups containing peers should update account's peers
-	// and send peer update
-	t.Run("enabling policy with source and destination groups with peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policyWithSourceAndDestinationPeers.Enabled = true
-		policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, policyWithSourceAndDestinationPeers, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Deleting policy should trigger account peers update and send peer update
-	t.Run("deleting policy with source and destination groups with peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.DeletePolicy(context.Background(), account.Id, policyWithSourceAndDestinationPeers.ID, userID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
+		for _, group := range g {
+			err := manager.CreateGroup(context.Background(), account.Id, userID, group)
+			assert.NoError(t, err)
 		}
 
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
+		})
+
+		var policyWithGroupRulesNoPeers *types.Policy
+		var policyWithDestinationPeersOnly *types.Policy
+		var policyWithSourceAndDestinationPeers *types.Policy
+		var err error
+
+		// Saving policy with rule groups with no peers should not update account's peers and not send peer update
+		step(t, "saving policy with rule groups with no peers", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			policyWithGroupRulesNoPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				AccountID: account.Id,
+				Enabled:   true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupB"},
+						Destinations:  []string{"groupC"},
+						Bidirectional: true,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+			}, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Saving policy with source group containing peers, but destination group without peers should
+		// update account's peers and send peer update
+		step(t, "saving policy where source has peers but destination does not", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				AccountID: account.Id,
+				Enabled:   true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupA"},
+						Destinations:  []string{"groupB"},
+						Protocol:      types.PolicyRuleProtocolTCP,
+						Bidirectional: true,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+			}, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Saving policy with destination group containing peers, but source group without peers should
+		// update account's peers and send peer update
+		step(t, "saving policy where destination has peers but source does not", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			policyWithDestinationPeersOnly, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				AccountID: account.Id,
+				Enabled:   true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupC"},
+						Destinations:  []string{"groupD"},
+						Bidirectional: true,
+						Protocol:      types.PolicyRuleProtocolTCP,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+			}, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Saving policy with destination and source groups containing peers should update account's peers
+		// and send peer update
+		step(t, "saving policy with source and destination groups with peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				AccountID: account.Id,
+				Enabled:   true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupA"},
+						Destinations:  []string{"groupD"},
+						Bidirectional: true,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+			}, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Disabling policy with destination and source groups containing peers should update account's peers
+		// and send peer update
+		step(t, "disabling policy with source and destination groups with peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			policyWithSourceAndDestinationPeers.Enabled = false
+			policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, policyWithSourceAndDestinationPeers, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Updating disabled policy with destination and source groups containing peers should still update account's peers
+		// because affected peer resolution does not filter by policy enabled state
+		step(t, "updating disabled policy with source and destination groups with peers", func(t *testing.T) {
+			drainPeerUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			policyWithSourceAndDestinationPeers.Description = "updated description"
+			policyWithSourceAndDestinationPeers.Rules[0].Destinations = []string{"groupA"}
+			policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, policyWithSourceAndDestinationPeers, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Enabling policy with destination and source groups containing peers should update account's peers
+		// and send peer update
+		step(t, "enabling policy with source and destination groups with peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			policyWithSourceAndDestinationPeers.Enabled = true
+			policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, policyWithSourceAndDestinationPeers, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Deleting policy should trigger account peers update and send peer update
+		step(t, "deleting policy with source and destination groups with peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.DeletePolicy(context.Background(), account.Id, policyWithSourceAndDestinationPeers.ID, userID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+
+		})
+
+		// Deleting policy with destination group containing peers, but source group without peers should
+		// update account's peers and send peer update
+		step(t, "deleting policy where destination has peers but source does not", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.DeletePolicy(context.Background(), account.Id, policyWithDestinationPeersOnly.ID, userID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Deleting policy with no peers in groups should not update account's peers and not send peer update
+		step(t, "deleting policy with no peers in groups", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.DeletePolicy(context.Background(), account.Id, policyWithGroupRulesNoPeers.ID, userID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
 	})
-
-	// Deleting policy with destination group containing peers, but source group without peers should
-	// update account's peers and send peer update
-	t.Run("deleting policy where destination has peers but source does not", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.DeletePolicy(context.Background(), account.Id, policyWithDestinationPeersOnly.ID, userID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Deleting policy with no peers in groups should not update account's peers and not send peer update
-	t.Run("deleting policy with no peers in groups", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.DeletePolicy(context.Background(), account.Id, policyWithGroupRulesNoPeers.ID, userID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
 }
diff --git a/management/server/posture_checks_test.go b/management/server/posture_checks_test.go
index 74738e72d..601294eda 100644
--- a/management/server/posture_checks_test.go
+++ b/management/server/posture_checks_test.go
@@ -123,324 +123,334 @@ func initTestPostureChecksAccount(am *DefaultAccountManager) (*types.Account, er
 }
 
 func TestPostureCheckAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	g := []*types.Group{
-		{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer2.ID, peer3.ID},
-		},
-		{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupC",
-			Name:  "GroupC",
-			Peers: []string{},
-		},
-	}
-	for _, group := range g {
-		err := manager.CreateGroup(context.Background(), account.Id, userID, group)
-		assert.NoError(t, err)
-	}
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	postureCheckA := &posture.Checks{
-		Name:      "postureCheckA",
-		AccountID: account.Id,
-		Checks: posture.ChecksDefinition{
-			ProcessCheck: &posture.ProcessCheck{
-				Processes: []posture.Process{
-					{LinuxPath: "/usr/bin/netbird", MacPath: "/usr/local/bin/netbird"},
-				},
-			},
-		},
-	}
-	postureCheckA, err := manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckA, true)
-	require.NoError(t, err)
-
-	postureCheckB := &posture.Checks{
-		Name:      "postureCheckB",
-		AccountID: account.Id,
-		Checks: posture.ChecksDefinition{
-			NBVersionCheck: &posture.NBVersionCheck{
-				MinVersion: "0.28.0",
-			},
-		},
-	}
-
-	// Saving unused posture check should not update account peers and not send peer update
-	t.Run("saving unused posture check", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		postureCheckB, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Updating unused posture check should not update account peers and not send peer update
-	t.Run("updating unused posture check", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		postureCheckB.Checks = posture.ChecksDefinition{
-			NBVersionCheck: &posture.NBVersionCheck{
-				MinVersion: "0.29.0",
-			},
-		}
-		_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	policy := &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
+		g := []*types.Group{
 			{
-				Enabled:       true,
-				Sources:       []string{"groupA"},
-				Destinations:  []string{"groupA"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer2.ID, peer3.ID},
 			},
-		},
-		SourcePostureChecks: []string{postureCheckB.ID},
-	}
-
-	// Linking posture check to policy should trigger update account peers and send peer update
-	t.Run("linking posture check to policy with peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policy, err = manager.SavePolicy(context.Background(), account.Id, userID, policy, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Updating linked posture checks should update account peers and send peer update
-	t.Run("updating linked to posture check with peers", func(t *testing.T) {
-		postureCheckB.Checks = posture.ChecksDefinition{
-			NBVersionCheck: &posture.NBVersionCheck{
-				MinVersion: "0.29.0",
+			{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{},
 			},
-			ProcessCheck: &posture.ProcessCheck{
-				Processes: []posture.Process{
-					{LinuxPath: "/usr/bin/netbird", MacPath: "/usr/local/bin/netbird"},
-				},
+			{
+				ID:    "groupC",
+				Name:  "GroupC",
+				Peers: []string{},
 			},
 		}
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
+		for _, group := range g {
+			err := manager.CreateGroup(context.Background(), account.Id, userID, group)
+			assert.NoError(t, err)
 		}
-	})
 
-	// Removing posture check from policy should trigger account peers update and send peer update
-	t.Run("removing posture check from policy", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policy.SourcePostureChecks = []string{}
-		_, err := manager.SavePolicy(context.Background(), account.Id, userID, policy, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Deleting unused posture check should not trigger account peers update and not send peer update
-	t.Run("deleting unused posture check", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.DeletePostureChecks(context.Background(), account.Id, postureCheckA.ID, userID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
-	assert.NoError(t, err)
-
-	// Updating linked posture check to policy with no peers should not trigger account peers update and not send peer update
-	t.Run("updating linked posture check to policy with no peers", func(t *testing.T) {
-		_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-			Enabled: true,
-			Rules: []*types.PolicyRule{
-				{
-					Enabled:       true,
-					Sources:       []string{"groupB"},
-					Destinations:  []string{"groupC"},
-					Bidirectional: true,
-					Action:        types.PolicyTrafficActionAccept,
-				},
-			},
-			SourcePostureChecks: []string{postureCheckB.ID},
-		}, true)
-		assert.NoError(t, err)
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		postureCheckB.Checks = posture.ChecksDefinition{
-			NBVersionCheck: &posture.NBVersionCheck{
-				MinVersion: "0.29.0",
-			},
-		}
-		_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Updating linked posture check to policy where destination has peers but source does not
-	// should trigger account peers update and send peer update
-	t.Run("updating linked posture check to policy where destination has peers but source does not", func(t *testing.T) {
-		updMsg1 := updateManager.CreateChannel(context.Background(), peer2.ID)
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
 		t.Cleanup(func() {
-			updateManager.CloseChannel(context.Background(), peer2.ID)
+			updateManager.CloseChannel(context.Background(), peer1.ID)
 		})
 
-		_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+		postureCheckA := &posture.Checks{
+			Name:      "postureCheckA",
+			AccountID: account.Id,
+			Checks: posture.ChecksDefinition{
+				ProcessCheck: &posture.ProcessCheck{
+					Processes: []posture.Process{
+						{LinuxPath: "/usr/bin/netbird", MacPath: "/usr/local/bin/netbird"},
+					},
+				},
+			},
+		}
+		postureCheckA, err := manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckA, true)
+		require.NoError(t, err)
+
+		postureCheckB := &posture.Checks{
+			Name:      "postureCheckB",
+			AccountID: account.Id,
+			Checks: posture.ChecksDefinition{
+				NBVersionCheck: &posture.NBVersionCheck{
+					MinVersion: "0.28.0",
+				},
+			},
+		}
+
+		// Saving unused posture check should not update account peers and not send peer update
+		step(t, "saving unused posture check", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			postureCheckB, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Updating unused posture check should not update account peers and not send peer update
+		step(t, "updating unused posture check", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			postureCheckB.Checks = posture.ChecksDefinition{
+				NBVersionCheck: &posture.NBVersionCheck{
+					MinVersion: "0.29.0",
+				},
+			}
+			_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		policy := &types.Policy{
 			Enabled: true,
 			Rules: []*types.PolicyRule{
 				{
 					Enabled:       true,
-					Sources:       []string{"groupB"},
+					Sources:       []string{"groupA"},
 					Destinations:  []string{"groupA"},
 					Bidirectional: true,
 					Action:        types.PolicyTrafficActionAccept,
 				},
 			},
 			SourcePostureChecks: []string{postureCheckB.ID},
-		}, true)
-		assert.NoError(t, err)
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			close(done)
-		}()
-
-		postureCheckB.Checks = posture.ChecksDefinition{
-			NBVersionCheck: &posture.NBVersionCheck{
-				MinVersion: "0.29.0",
-			},
 		}
-		_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// Linking posture check to policy should trigger update account peers and send peer update
+		step(t, "linking posture check to policy with peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	// Updating linked client posture check to policy where source has peers but destination does not,
-	// should trigger account peers update and send peer update
-	t.Run("updating linked posture check to policy where source has peers but destination does not", func(t *testing.T) {
-		_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-			Enabled: true,
-			Rules: []*types.PolicyRule{
-				{
-					Enabled:       true,
-					Sources:       []string{"groupA"},
-					Destinations:  []string{"groupB"},
-					Bidirectional: true,
-					Action:        types.PolicyTrafficActionAccept,
+			policy, err = manager.SavePolicy(context.Background(), account.Id, userID, policy, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Updating linked posture checks should update account peers and send peer update
+		step(t, "updating linked to posture check with peers", func(t *testing.T) {
+			postureCheckB.Checks = posture.ChecksDefinition{
+				NBVersionCheck: &posture.NBVersionCheck{
+					MinVersion: "0.29.0",
 				},
-			},
-			SourcePostureChecks: []string{postureCheckB.ID},
-		}, true)
-		assert.NoError(t, err)
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		postureCheckB.Checks = posture.ChecksDefinition{
-			ProcessCheck: &posture.ProcessCheck{
-				Processes: []posture.Process{
-					{
-						LinuxPath: "/usr/bin/netbird",
+				ProcessCheck: &posture.ProcessCheck{
+					Processes: []posture.Process{
+						{LinuxPath: "/usr/bin/netbird", MacPath: "/usr/local/bin/netbird"},
 					},
 				},
-			},
-		}
+			}
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Removing posture check from policy should trigger account peers update and send peer update
+		step(t, "removing posture check from policy", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			policy.SourcePostureChecks = []string{}
+			_, err := manager.SavePolicy(context.Background(), account.Id, userID, policy, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Deleting unused posture check should not trigger account peers update and not send peer update
+		step(t, "deleting unused posture check", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.DeletePostureChecks(context.Background(), account.Id, postureCheckA.ID, userID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
 		_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
 		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
+		// Updating linked posture check to policy with no peers should not trigger account peers update and not send peer update
+		step(t, "updating linked posture check to policy with no peers", func(t *testing.T) {
+			_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				Enabled: true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupB"},
+						Destinations:  []string{"groupC"},
+						Bidirectional: true,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+				SourcePostureChecks: []string{postureCheckB.ID},
+			}, true)
+			assert.NoError(t, err)
+
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			postureCheckB.Checks = posture.ChecksDefinition{
+				NBVersionCheck: &posture.NBVersionCheck{
+					MinVersion: "0.29.0",
+				},
+			}
+			_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Updating linked posture check to policy where destination has peers but source does not
+		// should trigger account peers update and send peer update
+		step(t, "updating linked posture check to policy where destination has peers but source does not", func(t *testing.T) {
+			updMsg1 := updateManager.CreateChannel(context.Background(), peer2.ID)
+			t.Cleanup(func() {
+				updateManager.CloseChannel(context.Background(), peer2.ID)
+			})
+
+			_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				Enabled: true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupB"},
+						Destinations:  []string{"groupA"},
+						Bidirectional: true,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+				SourcePostureChecks: []string{postureCheckB.ID},
+			}, true)
+			assert.NoError(t, err)
+
+			settleAffectedUpdates(updMsg, updMsg1)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				close(done)
+			}()
+
+			postureCheckB.Checks = posture.ChecksDefinition{
+				NBVersionCheck: &posture.NBVersionCheck{
+					MinVersion: "0.29.0",
+				},
+			}
+			_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Updating linked client posture check to policy where source has peers but destination does not,
+		// should trigger account peers update and send peer update
+		step(t, "updating linked posture check to policy where source has peers but destination does not", func(t *testing.T) {
+			_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				Enabled: true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupA"},
+						Destinations:  []string{"groupB"},
+						Bidirectional: true,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+				SourcePostureChecks: []string{postureCheckB.ID},
+			}, true)
+			assert.NoError(t, err)
+
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			postureCheckB.Checks = posture.ChecksDefinition{
+				ProcessCheck: &posture.ProcessCheck{
+					Processes: []posture.Process{
+						{
+							LinuxPath: "/usr/bin/netbird",
+						},
+					},
+				},
+			}
+			_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 	})
 }
 
diff --git a/management/server/route_test.go b/management/server/route_test.go
index 4ca9ee48f..69b9aec6c 100644
--- a/management/server/route_test.go
+++ b/management/server/route_test.go
@@ -6,10 +6,10 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
 	"github.com/rs/xid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/update_channel"
@@ -1262,7 +1262,10 @@ func createRouterManager(t *testing.T) (*DefaultAccountManager, *update_channel.
 	}
 	eventStore := &activity.InMemoryEventStore{}
 
-	metrics, err := telemetry.NewDefaultAppMetrics(context.Background())
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	metrics, err := telemetry.NewDefaultAppMetrics(ctx)
 	require.NoError(t, err)
 
 	ctrl := gomock.NewController(t)
@@ -1290,9 +1293,8 @@ func createRouterManager(t *testing.T) (*DefaultAccountManager, *update_channel.
 	permissionsManager := permissions.NewManager(store)
 	peersManager := peers.NewManager(store, permissionsManager)
 
-	ctx := context.Background()
-
-	cacheStore, err := cache.NewStore(ctx, 100*time.Millisecond, 300*time.Millisecond, 100)
+	// A go-cache janitor only stops through a GC finalizer, which would leave synctest bubbles with a goroutine that never exits.
+	cacheStore, err := cache.NewStore(ctx, 100*time.Millisecond, 0, 100)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -1301,10 +1303,12 @@ func createRouterManager(t *testing.T) (*DefaultAccountManager, *update_channel.
 	requestBuffer := NewAccountRequestBuffer(ctx, store)
 	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nil)
 
-	am, err := BuildManager(context.Background(), nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	am, err := BuildManager(ctx, nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
 	if err != nil {
 		return nil, nil, err
 	}
+	cacheManager := am.cacheManager
+	t.Cleanup(func() { _ = cacheManager.Close() })
 	return am, updateManager, nil
 }
 
@@ -1893,265 +1897,269 @@ func TestAccount_getPeersRoutesFirewall(t *testing.T) {
 }
 
 func TestRouteAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, err := createRouterManager(t)
-	require.NoError(t, err, "failed to create account manager")
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, err := createRouterManager(t)
+		require.NoError(t, err, "failed to create account manager")
 
-	account, err := initTestRouteAccount(t, manager)
-	require.NoError(t, err, "failed to init testing account")
+		account, err := initTestRouteAccount(t, manager)
+		require.NoError(t, err, "failed to init testing account")
 
-	g := []*types.Group{
-		{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupC",
-			Name:  "GroupC",
-			Peers: []string{},
-		},
-	}
-	for _, group := range g {
-		err = manager.CreateGroup(context.Background(), account.Id, userID, group)
-		require.NoError(t, err, "failed to create group %s", group.Name)
-	}
+		g := []*types.Group{
+			{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{},
+			},
+			{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{},
+			},
+			{
+				ID:    "groupC",
+				Name:  "GroupC",
+				Peers: []string{},
+			},
+		}
+		for _, group := range g {
+			err = manager.CreateGroup(context.Background(), account.Id, userID, group)
+			require.NoError(t, err, "failed to create group %s", group.Name)
+		}
 
-	updMsg := updateManager.CreateChannel(context.Background(), peer1ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1ID)
-	})
+		updMsg := updateManager.CreateChannel(context.Background(), peer1ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1ID)
+		})
 
-	// Creating a route with no routing peer and no peers in PeerGroups or Groups should not update account peers and not send peer update
-	t.Run("creating route no routing peer and no peers in groups", func(t *testing.T) {
-		route := route.Route{
-			ID:          "testingRoute1",
-			Network:     netip.MustParsePrefix("100.65.250.202/32"),
+		// Creating a route with no routing peer and no peers in PeerGroups or Groups should not update account peers and not send peer update
+		step(t, "creating route no routing peer and no peers in groups", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
+
+			route := route.Route{
+				ID:          "testingRoute1",
+				Network:     netip.MustParsePrefix("100.65.250.202/32"),
+				NetID:       "superNet",
+				NetworkType: route.IPv4Network,
+				PeerGroups:  []string{"groupA"},
+				Description: "super",
+				Masquerade:  false,
+				Metric:      9999,
+				Enabled:     true,
+				Groups:      []string{"groupA"},
+			}
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			_, err := manager.CreateRoute(
+				context.Background(), account.Id, route.Network, route.NetworkType, route.Domains, route.Peer,
+				route.PeerGroups, route.Description, route.NetID, route.Masquerade, route.Metric,
+				route.Groups, []string{}, true, userID, route.KeepRoute, route.SkipAutoApply,
+			)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+
+		})
+
+		// Creating a route with no routing peer and having peers in groups that don't include peer1 should not send peer1 an update
+		step(t, "creating a route with peers in  PeerGroups and Groups", func(t *testing.T) {
+			drainPeerUpdates(updMsg)
+
+			route := route.Route{
+				ID:          "testingRoute2",
+				Network:     netip.MustParsePrefix("192.0.2.0/32"),
+				NetID:       "superNet",
+				NetworkType: route.IPv4Network,
+				PeerGroups:  []string{routeGroup3},
+				Description: "super",
+				Masquerade:  false,
+				Metric:      9999,
+				Enabled:     true,
+				Groups:      []string{routeGroup3},
+			}
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			_, err := manager.CreateRoute(
+				context.Background(), account.Id, route.Network, route.NetworkType, route.Domains, route.Peer,
+				route.PeerGroups, route.Description, route.NetID, route.Masquerade, route.Metric,
+				route.Groups, []string{}, true, userID, route.KeepRoute, route.SkipAutoApply,
+			)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+
+		})
+
+		baseRoute := route.Route{
+			ID:          "testingRoute3",
+			Network:     netip.MustParsePrefix("192.168.0.0/16"),
 			NetID:       "superNet",
 			NetworkType: route.IPv4Network,
-			PeerGroups:  []string{"groupA"},
-			Description: "super",
-			Masquerade:  false,
-			Metric:      9999,
-			Enabled:     true,
-			Groups:      []string{"groupA"},
-		}
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err := manager.CreateRoute(
-			context.Background(), account.Id, route.Network, route.NetworkType, route.Domains, route.Peer,
-			route.PeerGroups, route.Description, route.NetID, route.Masquerade, route.Metric,
-			route.Groups, []string{}, true, userID, route.KeepRoute, route.SkipAutoApply,
-		)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-
-	})
-
-	// Creating a route with no routing peer and having peers in groups that don't include peer1 should not send peer1 an update
-	t.Run("creating a route with peers in  PeerGroups and Groups", func(t *testing.T) {
-		drainPeerUpdates(updMsg)
-
-		route := route.Route{
-			ID:          "testingRoute2",
-			Network:     netip.MustParsePrefix("192.0.2.0/32"),
-			NetID:       "superNet",
-			NetworkType: route.IPv4Network,
-			PeerGroups:  []string{routeGroup3},
-			Description: "super",
-			Masquerade:  false,
-			Metric:      9999,
-			Enabled:     true,
-			Groups:      []string{routeGroup3},
-		}
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err := manager.CreateRoute(
-			context.Background(), account.Id, route.Network, route.NetworkType, route.Domains, route.Peer,
-			route.PeerGroups, route.Description, route.NetID, route.Masquerade, route.Metric,
-			route.Groups, []string{}, true, userID, route.KeepRoute, route.SkipAutoApply,
-		)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-
-	})
-
-	baseRoute := route.Route{
-		ID:          "testingRoute3",
-		Network:     netip.MustParsePrefix("192.168.0.0/16"),
-		NetID:       "superNet",
-		NetworkType: route.IPv4Network,
-		Peer:        peer1ID,
-		Description: "super",
-		Masquerade:  false,
-		Metric:      9999,
-		Enabled:     true,
-		Groups:      []string{routeGroup1},
-	}
-
-	// Creating route should update account peers and send peer update
-	t.Run("creating route with a routing peer", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		newRoute, err := manager.CreateRoute(
-			context.Background(), account.Id, baseRoute.Network, baseRoute.NetworkType, baseRoute.Domains, baseRoute.Peer,
-			baseRoute.PeerGroups, baseRoute.Description, baseRoute.NetID, baseRoute.Masquerade, baseRoute.Metric,
-			baseRoute.Groups, []string{}, true, userID, baseRoute.KeepRoute, !baseRoute.SkipAutoApply,
-		)
-		require.NoError(t, err)
-		baseRoute = *newRoute
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Updating the route should update account peers and send peer update when there is peers in group
-	t.Run("updating route", func(t *testing.T) {
-		baseRoute.Groups = []string{routeGroup1, routeGroup2}
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.SaveRoute(context.Background(), account.Id, userID, &baseRoute)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Deleting the route should update account peers and send peer update
-	t.Run("deleting route", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.DeleteRoute(context.Background(), account.Id, baseRoute.ID, userID)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Adding peer to route peer groups that do not have any peers should update account peers and send peer update
-	t.Run("adding peer to route peer groups that do not have any peers", func(t *testing.T) {
-		newRoute := route.Route{
-			Network:     netip.MustParsePrefix("192.168.12.0/16"),
-			NetID:       "superNet",
-			NetworkType: route.IPv4Network,
-			PeerGroups:  []string{"groupB"},
+			Peer:        peer1ID,
 			Description: "super",
 			Masquerade:  false,
 			Metric:      9999,
 			Enabled:     true,
 			Groups:      []string{routeGroup1},
 		}
-		_, err := manager.CreateRoute(
-			context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer,
-			newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric,
-			newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, !newRoute.SkipAutoApply,
-		)
-		require.NoError(t, err)
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		// Creating route should update account peers and send peer update
+		step(t, "creating route with a routing peer", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{peer1ID},
+			newRoute, err := manager.CreateRoute(
+				context.Background(), account.Id, baseRoute.Network, baseRoute.NetworkType, baseRoute.Domains, baseRoute.Peer,
+				baseRoute.PeerGroups, baseRoute.Description, baseRoute.NetID, baseRoute.Masquerade, baseRoute.Metric,
+				baseRoute.Groups, []string{}, true, userID, baseRoute.KeepRoute, !baseRoute.SkipAutoApply,
+			)
+			require.NoError(t, err)
+			baseRoute = *newRoute
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// Updating the route should update account peers and send peer update when there is peers in group
+		step(t, "updating route", func(t *testing.T) {
+			baseRoute.Groups = []string{routeGroup1, routeGroup2}
 
-	// Adding peer to route groups that do not have any peers should update account peers and send peer update
-	t.Run("adding peer to route groups that do not have any peers", func(t *testing.T) {
-		newRoute := route.Route{
-			Network:     netip.MustParsePrefix("192.168.13.0/16"),
-			NetID:       "superNet",
-			NetworkType: route.IPv4Network,
-			PeerGroups:  []string{"groupB"},
-			Description: "super",
-			Masquerade:  false,
-			Metric:      9999,
-			Enabled:     true,
-			Groups:      []string{"groupC"},
-		}
-		_, err := manager.CreateRoute(
-			context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer,
-			newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric,
-			newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, !newRoute.SkipAutoApply,
-		)
-		require.NoError(t, err)
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			err := manager.SaveRoute(context.Background(), account.Id, userID, &baseRoute)
+			require.NoError(t, err)
 
-		err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupC",
-			Name:  "GroupC",
-			Peers: []string{peer1ID},
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
+		// Deleting the route should update account peers and send peer update
+		step(t, "deleting route", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.DeleteRoute(context.Background(), account.Id, baseRoute.ID, userID)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Adding peer to route peer groups that do not have any peers should update account peers and send peer update
+		step(t, "adding peer to route peer groups that do not have any peers", func(t *testing.T) {
+			newRoute := route.Route{
+				Network:     netip.MustParsePrefix("192.168.12.0/16"),
+				NetID:       "superNet",
+				NetworkType: route.IPv4Network,
+				PeerGroups:  []string{"groupB"},
+				Description: "super",
+				Masquerade:  false,
+				Metric:      9999,
+				Enabled:     true,
+				Groups:      []string{routeGroup1},
+			}
+			_, err := manager.CreateRoute(
+				context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer,
+				newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric,
+				newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, !newRoute.SkipAutoApply,
+			)
+			require.NoError(t, err)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{peer1ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Adding peer to route groups that do not have any peers should update account peers and send peer update
+		step(t, "adding peer to route groups that do not have any peers", func(t *testing.T) {
+			newRoute := route.Route{
+				Network:     netip.MustParsePrefix("192.168.13.0/16"),
+				NetID:       "superNet",
+				NetworkType: route.IPv4Network,
+				PeerGroups:  []string{"groupB"},
+				Description: "super",
+				Masquerade:  false,
+				Metric:      9999,
+				Enabled:     true,
+				Groups:      []string{"groupC"},
+			}
+			_, err := manager.CreateRoute(
+				context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer,
+				newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric,
+				newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, !newRoute.SkipAutoApply,
+			)
+			require.NoError(t, err)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupC",
+				Name:  "GroupC",
+				Peers: []string{peer1ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 	})
 }
 
diff --git a/management/server/setupkey_test.go b/management/server/setupkey_test.go
index 2d43ea28b..87959113d 100644
--- a/management/server/setupkey_test.go
+++ b/management/server/setupkey_test.go
@@ -397,75 +397,77 @@ func TestSetupKey_Copy(t *testing.T) {
 }
 
 func TestSetupKeyAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	err := manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
-		ID:    "groupA",
-		Name:  "GroupA",
-		Peers: []string{peer1.ID, peer2.ID, peer3.ID},
-	})
-	assert.NoError(t, err)
-
-	policy := &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
-			{
-				Enabled:       true,
-				Sources:       []string{"groupA"},
-				Destinations:  []string{"group"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
-			},
-		},
-	}
-	_, err = manager.SavePolicy(context.Background(), account.Id, userID, policy, true)
-	require.NoError(t, err)
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	// The setup policy above dispatches affected-peer updates asynchronously; drain
-	// any in-flight ones so the assertions only observe the setup-key operations.
-	settleAffectedUpdates(updMsg)
-
-	var setupKey *types.SetupKey
-
-	// Creating setup key should not update account peers and not send peer update
-	t.Run("creating setup key", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		setupKey, err = manager.CreateSetupKey(context.Background(), account.Id, "key1", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
+		err := manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
+			ID:    "groupA",
+			Name:  "GroupA",
+			Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+		})
 		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+		policy := &types.Policy{
+			Enabled: true,
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"groupA"},
+					Destinations:  []string{"group"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
+			},
 		}
-	})
-
-	// Saving setup key should not update account peers and not send peer update
-	t.Run("saving setup key", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err = manager.SaveSetupKey(context.Background(), account.Id, setupKey, userID)
+		_, err = manager.SavePolicy(context.Background(), account.Id, userID, policy, true)
 		require.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
+		})
+
+		// The setup policy above dispatches affected-peer updates asynchronously; drain
+		// any in-flight ones so the assertions only observe the setup-key operations.
+		settleAffectedUpdates(updMsg)
+
+		var setupKey *types.SetupKey
+
+		// Creating setup key should not update account peers and not send peer update
+		step(t, "creating setup key", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			setupKey, err = manager.CreateSetupKey(context.Background(), account.Id, "key1", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Saving setup key should not update account peers and not send peer update
+		step(t, "saving setup key", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			_, err = manager.SaveSetupKey(context.Background(), account.Id, setupKey, userID)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
 	})
 }
 
diff --git a/management/server/user_test.go b/management/server/user_test.go
index 2d1a5f1e9..fcfb7a1e7 100644
--- a/management/server/user_test.go
+++ b/management/server/user_test.go
@@ -1544,166 +1544,170 @@ func TestDefaultAccountManager_SaveUser(t *testing.T) {
 }
 
 func TestUserAccountPeersUpdate(t *testing.T) {
-	// account groups propagation is enabled
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		// account groups propagation is enabled
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	err := manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
-		ID:    "groupA",
-		Name:  "GroupA",
-		Peers: []string{peer1.ID, peer2.ID, peer3.ID},
-	})
-	require.NoError(t, err)
+		err := manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
+			ID:    "groupA",
+			Name:  "GroupA",
+			Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+		})
+		require.NoError(t, err)
 
-	policy := &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
-			{
-				Enabled:       true,
-				Sources:       []string{"groupA"},
-				Destinations:  []string{"groupA"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
+		policy := &types.Policy{
+			Enabled: true,
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"groupA"},
+					Destinations:  []string{"groupA"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
 			},
-		},
-	}
-	_, err = manager.SavePolicy(context.Background(), account.Id, userID, policy, true)
-	require.NoError(t, err)
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	// Creating a new regular user should send peer update (as users are not filtered yet)
-	t.Run("creating new regular user with no groups", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err = manager.SaveOrAddUser(context.Background(), account.Id, userID, &types.User{
-			Id:        "regularUser1",
-			AccountID: account.Id,
-			Role:      types.UserRoleUser,
-			Issued:    types.UserIssuedAPI,
-		}, true)
+		}
+		_, err = manager.SavePolicy(context.Background(), account.Id, userID, policy, true)
 		require.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
+		})
 
-	// updating user with no linked peers should update account peers and send peer update (as users are not filtered yet)
-	t.Run("updating user with no linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		// Creating a new regular user should send peer update (as users are not filtered yet)
+		step(t, "creating new regular user with no groups", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
 
-		_, err = manager.SaveOrAddUser(context.Background(), account.Id, userID, &types.User{
-			Id:        "regularUser1",
-			AccountID: account.Id,
-			Role:      types.UserRoleUser,
-			Issued:    types.UserIssuedAPI,
-		}, false)
-		require.NoError(t, err)
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+			_, err = manager.SaveOrAddUser(context.Background(), account.Id, userID, &types.User{
+				Id:        "regularUser1",
+				AccountID: account.Id,
+				Role:      types.UserRoleUser,
+				Issued:    types.UserIssuedAPI,
+			}, true)
+			require.NoError(t, err)
 
-	// drain any buffered updates from previous subtests
-	drainPeerUpdates(updMsg)
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 
-	// deleting user with no linked peers should not update account peers and not send peer update
-	t.Run("deleting user with no linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		// saving an unchanged user with no linked peers should not update account peers and not send peer update
+		step(t, "updating user with no linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		err = manager.DeleteUser(context.Background(), account.Id, userID, "regularUser1")
-		require.NoError(t, err)
+			_, err = manager.SaveOrAddUser(context.Background(), account.Id, userID, &types.User{
+				Id:        "regularUser1",
+				AccountID: account.Id,
+				Role:      types.UserRoleUser,
+				Issued:    types.UserIssuedAPI,
+			}, false)
+			require.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
 
-	// create a user and add new peer with the user
-	_, err = manager.SaveOrAddUser(context.Background(), account.Id, userID, &types.User{
-		Id:        "regularUser2",
-		AccountID: account.Id,
-		Role:      types.UserRoleAdmin,
-		Issued:    types.UserIssuedAPI,
-	}, true)
-	require.NoError(t, err)
+		// drain any buffered updates from previous subtests
+		drainPeerUpdates(updMsg)
 
-	key, err := wgtypes.GeneratePrivateKey()
-	require.NoError(t, err)
+		// deleting user with no linked peers should not update account peers and not send peer update
+		step(t, "deleting user with no linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	expectedPeerKey := key.PublicKey().String()
-	peer4, _, _, _, err := manager.AddPeer(context.Background(), "", "", "regularUser2", &nbpeer.Peer{
-		Key:  expectedPeerKey,
-		Meta: nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
-	}, false)
-	require.NoError(t, err)
+			err = manager.DeleteUser(context.Background(), account.Id, userID, "regularUser1")
+			require.NoError(t, err)
 
-	// updating user with linked peers should update account peers and send peer update
-	t.Run("updating user with linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
 
+		// create a user and add new peer with the user
 		_, err = manager.SaveOrAddUser(context.Background(), account.Id, userID, &types.User{
 			Id:        "regularUser2",
 			AccountID: account.Id,
 			Role:      types.UserRoleAdmin,
 			Issued:    types.UserIssuedAPI,
+		}, true)
+		require.NoError(t, err)
+
+		key, err := wgtypes.GeneratePrivateKey()
+		require.NoError(t, err)
+
+		expectedPeerKey := key.PublicKey().String()
+		peer4, _, _, _, err := manager.AddPeer(context.Background(), "", "", "regularUser2", &nbpeer.Peer{
+			Key:  expectedPeerKey,
+			Meta: nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
 		}, false)
 		require.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// updating user with linked peers should update account peers and send peer update
+		step(t, "updating user with linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	peer4UpdMsg := updateManager.CreateChannel(context.Background(), peer4.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer4.ID)
-	})
+			_, err = manager.SaveOrAddUser(context.Background(), account.Id, userID, &types.User{
+				Id:        "regularUser2",
+				AccountID: account.Id,
+				Role:      types.UserRoleAdmin,
+				Issued:    types.UserIssuedAPI,
+			}, false)
+			require.NoError(t, err)
 
-	// deleting user with linked peers should update account peers and send peer update
-	t.Run("deleting user with linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, peer4UpdMsg)
-			close(done)
-		}()
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 
-		err = manager.DeleteUser(context.Background(), account.Id, userID, "regularUser2")
-		require.NoError(t, err)
+		peer4UpdMsg := updateManager.CreateChannel(context.Background(), peer4.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer4.ID)
+		})
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
+		// deleting user with linked peers should update account peers and send peer update
+		step(t, "deleting user with linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, peer4UpdMsg)
+				close(done)
+			}()
+
+			err = manager.DeleteUser(context.Background(), account.Id, userID, "regularUser2")
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 	})
 }
 

From c5aa55d2b911f85fc8d2e7b8c6206be8e7dcdcd7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alberto=20Xos=C3=A9=20M=C3=A9ndez=20Taboada?=
 <amtaboada99@gmail.com>
Date: Tue, 6 Oct 2026 15:05:01 +0200
Subject: [PATCH 10/70] [client] feat(i18n): Add Galician (gl) localization for
 desktop client (#7041)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Add Galician (gl) localization for desktop client

* [client] Address review feedback and sync latest i18n keys for Galician

Fix terms per review feedback (usarase, creen, auditar, JWT cache, poscuántico, etc.) and translate newly added upstream i18n keys.

* [client] Fix translations, polish terminology, and sync latest keys for Galician

* [client] Fix i18n parity against branch source of truth and drop undeclared uk

* [ci] Skip Galician locales in codespell check

* [client] Add latest error keys for Galician and revert _index.json formatting

Add error.settings_locked and error.settings_managed_by_mdm to Galician locale for 100% key parity with en/common.json. Revert multi-line formatting in _index.json to keep a single-line entry for Galician.
---
 .github/workflows/golangci-lint.yml   |    2 +-
 client/ui/i18n/locales/_index.json    |    3 +-
 client/ui/i18n/locales/gl/common.json | 1397 +++++++++++++++++++++++++
 3 files changed, 1400 insertions(+), 2 deletions(-)
 create mode 100644 client/ui/i18n/locales/gl/common.json

diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index ff36a0854..843177b88 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -30,7 +30,7 @@ jobs:
           # segment by codespell and behave the same across versions; the
           # recursive "**" form did not take effect with the codespell shipped
           # by this action.
-          skip: go.mod,go.sum,*/proxy/web/*,*pnpm-lock.yaml,*package-lock.json,*/locales/de/*,*/locales/es/*,*/locales/fr/*,*/locales/hu/*,*/locales/it/*,*/locales/pt/*,*/locales/ru/*,*/locales/zh-CN/*,*/i18n/TRANSLATING.md
+          skip: go.mod,go.sum,*/proxy/web/*,*pnpm-lock.yaml,*package-lock.json,*/locales/de/*,*/locales/es/*,*/locales/fr/*,*/locales/gl/*,*/locales/hu/*,*/locales/it/*,*/locales/pt/*,*/locales/ru/*,*/locales/zh-CN/*,*/i18n/TRANSLATING.md
   golangci:
     strategy:
       fail-fast: false
diff --git a/client/ui/i18n/locales/_index.json b/client/ui/i18n/locales/_index.json
index 17fb1d8ea..a52ff5929 100644
--- a/client/ui/i18n/locales/_index.json
+++ b/client/ui/i18n/locales/_index.json
@@ -10,6 +10,7 @@
         {"code": "it", "displayName": "Italiano", "englishName": "Italian"},
         {"code": "pt", "displayName": "Português", "englishName": "Portuguese"},
         {"code": "zh-CN", "displayName": "简体中文", "englishName": "Simplified Chinese"},
-        {"code": "ja", "displayName": "日本語", "englishName": "Japanese"}
+        {"code": "ja", "displayName": "日本語", "englishName": "Japanese"},
+        {"code": "gl", "displayName": "Galego", "englishName": "Galician"}
     ]
 }
diff --git a/client/ui/i18n/locales/gl/common.json b/client/ui/i18n/locales/gl/common.json
new file mode 100644
index 000000000..2b948104e
--- /dev/null
+++ b/client/ui/i18n/locales/gl/common.json
@@ -0,0 +1,1397 @@
+{
+    "tray.tooltip": {
+        "message": "NetBird"
+    },
+    "tray.status.disconnected": {
+        "message": "Desconectado"
+    },
+    "tray.status.daemonUnavailable": {
+        "message": "Non está en execución"
+    },
+    "tray.status.error": {
+        "message": "Erro"
+    },
+    "tray.status.connected": {
+        "message": "Conectado"
+    },
+    "tray.status.connecting": {
+        "message": "Conectando"
+    },
+    "tray.status.needsLogin": {
+        "message": "Inicio de sesión requirido"
+    },
+    "tray.status.loginFailed": {
+        "message": "Erro ao iniciar sesión"
+    },
+    "tray.status.sessionExpired": {
+        "message": "Sesión caducada"
+    },
+    "tray.session.expiresIn": {
+        "message": "A sesión caduca en {remaining}"
+    },
+    "tray.session.unit.lessThanMinute": {
+        "message": "menos dun minuto"
+    },
+    "tray.session.unit.minute": {
+        "message": "1 minuto"
+    },
+    "tray.session.unit.minutes": {
+        "message": "{count} minutos"
+    },
+    "tray.session.unit.hour": {
+        "message": "1 hora"
+    },
+    "tray.session.unit.hours": {
+        "message": "{count} horas"
+    },
+    "tray.session.unit.day": {
+        "message": "1 día"
+    },
+    "tray.session.unit.days": {
+        "message": "{count} días"
+    },
+    "tray.menu.open": {
+        "message": "Abrir NetBird"
+    },
+    "tray.menu.connect": {
+        "message": "Conectar"
+    },
+    "tray.menu.disconnect": {
+        "message": "Desconectar"
+    },
+    "tray.menu.exitNode": {
+        "message": "Nodo de saída"
+    },
+    "tray.menu.networks": {
+        "message": "Recursos"
+    },
+    "tray.menu.profiles": {
+        "message": "Perfís"
+    },
+    "tray.menu.manageProfiles": {
+        "message": "Xestionar perfís"
+    },
+    "tray.menu.settings": {
+        "message": "Configuración..."
+    },
+    "tray.menu.debugBundle": {
+        "message": "Crear paquete de depuración"
+    },
+    "tray.menu.about": {
+        "message": "Axuda e soporte"
+    },
+    "tray.menu.github": {
+        "message": "GitHub"
+    },
+    "tray.menu.documentation": {
+        "message": "Documentación"
+    },
+    "tray.menu.troubleshoot": {
+        "message": "Resolución de problemas"
+    },
+    "tray.menu.downloadLatest": {
+        "message": "Descargar a última versión"
+    },
+    "tray.menu.installVersion": {
+        "message": "Instalar versión {version}"
+    },
+    "tray.menu.guiVersion": {
+        "message": "GUI: {version}"
+    },
+    "tray.menu.daemonVersion": {
+        "message": "Daemon: {version}"
+    },
+    "tray.menu.versionUnknown": {
+        "message": "—"
+    },
+    "tray.menu.quit": {
+        "message": "Saír de NetBird"
+    },
+    "notify.daemonOutdated.title": {
+        "message": "O servizo NetBird está desactualizado"
+    },
+    "notify.daemonOutdated.body": {
+        "message": "Actualice o servizo NetBird para usar esta aplicación."
+    },
+    "notify.update.title": {
+        "message": "Actualización de NetBird dispoñible"
+    },
+    "notify.update.body": {
+        "message": "NetBird {version} está dispoñible."
+    },
+    "notify.update.enforcedSuffix": {
+        "message": " O seu administrador require esta actualización."
+    },
+    "notify.error.title": {
+        "message": "Erro"
+    },
+    "notify.error.connect": {
+        "message": "Erro ao conectar"
+    },
+    "notify.error.disconnect": {
+        "message": "Erro ao desconectar"
+    },
+    "notify.error.switchProfile": {
+        "message": "Erro ao cambiar a {profile}"
+    },
+    "notify.error.exitNode": {
+        "message": "Erro ao actualizar o nodo de saída {name}"
+    },
+    "notify.sessionExpired.title": {
+        "message": "Sesión caducada"
+    },
+    "notify.sessionExpired.body": {
+        "message": "A súa sesión caducou. Volva iniciar sesión para conectar."
+    },
+    "notify.sessionWarning.title": {
+        "message": "A sesión caduca en breve"
+    },
+    "notify.sessionWarning.body": {
+        "message": "A súa sesión de NetBird caduca en {remaining}. Prema en Prolongar agora para renovar."
+    },
+    "notify.sessionWarning.bodyGeneric": {
+        "message": "A súa sesión de NetBird está a punto de caducar. Prema en Prolongar agora para renovar."
+    },
+    "notify.sessionWarning.extend": {
+        "message": "Prolongar agora"
+    },
+    "notify.sessionWarning.dismiss": {
+        "message": "Descartar"
+    },
+    "notify.sessionWarning.failed": {
+        "message": "Erro ao prolongar a sesión de NetBird"
+    },
+    "notify.sessionWarning.successTitle": {
+        "message": "Sesión de NetBird prolongada"
+    },
+    "notify.sessionWarning.successBody": {
+        "message": "A súa sesión foi renovada."
+    },
+    "notify.sessionDeadlineRejected.title": {
+        "message": "Data límite de sesión rexeitada"
+    },
+    "notify.sessionDeadlineRejected.body": {
+        "message": "O servidor enviou unha data límite de sesión non válida. Por favor, inicie sesión de novo."
+    },
+    "notify.mdm.policyApplied.title": {
+        "message": "Configuración de NetBird actualizada"
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "A súa configuración de NetBird foi actualizada pola súa política de IT."
+    },
+    "common.cancel": {
+        "message": "Cancelar"
+    },
+    "common.save": {
+        "message": "Gardar"
+    },
+    "common.saveChanges": {
+        "message": "Gardar cambios"
+    },
+    "common.saving": {
+        "message": "Gardando…"
+    },
+    "common.close": {
+        "message": "Pechar"
+    },
+    "common.copy": {
+        "message": "Copiar"
+    },
+    "common.togglePasswordVisibility": {
+        "message": "Amosar ou ocultar o contrasinal"
+    },
+    "common.increase": {
+        "message": "Aumentar"
+    },
+    "common.decrease": {
+        "message": "Diminuír"
+    },
+    "common.delete": {
+        "message": "Eliminar"
+    },
+    "common.create": {
+        "message": "Crear"
+    },
+    "common.add": {
+        "message": "Engadir"
+    },
+    "common.remove": {
+        "message": "Quitar"
+    },
+    "common.refresh": {
+        "message": "Actualizar"
+    },
+    "common.loading": {
+        "message": "Cargando…"
+    },
+    "common.netbird": {
+        "message": "NetBird"
+    },
+    "common.noResults.title": {
+        "message": "Non se puido atopar ningún resultado"
+    },
+    "common.noResults.description": {
+        "message": "Non puidemos atopar ningún resultado. Por favor, tente cun termo de busca diferente ou cambie os seus filtros."
+    },
+    "notConnected.title": {
+        "message": "Sen conexión"
+    },
+    "notConnected.description": {
+        "message": "Conéctese primeiro a NetBird para ver información detallada sobre os seus peers, recursos de rede e nodos de saída."
+    },
+    "connect.status.disconnected": {
+        "message": "Desconectado"
+    },
+    "connect.status.connecting": {
+        "message": "Establecendo conexión..."
+    },
+    "connect.status.connected": {
+        "message": "Conectado á rede NetBird"
+    },
+    "connect.status.disconnecting": {
+        "message": "Desconectando..."
+    },
+    "connect.status.daemonUnavailable": {
+        "message": "Daemon non dispoñible"
+    },
+    "connect.status.loginRequired": {
+        "message": "Inicie sesión para conectar"
+    },
+    "connect.error.loginTitle": {
+        "message": "Erro ao iniciar sesión"
+    },
+    "connect.error.connectTitle": {
+        "message": "Erro ao conectar"
+    },
+    "connect.error.disconnectTitle": {
+        "message": "Erro ao desconectar"
+    },
+    "nav.peers.title": {
+        "message": "Peers"
+    },
+    "nav.peers.description": {
+        "message": "{connected} de {total} conectados"
+    },
+    "nav.resources.title": {
+        "message": "Recursos"
+    },
+    "nav.resources.description": {
+        "message": "{active} de {total} activos"
+    },
+    "nav.exitNode.title": {
+        "message": "Nodos de saída"
+    },
+    "nav.exitNode.none": {
+        "message": "Non activo"
+    },
+    "nav.exitNode.using": {
+        "message": "Vía {name}"
+    },
+    "header.openSettings": {
+        "message": "Abrir configuración"
+    },
+    "header.togglePanel": {
+        "message": "Alternar panel lateral"
+    },
+    "profile.selector.loading": {
+        "message": "Cargando..."
+    },
+    "profile.selector.noProfile": {
+        "message": "Sen perfil"
+    },
+    "profile.selector.searchPlaceholder": {
+        "message": "Buscar perfil por nome..."
+    },
+    "profile.selector.emptyTitle": {
+        "message": "Non se atoparon perfís"
+    },
+    "profile.selector.emptyDescription": {
+        "message": "Probe cun termo de busca diferente ou cree un novo perfil."
+    },
+    "profile.selector.newProfile": {
+        "message": "Novo perfil"
+    },
+    "profile.selector.moreOptions": {
+        "message": "Máis opcións"
+    },
+    "profile.selector.deregister": {
+        "message": "Dar de baixa"
+    },
+    "profile.selector.delete": {
+        "message": "Eliminar"
+    },
+    "profile.selector.switchTo": {
+        "message": "Cambiar a este perfil"
+    },
+    "profile.selector.edit": {
+        "message": "Editar"
+    },
+    "profile.edit.title": {
+        "message": "Editar perfil"
+    },
+    "profile.edit.submit": {
+        "message": "Gardar cambios"
+    },
+    "profile.dialog.title": {
+        "message": "Introduza o nome do perfil"
+    },
+    "profile.dialog.nameLabel": {
+        "message": "Nome do perfil"
+    },
+    "profile.dialog.description": {
+        "message": "Estableza un nome facilmente identificable para o seu perfil."
+    },
+    "profile.dialog.placeholder": {
+        "message": "p. ex. Traballo"
+    },
+    "profile.dialog.submit": {
+        "message": "Engadir perfil"
+    },
+    "profile.dialog.required": {
+        "message": "Por favor, introduza un nome de perfil, p. ex. traballo, casa"
+    },
+    "profile.dialog.managementHelp": {
+        "message": "Use NetBird Cloud ou o seu propio servidor."
+    },
+    "profile.dialog.urlUnreachable": {
+        "message": "Non se puido acadar este servidor. Comprobe o URL ou engada o perfil de todas formas se ten a certeza de que é correcto."
+    },
+    "header.menu.settings": {
+        "message": "Configuración..."
+    },
+    "header.menu.defaultView": {
+        "message": "Vista predeterminada"
+    },
+    "header.menu.advancedView": {
+        "message": "Vista avanzada"
+    },
+    "header.menu.updateAvailable": {
+        "message": "Actualización dispoñible"
+    },
+    "header.menu.open": {
+        "message": "Abrir menú"
+    },
+    "header.profile.switch": {
+        "message": "Cambiar de perfil"
+    },
+    "connect.toggle.label": {
+        "message": "Alternar conexión de NetBird"
+    },
+    "connect.localIp.label": {
+        "message": "Enderezos IP locais"
+    },
+    "common.search": {
+        "message": "Buscar"
+    },
+    "common.filter": {
+        "message": "Filtrar"
+    },
+    "exitNodes.dropdown.trigger": {
+        "message": "Seleccionar nodo de saída"
+    },
+    "peers.row.label": {
+        "message": "Abrir detalles de {name}, {status}"
+    },
+    "peers.dialog.title": {
+        "message": "Detalles do peer"
+    },
+    "networks.row.toggle": {
+        "message": "Alternar {name}"
+    },
+    "networks.bulk.label": {
+        "message": "Alternar todos os recursos visibles"
+    },
+    "profile.switch.title": {
+        "message": "Cambiar ao perfil «{name}»?"
+    },
+    "profile.switch.message": {
+        "message": "Ten a certeza de que quere cambiar de perfil?\nO seu perfil actual desconectarase."
+    },
+    "profile.switch.confirm": {
+        "message": "Confirmar"
+    },
+    "profile.deregister.title": {
+        "message": "Dar de baixa o perfil «{name}»?"
+    },
+    "profile.deregister.message": {
+        "message": "Ten a certeza de que quere dar de baixa este perfil?\nTerá que iniciar sesión de novo para usalo."
+    },
+    "profile.deregister.confirm": {
+        "message": "Dar de baixa"
+    },
+    "profile.delete.title": {
+        "message": "Eliminar o perfil «{name}»?"
+    },
+    "profile.delete.message": {
+        "message": "Ten a certeza de que quere eliminar este perfil?\nEsta acción non se pode desfacer."
+    },
+    "profile.delete.disabledActive": {
+        "message": "Os perfís activos non se poden eliminar. Cambie a un perfil diferente antes de eliminar este perfil."
+    },
+    "profile.delete.disabledDefault": {
+        "message": "O perfil predeterminado non se pode eliminar."
+    },
+    "profile.error.switchTitle": {
+        "message": "Erro ao cambiar de perfil"
+    },
+    "profile.error.deregisterTitle": {
+        "message": "Erro ao dar de baixa o perfil"
+    },
+    "profile.error.deleteTitle": {
+        "message": "Erro ao eliminar o perfil"
+    },
+    "profile.error.createTitle": {
+        "message": "Erro ao crear o perfil"
+    },
+    "profile.error.editTitle": {
+        "message": "Erro ao editar o perfil"
+    },
+    "profile.error.loadTitle": {
+        "message": "Erro ao cargar os perfís"
+    },
+    "profile.dropdown.activeProfile": {
+        "message": "Perfil activo"
+    },
+    "profile.dropdown.switchProfile": {
+        "message": "Cambiar de perfil"
+    },
+    "profile.dropdown.noEmail": {
+        "message": "Outro"
+    },
+    "profile.dropdown.addProfile": {
+        "message": "Engadir perfil"
+    },
+    "profile.dropdown.manageProfiles": {
+        "message": "Xestionar perfís"
+    },
+    "profile.dropdown.settings": {
+        "message": "Configuración"
+    },
+    "settings.profiles.section.profiles": {
+        "message": "Perfís"
+    },
+    "settings.profiles.intro": {
+        "message": "Manteña identidades de NetBird separadas lado a lado, por exemplo contas de traballo e persoais, ou diferentes servidores de xestión. Engada, dea de baixa ou elimine perfís a continuación."
+    },
+    "settings.profiles.addProfile": {
+        "message": "Engadir perfil"
+    },
+    "settings.profiles.active": {
+        "message": "Activo"
+    },
+    "settings.profiles.emptyTitle": {
+        "message": "Sen perfís"
+    },
+    "settings.profiles.emptyDescription": {
+        "message": "Cree un perfil para conectarse a un servidor de xestión de NetBird."
+    },
+    "settings.error.loadTitle": {
+        "message": "Erro ao cargar a configuración"
+    },
+    "settings.error.saveTitle": {
+        "message": "Erro ao gardar a configuración"
+    },
+    "settings.error.debugBundleTitle": {
+        "message": "Erro no paquete de depuración"
+    },
+    "settings.nav.label": {
+        "message": "Seccións de configuración"
+    },
+    "settings.tabs.general": {
+        "message": "Xeral"
+    },
+    "settings.tabs.network": {
+        "message": "Rede"
+    },
+    "settings.tabs.security": {
+        "message": "Seguridade"
+    },
+    "settings.tabs.profiles": {
+        "message": "Perfís"
+    },
+    "settings.tabs.ssh": {
+        "message": "SSH"
+    },
+    "settings.tabs.advanced": {
+        "message": "Avanzado"
+    },
+    "settings.tabs.troubleshooting": {
+        "message": "Resolución de problemas"
+    },
+    "settings.tabs.about": {
+        "message": "Acerca de"
+    },
+    "settings.tabs.updateAvailable": {
+        "message": "Actualización dispoñible"
+    },
+    "settings.general.section.general": {
+        "message": "Xeral"
+    },
+    "settings.general.section.connection": {
+        "message": "Conexión"
+    },
+    "settings.general.connectOnStartup.label": {
+        "message": "Conectar ao iniciar"
+    },
+    "settings.general.connectOnStartup.help": {
+        "message": "Establece a conexión automaticamente cando se inicia o servizo."
+    },
+    "settings.general.notifications.label": {
+        "message": "Notificacións de escritorio"
+    },
+    "settings.general.notifications.help": {
+        "message": "Amosar notificacións de escritorio para novas actualizacións e eventos de conexión."
+    },
+    "settings.general.autostart.label": {
+        "message": "Iniciar UI de NetBird ao acceder"
+    },
+    "settings.general.autostart.help": {
+        "message": "Inicie a interface de NetBird automaticamente cando inicie sesión. Isto afecta só á interface gráfica, non ao servizo en segundo plano."
+    },
+    "settings.general.autostart.errorTitle": {
+        "message": "Erro ao cambiar o inicio automático"
+    },
+    "settings.general.keepConnectedOnQuit.label": {
+        "message": "Manter conectado ao pechar"
+    },
+    "settings.general.keepConnectedOnQuit.help": {
+        "message": "Mantén a conexión de NetBird en segundo plano cando se pecha a xanela principal."
+    },
+    "settings.general.language.label": {
+        "message": "Idioma da interface"
+    },
+    "settings.general.language.help": {
+        "message": "Escolla o idioma no que se amosa a aplicación NetBird."
+    },
+    "settings.general.language.search": {
+        "message": "Buscar idioma…"
+    },
+    "settings.general.language.empty": {
+        "message": "Ningún idioma coincide."
+    },
+    "settings.general.theme.label": {
+        "message": "Tema"
+    },
+    "settings.general.theme.help": {
+        "message": "Escolla claro ou escuro, ou siga a aparencia do seu sistema."
+    },
+    "settings.general.theme.system": {
+        "message": "Sistema"
+    },
+    "settings.general.theme.light": {
+        "message": "Claro"
+    },
+    "settings.general.theme.dark": {
+        "message": "Escuro"
+    },
+    "settings.general.management.label": {
+        "message": "Servidor de xestión"
+    },
+    "settings.general.management.help": {
+        "message": "Conéctese a NetBird Cloud ou ao seu propio servidor de xestión autoaloxado. Os cambios volverán conectar o cliente."
+    },
+    "settings.general.management.cloud": {
+        "message": "Cloud"
+    },
+    "settings.general.management.selfHosted": {
+        "message": "Autoaloxado"
+    },
+    "settings.general.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlError": {
+        "message": "Por favor, introduza un URL válido, p. ex. https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlUnreachable": {
+        "message": "Non se puido acadar este servidor. Comprobe o URL ou garde de todas formas se ten a certeza de que é correcto."
+    },
+    "settings.general.management.switchCloudTitle": {
+        "message": "Cambiar a NetBird Cloud?"
+    },
+    "settings.general.management.switchCloudMessage": {
+        "message": "Isto desconecta o seu servidor autoaloxado.\nPode que teña que iniciar sesión de novo."
+    },
+    "settings.general.management.switchCloudConfirm": {
+        "message": "Cambiar a Cloud"
+    },
+    "settings.network.section.connectivity": {
+        "message": "Conectividade"
+    },
+    "settings.network.section.routingDns": {
+        "message": "Encamiñamento e DNS"
+    },
+    "settings.network.monitor.label": {
+        "message": "Reconectar ao cambiar de rede"
+    },
+    "settings.network.monitor.help": {
+        "message": "Supervisa a rede e reconéctase automaticamente ante cambios como o cambio de Wi-Fi ou o reinicio tras a suspensión."
+    },
+    "settings.network.dns.label": {
+        "message": "Activar DNS"
+    },
+    "settings.network.dns.help": {
+        "message": "Aplica a configuración DNS xestionada por NetBird ao resolutor do sistema."
+    },
+    "settings.network.clientRoutes.label": {
+        "message": "Activar rutas de cliente"
+    },
+    "settings.network.clientRoutes.help": {
+        "message": "Acepta rutas doutros peers para acadar as súas redes."
+    },
+    "settings.network.serverRoutes.label": {
+        "message": "Activar rutas de servidor"
+    },
+    "settings.network.serverRoutes.help": {
+        "message": "Anuncia as rutas locais deste equipo a outros peers."
+    },
+    "settings.network.ipv6.label": {
+        "message": "Activar IPv6"
+    },
+    "settings.network.ipv6.help": {
+        "message": "Use o enderezamento IPv6 para a rede superposta de NetBird."
+    },
+    "settings.security.section.firewall": {
+        "message": "Cortafogos"
+    },
+    "settings.security.section.encryption": {
+        "message": "Cifrado"
+    },
+    "settings.security.blockInbound.label": {
+        "message": "Bloquear tráfico entrante"
+    },
+    "settings.security.blockInbound.help": {
+        "message": "Rexeita conexións non solicitadas de peers a este dispositivo e a calquera rede que encamiñe. O tráfico saínte non se ve afectado."
+    },
+    "settings.security.blockLan.label": {
+        "message": "Bloquear acceso a LAN"
+    },
+    "settings.security.blockLan.help": {
+        "message": "Evita que os peers acaden a súa rede local ou os seus dispositivos cando este dispositivo encamiñe o seu tráfico."
+    },
+    "settings.security.rosenpass.label": {
+        "message": "Activar resistencia cuántica"
+    },
+    "settings.security.rosenpass.help": {
+        "message": "Engade un intercambio de chaves poscuántico mediante Rosenpass sobre WireGuard®."
+    },
+    "settings.security.rosenpassPermissive.label": {
+        "message": "Activar modo permisivo"
+    },
+    "settings.security.rosenpassPermissive.help": {
+        "message": "Permite conexións con peers que non teñan soporte de resistencia cuántica."
+    },
+    "settings.ssh.section.server": {
+        "message": "Servidor"
+    },
+    "settings.ssh.section.capabilities": {
+        "message": "Capacidades"
+    },
+    "settings.ssh.section.authentication": {
+        "message": "Autenticación"
+    },
+    "settings.ssh.server.label": {
+        "message": "Activar servidor SSH"
+    },
+    "settings.ssh.server.help": {
+        "message": "Executa o servidor SSH de NetBird neste equipo para que outros peers poidan conectarse a el."
+    },
+    "settings.ssh.root.label": {
+        "message": "Permitir inicio de sesión de root"
+    },
+    "settings.ssh.root.help": {
+        "message": "Permite que os peers inicien sesión como usuario root. Desactíveo para requirir unha conta sen privilexios."
+    },
+    "settings.ssh.sftp.label": {
+        "message": "Permitir SFTP"
+    },
+    "settings.ssh.sftp.help": {
+        "message": "Transfire ficheiros de xeito seguro usando clientes nativos de SFTP ou SCP."
+    },
+    "settings.ssh.localForward.label": {
+        "message": "Reenvío de portos locais"
+    },
+    "settings.ssh.localForward.help": {
+        "message": "Permite que os peers conectados fagan túneles de portos locais cara a servizos accesibles desde este equipo."
+    },
+    "settings.ssh.remoteForward.label": {
+        "message": "Reenvío de portos remotos"
+    },
+    "settings.ssh.remoteForward.help": {
+        "message": "Permite que os peers conectados expoñan portos neste equipo cara á súa propia máquina."
+    },
+    "settings.ssh.jwt.label": {
+        "message": "Activar autenticación JWT"
+    },
+    "settings.ssh.jwt.help": {
+        "message": "Verifica cada sesión SSH co seu IdP para a identidade do usuario e auditar. Desactíveo para depender só de políticas ACL de rede, útil cando non hai IdP dispoñible."
+    },
+    "settings.ssh.jwtTtl.label": {
+        "message": "TTL da caché JWT"
+    },
+    "settings.ssh.jwtTtl.help": {
+        "message": "Canto tempo almacena este cliente un JWT na caché antes de solicitalo de novo nas conexións SSH saíntes. Estableza en 0 para desactivar a caché e autenticar en cada conexión."
+    },
+    "settings.ssh.jwtTtl.suffix": {
+        "message": "Segundo(s)"
+    },
+    "settings.advanced.section.interface": {
+        "message": "Interface"
+    },
+    "settings.advanced.section.security": {
+        "message": "Seguridade"
+    },
+    "settings.advanced.interfaceName.label": {
+        "message": "Nome"
+    },
+    "settings.advanced.interfaceName.error": {
+        "message": "Use entre 1 e 15 letras, díxitos, puntos, guións ou guións baixos."
+    },
+    "settings.advanced.interfaceName.errorMac": {
+        "message": "Debe comezar por \"utun\" seguido dun número (p. ex. utun100)."
+    },
+    "settings.advanced.port.label": {
+        "message": "Porto"
+    },
+    "settings.advanced.port.error": {
+        "message": "Introduza un porto entre {min} e {max}."
+    },
+    "settings.advanced.port.help": {
+        "message": "Se se establece en 0, usarase un porto libre ao azar."
+    },
+    "settings.advanced.mtu.label": {
+        "message": "MTU"
+    },
+    "settings.advanced.mtu.error": {
+        "message": "Introduza un valor de MTU entre {min} e {max}."
+    },
+    "settings.advanced.psk.label": {
+        "message": "Chave precompartida"
+    },
+    "settings.advanced.psk.help": {
+        "message": "Chave PSK opcional de WireGuard para cifrado simétrico adicional. Non é o mesmo que unha chave de configuración de NetBird. Só se comunicará con peers que usen a mesma chave precompartida."
+    },
+    "settings.troubleshooting.section.title": {
+        "message": "Paquete de depuración"
+    },
+    "settings.troubleshooting.anonymize.label": {
+        "message": "Anonimizar información confidencial"
+    },
+    "settings.troubleshooting.anonymize.help": {
+        "message": "Oculta enderezos IP públicos e dominios que non sexan de NetBird nos rexistros."
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "O nivel predeterminado mantén lexibles os enderezos IPv4 internos e os nomes dos peers para o soporte. O nivel estrito anonimiza ademais os enderezos IP privados (RFC 1918), CGNAT e de ligazón local, os nomes dos peers e as chaves públicas de WireGuard. Os valores recorrentes asígnanse ao mesmo marcador, polo que os peers seguen sendo distinguibles. Use Estrito cando comparta o paquete fóra da súa organización."
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "Ningunha"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "Predeterminada"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "Estrita"
+    },
+    "settings.troubleshooting.systemInfo.label": {
+        "message": "Incluír información do sistema"
+    },
+    "settings.troubleshooting.systemInfo.help": {
+        "message": "Inclúe SO, kernel, interfaces de rede e táboas de encamiñamento."
+    },
+    "settings.troubleshooting.upload.label": {
+        "message": "Subir paquete aos servidores de NetBird"
+    },
+    "settings.troubleshooting.upload.help": {
+        "message": "Devolve unha chave de subida para compartir co soporte de NetBird."
+    },
+    "settings.troubleshooting.trace.label": {
+        "message": "Activar rexistros de traza"
+    },
+    "settings.troubleshooting.trace.help": {
+        "message": "Eleva o nivel de rexistro a TRACE e restaúrao despois."
+    },
+    "settings.troubleshooting.capture.label": {
+        "message": "Sesión de captura"
+    },
+    "settings.troubleshooting.capture.help": {
+        "message": "Volve conectar e agarda para que poida reproducir a incidencia."
+    },
+    "settings.troubleshooting.packets.label": {
+        "message": "Capturar paquetes de rede"
+    },
+    "settings.troubleshooting.packets.help": {
+        "message": "Garda un ficheiro .pcap do tráfico de rede durante a xanela de captura."
+    },
+    "settings.troubleshooting.duration.label": {
+        "message": "Duración da captura"
+    },
+    "settings.troubleshooting.duration.help": {
+        "message": "Canto tempo se executa a sesión de captura."
+    },
+    "settings.troubleshooting.duration.suffix": {
+        "message": "Minuto(s)"
+    },
+    "settings.troubleshooting.create": {
+        "message": "Crear paquete"
+    },
+    "settings.troubleshooting.progress.description": {
+        "message": "Recompilando rexistros, detalles do sistema e estado de conexión. Isto adoita levar un momento. Pode seguir usando NetBird ou pechar a Configuración mentres remata."
+    },
+    "settings.troubleshooting.cancelling": {
+        "message": "Cancelando…"
+    },
+    "settings.troubleshooting.done.uploadedTitle": {
+        "message": "Paquete de depuración subido con éxito!"
+    },
+    "settings.troubleshooting.done.savedTitle": {
+        "message": "Paquete gardado"
+    },
+    "settings.troubleshooting.done.uploadedDescription": {
+        "message": "Comparta a chave de subida de abaixo co <docs>soporte de NetBird</docs>. Tamén se gardou unha copia local no seu dispositivo."
+    },
+    "settings.troubleshooting.done.savedDescription": {
+        "message": "O seu paquete de depuración gardouse localmente."
+    },
+    "settings.troubleshooting.done.copyKey": {
+        "message": "Copiar chave"
+    },
+    "settings.troubleshooting.done.openFolder": {
+        "message": "Abrir cartafol"
+    },
+    "settings.troubleshooting.done.openFileLocation": {
+        "message": "Abrir localización do ficheiro"
+    },
+    "settings.troubleshooting.uploadFailedWithReason": {
+        "message": "Erro na subida: {reason} O paquete aínda está gardado localmente."
+    },
+    "settings.troubleshooting.uploadFailed": {
+        "message": "Erro na subida. O paquete aínda está gardado localmente."
+    },
+    "settings.troubleshooting.stage.reconnecting": {
+        "message": "Reconectando NetBird…"
+    },
+    "settings.troubleshooting.stage.capturing": {
+        "message": "Capturando rexistros de depuración"
+    },
+    "settings.troubleshooting.stage.bundling": {
+        "message": "Xerando paquete de depuración…"
+    },
+    "settings.troubleshooting.stage.uploading": {
+        "message": "Subindo a NetBird…"
+    },
+    "settings.troubleshooting.stage.cancelling": {
+        "message": "Cancelando…"
+    },
+    "settings.about.client": {
+        "message": "Cliente NetBird v{version}"
+    },
+    "settings.about.clientName": {
+        "message": "Cliente NetBird"
+    },
+    "settings.about.development": {
+        "message": "[Desenvolvemento]"
+    },
+    "settings.about.gui": {
+        "message": "GUI v{version}"
+    },
+    "settings.about.guiName": {
+        "message": "GUI"
+    },
+    "settings.about.copyright": {
+        "message": "© {year} NetBird. Todos os dereitos reservados."
+    },
+    "settings.about.links.imprint": {
+        "message": "Aviso legal"
+    },
+    "settings.about.links.privacy": {
+        "message": "Privacidade"
+    },
+    "settings.about.links.cla": {
+        "message": "CLA"
+    },
+    "settings.about.links.terms": {
+        "message": "Termos do servizo"
+    },
+    "settings.about.community.github": {
+        "message": "GitHub"
+    },
+    "settings.about.community.slack": {
+        "message": "Slack"
+    },
+    "settings.about.community.forum": {
+        "message": "Foro"
+    },
+    "settings.about.community.documentation": {
+        "message": "Documentación"
+    },
+    "settings.about.community.feedback": {
+        "message": "Comentarios"
+    },
+    "update.banner.message": {
+        "message": "NetBird {version} está listo para instalar."
+    },
+    "update.banner.later": {
+        "message": "Máis tarde"
+    },
+    "update.banner.installNow": {
+        "message": "Instalar agora"
+    },
+    "update.card.versionAvailableDownload": {
+        "message": "A versión {version} está dispoñible para descargar."
+    },
+    "update.card.versionAvailableInstall": {
+        "message": "A versión {version} está dispoñible para instalar."
+    },
+    "update.card.whatsNew": {
+        "message": "Que hai de novo?"
+    },
+    "update.card.installNow": {
+        "message": "Instalar agora"
+    },
+    "update.card.getInstaller": {
+        "message": "Descargar"
+    },
+    "update.card.autoCheckInterval": {
+        "message": "NetBird busca actualizacións en segundo plano."
+    },
+    "update.card.changelog": {
+        "message": "Rexistro de cambios"
+    },
+    "update.card.onLatestVersion": {
+        "message": "Ten a versión máis recente"
+    },
+    "update.header.tooltip": {
+        "message": "Actualización dispoñible"
+    },
+    "update.overlay.updatingVersion": {
+        "message": "Actualizando NetBird á v{version}"
+    },
+    "update.overlay.updating": {
+        "message": "Actualizando NetBird"
+    },
+    "update.overlay.description": {
+        "message": "Unha versión máis recente está dispoñible e estase instalando. NetBird reiniciarase automaticamente unha vez remate a actualización."
+    },
+    "update.overlay.error.timeoutTitle": {
+        "message": "A actualización está tardando demasiado"
+    },
+    "update.overlay.error.timeoutDescription": {
+        "message": "A instalación de {target} tardou demasiado e non rematou."
+    },
+    "update.overlay.error.canceledTitle": {
+        "message": "Detívose a actualización"
+    },
+    "update.overlay.error.canceledDescription": {
+        "message": "A actualización a {target} cancelouse antes de rematar."
+    },
+    "update.overlay.error.failTitle": {
+        "message": "Non se puido instalar a actualización"
+    },
+    "update.overlay.error.failDescription": {
+        "message": "Non se puido instalar {target}."
+    },
+    "update.overlay.error.unknownMessage": {
+        "message": "erro descoñecido"
+    },
+    "update.overlay.error.targetVersion": {
+        "message": "v{version}"
+    },
+    "update.overlay.error.targetFallback": {
+        "message": "a nova versión"
+    },
+    "update.error.loadStateTitle": {
+        "message": "Erro ao cargar o estado de actualización"
+    },
+    "update.error.triggerTitle": {
+        "message": "Erro ao iniciar a actualización"
+    },
+    "update.page.versionLine": {
+        "message": "Actualizando cliente a: {version}."
+    },
+    "update.page.versionLineGeneric": {
+        "message": "Actualizando cliente."
+    },
+    "update.page.outdated": {
+        "message": "A súa versión de cliente é máis antiga que a versión de actualización automática establecida na xestión."
+    },
+    "update.page.status.running": {
+        "message": "Actualizando"
+    },
+    "update.page.status.timeout": {
+        "message": "Esgotouse o tempo de espera da actualización. Por favor, inténteo de novo."
+    },
+    "update.page.status.canceled": {
+        "message": "Actualización cancelada."
+    },
+    "update.page.status.failed": {
+        "message": "Erro na actualización: {message}"
+    },
+    "update.page.status.unknownError": {
+        "message": "erro de actualización descoñecido"
+    },
+    "update.page.failedTitle": {
+        "message": "Erro na actualización"
+    },
+    "update.page.timeoutMessage": {
+        "message": "Esgotouse o tempo de espera da actualización."
+    },
+    "update.page.dontClose": {
+        "message": "Por favor, non peche esta xanela."
+    },
+    "update.page.updating": {
+        "message": "Actualizando…"
+    },
+    "update.page.complete": {
+        "message": "Actualización completada"
+    },
+    "update.page.failed": {
+        "message": "Erro na actualización"
+    },
+    "window.title.settings": {
+        "message": "Configuración"
+    },
+    "window.title.signIn": {
+        "message": "Iniciar sesión"
+    },
+    "window.title.sessionExpiration": {
+        "message": "Sesión a punto de caducar"
+    },
+    "window.title.updating": {
+        "message": "Actualizando"
+    },
+    "window.title.welcome": {
+        "message": "Benvido a NetBird"
+    },
+    "window.title.error": {
+        "message": "Erro"
+    },
+    "welcome.title": {
+        "message": "Busque NetBird na súa área de notificación"
+    },
+    "welcome.titleMac": {
+        "message": "Busque NetBird na súa barra de menú"
+    },
+    "welcome.description": {
+        "message": "NetBird reside na súa área de notificación. Faga clic na icona para conectar, cambiar de perfil ou abrir a configuración."
+    },
+    "welcome.descriptionMac": {
+        "message": "NetBird reside na súa barra de menú. Faga clic na icona para conectar, cambiar de perfil ou abrir a configuración."
+    },
+    "welcome.continue": {
+        "message": "Continuar"
+    },
+    "welcome.back": {
+        "message": "Volver"
+    },
+    "welcome.management.title": {
+        "message": "Configurar NetBird"
+    },
+    "welcome.management.description": {
+        "message": "Faga clic en Continuar para comezar, ou escolla Autoaloxado se ten o seu propio servidor de NetBird."
+    },
+    "welcome.management.cloud.title": {
+        "message": "NetBird Cloud"
+    },
+    "welcome.management.cloud.description": {
+        "message": "Use o noso servizo aloxado. Sen necesidade de configuración."
+    },
+    "welcome.management.selfHosted.title": {
+        "message": "Autoaloxado"
+    },
+    "welcome.management.selfHosted.description": {
+        "message": "Conéctese ao seu propio servidor de xestión."
+    },
+    "welcome.management.urlLabel": {
+        "message": "URL do servidor de xestión"
+    },
+    "welcome.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlInvalid": {
+        "message": "Por favor, introduza un URL válido, p. ex. https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlUnreachable": {
+        "message": "Non se puido acadar este servidor. Comprobe o URL ou a súa rede, e continúe se ten a certeza de que é correcto."
+    },
+    "welcome.management.checking": {
+        "message": "Comprobando…"
+    },
+    "browserLogin.title": {
+        "message": "Complete o inicio de sesión no navegador"
+    },
+    "browserLogin.notSeeing": {
+        "message": "Abrimos unha lapela no seu navegador para que poida rematar de iniciar sesión. Non a ve?"
+    },
+    "browserLogin.tryAgain": {
+        "message": "Tentar de novo"
+    },
+    "browserLogin.openFailedTitle": {
+        "message": "Erro ao abrir o navegador"
+    },
+    "sessionExpiration.title": {
+        "message": "A sesión caduca en breve"
+    },
+    "sessionExpiration.titleLater": {
+        "message": "A súa sesión caducará"
+    },
+    "sessionExpiration.description": {
+        "message": "Este dispositivo desconectarase en breve. Renove iniciando sesión no navegador."
+    },
+    "sessionExpiration.descriptionLater": {
+        "message": "Un inicio de sesión no navegador mantén este dispositivo conectado á súa rede."
+    },
+    "sessionExpiration.stay": {
+        "message": "Renovar sesión"
+    },
+    "sessionExpiration.authenticate": {
+        "message": "Autenticar"
+    },
+    "sessionExpiration.logout": {
+        "message": "Pechar sesión"
+    },
+    "sessionExpiration.expired": {
+        "message": "Sesión caducada"
+    },
+    "sessionExpiration.expiredDescription": {
+        "message": "Dispositivo desconectado. Autentíquese cun inicio de sesión no navegador para volver conectar."
+    },
+    "sessionExpiration.close": {
+        "message": "Pechar"
+    },
+    "sessionExpiration.extendFailedTitle": {
+        "message": "Erro ao prolongar a sesión"
+    },
+    "sessionExpiration.logoutFailedTitle": {
+        "message": "Erro ao pechar sesión"
+    },
+    "peers.search.placeholder": {
+        "message": "Buscar por nome ou IP"
+    },
+    "peers.filter.all": {
+        "message": "Todos"
+    },
+    "peers.filter.online": {
+        "message": "En liña"
+    },
+    "peers.filter.offline": {
+        "message": "Fóra de liña"
+    },
+    "peers.empty.title": {
+        "message": "Sen peers dispoñibles"
+    },
+    "peers.empty.description": {
+        "message": "Ou non ten ningún peer dispoñible ou non ten acceso a ningún deles."
+    },
+    "peers.details.domain": {
+        "message": "Dominio"
+    },
+    "peers.details.netbirdIp": {
+        "message": "IP de NetBird"
+    },
+    "peers.details.netbirdIpv6": {
+        "message": "IPv6 de NetBird"
+    },
+    "peers.details.publicKey": {
+        "message": "Chave pública"
+    },
+    "peers.details.connection": {
+        "message": "Conexión"
+    },
+    "peers.details.latency": {
+        "message": "Latencia"
+    },
+    "peers.details.lastHandshake": {
+        "message": "Último handshake"
+    },
+    "peers.details.statusSince": {
+        "message": "Última actualización de conexión"
+    },
+    "peers.details.bytes": {
+        "message": "Bytes"
+    },
+    "peers.details.bytesSent": {
+        "message": "Enviados"
+    },
+    "peers.details.bytesReceived": {
+        "message": "Recibidos"
+    },
+    "peers.details.localIce": {
+        "message": "ICE local"
+    },
+    "peers.details.remoteIce": {
+        "message": "ICE remoto"
+    },
+    "peers.details.never": {
+        "message": "Nunca"
+    },
+    "peers.details.justNow": {
+        "message": "Agora mesmo"
+    },
+    "peers.details.refresh": {
+        "message": "Actualizar"
+    },
+    "peers.status.connected": {
+        "message": "Conectado"
+    },
+    "peers.status.connecting": {
+        "message": "Conectando"
+    },
+    "peers.status.disconnected": {
+        "message": "Desconectado"
+    },
+    "peers.details.relayAddress": {
+        "message": "Servidor de retransmisión"
+    },
+    "peers.details.networks": {
+        "message": "Recursos"
+    },
+    "peers.details.relayed": {
+        "message": "Retransmitido"
+    },
+    "peers.details.p2p": {
+        "message": "P2P"
+    },
+    "peers.details.rosenpass": {
+        "message": "Rosenpass activado"
+    },
+    "networks.search.placeholder": {
+        "message": "Buscar por rede ou dominio"
+    },
+    "networks.filter.all": {
+        "message": "Todos"
+    },
+    "networks.filter.active": {
+        "message": "Activos"
+    },
+    "networks.filter.overlapping": {
+        "message": "Sobrepostos"
+    },
+    "networks.empty.title": {
+        "message": "Sen recursos dispoñibles"
+    },
+    "networks.empty.description": {
+        "message": "Ou non ten recursos de rede dispoñibles ou non ten acceso a ningún deles."
+    },
+    "networks.selected": {
+        "message": "Seleccionado"
+    },
+    "networks.unselected": {
+        "message": "Non seleccionado"
+    },
+    "networks.ips.heading": {
+        "message": "IPs resoltas"
+    },
+    "networks.bulk.selectionCount": {
+        "message": "{selected} de {total} Activos"
+    },
+    "networks.bulk.enableAll": {
+        "message": "Activar todos"
+    },
+    "networks.bulk.disableAll": {
+        "message": "Desactivar todos"
+    },
+    "exitNodes.search.placeholder": {
+        "message": "Buscar nodos de saída"
+    },
+    "exitNodes.none": {
+        "message": "Ningún"
+    },
+    "exitNodes.empty.title": {
+        "message": "Sen nodos de saída dispoñibles"
+    },
+    "exitNodes.empty.description": {
+        "message": "Non se compartiron nodos de saída con este peer."
+    },
+    "exitNodes.card.title": {
+        "message": "Nodo de saída"
+    },
+    "exitNodes.card.statusActive": {
+        "message": "Activo"
+    },
+    "exitNodes.card.statusInactive": {
+        "message": "Inactivo"
+    },
+    "exitNodes.dropdown.noneTitle": {
+        "message": "Ningún"
+    },
+    "exitNodes.dropdown.noneDescription": {
+        "message": "Conexión directa sen nodo de saída"
+    },
+    "quickActions.connect": {
+        "message": "Conectar"
+    },
+    "quickActions.disconnect": {
+        "message": "Desconectar"
+    },
+    "daemon.unavailable.title": {
+        "message": "O servizo NetBird non está en execución"
+    },
+    "daemon.unavailable.description": {
+        "message": "A aplicación volverá conectar automaticamente cando o servizo estea en execución."
+    },
+    "daemon.unavailable.docsLink": {
+        "message": "Documentación"
+    },
+    "daemon.outdated.title": {
+        "message": "O cliente NetBird está desactualizado"
+    },
+    "daemon.outdated.description": {
+        "message": "A nova GUI non é compatible co cliente NetBird máis antigo. Actualice o seu cliente para usar a nova aplicación."
+    },
+    "daemon.outdated.download": {
+        "message": "Descargar a última versión"
+    },
+    "error.jwt_clock_skew": {
+        "message": "Erro ao iniciar sesión: o reloxo deste dispositivo non está sincronizado co servidor. Por favor, sincronice o reloxo do sistema e inténteo de novo."
+    },
+    "error.jwt_expired": {
+        "message": "O seu token de inicio de sesión caducou. Por favor, inicie sesión de novo."
+    },
+    "error.jwt_signature_invalid": {
+        "message": "Erro ao iniciar sesión: a sinatura do token non é válida. Por favor, contacte co seu administrador."
+    },
+    "error.session_expired": {
+        "message": "A súa sesión caducou. Por favor, inicie sesión de novo."
+    },
+    "error.invalid_setup_key": {
+        "message": "A chave de configuración falta ou non é válida."
+    },
+    "error.permission_denied": {
+        "message": "O inicio de sesión foi rexeitado polo servidor."
+    },
+    "error.daemon_unreachable": {
+        "message": "O daemon de NetBird non responde. Por favor, comprobe que o servizo está en execución."
+    },
+    "error.settings_locked": {
+        "message": "A configuración non se pode cambiar neste dispositivo: un administrador bloqueouna."
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "Esta configuración está xestionada pola súa organización e non se pode cambiar."
+    },
+    "error.unknown": {
+        "message": "A operación fallou."
+    },
+    "error.elevation_unavailable": {
+        "message": "NetBird non puido solicitar a este sistema os privilexios que o cambio require. Execute isto no seu lugar:"
+    },
+    "error.elevation_failed": {
+        "message": "O cambio non se puido aplicar con privilexios elevados. Execute isto no seu lugar:"
+    },
+    "settings.ssh.privilege.actorRoot": {
+        "message": "root"
+    },
+    "settings.ssh.privilege.actorAdministrator": {
+        "message": "privilexios de administrador"
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "Require {actor}. Execute isto no seu lugar:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Pode desactivalo, pero para volvelo activar requírese {actor}:"
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Pode activalo, pero para volvelo desactivar requírese {actor}:"
+    },
+    "settings.ssh.privilege.authorizePending": {
+        "message": "Agardando pola autorización…"
+    }
+}

From d56e6fc5f4ae07e352ada103fd6354d95d1715c3 Mon Sep 17 00:00:00 2001
From: Zoltan Papp <zoltan.pmail@gmail.com>
Date: Tue, 6 Oct 2026 15:41:01 +0200
Subject: [PATCH 11/70] [client, android, ios] Coalesce peer list change
 notifications to the mobile listener (#7546)

* [client] Coalesce peer list change notifications to the mobile listener

Every peer state change spawned a goroutine to call the platform
listener. During a reconnect storm this pinned hundreds of OS threads
in JNI and let the UI call back into the engine from each of them.
Deliver peer list changes from a single goroutine per listener and
collapse pending changes into the latest count.

* [client] Cover a pending wake-up when the peer list deliverer is replaced

The replacement test waited for the old callback to finish before
swapping listeners, so it never exercised the stop check that runs
after a wake-up. Block the old callback, queue a peer list change and
swap while it is blocked, then assert the old listener never sees the
new count.

* [client] Signal peer list deliverer exit and wait for it in the test

The replacement test sampled the old listener after a fixed sleep, so a
late stale delivery could slip past it. Close a done channel when the
deliverer goroutine returns and let the test wait on it instead.

* [client] Drop the test-only peer list deliverer exit channel

The done channel was only read by the replacement test. Production code
cannot wait on it, since joining the deliverer would block on a mobile
callback. The tests now drive the deliverer loop directly and check that
setListener and removeListener close its stop channel.
---
 client/internal/peer/notifier.go      |  60 ++++++++--
 client/internal/peer/notifier_test.go | 155 ++++++++++++++++++++++++++
 2 files changed, 207 insertions(+), 8 deletions(-)

diff --git a/client/internal/peer/notifier.go b/client/internal/peer/notifier.go
index 1ee1d32ea..564098bd4 100644
--- a/client/internal/peer/notifier.go
+++ b/client/internal/peer/notifier.go
@@ -12,6 +12,8 @@ type notifier struct {
 	serverStateLock    sync.Mutex
 	listenersLock      sync.Mutex
 	listener           Listener
+	peerListWake       chan struct{}
+	peerListStop       chan struct{}
 	currentClientState bool
 	lastNotification   ClientState
 	lastNumberOfPeers  int
@@ -62,7 +64,6 @@ func (n *notifier) setNetworkAvailable(available bool) {
 func (n *notifier) setListener(listener Listener) {
 	n.serverStateLock.Lock()
 	lastNotification := n.effectiveState(n.lastNotification)
-	numOfPeers := n.lastNumberOfPeers
 	fqdnAddress := n.lastFqdnAddress
 	address := n.lastIPAddress
 	n.serverStateLock.Unlock()
@@ -70,17 +71,19 @@ func (n *notifier) setListener(listener Listener) {
 	n.listenersLock.Lock()
 	defer n.listenersLock.Unlock()
 
+	n.stopPeerListDelivererLocked()
 	n.listener = listener
 
 	listener.OnAddressChanged(fqdnAddress, address)
 	notifyListener(listener, lastNotification)
-	// run on go routine to avoid on Java layer to call go functions on same thread
-	go listener.OnPeersListChanged(numOfPeers)
+	n.startPeerListDelivererLocked(listener)
+	n.wakePeerListDelivererLocked()
 }
 
 func (n *notifier) removeListener() {
 	n.listenersLock.Lock()
 	defer n.listenersLock.Unlock()
+	n.stopPeerListDelivererLocked()
 	n.listener = nil
 }
 
@@ -178,15 +181,56 @@ func (n *notifier) peerListChanged(numOfPeers int) {
 	n.serverStateLock.Unlock()
 
 	n.listenersLock.Lock()
-	listener := n.listener
-	n.listenersLock.Unlock()
+	defer n.listenersLock.Unlock()
+	n.wakePeerListDelivererLocked()
+}
 
-	if listener == nil {
+func (n *notifier) startPeerListDelivererLocked(listener Listener) {
+	wake := make(chan struct{}, 1)
+	stop := make(chan struct{})
+	n.peerListWake = wake
+	n.peerListStop = stop
+	go n.deliverPeerListChanges(listener, wake, stop)
+}
+
+func (n *notifier) stopPeerListDelivererLocked() {
+	if n.peerListStop == nil {
 		return
 	}
+	close(n.peerListStop)
+	n.peerListStop = nil
+	n.peerListWake = nil
+}
 
-	// run on go routine to avoid on Java layer to call go functions on same thread
-	go listener.OnPeersListChanged(numOfPeers)
+func (n *notifier) wakePeerListDelivererLocked() {
+	if n.peerListWake == nil {
+		return
+	}
+	select {
+	case n.peerListWake <- struct{}{}:
+	default:
+	}
+}
+
+func (n *notifier) deliverPeerListChanges(listener Listener, wake <-chan struct{}, stop <-chan struct{}) {
+	for {
+		select {
+		case <-stop:
+			return
+		case <-wake:
+		}
+		select {
+		case <-stop:
+			return
+		default:
+		}
+
+		n.serverStateLock.Lock()
+		numOfPeers := n.lastNumberOfPeers
+		n.serverStateLock.Unlock()
+
+		listener.OnPeersListChanged(numOfPeers)
+	}
 }
 
 func (n *notifier) localAddressChanged(fqdn, address string) {
diff --git a/client/internal/peer/notifier_test.go b/client/internal/peer/notifier_test.go
index a73016b05..f81866214 100644
--- a/client/internal/peer/notifier_test.go
+++ b/client/internal/peer/notifier_test.go
@@ -2,7 +2,9 @@ package peer
 
 import (
 	"sync"
+	"sync/atomic"
 	"testing"
+	"time"
 )
 
 type mocListener struct {
@@ -115,3 +117,156 @@ func Test_notifier_RemoveListener(t *testing.T) {
 		t.Errorf("invalid state: %d", listener.peers)
 	}
 }
+
+type coalescingListener struct {
+	final       int
+	calls       atomic.Int32
+	inFlight    atomic.Int32
+	maxInFlight atomic.Int32
+	last        atomic.Int32
+	done        chan struct{}
+	entered     chan struct{}
+	release     chan struct{}
+	once        sync.Once
+}
+
+func (l *coalescingListener) OnStateChanged(ClientState)      {}
+func (l *coalescingListener) OnConnected()                    {}
+func (l *coalescingListener) OnDisconnected()                 {}
+func (l *coalescingListener) OnConnecting()                   {}
+func (l *coalescingListener) OnDisconnecting()                {}
+func (l *coalescingListener) OnAddressChanged(string, string) {}
+
+func (l *coalescingListener) OnPeersListChanged(size int) {
+	current := l.inFlight.Add(1)
+	for {
+		seen := l.maxInFlight.Load()
+		if current <= seen || l.maxInFlight.CompareAndSwap(seen, current) {
+			break
+		}
+	}
+	if l.calls.Add(1) == 1 && l.entered != nil {
+		close(l.entered)
+	}
+	if l.release != nil {
+		<-l.release
+	}
+	time.Sleep(time.Millisecond)
+	l.last.Store(int32(size))
+	l.inFlight.Add(-1)
+	if size == l.final {
+		l.once.Do(func() { close(l.done) })
+	}
+}
+
+func Test_notifier_PeerListChangedCoalesces(t *testing.T) {
+	const events = 1000
+	listener := &coalescingListener{final: events, done: make(chan struct{})}
+	n := newNotifier()
+	n.setListener(listener)
+
+	for i := 1; i <= events; i++ {
+		n.peerListChanged(i)
+	}
+
+	select {
+	case <-listener.done:
+	case <-time.After(5 * time.Second):
+		t.Fatalf("last peer count not delivered, last seen: %d", listener.last.Load())
+	}
+
+	if got := listener.maxInFlight.Load(); got != 1 {
+		t.Errorf("concurrent deliveries: %d, expected 1", got)
+	}
+	if got := listener.calls.Load(); got >= events {
+		t.Errorf("deliveries not coalesced: %d calls for %d events", got, events)
+	}
+}
+
+func Test_notifier_SetListenerStopsPreviousDeliverer(t *testing.T) {
+	old := &coalescingListener{final: -1}
+	replacement := &coalescingListener{final: 7, done: make(chan struct{})}
+	n := newNotifier()
+	n.setListener(old)
+	oldStop := n.peerListStop
+
+	n.peerListChanged(7)
+	n.setListener(replacement)
+
+	select {
+	case <-oldStop:
+	default:
+		t.Fatal("old deliverer not stopped on listener replacement")
+	}
+	waitFor(t, replacement.done, "replacement listener not notified")
+}
+
+func Test_notifier_RemoveListenerStopsDeliverer(t *testing.T) {
+	n := newNotifier()
+	n.setListener(&coalescingListener{final: -1})
+	stop := n.peerListStop
+
+	n.removeListener()
+
+	select {
+	case <-stop:
+	default:
+		t.Fatal("deliverer not stopped on listener removal")
+	}
+}
+
+func Test_notifier_DelivererExitsAfterInFlightCallback(t *testing.T) {
+	listener := &coalescingListener{
+		final:   -1,
+		entered: make(chan struct{}),
+		release: make(chan struct{}),
+	}
+	n := newNotifier()
+	wake := make(chan struct{}, 1)
+	stop := make(chan struct{})
+	exited := make(chan struct{})
+	go func() {
+		n.deliverPeerListChanges(listener, wake, stop)
+		close(exited)
+	}()
+
+	wake <- struct{}{}
+	waitFor(t, listener.entered, "listener not called")
+
+	n.peerListChanged(7)
+	wake <- struct{}{}
+	close(stop)
+	close(listener.release)
+
+	waitFor(t, exited, "deliverer did not exit after stop")
+	if got := listener.calls.Load(); got != 1 {
+		t.Errorf("deliverer ran %d callbacks after stop, expected only the in-flight one", got)
+	}
+	if got := listener.last.Load(); got == 7 {
+		t.Errorf("deliverer delivered the peer count queued after stop")
+	}
+}
+
+func Test_notifier_DelivererPrefersStopOverPendingWake(t *testing.T) {
+	listener := &coalescingListener{final: -1}
+	n := newNotifier()
+	wake := make(chan struct{}, 1)
+	stop := make(chan struct{})
+
+	wake <- struct{}{}
+	close(stop)
+	n.deliverPeerListChanges(listener, wake, stop)
+
+	if got := listener.calls.Load(); got != 0 {
+		t.Errorf("deliverer ran %d callbacks with stop closed, expected 0", got)
+	}
+}
+
+func waitFor(t *testing.T, ch <-chan struct{}, msg string) {
+	t.Helper()
+	select {
+	case <-ch:
+	case <-time.After(5 * time.Second):
+		t.Fatal(msg)
+	}
+}

From 2623feeb5b7ca6338f98de697076bc835bed6fee Mon Sep 17 00:00:00 2001
From: Pascal Fischer <32096965+pascal-fischer@users.noreply.github.com>
Date: Tue, 6 Oct 2026 16:35:31 +0200
Subject: [PATCH 12/70] [management] remove ingress ports (#8062)

---
 client/cmd/forwarding_rules.go                |  98 --
 client/cmd/root.go                            |   3 -
 client/cmd/testutil_test.go                   |   7 +-
 client/embed/embed_test.go                    |   7 +-
 client/firewall/iptables/dnat_linux.go        | 166 ----
 .../iptables/dnat_refcount_linux_test.go      | 240 -----
 client/firewall/iptables/family_linux.go      |   4 -
 client/firewall/iptables/filter_linux.go      |   9 -
 client/firewall/iptables/manager_linux.go     |  25 -
 .../firewall/iptables/manager_linux_test.go   |  10 -
 client/firewall/manager/firewall.go           |   6 -
 client/firewall/manager/forward_rule.go       |  27 -
 client/firewall/nftables/dnat_linux.go        | 321 -------
 .../nftables/dnat_refcount_linux_test.go      | 249 -----
 client/firewall/nftables/family_linux.go      |   8 -
 client/firewall/nftables/filter_linux.go      |   5 -
 client/firewall/nftables/manager_linux.go     |  47 +-
 .../firewall/nftables/manager_linux_test.go   |  24 -
 client/firewall/nftables/routing_linux.go     |  35 -
 client/firewall/uspfilter/nat.go              |  10 -
 client/internal/engine.go                     |  92 +-
 client/internal/engine_privileged_test.go     |   5 +-
 client/internal/ingressgw/manager.go          | 111 ---
 client/internal/ingressgw/manager_test.go     | 281 ------
 client/internal/message_convert.go            |  43 -
 client/internal/peer/status.go                |  35 -
 .../routemanager/ipfwdstate/ipfwdstate.go     |  28 +-
 .../ipfwdstate_privileged_linux_test.go       |  10 +-
 client/proto/daemon.pb.go                     |  55 +-
 client/proto/daemon.proto                     |  18 +-
 client/proto/daemon_grpc.pb.go                |   5 +
 client/server/forwardingrules.go              |  54 --
 client/server/server_privileged_test.go       |   7 +-
 client/status/status.go                       |  94 +-
 client/status/status_test.go                  |   2 -
 client/ui/frontend/WAILS-API.md               |  17 +-
 client/ui/main.go                             |   1 -
 client/ui/services/forwarding.go              |  83 --
 go.mod                                        |   2 +-
 go.sum                                        |   4 +-
 .../network_map/controller/controller.go      | 122 +--
 .../network_map/controller/controller_test.go |   3 +-
 .../network_map/controller/repository_mock.go |  15 +
 .../controllers/network_map/interface.go      |   2 +-
 .../controllers/network_map/interface_mock.go |  11 +-
 .../network_map/nmaptest/canonicalize.go      |  11 -
 .../network_map/nmaptest/runner.go            |   2 +-
 management/internals/server/controllers.go    |  11 +-
 management/internals/server/modules.go        |   4 +-
 .../shared/grpc/components_encoder.go         |   6 -
 .../shared/grpc/components_encoder_test.go    |  60 --
 .../grpc/components_envelope_response.go      |  43 -
 .../internals/shared/grpc/conversion.go       |   8 -
 management/internals/shared/grpc/server.go    |   4 +-
 management/server/account.go                  |   4 -
 management/server/account_test.go             |   5 +-
 management/server/dns_test.go                 |   5 +-
 .../testing/testing_tools/channel/channel.go  |  11 +-
 management/server/identity_provider_test.go   |   5 +-
 .../port_forwarding/controller.go             |  38 -
 management/server/management_proto_test.go    |   7 +-
 management/server/management_test.go          |   6 +-
 management/server/nameserver_test.go          |   5 +-
 management/server/peer.go                     |   9 -
 management/server/peer_test.go                |  39 +-
 management/server/route_test.go               |   5 +-
 .../server/types/account_networkmapdata.go    |   3 +-
 management/server/types/aliases.go            |   1 -
 management/server/types/legacynmap/aliases.go |   1 -
 .../server/types/legacynmap/converters.go     |   1 -
 .../types/legacynmap/equivalence_test.go      |  12 -
 .../server/types/legacynmap/proto_legacy.go   |   8 -
 shared/management/client/client_test.go       |   7 +-
 shared/management/client/rest/client.go       |   5 -
 shared/management/client/rest/ingress.go      |  92 --
 shared/management/client/rest/ingress_test.go | 184 ----
 shared/management/client/rest/peers.go        |  92 --
 shared/management/client/rest/peers_test.go   | 145 ---
 shared/management/http/api/openapi.yml        | 554 -----------
 shared/management/http/api/types.gen.go       | 223 -----
 shared/management/networkmap/envelope.go      |  68 +-
 shared/management/proto/management.pb.go      | 907 +++++++++---------
 shared/management/proto/management.proto      |  35 +-
 shared/management/types/network.go            | 104 --
 shared/management/types/network_test.go       |  41 -
 85 files changed, 667 insertions(+), 4505 deletions(-)
 delete mode 100644 client/cmd/forwarding_rules.go
 delete mode 100644 client/firewall/iptables/dnat_refcount_linux_test.go
 delete mode 100644 client/firewall/manager/forward_rule.go
 delete mode 100644 client/firewall/nftables/dnat_refcount_linux_test.go
 delete mode 100644 client/internal/ingressgw/manager.go
 delete mode 100644 client/internal/ingressgw/manager_test.go
 delete mode 100644 client/internal/message_convert.go
 delete mode 100644 client/server/forwardingrules.go
 delete mode 100644 client/ui/services/forwarding.go
 delete mode 100644 management/server/integrations/port_forwarding/controller.go
 delete mode 100644 shared/management/client/rest/ingress.go
 delete mode 100644 shared/management/client/rest/ingress_test.go
 delete mode 100644 shared/management/types/network_test.go

diff --git a/client/cmd/forwarding_rules.go b/client/cmd/forwarding_rules.go
deleted file mode 100644
index b3052746a..000000000
--- a/client/cmd/forwarding_rules.go
+++ /dev/null
@@ -1,98 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-	"sort"
-
-	"github.com/spf13/cobra"
-	"google.golang.org/grpc/status"
-
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-var forwardingRulesCmd = &cobra.Command{
-	Use:   "forwarding",
-	Short: "List forwarding rules",
-	Long:  `Commands to list forwarding rules.`,
-}
-
-var forwardingRulesListCmd = &cobra.Command{
-	Use:     "list",
-	Aliases: []string{"ls"},
-	Short:   "List forwarding rules",
-	Example: "  netbird forwarding list",
-	Long:    "Commands to list forwarding rules.",
-	RunE:    listForwardingRules,
-}
-
-func listForwardingRules(cmd *cobra.Command, _ []string) error {
-	conn, err := getClient(cmd)
-	if err != nil {
-		return err
-	}
-	defer conn.Close()
-
-	client := proto.NewDaemonServiceClient(conn)
-	resp, err := client.ForwardingRules(cmd.Context(), &proto.EmptyRequest{})
-	if err != nil {
-		return fmt.Errorf("failed to list network: %v", status.Convert(err).Message())
-	}
-
-	if len(resp.GetRules()) == 0 {
-		cmd.Println("No forwarding rules available.")
-		return nil
-	}
-
-	printForwardingRules(cmd, resp.GetRules())
-	return nil
-}
-
-func printForwardingRules(cmd *cobra.Command, rules []*proto.ForwardingRule) {
-	cmd.Println("Available forwarding rules:")
-
-	// Sort rules by translated address
-	sort.Slice(rules, func(i, j int) bool {
-		if rules[i].GetTranslatedAddress() != rules[j].GetTranslatedAddress() {
-			return rules[i].GetTranslatedAddress() < rules[j].GetTranslatedAddress()
-		}
-		if rules[i].GetProtocol() != rules[j].GetProtocol() {
-			return rules[i].GetProtocol() < rules[j].GetProtocol()
-		}
-
-		return getFirstPort(rules[i].GetDestinationPort()) < getFirstPort(rules[j].GetDestinationPort())
-	})
-
-	var lastIP string
-	for _, rule := range rules {
-		dPort := portToString(rule.GetDestinationPort())
-		tPort := portToString(rule.GetTranslatedPort())
-		if lastIP != rule.GetTranslatedAddress() {
-			lastIP = rule.GetTranslatedAddress()
-			cmd.Printf("\nTranslated peer: %s\n", rule.GetTranslatedHostname())
-		}
-
-		cmd.Printf("  Local %s/%s to %s:%s\n", rule.GetProtocol(), dPort, rule.GetTranslatedAddress(), tPort)
-	}
-}
-
-func getFirstPort(portInfo *proto.PortInfo) int {
-	switch v := portInfo.PortSelection.(type) {
-	case *proto.PortInfo_Port:
-		return int(v.Port)
-	case *proto.PortInfo_Range_:
-		return int(v.Range.GetStart())
-	default:
-		return 0
-	}
-}
-
-func portToString(translatedPort *proto.PortInfo) string {
-	switch v := translatedPort.PortSelection.(type) {
-	case *proto.PortInfo_Port:
-		return fmt.Sprintf("%d", v.Port)
-	case *proto.PortInfo_Range_:
-		return fmt.Sprintf("%d-%d", v.Range.GetStart(), v.Range.GetEnd())
-	default:
-		return "No port specified"
-	}
-}
diff --git a/client/cmd/root.go b/client/cmd/root.go
index 2ca14c39c..4525a9bd6 100644
--- a/client/cmd/root.go
+++ b/client/cmd/root.go
@@ -177,7 +177,6 @@ func init() {
 	rootCmd.AddCommand(versionCmd)
 	rootCmd.AddCommand(sshCmd)
 	rootCmd.AddCommand(networksCMD)
-	rootCmd.AddCommand(forwardingRulesCmd)
 	rootCmd.AddCommand(debugCmd)
 	rootCmd.AddCommand(profileCmd)
 	rootCmd.AddCommand(exposeCmd)
@@ -185,8 +184,6 @@ func init() {
 	networksCMD.AddCommand(routesListCmd)
 	networksCMD.AddCommand(routesSelectCmd, routesDeselectCmd)
 
-	forwardingRulesCmd.AddCommand(forwardingRulesListCmd)
-
 	debugCmd.AddCommand(debugBundleCmd)
 	debugCmd.AddCommand(logCmd)
 	logCmd.AddCommand(logLevelCmd)
diff --git a/client/cmd/testutil_test.go b/client/cmd/testutil_test.go
index 328a15454..46bf31837 100644
--- a/client/cmd/testutil_test.go
+++ b/client/cmd/testutil_test.go
@@ -6,9 +6,9 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
 	"github.com/stretchr/testify/require"
 	"go.opentelemetry.io/otel"
+	"go.uber.org/mock/gomock"
 	"google.golang.org/grpc"
 
 	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator/validator"
@@ -28,7 +28,6 @@ import (
 	mgmt "github.com/netbirdio/netbird/management/server"
 	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/management/server/groups"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
 	"github.com/netbirdio/netbird/management/server/store"
@@ -124,9 +123,9 @@ func startManagement(t *testing.T, config *config.Config, testFile string) (*grp
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := mgmt.NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, mgmt.MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), manager.NewEphemeralManager(store, peersmanager), config, nil)
+	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, mgmt.MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", manager.NewEphemeralManager(store, peersmanager), config, nil)
 
-	accountManager, err := mgmt.BuildManager(ctx, config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, iv, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManagerMock, false, cacheStore)
+	accountManager, err := mgmt.BuildManager(ctx, config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, iv, metrics, settingsMockManager, permissionsManagerMock, false, cacheStore)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/client/embed/embed_test.go b/client/embed/embed_test.go
index 4ff5c9978..a818af055 100644
--- a/client/embed/embed_test.go
+++ b/client/embed/embed_test.go
@@ -6,8 +6,8 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 	"google.golang.org/grpc"
 
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller"
@@ -21,7 +21,6 @@ import (
 	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/groups"
 	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator/validator"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
@@ -146,8 +145,8 @@ func startManagement(t *testing.T, signalAddr string) string {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := mgmt.NewAccountRequestBuffer(context.Background(), testStore)
-	networkMapController := controller.NewController(context.Background(), testStore, metrics, updateManager, requestBuffer, mgmt.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), manager.NewEphemeralManager(testStore, peersManager), cfg, nil)
-	accountManager, err := mgmt.BuildManager(context.Background(), cfg, testStore, networkMapController, jobManager, nil, "", eventStore, nil, false, iv, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	networkMapController := controller.NewController(context.Background(), testStore, metrics, updateManager, requestBuffer, mgmt.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", manager.NewEphemeralManager(testStore, peersManager), cfg, nil)
+	accountManager, err := mgmt.BuildManager(context.Background(), cfg, testStore, networkMapController, jobManager, nil, "", eventStore, nil, false, iv, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	require.NoError(t, err)
 
 	secretsManager, err := nbgrpc.NewTimeBasedAuthSecretsManager(updateManager, cfg.TURNConfig, cfg.Relay, settingsMockManager, groupsManager)
diff --git a/client/firewall/iptables/dnat_linux.go b/client/firewall/iptables/dnat_linux.go
index eca8386c0..f118c9dfe 100644
--- a/client/firewall/iptables/dnat_linux.go
+++ b/client/firewall/iptables/dnat_linux.go
@@ -8,177 +8,11 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/hashicorp/go-multierror"
 	log "github.com/sirupsen/logrus"
 
-	nberrors "github.com/netbirdio/netbird/client/errors"
 	firewall "github.com/netbirdio/netbird/client/firewall/manager"
 )
 
-func (r *family) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error) {
-	ruleID := rule.ID()
-	if _, exists := r.rules[ruleID+dnatSuffix]; exists {
-		return rule, nil
-	}
-
-	toDestination := rule.TranslatedAddress.String()
-	switch {
-	case len(rule.TranslatedPort.Values) == 0:
-		// no translated port, use original port
-	case len(rule.TranslatedPort.Values) == 1:
-		toDestination += fmt.Sprintf(":%d", rule.TranslatedPort.Values[0])
-	case rule.TranslatedPort.IsRange && len(rule.TranslatedPort.Values) == 2:
-		// need the "/originalport" suffix to avoid dnat port randomization
-		toDestination += fmt.Sprintf(":%d-%d/%d", rule.TranslatedPort.Values[0], rule.TranslatedPort.Values[1], rule.DestinationPort.Values[0])
-	default:
-		return nil, fmt.Errorf("invalid translated port: %v", rule.TranslatedPort)
-	}
-
-	proto := strings.ToLower(string(rule.Protocol))
-
-	rules := make(map[firewall.RuleID]ruleInfo, 3)
-
-	// DNAT rule
-	dnatRule := []string{
-		"!", "-i", r.wgIface.Name(),
-		"-p", proto,
-		"-j", "DNAT",
-		"--to-destination", toDestination,
-	}
-	dnatRule = append(dnatRule, applyPort("--dport", &rule.DestinationPort)...)
-	rules[ruleID+dnatSuffix] = ruleInfo{
-		table: tableNat,
-		chain: chainRTRdr,
-		rule:  dnatRule,
-	}
-
-	// SNAT rule
-	snatRule := []string{
-		"-o", r.wgIface.Name(),
-		"-p", proto,
-		"-d", rule.TranslatedAddress.String(),
-		"-j", "MASQUERADE",
-	}
-	snatRule = append(snatRule, applyPort("--dport", &rule.TranslatedPort)...)
-	rules[ruleID+snatSuffix] = ruleInfo{
-		table: tableNat,
-		chain: chainRTNAT,
-		rule:  snatRule,
-	}
-
-	// Forward filtering rule, if fwd policy is DROP
-	forwardRule := []string{
-		"-o", r.wgIface.Name(),
-		"-p", proto,
-		"-d", rule.TranslatedAddress.String(),
-		"-j", "ACCEPT",
-	}
-	forwardRule = append(forwardRule, applyPort("--dport", &rule.TranslatedPort)...)
-	rules[ruleID+fwdSuffix] = ruleInfo{
-		table: tableFilter,
-		chain: chainRTFwdOut,
-		rule:  forwardRule,
-	}
-
-	for key, ruleInfo := range rules {
-		if err := r.iptablesClient.Append(ruleInfo.table, ruleInfo.chain, ruleInfo.rule...); err != nil {
-			r.cleanupFailedDNATAdd(rules)
-			return nil, fmt.Errorf("add rule %s: %w", key, err)
-		}
-		r.rules[key] = ruleInfo.rule
-	}
-
-	if err := r.ipFwdState.RequestForwarding(r.v6); err != nil {
-		r.cleanupFailedDNATAdd(rules)
-		return nil, fmt.Errorf("enable forwarding: %w", err)
-	}
-
-	r.updateState()
-	return rule, nil
-}
-
-// cleanupFailedDNATAdd removes the bookkeeping written by a partially applied
-// AddDNATRule before rolling back the kernel rules, so no entries remain that
-// never got a forwarding refcount. rollbackRules re-adds entries it failed to
-// remove from the kernel.
-func (r *family) cleanupFailedDNATAdd(rules map[firewall.RuleID]ruleInfo) {
-	for key := range rules {
-		delete(r.rules, key)
-	}
-	if err := r.rollbackRules(rules); err != nil {
-		log.Errorf("rollback failed: %v", err)
-	}
-}
-
-func (r *family) rollbackRules(rules map[firewall.RuleID]ruleInfo) error {
-	var merr *multierror.Error
-	for key, ruleInfo := range rules {
-		if err := r.iptablesClient.DeleteIfExists(ruleInfo.table, ruleInfo.chain, ruleInfo.rule...); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("rollback rule %s: %w", key, err))
-			// On rollback error, add to rules map for next cleanup
-			r.rules[key] = ruleInfo.rule
-		}
-	}
-	if merr != nil {
-		r.updateState()
-	}
-	return nberrors.FormatErrorOrNil(merr)
-}
-
-func (r *family) DeleteDNATRule(rule firewall.Rule) error {
-	ruleID := rule.ID()
-
-	_, hadDNAT := r.rules[ruleID+dnatSuffix]
-	_, hadSNAT := r.rules[ruleID+snatSuffix]
-	_, hadFWD := r.rules[ruleID+fwdSuffix]
-	if !hadDNAT && !hadSNAT && !hadFWD {
-		return nil
-	}
-
-	var merr *multierror.Error
-	if dnatRule, exists := r.rules[ruleID+dnatSuffix]; exists {
-		if err := r.iptablesClient.Delete(tableNat, chainRTRdr, dnatRule...); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("delete DNAT rule: %w", err))
-		} else {
-			delete(r.rules, ruleID+dnatSuffix)
-		}
-	}
-
-	if snatRule, exists := r.rules[ruleID+snatSuffix]; exists {
-		if err := r.iptablesClient.Delete(tableNat, chainRTNAT, snatRule...); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("delete SNAT rule: %w", err))
-		} else {
-			delete(r.rules, ruleID+snatSuffix)
-		}
-	}
-
-	if fwdRule, exists := r.rules[ruleID+fwdSuffix]; exists {
-		if err := r.iptablesClient.Delete(tableFilter, chainRTFwdOut, fwdRule...); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("delete forward rule: %w", err))
-		} else {
-			delete(r.rules, ruleID+fwdSuffix)
-		}
-	}
-
-	// Release the refcount only once all rules are gone from the kernel. On
-	// partial failure the failed entries stay in r.rules so a retry can remove
-	// them and release then.
-	if merr == nil {
-		r.releaseForwarding()
-	}
-
-	r.updateState()
-
-	return nberrors.FormatErrorOrNil(merr)
-}
-
-// releaseForwarding drops one IP forwarding reference, logging any error.
-func (r *family) releaseForwarding() {
-	if err := r.ipFwdState.ReleaseForwarding(r.v6); err != nil {
-		log.Errorf("release IP forwarding: %v", err)
-	}
-}
-
 func (r *family) AddInboundDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error {
 	ruleID := firewall.RuleID(fmt.Sprintf("inbound-dnat-%s-%s-%d-%d", localAddr.String(), protocol, originalPort, translatedPort))
 
diff --git a/client/firewall/iptables/dnat_refcount_linux_test.go b/client/firewall/iptables/dnat_refcount_linux_test.go
deleted file mode 100644
index 40ebc6cc3..000000000
--- a/client/firewall/iptables/dnat_refcount_linux_test.go
+++ /dev/null
@@ -1,240 +0,0 @@
-//go:build privileged
-
-package iptables
-
-import (
-	"net/netip"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	fw "github.com/netbirdio/netbird/client/firewall/manager"
-	"github.com/netbirdio/netbird/client/iface"
-	"github.com/netbirdio/netbird/client/iface/wgaddr"
-)
-
-func iptRefcountIfaceV4() *iFaceMock {
-	return &iFaceMock{
-		NameFunc: func() string { return "wt-refcount" },
-		AddressFunc: func() wgaddr.Address {
-			return wgaddr.Address{
-				IP:      netip.MustParseAddr("10.20.0.1"),
-				Network: netip.MustParsePrefix("10.20.0.0/24"),
-			}
-		},
-	}
-}
-
-func iptRefcountIfaceDual() *iFaceMock {
-	return &iFaceMock{
-		NameFunc: func() string { return "wt-refcount" },
-		AddressFunc: func() wgaddr.Address {
-			return wgaddr.Address{
-				IP:      netip.MustParseAddr("10.20.0.1"),
-				Network: netip.MustParsePrefix("10.20.0.0/24"),
-				IPv6:    netip.MustParseAddr("fd00::1"),
-				IPv6Net: netip.MustParsePrefix("fd00::/64"),
-			}
-		},
-	}
-}
-
-func newIptRefcountManager(t *testing.T, dual bool) *Manager {
-	t.Helper()
-	var ifMock *iFaceMock
-	if dual {
-		ifMock = iptRefcountIfaceDual()
-	} else {
-		ifMock = iptRefcountIfaceV4()
-	}
-	m, err := Create(ifMock, iface.DefaultMTU)
-	require.NoError(t, err, "create manager")
-	require.NoError(t, m.Init(nil), "init manager")
-	t.Cleanup(func() {
-		require.NoError(t, m.Close(nil), "close manager")
-	})
-	return m
-}
-
-func iptDnatV4(port uint16) fw.ForwardRule {
-	return fw.ForwardRule{
-		Protocol:          fw.ProtocolTCP,
-		DestinationPort:   fw.Port{Values: []uint16{port}},
-		TranslatedAddress: netip.MustParseAddr("10.20.0.2"),
-		TranslatedPort:    fw.Port{Values: []uint16{80}},
-	}
-}
-
-func iptDnatV6(port uint16) fw.ForwardRule {
-	return fw.ForwardRule{
-		Protocol:          fw.ProtocolTCP,
-		DestinationPort:   fw.Port{Values: []uint16{port}},
-		TranslatedAddress: netip.MustParseAddr("fd00::2"),
-		TranslatedPort:    fw.Port{Values: []uint16{80}},
-	}
-}
-
-// TestIptablesRouting_RepeatedEnableSingleReference verifies that EnableRouting
-// (called on every network-map update) holds at most one reference per family
-// and a single DisableRouting drops both back to zero.
-func TestIptablesRouting_RepeatedEnableSingleReference(t *testing.T) {
-	m := newIptRefcountManager(t, true)
-	state := m.family4.ipFwdState
-
-	require.NoError(t, m.EnableRouting(), "first enable")
-	require.NoError(t, m.EnableRouting(), "second enable")
-	require.NoError(t, m.EnableRouting(), "third enable")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 1, v4, "repeated enable holds a single v4 reference")
-	assert.Equal(t, 1, v6, "repeated enable holds a single v6 reference")
-
-	require.NoError(t, m.DisableRouting(), "disable")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "single disable releases the v4 reference")
-	assert.Equal(t, 0, v6, "single disable releases the v6 reference")
-}
-
-// TestIptablesRouting_DisableKeepsDNATReference verifies that an unpaired
-// DisableRouting does not release references held by active DNAT rules.
-func TestIptablesRouting_DisableKeepsDNATReference(t *testing.T) {
-	m := newIptRefcountManager(t, true)
-	state := m.family4.ipFwdState
-
-	r1, err := m.AddDNATRule(iptDnatV6(9095))
-	require.NoError(t, err, "add v6 dnat")
-
-	require.NoError(t, m.DisableRouting(), "unpaired disable")
-	_, v6 := state.Counts()
-	assert.Equal(t, 1, v6, "DNAT-held reference survives unpaired DisableRouting")
-
-	require.NoError(t, m.DeleteDNATRule(r1), "delete v6 dnat")
-	_, v6 = state.Counts()
-	assert.Equal(t, 0, v6, "delete releases the DNAT reference")
-}
-
-// TestIptablesDNAT_RefcountBalancedV4 covers a Balanced Add/Delete pair on v4.
-func TestIptablesDNAT_RefcountBalancedV4(t *testing.T) {
-	m := newIptRefcountManager(t, false)
-	state := m.family4.ipFwdState
-
-	r1, err := m.AddDNATRule(iptDnatV4(7081))
-	require.NoError(t, err, "add v4 dnat 1")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 1, v4, "v4 refcount after first add")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-
-	r2, err := m.AddDNATRule(iptDnatV4(7082))
-	require.NoError(t, err, "add v4 dnat 2")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 2, v4, "v4 refcount after second add")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-
-	require.NoError(t, m.DeleteDNATRule(r1))
-	v4, v6 = state.Counts()
-	assert.Equal(t, 1, v4, "v4 refcount after first delete")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-
-	require.NoError(t, m.DeleteDNATRule(r2))
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount after second delete")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-}
-
-// TestIptablesDNAT_RefcountBalancedV6 checks the v6 path increments v6 only and
-// decrements back to zero.
-func TestIptablesDNAT_RefcountBalancedV6(t *testing.T) {
-	m := newIptRefcountManager(t, true)
-	require.NotNil(t, m.family6, "v6 family")
-	require.Same(t, m.family4.ipFwdState, m.family6.ipFwdState, "shared state")
-	state := m.family4.ipFwdState
-
-	r1, err := m.AddDNATRule(iptDnatV6(9081))
-	require.NoError(t, err, "add v6 dnat 1")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 1, v6, "v6 refcount after first add")
-
-	r2, err := m.AddDNATRule(iptDnatV6(9082))
-	require.NoError(t, err, "add v6 dnat 2")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount unchanged")
-	assert.Equal(t, 2, v6, "v6 refcount after second add")
-
-	require.NoError(t, m.DeleteDNATRule(r1))
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount unchanged")
-	assert.Equal(t, 1, v6, "v6 refcount after first delete")
-
-	require.NoError(t, m.DeleteDNATRule(r2))
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 0, v6, "v6 refcount after second delete")
-}
-
-// TestIptablesDNAT_DuplicateAddNoLeak verifies the duplicate-rule path returns
-// without bumping the refcount.
-func TestIptablesDNAT_DuplicateAddNoLeak(t *testing.T) {
-	m := newIptRefcountManager(t, true)
-	state := m.family4.ipFwdState
-
-	rule := iptDnatV4(7083)
-	r1, err := m.AddDNATRule(rule)
-	require.NoError(t, err)
-	v4, _ := state.Counts()
-	assert.Equal(t, 1, v4)
-
-	_, err = m.AddDNATRule(rule)
-	require.NoError(t, err, "duplicate add")
-	v4, _ = state.Counts()
-	assert.Equal(t, 1, v4, "duplicate add must not increment")
-
-	require.NoError(t, m.DeleteDNATRule(r1))
-	v4, _ = state.Counts()
-	assert.Equal(t, 0, v4, "single delete must drop to zero")
-}
-
-// TestIptablesDNAT_DeleteMissingNoUnderflow verifies Delete on an unknown rule
-// neither errors nor releases the refcount.
-func TestIptablesDNAT_DeleteMissingNoUnderflow(t *testing.T) {
-	m := newIptRefcountManager(t, true)
-	state := m.family4.ipFwdState
-
-	phantom := iptDnatV4(7099)
-	require.NoError(t, m.DeleteDNATRule(&phantom), "delete missing v4")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 0, v6)
-
-	phantom6 := iptDnatV6(9099)
-	require.NoError(t, m.DeleteDNATRule(&phantom6), "delete missing v6")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 0, v6)
-
-	r1, err := m.AddDNATRule(iptDnatV4(7100))
-	require.NoError(t, err)
-	v4, _ = state.Counts()
-	assert.Equal(t, 1, v4, "real add still increments after phantom delete")
-	require.NoError(t, m.DeleteDNATRule(r1))
-}
-
-// TestIptablesDNAT_DoubleDeleteNoUnderflow verifies a second Delete on the same
-// rule is a no-op.
-func TestIptablesDNAT_DoubleDeleteNoUnderflow(t *testing.T) {
-	m := newIptRefcountManager(t, true)
-	state := m.family4.ipFwdState
-
-	r1, err := m.AddDNATRule(iptDnatV6(9083))
-	require.NoError(t, err)
-	_, v6 := state.Counts()
-	assert.Equal(t, 1, v6)
-
-	require.NoError(t, m.DeleteDNATRule(r1), "first delete")
-	_, v6 = state.Counts()
-	assert.Equal(t, 0, v6)
-
-	require.NoError(t, m.DeleteDNATRule(r1), "second delete must be no-op")
-	_, v6 = state.Counts()
-	assert.Equal(t, 0, v6, "double delete must not underflow")
-}
diff --git a/client/firewall/iptables/family_linux.go b/client/firewall/iptables/family_linux.go
index 0e1ce5440..2ac860a0a 100644
--- a/client/firewall/iptables/family_linux.go
+++ b/client/firewall/iptables/family_linux.go
@@ -56,10 +56,6 @@ const (
 	markManglePost = "mark-mangle-post"
 	matchSet       = "--match-set"
 
-	dnatSuffix firewall.RuleID = "_dnat"
-	snatSuffix firewall.RuleID = "_snat"
-	fwdSuffix  firewall.RuleID = "_fwd"
-
 	// ipv4TCPHeaderSize is the minimum IPv4 (20) + TCP (20) header size for MSS calculation.
 	ipv4TCPHeaderSize = 40
 	// ipv6TCPHeaderSize is the minimum IPv6 (40) + TCP (20) header size for MSS calculation.
diff --git a/client/firewall/iptables/filter_linux.go b/client/firewall/iptables/filter_linux.go
index dc606da2d..30cd81018 100644
--- a/client/firewall/iptables/filter_linux.go
+++ b/client/firewall/iptables/filter_linux.go
@@ -81,15 +81,6 @@ func (r *family) hasRule(id nbid.RuleID) bool {
 	return ok
 }
 
-// hasDNATRule reports whether this family owns the DNAT rule set for
-// the given user id. DNAT rules live in r.rules under the well-known
-// "<id>_dnat" key; the lookup here is used by Manager.DeleteDNATRule
-// to pick the right family.
-func (r *family) hasDNATRule(id firewall.RuleID) bool {
-	_, ok := r.rules[id+dnatSuffix]
-	return ok
-}
-
 // DeleteFilterRule removes a previously installed filter rule. The
 // rule's stored chain/table identify where to delete from; source set
 // references are recovered from the spec via findSets and dropped
diff --git a/client/firewall/iptables/manager_linux.go b/client/firewall/iptables/manager_linux.go
index 0f0b0110e..a566909c8 100644
--- a/client/firewall/iptables/manager_linux.go
+++ b/client/firewall/iptables/manager_linux.go
@@ -323,31 +323,6 @@ func (m *Manager) DisableRouting() error {
 	return m.family4.ipFwdState.ReleaseRouting()
 }
 
-// AddDNATRule adds a DNAT rule
-func (m *Manager) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error) {
-	m.mutex.Lock()
-	defer m.mutex.Unlock()
-
-	if rule.TranslatedAddress.Is6() {
-		if !m.hasIPv6() {
-			return nil, fmt.Errorf("add DNAT rule: %w", firewall.ErrIPv6NotInitialized)
-		}
-		return m.family6.AddDNATRule(rule)
-	}
-	return m.family4.AddDNATRule(rule)
-}
-
-// DeleteDNATRule deletes a DNAT rule
-func (m *Manager) DeleteDNATRule(rule firewall.Rule) error {
-	m.mutex.Lock()
-	defer m.mutex.Unlock()
-
-	if m.hasIPv6() && !m.family4.hasDNATRule(rule.ID()) {
-		return m.family6.DeleteDNATRule(rule)
-	}
-	return m.family4.DeleteDNATRule(rule)
-}
-
 // UpdateSet updates the set with the given prefixes
 func (m *Manager) UpdateSet(set firewall.Set, prefixes []netip.Prefix) error {
 	m.mutex.Lock()
diff --git a/client/firewall/iptables/manager_linux_test.go b/client/firewall/iptables/manager_linux_test.go
index 9f53352e1..8435bf6a5 100644
--- a/client/firewall/iptables/manager_linux_test.go
+++ b/client/firewall/iptables/manager_linux_test.go
@@ -497,16 +497,6 @@ func TestIptablesCloseRemovesAllState(t *testing.T) {
 	require.NoError(t, manager.AddNatRule(pair), "add nat rule")
 	require.NoError(t, manager.EnableRouting(), "enable routing")
 
-	// A DNAT redirect, which also holds a forwarding reference.
-	dnat := fw.ForwardRule{
-		Protocol:          fw.ProtocolTCP,
-		DestinationPort:   fw.Port{Values: []uint16{8080}},
-		TranslatedAddress: netip.MustParseAddr("10.20.0.44"),
-		TranslatedPort:    fw.Port{Values: []uint16{80}},
-	}
-	_, err = manager.AddDNATRule(dnat)
-	require.NoError(t, err, "add dnat rule")
-
 	require.NotEqual(t, before, snapshotIptables(t, ipv4Client), "the manager must have installed state")
 
 	// Everything above stays in place, so Close is what has to remove it.
diff --git a/client/firewall/manager/firewall.go b/client/firewall/manager/firewall.go
index 0eb376875..f8de1e2b5 100644
--- a/client/firewall/manager/firewall.go
+++ b/client/firewall/manager/firewall.go
@@ -172,12 +172,6 @@ type Manager interface {
 
 	DisableRouting() error
 
-	// AddDNATRule adds outbound DNAT rule for forwarding external traffic to the NetBird network.
-	AddDNATRule(ForwardRule) (Rule, error)
-
-	// DeleteDNATRule deletes the outbound DNAT rule.
-	DeleteDNATRule(Rule) error
-
 	// UpdateSet updates the set with the given prefixes
 	UpdateSet(hash Set, prefixes []netip.Prefix) error
 
diff --git a/client/firewall/manager/forward_rule.go b/client/firewall/manager/forward_rule.go
deleted file mode 100644
index c2e9e5c60..000000000
--- a/client/firewall/manager/forward_rule.go
+++ /dev/null
@@ -1,27 +0,0 @@
-package manager
-
-import (
-	"fmt"
-	"net/netip"
-)
-
-// ForwardRule todo figure out better place to this to avoid circular imports
-type ForwardRule struct {
-	Protocol          Protocol
-	DestinationPort   Port
-	TranslatedAddress netip.Addr
-	TranslatedPort    Port
-}
-
-func (r ForwardRule) ID() RuleID {
-	id := fmt.Sprintf("%s;%s;%s;%s",
-		r.Protocol,
-		r.DestinationPort.String(),
-		r.TranslatedAddress.String(),
-		r.TranslatedPort.String())
-	return RuleID(id)
-}
-
-func (r ForwardRule) String() string {
-	return fmt.Sprintf("protocol: %s, destinationPort: %s, translatedAddress: %s, translatedPort: %s", r.Protocol, r.DestinationPort.String(), r.TranslatedAddress.String(), r.TranslatedPort.String())
-}
diff --git a/client/firewall/nftables/dnat_linux.go b/client/firewall/nftables/dnat_linux.go
index 8eae694a2..c179d60cc 100644
--- a/client/firewall/nftables/dnat_linux.go
+++ b/client/firewall/nftables/dnat_linux.go
@@ -9,332 +9,11 @@ import (
 	"github.com/google/nftables"
 	"github.com/google/nftables/binaryutil"
 	"github.com/google/nftables/expr"
-	"github.com/google/nftables/xt"
-	"github.com/hashicorp/go-multierror"
 	log "github.com/sirupsen/logrus"
 
-	nberrors "github.com/netbirdio/netbird/client/errors"
 	firewall "github.com/netbirdio/netbird/client/firewall/manager"
 )
 
-func (r *family) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error) {
-	ruleID := rule.ID()
-	if _, exists := r.rules[ruleID+dnatSuffix]; exists {
-		return rule, nil
-	}
-
-	protoNum, err := r.af.protoNum(rule.Protocol)
-	if err != nil {
-		return nil, fmt.Errorf("convert protocol to number: %w", err)
-	}
-
-	// Request forwarding before queueing rules: addDnatRedirect/addDnatMasq
-	// buffer netlink messages on r.conn that the next caller's Flush would
-	// commit if we returned without flushing them ourselves.
-	if err := r.ipFwdState.RequestForwarding(r.isV6()); err != nil {
-		return nil, fmt.Errorf("enable forwarding: %w", err)
-	}
-
-	if err := r.addDnatRedirect(rule, protoNum, ruleID); err != nil {
-		r.releaseForwarding()
-		return nil, err
-	}
-
-	if err := r.addDnatMasq(rule, protoNum, ruleID); err != nil {
-		r.releaseForwarding()
-		delete(r.rules, ruleID+dnatSuffix)
-		return nil, err
-	}
-
-	// Unlike iptables, there's no point in adding "out" rules in the forward chain here as our policy is ACCEPT.
-	// To overcome DROP policies in other chains, we'd have to add rules to the chains there.
-	// We also cannot just add "oif <iface> accept" there and filter in our own table as we don't know what is supposed to be allowed.
-	// TODO: find chains with drop policies and add rules there
-
-	if err := r.conn.Flush(); err != nil {
-		r.releaseForwarding()
-		delete(r.rules, ruleID+dnatSuffix)
-		delete(r.rules, ruleID+snatSuffix)
-		return nil, fmt.Errorf("flush rules: %w", err)
-	}
-
-	return &rule, nil
-}
-
-func (r *family) addDnatRedirect(rule firewall.ForwardRule, protoNum uint8, ruleID firewall.RuleID) error {
-	dnatExprs := []expr.Any{
-		&expr.Meta{Key: expr.MetaKeyIIFNAME, Register: 1},
-		&expr.Cmp{
-			Op:       expr.CmpOpNeq,
-			Register: 1,
-			Data:     ifname(r.wgIface.Name()),
-		},
-		&expr.Meta{Key: expr.MetaKeyL4PROTO, Register: 1},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 1,
-			Data:     []byte{protoNum},
-		},
-		&expr.Payload{
-			DestRegister: 1,
-			Base:         expr.PayloadBaseTransportHeader,
-			Offset:       2,
-			Len:          2,
-		},
-	}
-	portExprs, err := r.applyPort(&rule.DestinationPort, false)
-	if err != nil {
-		return fmt.Errorf("apply destination port: %w", err)
-	}
-	dnatExprs = append(dnatExprs, portExprs...)
-
-	// shifted translated port is not supported in nftables, so we hand this over to xtables
-	if rule.TranslatedPort.IsRange && len(rule.TranslatedPort.Values) == 2 {
-		if rule.TranslatedPort.Values[0] != rule.DestinationPort.Values[0] ||
-			rule.TranslatedPort.Values[1] != rule.DestinationPort.Values[1] {
-			return r.addXTablesRedirect(dnatExprs, ruleID, rule)
-		}
-	}
-
-	additionalExprs, regProtoMin, regProtoMax, err := r.handleTranslatedPort(rule)
-	if err != nil {
-		return err
-	}
-	dnatExprs = append(dnatExprs, additionalExprs...)
-
-	dnatExprs = append(dnatExprs,
-		&expr.NAT{
-			Type:        expr.NATTypeDestNAT,
-			Family:      uint32(r.af.tableFamily),
-			RegAddrMin:  1,
-			RegProtoMin: regProtoMin,
-			RegProtoMax: regProtoMax,
-		},
-	)
-
-	dnatRule := &nftables.Rule{
-		Table:    r.workTable,
-		Chain:    r.chains[chainNameRoutingRdr],
-		Exprs:    dnatExprs,
-		UserData: []byte(ruleID + dnatSuffix),
-	}
-	r.conn.AddRule(dnatRule)
-	r.rules[ruleID+dnatSuffix] = dnatRule
-
-	return nil
-}
-
-func (r *family) handleTranslatedPort(rule firewall.ForwardRule) ([]expr.Any, uint32, uint32, error) {
-	switch {
-	case rule.TranslatedPort.IsRange && len(rule.TranslatedPort.Values) == 2:
-		return r.handlePortRange(rule)
-	case len(rule.TranslatedPort.Values) == 0:
-		return r.handleAddressOnly(rule)
-	case len(rule.TranslatedPort.Values) == 1:
-		return r.handleSinglePort(rule)
-	default:
-		return nil, 0, 0, fmt.Errorf("invalid translated port: %v", rule.TranslatedPort)
-	}
-}
-
-func (r *family) handlePortRange(rule firewall.ForwardRule) ([]expr.Any, uint32, uint32, error) {
-	exprs := []expr.Any{
-		&expr.Immediate{
-			Register: 1,
-			Data:     rule.TranslatedAddress.AsSlice(),
-		},
-		&expr.Immediate{
-			Register: 2,
-			Data:     binaryutil.BigEndian.PutUint16(rule.TranslatedPort.Values[0]),
-		},
-		&expr.Immediate{
-			Register: 3,
-			Data:     binaryutil.BigEndian.PutUint16(rule.TranslatedPort.Values[1]),
-		},
-	}
-	return exprs, 2, 3, nil
-}
-
-func (r *family) handleAddressOnly(rule firewall.ForwardRule) ([]expr.Any, uint32, uint32, error) {
-	exprs := []expr.Any{
-		&expr.Immediate{
-			Register: 1,
-			Data:     rule.TranslatedAddress.AsSlice(),
-		},
-	}
-	return exprs, 0, 0, nil
-}
-
-func (r *family) handleSinglePort(rule firewall.ForwardRule) ([]expr.Any, uint32, uint32, error) {
-	exprs := []expr.Any{
-		&expr.Immediate{
-			Register: 1,
-			Data:     rule.TranslatedAddress.AsSlice(),
-		},
-		&expr.Immediate{
-			Register: 2,
-			Data:     binaryutil.BigEndian.PutUint16(rule.TranslatedPort.Values[0]),
-		},
-	}
-	return exprs, 2, 0, nil
-}
-
-func (r *family) addXTablesRedirect(dnatExprs []expr.Any, ruleID firewall.RuleID, rule firewall.ForwardRule) error {
-	dnatExprs = append(dnatExprs,
-		&expr.Counter{},
-		&expr.Target{
-			Name: "DNAT",
-			Rev:  2,
-			Info: &xt.NatRange2{
-				NatRange: xt.NatRange{
-					Flags:   uint(xt.NatRangeMapIPs | xt.NatRangeProtoSpecified | xt.NatRangeProtoOffset),
-					MinIP:   rule.TranslatedAddress.AsSlice(),
-					MaxIP:   rule.TranslatedAddress.AsSlice(),
-					MinPort: rule.TranslatedPort.Values[0],
-					MaxPort: rule.TranslatedPort.Values[1],
-				},
-				BasePort: rule.DestinationPort.Values[0],
-			},
-		},
-	)
-
-	natTable := &nftables.Table{
-		Name:   tableNat,
-		Family: r.af.tableFamily,
-	}
-	dnatRule := &nftables.Rule{
-		Table: natTable,
-		Chain: &nftables.Chain{
-			Name:     chainNameNatPrerouting,
-			Table:    natTable,
-			Type:     nftables.ChainTypeNAT,
-			Hooknum:  nftables.ChainHookPrerouting,
-			Priority: nftables.ChainPriorityNATDest,
-		},
-		Exprs:    dnatExprs,
-		UserData: []byte(ruleID + dnatSuffix),
-	}
-	r.conn.AddRule(dnatRule)
-	r.rules[ruleID+dnatSuffix] = dnatRule
-
-	return nil
-}
-
-func (r *family) addDnatMasq(rule firewall.ForwardRule, protoNum uint8, ruleID firewall.RuleID) error {
-	portExprs, err := r.applyPort(&rule.TranslatedPort, false)
-	if err != nil {
-		return fmt.Errorf("apply translated port: %w", err)
-	}
-
-	masqExprs := []expr.Any{
-		&expr.Meta{Key: expr.MetaKeyOIFNAME, Register: 1},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 1,
-			Data:     ifname(r.wgIface.Name()),
-		},
-		&expr.Meta{Key: expr.MetaKeyL4PROTO, Register: 1},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 1,
-			Data:     []byte{protoNum},
-		},
-		&expr.Payload{
-			DestRegister: 1,
-			Base:         expr.PayloadBaseNetworkHeader,
-			Offset:       r.af.dstAddrOffset,
-			Len:          r.af.addrLen,
-		},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 1,
-			Data:     rule.TranslatedAddress.AsSlice(),
-		},
-	}
-
-	masqExprs = append(masqExprs, portExprs...)
-	masqExprs = append(masqExprs, &expr.Masq{})
-
-	masqRule := &nftables.Rule{
-		Table:    r.workTable,
-		Chain:    r.chains[chainNameRoutingNat],
-		Exprs:    masqExprs,
-		UserData: []byte(ruleID + snatSuffix),
-	}
-	r.conn.AddRule(masqRule)
-	r.rules[ruleID+snatSuffix] = masqRule
-
-	return nil
-}
-
-func (r *family) DeleteDNATRule(rule firewall.Rule) error {
-	ruleID := rule.ID()
-
-	if err := r.refreshRulesMap(); err != nil {
-		return fmt.Errorf(refreshRulesMapError, err)
-	}
-
-	var merr *multierror.Error
-	var needsFlush bool
-	var found bool
-
-	if dnatRule, exists := r.rules[ruleID+dnatSuffix]; exists {
-		found = true
-		if dnatRule.Handle == 0 {
-			log.Warnf("dnat rule %s has no handle, removing stale entry", ruleID+dnatSuffix)
-			delete(r.rules, ruleID+dnatSuffix)
-		} else if err := r.conn.DelRule(dnatRule); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("delete dnat rule: %w", err))
-		} else {
-			needsFlush = true
-		}
-	}
-
-	if masqRule, exists := r.rules[ruleID+snatSuffix]; exists {
-		found = true
-		if masqRule.Handle == 0 {
-			log.Warnf("snat rule %s has no handle, removing stale entry", ruleID+snatSuffix)
-			delete(r.rules, ruleID+snatSuffix)
-		} else if err := r.conn.DelRule(masqRule); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("delete snat rule: %w", err))
-		} else {
-			needsFlush = true
-		}
-	}
-
-	if needsFlush {
-		if err := r.conn.Flush(); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf(flushError, err))
-		}
-	}
-
-	if merr != nil {
-		return nberrors.FormatErrorOrNil(merr)
-	}
-
-	delete(r.rules, ruleID+dnatSuffix)
-	delete(r.rules, ruleID+snatSuffix)
-
-	// Release once, only if the rule was present and removed.
-	if found {
-		r.releaseForwarding()
-	}
-
-	return nil
-}
-
-// releaseForwarding drops one IP forwarding reference, logging any error.
-func (r *family) releaseForwarding() {
-	if err := r.ipFwdState.ReleaseForwarding(r.isV6()); err != nil {
-		log.Errorf("release IP forwarding: %v", err)
-	}
-}
-
-// isV6 reports whether this family handles the IPv6 table.
-func (r *family) isV6() bool {
-	return r.af.tableFamily == nftables.TableFamilyIPv6
-}
-
 func (r *family) AddInboundDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error {
 	ruleID := firewall.RuleID(fmt.Sprintf("inbound-dnat-%s-%s-%d-%d", localAddr.String(), protocol, originalPort, translatedPort))
 
diff --git a/client/firewall/nftables/dnat_refcount_linux_test.go b/client/firewall/nftables/dnat_refcount_linux_test.go
deleted file mode 100644
index cdc24e77f..000000000
--- a/client/firewall/nftables/dnat_refcount_linux_test.go
+++ /dev/null
@@ -1,249 +0,0 @@
-//go:build privileged
-
-package nftables
-
-import (
-	"net/netip"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	fw "github.com/netbirdio/netbird/client/firewall/manager"
-	"github.com/netbirdio/netbird/client/iface"
-	"github.com/netbirdio/netbird/client/iface/wgaddr"
-)
-
-func nftRefcountIfaceV4() *iFaceMock {
-	return &iFaceMock{
-		NameFunc: func() string { return "wt-refcount" },
-		AddressFunc: func() wgaddr.Address {
-			return wgaddr.Address{
-				IP:      netip.MustParseAddr("100.96.0.1"),
-				Network: netip.MustParsePrefix("100.96.0.0/16"),
-			}
-		},
-	}
-}
-
-func nftRefcountIfaceDual() *iFaceMock {
-	return &iFaceMock{
-		NameFunc: func() string { return "wt-refcount" },
-		AddressFunc: func() wgaddr.Address {
-			return wgaddr.Address{
-				IP:      netip.MustParseAddr("100.96.0.1"),
-				Network: netip.MustParsePrefix("100.96.0.0/16"),
-				IPv6:    netip.MustParseAddr("fd00::1"),
-				IPv6Net: netip.MustParsePrefix("fd00::/64"),
-			}
-		},
-	}
-}
-
-func newNftRefcountManager(t *testing.T, dual bool) *Manager {
-	t.Helper()
-	if check() != NFTABLES {
-		t.Skip("nftables not supported on this system")
-	}
-	var ifMock *iFaceMock
-	if dual {
-		ifMock = nftRefcountIfaceDual()
-	} else {
-		ifMock = nftRefcountIfaceV4()
-	}
-	m, err := Create(ifMock, iface.DefaultMTU)
-	require.NoError(t, err, "create manager")
-	require.NoError(t, m.Init(nil), "init manager")
-	t.Cleanup(func() {
-		require.NoError(t, m.Close(nil), "close manager")
-	})
-	return m
-}
-
-func dnatV4(port uint16) fw.ForwardRule {
-	return fw.ForwardRule{
-		Protocol:          fw.ProtocolTCP,
-		DestinationPort:   fw.Port{Values: []uint16{port}},
-		TranslatedAddress: netip.MustParseAddr("100.96.0.2"),
-		TranslatedPort:    fw.Port{Values: []uint16{80}},
-	}
-}
-
-func dnatV6(port uint16) fw.ForwardRule {
-	return fw.ForwardRule{
-		Protocol:          fw.ProtocolTCP,
-		DestinationPort:   fw.Port{Values: []uint16{port}},
-		TranslatedAddress: netip.MustParseAddr("fd00::2"),
-		TranslatedPort:    fw.Port{Values: []uint16{80}},
-	}
-}
-
-// TestNftablesDNAT_RefcountBalancedV4 verifies that Add/Delete pairs leave the
-// v4 refcount at zero.
-func TestNftablesDNAT_RefcountBalancedV4(t *testing.T) {
-	m := newNftRefcountManager(t, false)
-	state := m.family4.ipFwdState
-
-	r1, err := m.AddDNATRule(dnatV4(8081))
-	require.NoError(t, err, "add v4 dnat 1")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 1, v4, "v4 refcount after first add")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-
-	r2, err := m.AddDNATRule(dnatV4(8082))
-	require.NoError(t, err, "add v4 dnat 2")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 2, v4, "v4 refcount after second add")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-
-	require.NoError(t, m.DeleteDNATRule(r1), "delete v4 dnat 1")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 1, v4, "v4 refcount after first delete")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-
-	require.NoError(t, m.DeleteDNATRule(r2), "delete v4 dnat 2")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount after second delete")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-}
-
-// TestNftablesDNAT_RefcountBalancedV6 verifies the v6 path increments v6 only
-// and decrements back to zero on Delete.
-func TestNftablesDNAT_RefcountBalancedV6(t *testing.T) {
-	m := newNftRefcountManager(t, true)
-	require.NotNil(t, m.family6, "v6 family")
-	require.Same(t, m.family4.ipFwdState, m.family6.ipFwdState, "shared state")
-	state := m.family4.ipFwdState
-
-	r1, err := m.AddDNATRule(dnatV6(9091))
-	require.NoError(t, err, "add v6 dnat 1")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount unchanged")
-	assert.Equal(t, 1, v6, "v6 refcount after first add")
-
-	r2, err := m.AddDNATRule(dnatV6(9092))
-	require.NoError(t, err, "add v6 dnat 2")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 2, v6, "v6 refcount after second add")
-
-	require.NoError(t, m.DeleteDNATRule(r1), "delete v6 dnat 1")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount unchanged")
-	assert.Equal(t, 1, v6, "v6 refcount after first delete")
-
-	require.NoError(t, m.DeleteDNATRule(r2), "delete v6 dnat 2")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 0, v6, "v6 refcount after second delete")
-}
-
-// TestNftablesDNAT_DuplicateAddNoLeak verifies that a duplicate Add (same
-// ForwardRule) does not double-increment the refcount.
-func TestNftablesDNAT_DuplicateAddNoLeak(t *testing.T) {
-	m := newNftRefcountManager(t, true)
-	state := m.family4.ipFwdState
-
-	rule := dnatV4(8083)
-	r1, err := m.AddDNATRule(rule)
-	require.NoError(t, err, "add v4 dnat")
-	v4, _ := state.Counts()
-	assert.Equal(t, 1, v4)
-
-	// duplicate add: same rule ID, must be a no-op for the refcount.
-	_, err = m.AddDNATRule(rule)
-	require.NoError(t, err, "duplicate add")
-	v4, _ = state.Counts()
-	assert.Equal(t, 1, v4, "duplicate add must not increment")
-
-	require.NoError(t, m.DeleteDNATRule(r1), "delete v4 dnat")
-	v4, _ = state.Counts()
-	assert.Equal(t, 0, v4, "single delete must drop to zero")
-}
-
-// TestNftablesDNAT_DeleteMissingNoUnderflow verifies deleting a rule that was
-// never added does not underflow the refcount.
-func TestNftablesDNAT_DeleteMissingNoUnderflow(t *testing.T) {
-	m := newNftRefcountManager(t, true)
-	state := m.family4.ipFwdState
-
-	// Construct a Rule reference for something never added. The router stores
-	// rules by ID(), and DeleteDNATRule looks them up in r.rules; a missing
-	// entry must be a no-op rather than calling Release.
-	phantom := dnatV4(8099)
-	require.NoError(t, m.DeleteDNATRule(&phantom), "delete missing v4 dnat")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount unaffected by missing delete")
-	assert.Equal(t, 0, v6, "v6 refcount unaffected")
-
-	phantom6 := dnatV6(9099)
-	require.NoError(t, m.DeleteDNATRule(&phantom6), "delete missing v6 dnat")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 0, v6, "v6 refcount unaffected by missing delete")
-
-	// And after a phantom delete, a real add still results in count=1.
-	r1, err := m.AddDNATRule(dnatV4(8100))
-	require.NoError(t, err, "add v4 dnat after phantom delete")
-	v4, _ = state.Counts()
-	assert.Equal(t, 1, v4, "real add still increments after phantom delete")
-	require.NoError(t, m.DeleteDNATRule(r1))
-}
-
-// TestNftablesRouting_RepeatedEnableSingleReference verifies that EnableRouting
-// (called on every network-map update) holds at most one reference per family
-// and a single DisableRouting drops both back to zero.
-func TestNftablesRouting_RepeatedEnableSingleReference(t *testing.T) {
-	m := newNftRefcountManager(t, true)
-	state := m.family4.ipFwdState
-
-	require.NoError(t, m.EnableRouting(), "first enable")
-	require.NoError(t, m.EnableRouting(), "second enable")
-	require.NoError(t, m.EnableRouting(), "third enable")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 1, v4, "repeated enable holds a single v4 reference")
-	assert.Equal(t, 1, v6, "repeated enable holds a single v6 reference")
-
-	require.NoError(t, m.DisableRouting(), "disable")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "single disable releases the v4 reference")
-	assert.Equal(t, 0, v6, "single disable releases the v6 reference")
-}
-
-// TestNftablesRouting_DisableKeepsDNATReference verifies that an unpaired
-// DisableRouting does not release references held by active DNAT rules.
-func TestNftablesRouting_DisableKeepsDNATReference(t *testing.T) {
-	m := newNftRefcountManager(t, true)
-	state := m.family4.ipFwdState
-
-	r1, err := m.AddDNATRule(dnatV6(9095))
-	require.NoError(t, err, "add v6 dnat")
-
-	require.NoError(t, m.DisableRouting(), "unpaired disable")
-	_, v6 := state.Counts()
-	assert.Equal(t, 1, v6, "DNAT-held reference survives unpaired DisableRouting")
-
-	require.NoError(t, m.DeleteDNATRule(r1), "delete v6 dnat")
-	_, v6 = state.Counts()
-	assert.Equal(t, 0, v6, "delete releases the DNAT reference")
-}
-
-// TestNftablesDNAT_DoubleDeleteNoUnderflow verifies that deleting the same rule
-// twice does not underflow the refcount (the second delete is a no-op).
-func TestNftablesDNAT_DoubleDeleteNoUnderflow(t *testing.T) {
-	m := newNftRefcountManager(t, true)
-	state := m.family4.ipFwdState
-
-	r1, err := m.AddDNATRule(dnatV6(9093))
-	require.NoError(t, err)
-	_, v6 := state.Counts()
-	assert.Equal(t, 1, v6)
-
-	require.NoError(t, m.DeleteDNATRule(r1), "first delete")
-	_, v6 = state.Counts()
-	assert.Equal(t, 0, v6)
-
-	require.NoError(t, m.DeleteDNATRule(r1), "second delete must be no-op")
-	_, v6 = state.Counts()
-	assert.Equal(t, 0, v6, "double delete must not underflow")
-}
diff --git a/client/firewall/nftables/family_linux.go b/client/firewall/nftables/family_linux.go
index 7a5df3ed7..4169c9d2d 100644
--- a/client/firewall/nftables/family_linux.go
+++ b/client/firewall/nftables/family_linux.go
@@ -24,7 +24,6 @@ const (
 	tableRaw      = "raw"
 	tableSecurity = "security"
 
-	chainNameNatPrerouting = "PREROUTING"
 	chainNameRoutingFw     = "netbird-rt-fwd"
 	chainNameRoutingNat    = "netbird-rt-postrouting"
 	chainNameRoutingRdr    = "netbird-rt-redirect"
@@ -47,9 +46,6 @@ const (
 	userDataAcceptForwardRuleOif = "frwacceptoif"
 	userDataAcceptInputRule      = "inputaccept"
 
-	dnatSuffix firewall.RuleID = "_dnat"
-	snatSuffix firewall.RuleID = "_snat"
-
 	// ipv4TCPHeaderSize is the minimum IPv4 (20) + TCP (20) header size for MSS calculation.
 	ipv4TCPHeaderSize = 40
 	// ipv6TCPHeaderSize is the minimum IPv6 (40) + TCP (20) header size for MSS calculation.
@@ -167,10 +163,6 @@ func (r *family) Reset() error {
 		merr = multierror.Append(merr, err)
 	}
 
-	if err := r.removeNatPreroutingRules(); err != nil {
-		merr = multierror.Append(merr, fmt.Errorf("remove filter prerouting rules: %w", err))
-	}
-
 	return nberrors.FormatErrorOrNil(merr)
 }
 
diff --git a/client/firewall/nftables/filter_linux.go b/client/firewall/nftables/filter_linux.go
index ebd238063..bb3ac1dfe 100644
--- a/client/firewall/nftables/filter_linux.go
+++ b/client/firewall/nftables/filter_linux.go
@@ -197,11 +197,6 @@ func (r *family) hasRule(id firewall.RuleID) bool {
 	return ok
 }
 
-func (r *family) hasDNATRule(id firewall.RuleID) bool {
-	_, ok := r.rules[id+dnatSuffix]
-	return ok
-}
-
 // DeleteFilterRule removes a previously installed filter rule. Source
 // set references are recovered from the stored rule's expressions via
 // findSets and dropped from the shared refcounter.
diff --git a/client/firewall/nftables/manager_linux.go b/client/firewall/nftables/manager_linux.go
index 87651761f..75405e213 100644
--- a/client/firewall/nftables/manager_linux.go
+++ b/client/firewall/nftables/manager_linux.go
@@ -252,7 +252,7 @@ func (m *Manager) DeleteFilterRule(rule firewall.Rule) error {
 	m.mutex.Lock()
 	defer m.mutex.Unlock()
 
-	fam, err := m.familyForRuleID(rule.ID(), (*family).hasRule, false)
+	fam, err := m.familyForRuleID(rule.ID(), (*family).hasRule)
 	if err != nil {
 		return err
 	}
@@ -260,11 +260,8 @@ func (m *Manager) DeleteFilterRule(rule firewall.Rule) error {
 }
 
 // familyForRuleID picks the family holding the rule with the given id, using
-// the supplied lookup. With refresh set, a miss in both cached maps reloads
-// the NAT/DNAT rule maps from the kernel once and re-checks before falling
-// back to the v4 family. Filter rules are tracked only in memory and have no
-// kernel-backed reload, so their callers pass refresh as false.
-func (m *Manager) familyForRuleID(id firewall.RuleID, has func(*family, firewall.RuleID) bool, refresh bool) (*family, error) {
+// the supplied lookup, and falls back to the v4 family on a miss.
+func (m *Manager) familyForRuleID(id firewall.RuleID, has func(*family, firewall.RuleID) bool) (*family, error) {
 	if has(m.family4, id) {
 		return m.family4, nil
 	}
@@ -274,18 +271,6 @@ func (m *Manager) familyForRuleID(id firewall.RuleID, has func(*family, firewall
 	if has(m.family6, id) {
 		return m.family6, nil
 	}
-	if !refresh {
-		return m.family4, nil
-	}
-	if err := m.family4.refreshRulesMap(); err != nil {
-		return nil, fmt.Errorf("refresh v4 rules: %w", err)
-	}
-	if err := m.family6.refreshRulesMap(); err != nil {
-		return nil, fmt.Errorf("refresh v6 rules: %w", err)
-	}
-	if has(m.family6, id) && !has(m.family4, id) {
-		return m.family6, nil
-	}
 	return m.family4, nil
 }
 
@@ -450,32 +435,6 @@ func (m *Manager) Flush() error {
 	return nil
 }
 
-// AddDNATRule adds a DNAT rule
-func (m *Manager) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error) {
-	m.mutex.Lock()
-	defer m.mutex.Unlock()
-
-	if rule.TranslatedAddress.Is6() {
-		if !m.hasIPv6() {
-			return nil, fmt.Errorf("add DNAT rule: %w", firewall.ErrIPv6NotInitialized)
-		}
-		return m.family6.AddDNATRule(rule)
-	}
-	return m.family4.AddDNATRule(rule)
-}
-
-// DeleteDNATRule deletes a DNAT rule
-func (m *Manager) DeleteDNATRule(rule firewall.Rule) error {
-	m.mutex.Lock()
-	defer m.mutex.Unlock()
-
-	r, err := m.familyForRuleID(rule.ID(), (*family).hasDNATRule, true)
-	if err != nil {
-		return err
-	}
-	return r.DeleteDNATRule(rule)
-}
-
 // UpdateSet updates the set with the given prefixes
 func (m *Manager) UpdateSet(set firewall.Set, prefixes []netip.Prefix) error {
 	m.mutex.Lock()
diff --git a/client/firewall/nftables/manager_linux_test.go b/client/firewall/nftables/manager_linux_test.go
index 0ca56409e..4d6eec3c1 100644
--- a/client/firewall/nftables/manager_linux_test.go
+++ b/client/firewall/nftables/manager_linux_test.go
@@ -378,18 +378,6 @@ func TestNftablesManagerCompatibilityWithIptables(t *testing.T) {
 	err = manager.AddNatRule(pair)
 	require.NoError(t, err, "failed to add NAT rule")
 
-	dnatRule, err := manager.AddDNATRule(fw.ForwardRule{
-		Protocol:          fw.ProtocolTCP,
-		DestinationPort:   fw.Port{Values: []uint16{8080}},
-		TranslatedAddress: netip.MustParseAddr("100.96.0.2"),
-		TranslatedPort:    fw.Port{Values: []uint16{80}},
-	})
-	require.NoError(t, err, "failed to add DNAT rule")
-
-	t.Cleanup(func() {
-		require.NoError(t, manager.DeleteDNATRule(dnatRule), "failed to delete DNAT rule")
-	})
-
 	stdout, stderr = runIptablesSave(t)
 	verifyIptablesOutput(t, stdout, stderr)
 }
@@ -453,18 +441,6 @@ func TestNftablesManagerIPv6CompatibilityWithIp6tables(t *testing.T) {
 	})
 	require.NoError(t, err, "add v6 NAT rule")
 
-	dnatRule, err := manager.AddDNATRule(fw.ForwardRule{
-		Protocol:          fw.ProtocolTCP,
-		DestinationPort:   fw.Port{Values: []uint16{8080}},
-		TranslatedAddress: netip.MustParseAddr("fd00::2"),
-		TranslatedPort:    fw.Port{Values: []uint16{80}},
-	})
-	require.NoError(t, err, "add v6 DNAT rule")
-
-	t.Cleanup(func() {
-		require.NoError(t, manager.DeleteDNATRule(dnatRule), "delete v6 DNAT rule")
-	})
-
 	stdout, stderr := runIptablesSave(t)
 	verifyIptablesOutput(t, stdout, stderr)
 
diff --git a/client/firewall/nftables/routing_linux.go b/client/firewall/nftables/routing_linux.go
index d619c5543..e98471e8f 100644
--- a/client/firewall/nftables/routing_linux.go
+++ b/client/firewall/nftables/routing_linux.go
@@ -459,41 +459,6 @@ func (r *family) RemoveAllLegacyRouteRules() error {
 	return nberrors.FormatErrorOrNil(merr)
 }
 
-func (r *family) removeNatPreroutingRules() error {
-	table := &nftables.Table{
-		Name:   tableNat,
-		Family: r.af.tableFamily,
-	}
-	chain := &nftables.Chain{
-		Name:     chainNameNatPrerouting,
-		Table:    table,
-		Hooknum:  nftables.ChainHookPrerouting,
-		Priority: nftables.ChainPriorityNATDest,
-		Type:     nftables.ChainTypeNAT,
-	}
-	rules, err := r.conn.GetRules(table, chain)
-	if err != nil {
-		return fmt.Errorf("get rules from nat table: %w", err)
-	}
-
-	var merr *multierror.Error
-
-	// Delete rules that have our UserData suffix
-	for _, rule := range rules {
-		if len(rule.UserData) == 0 || !strings.HasSuffix(string(rule.UserData), string(dnatSuffix)) {
-			continue
-		}
-		if err := r.conn.DelRule(rule); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("delete rule %s: %w", rule.UserData, err))
-		}
-	}
-
-	if err := r.conn.Flush(); err != nil {
-		merr = multierror.Append(merr, fmt.Errorf(flushError, err))
-	}
-	return nberrors.FormatErrorOrNil(merr)
-}
-
 func (r *family) RemoveNatRule(pair firewall.RouterPair) error {
 	if err := r.refreshRulesMap(); err != nil {
 		return fmt.Errorf(refreshRulesMapError, err)
diff --git a/client/firewall/uspfilter/nat.go b/client/firewall/uspfilter/nat.go
index 06312aabf..49c26766a 100644
--- a/client/firewall/uspfilter/nat.go
+++ b/client/firewall/uspfilter/nat.go
@@ -486,16 +486,6 @@ func incrementalUpdate(oldChecksum uint16, oldBytes, newBytes []byte) uint16 {
 	return ^uint16(sum)
 }
 
-// AddDNATRule adds outbound DNAT rule for forwarding external traffic to NetBird network.
-func (m *Manager) AddDNATRule(firewall.ForwardRule) (firewall.Rule, error) {
-	return nil, errNotSupported
-}
-
-// DeleteDNATRule deletes outbound DNAT rule.
-func (m *Manager) DeleteDNATRule(firewall.Rule) error {
-	return errNotSupported
-}
-
 // addPortRedirection adds a port redirection rule.
 func (m *Manager) addPortRedirection(targetIP netip.Addr, protocol gopacket.LayerType, originalPort, translatedPort uint16) error {
 	m.portDNATMutex.Lock()
diff --git a/client/internal/engine.go b/client/internal/engine.go
index 7e9375771..4d731cbd7 100644
--- a/client/internal/engine.go
+++ b/client/internal/engine.go
@@ -42,7 +42,6 @@ import (
 	dnsconfig "github.com/netbirdio/netbird/client/internal/dns/config"
 	"github.com/netbirdio/netbird/client/internal/dnsfwd"
 	"github.com/netbirdio/netbird/client/internal/expose"
-	"github.com/netbirdio/netbird/client/internal/ingressgw"
 	"github.com/netbirdio/netbird/client/internal/lazyconn"
 	"github.com/netbirdio/netbird/client/internal/metrics"
 	"github.com/netbirdio/netbird/client/internal/netflow"
@@ -262,11 +261,10 @@ type Engine struct {
 
 	statusRecorder *peer.Status
 
-	firewall          firewallManager.Manager
-	routeManager      routemanager.Manager
-	acl               acl.Manager
-	dnsForwardMgr     *dnsfwd.Manager
-	ingressGatewayMgr *ingressgw.Manager
+	firewall      firewallManager.Manager
+	routeManager  routemanager.Manager
+	acl           acl.Manager
+	dnsForwardMgr *dnsfwd.Manager
 
 	dnsServer dns.Server
 
@@ -448,13 +446,6 @@ func (e *Engine) stopLocked() {
 
 	e.cleanupSSHConfig()
 
-	if e.ingressGatewayMgr != nil {
-		if err := e.ingressGatewayMgr.Close(); err != nil {
-			log.Warnf("failed to cleanup forward rules: %v", err)
-		}
-		e.ingressGatewayMgr = nil
-	}
-
 	if e.srWatcher != nil {
 		e.srWatcher.Close()
 	}
@@ -1627,13 +1618,6 @@ func (e *Engine) updateNetworkMap(networkMap *mgmProto.NetworkMap) error {
 	e.updateDNSForwarder(dnsRouteFeatureFlag, fwdEntries)
 	done()
 
-	// Ingress forward rules
-	done = e.phase("forward_rules")
-	if _, err := e.updateForwardRules(networkMap.GetForwardingRules()); err != nil {
-		log.Errorf("failed to update forward rules, err: %v", err)
-	}
-	done()
-
 	log.Debugf("got peers update from Management Service, total peers to connect to = %d", len(networkMap.GetRemotePeers()))
 
 	done = e.phase("offline_peers")
@@ -2733,74 +2717,6 @@ func (e *Engine) setForwarderCapture(pc device.PacketCapture) {
 	}
 }
 
-func (e *Engine) updateForwardRules(rules []*mgmProto.ForwardingRule) ([]firewallManager.ForwardRule, error) {
-	if e.firewall == nil {
-		log.Warn("firewall is disabled, not updating forwarding rules")
-		return nil, nil
-	}
-
-	if len(rules) == 0 {
-		if e.ingressGatewayMgr == nil {
-			return nil, nil
-		}
-
-		err := e.ingressGatewayMgr.Close()
-		e.ingressGatewayMgr = nil
-		e.statusRecorder.SetIngressGwMgr(nil)
-		return nil, err
-	}
-
-	if e.ingressGatewayMgr == nil {
-		mgr := ingressgw.NewManager(e.firewall)
-		e.ingressGatewayMgr = mgr
-		e.statusRecorder.SetIngressGwMgr(mgr)
-	}
-
-	var merr *multierror.Error
-	forwardingRules := make([]firewallManager.ForwardRule, 0, len(rules))
-	for _, rule := range rules {
-		proto, err := acl.ConvertToFirewallProtocol(rule.GetProtocol())
-		if err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("failed to convert protocol '%s': %w", rule.GetProtocol(), err))
-			continue
-		}
-
-		dstPortInfo, err := convertPortInfo(rule.GetDestinationPort())
-		if err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("invalid destination port '%v': %w", rule.GetDestinationPort(), err))
-			continue
-		}
-
-		translateIP, err := convertToIP(rule.GetTranslatedAddress())
-		if err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("failed to convert translated address '%s': %w", rule.GetTranslatedAddress(), err))
-			continue
-		}
-
-		translatePort, err := convertPortInfo(rule.GetTranslatedPort())
-		if err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("invalid translate port '%v': %w", rule.GetTranslatedPort(), err))
-			continue
-		}
-
-		forwardRule := firewallManager.ForwardRule{
-			Protocol:          proto,
-			DestinationPort:   *dstPortInfo,
-			TranslatedAddress: translateIP,
-			TranslatedPort:    *translatePort,
-		}
-
-		forwardingRules = append(forwardingRules, forwardRule)
-	}
-
-	log.Infof("updating forwarding rules: %d", len(forwardingRules))
-	if err := e.ingressGatewayMgr.Update(forwardingRules); err != nil {
-		log.Errorf("failed to update forwarding rules: %v", err)
-	}
-
-	return forwardingRules, nberrors.FormatErrorOrNil(merr)
-}
-
 // toExcludedLazyPeers returns the peers that must have an always-active
 // connection: those that are not lazy by policy (the per-peer lazy state or the
 // account flag, subject to the local override).
diff --git a/client/internal/engine_privileged_test.go b/client/internal/engine_privileged_test.go
index 2db0cd5ed..4449b5788 100644
--- a/client/internal/engine_privileged_test.go
+++ b/client/internal/engine_privileged_test.go
@@ -42,7 +42,6 @@ import (
 	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/groups"
 	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator/validator"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
@@ -523,8 +522,8 @@ func startManagement(t *testing.T, dataDir, testFile string) (*grpc.Server, stri
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := server.NewAccountRequestBuffer(context.Background(), store)
-	networkMapController := controller.NewController(context.Background(), store, metrics, updateManager, requestBuffer, server.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), manager.NewEphemeralManager(store, peersManager), config, nil)
-	accountManager, err := server.BuildManager(context.Background(), config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, ia, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	networkMapController := controller.NewController(context.Background(), store, metrics, updateManager, requestBuffer, server.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", manager.NewEphemeralManager(store, peersManager), config, nil)
+	accountManager, err := server.BuildManager(context.Background(), config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, ia, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	if err != nil {
 		return nil, "", err
 	}
diff --git a/client/internal/ingressgw/manager.go b/client/internal/ingressgw/manager.go
deleted file mode 100644
index 605543d1c..000000000
--- a/client/internal/ingressgw/manager.go
+++ /dev/null
@@ -1,111 +0,0 @@
-package ingressgw
-
-import (
-	"fmt"
-	"sync"
-
-	"github.com/hashicorp/go-multierror"
-	log "github.com/sirupsen/logrus"
-
-	nberrors "github.com/netbirdio/netbird/client/errors"
-	firewall "github.com/netbirdio/netbird/client/firewall/manager"
-)
-
-type DNATFirewall interface {
-	AddDNATRule(fwdRule firewall.ForwardRule) (firewall.Rule, error)
-	DeleteDNATRule(rule firewall.Rule) error
-}
-
-type RulePair struct {
-	firewall.ForwardRule
-	firewall.Rule
-}
-
-type Manager struct {
-	dnatFirewall DNATFirewall
-
-	rules   map[firewall.RuleID]RulePair
-	rulesMu sync.Mutex
-}
-
-func NewManager(dnatFirewall DNATFirewall) *Manager {
-	return &Manager{
-		dnatFirewall: dnatFirewall,
-		rules:        make(map[firewall.RuleID]RulePair),
-	}
-}
-
-func (h *Manager) Update(forwardRules []firewall.ForwardRule) error {
-	h.rulesMu.Lock()
-	defer h.rulesMu.Unlock()
-
-	var mErr *multierror.Error
-
-	toDelete := make(map[firewall.RuleID]RulePair, len(h.rules))
-	for id, r := range h.rules {
-		toDelete[id] = r
-	}
-
-	// Process new/updated rules
-	for _, fwdRule := range forwardRules {
-		id := fwdRule.ID()
-		if _, ok := h.rules[id]; ok {
-			delete(toDelete, id)
-			continue
-		}
-
-		rule, err := h.dnatFirewall.AddDNATRule(fwdRule)
-		if err != nil {
-			mErr = multierror.Append(mErr, fmt.Errorf("add forward rule '%s': %v", fwdRule.String(), err))
-			continue
-		}
-		if rule == nil {
-			mErr = multierror.Append(mErr, fmt.Errorf("add forward rule '%s': backend returned no rule", fwdRule.String()))
-			continue
-		}
-		log.Infof("forward rule has been added '%s'", fwdRule)
-		h.rules[id] = RulePair{
-			ForwardRule: fwdRule,
-			Rule:        rule,
-		}
-	}
-
-	// Remove deleted rules
-	for id, rulePair := range toDelete {
-		if err := h.dnatFirewall.DeleteDNATRule(rulePair.Rule); err != nil {
-			mErr = multierror.Append(mErr, fmt.Errorf("failed to delete forward rule '%s': %v", rulePair.ForwardRule.String(), err))
-		}
-		log.Infof("forward rule has been deleted '%s'", rulePair.ForwardRule)
-		delete(h.rules, id)
-	}
-
-	return nberrors.FormatErrorOrNil(mErr)
-}
-
-func (h *Manager) Close() error {
-	h.rulesMu.Lock()
-	defer h.rulesMu.Unlock()
-
-	log.Infof("clean up all (%d) forward rules", len(h.rules))
-	var mErr *multierror.Error
-	for _, rule := range h.rules {
-		if err := h.dnatFirewall.DeleteDNATRule(rule.Rule); err != nil {
-			mErr = multierror.Append(mErr, fmt.Errorf("failed to delete forward rule '%s': %v", rule, err))
-		}
-	}
-
-	h.rules = make(map[firewall.RuleID]RulePair)
-	return nberrors.FormatErrorOrNil(mErr)
-}
-
-func (h *Manager) Rules() []firewall.ForwardRule {
-	h.rulesMu.Lock()
-	defer h.rulesMu.Unlock()
-
-	rules := make([]firewall.ForwardRule, 0, len(h.rules))
-	for _, rulePair := range h.rules {
-		rules = append(rules, rulePair.ForwardRule)
-	}
-
-	return rules
-}
diff --git a/client/internal/ingressgw/manager_test.go b/client/internal/ingressgw/manager_test.go
deleted file mode 100644
index 0cd40fcc4..000000000
--- a/client/internal/ingressgw/manager_test.go
+++ /dev/null
@@ -1,281 +0,0 @@
-package ingressgw
-
-import (
-	"fmt"
-	"net/netip"
-	"testing"
-
-	firewall "github.com/netbirdio/netbird/client/firewall/manager"
-)
-
-var (
-	_ firewall.Rule = (*MocFwRule)(nil)
-	_ DNATFirewall  = &MockDNATFirewall{}
-)
-
-type MocFwRule struct {
-	id firewall.RuleID
-}
-
-func (m *MocFwRule) ID() firewall.RuleID {
-	return m.id
-}
-
-type MockDNATFirewall struct {
-	throwError bool
-}
-
-func (m *MockDNATFirewall) AddDNATRule(fwdRule firewall.ForwardRule) (firewall.Rule, error) {
-	if m.throwError {
-		return nil, fmt.Errorf("moc error")
-	}
-
-	fwRule := &MocFwRule{
-		id: fwdRule.ID(),
-	}
-	return fwRule, nil
-}
-
-func (m *MockDNATFirewall) DeleteDNATRule(rule firewall.Rule) error {
-	if m.throwError {
-		return fmt.Errorf("moc error")
-	}
-	return nil
-}
-
-func (m *MockDNATFirewall) forceToThrowErrors() {
-	m.throwError = true
-}
-
-func TestManager_AddRule(t *testing.T) {
-	fw := &MockDNATFirewall{}
-	mgr := NewManager(fw)
-
-	port, _ := firewall.NewPort(8080)
-
-	updates := []firewall.ForwardRule{
-		{
-			Protocol:          firewall.ProtocolTCP,
-			DestinationPort:   *port,
-			TranslatedAddress: netip.MustParseAddr("172.16.254.1"),
-			TranslatedPort:    *port,
-		},
-		{
-			Protocol:          firewall.ProtocolUDP,
-			DestinationPort:   *port,
-			TranslatedAddress: netip.MustParseAddr("172.16.254.1"),
-			TranslatedPort:    *port,
-		}}
-
-	if err := mgr.Update(updates); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	rules := mgr.Rules()
-	if len(rules) != len(updates) {
-		t.Errorf("unexpected rules count: %d", len(rules))
-	}
-}
-
-func TestManager_UpdateRule(t *testing.T) {
-	fw := &MockDNATFirewall{}
-	mgr := NewManager(fw)
-
-	port, _ := firewall.NewPort(8080)
-	ruleTCP := firewall.ForwardRule{
-		Protocol:          firewall.ProtocolTCP,
-		DestinationPort:   *port,
-		TranslatedAddress: netip.MustParseAddr("172.16.254.1"),
-		TranslatedPort:    *port,
-	}
-
-	if err := mgr.Update([]firewall.ForwardRule{ruleTCP}); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	ruleUDP := firewall.ForwardRule{
-		Protocol:          firewall.ProtocolUDP,
-		DestinationPort:   *port,
-		TranslatedAddress: netip.MustParseAddr("172.16.254.2"),
-		TranslatedPort:    *port,
-	}
-
-	if err := mgr.Update([]firewall.ForwardRule{ruleUDP}); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	rules := mgr.Rules()
-	if len(rules) != 1 {
-		t.Errorf("unexpected rules count: %d", len(rules))
-	}
-
-	if rules[0].TranslatedAddress.String() != ruleUDP.TranslatedAddress.String() {
-		t.Errorf("unexpected rule: %v", rules[0])
-	}
-
-	if rules[0].TranslatedPort.String() != ruleUDP.TranslatedPort.String() {
-		t.Errorf("unexpected rule: %v", rules[0])
-	}
-
-	if rules[0].DestinationPort.String() != ruleUDP.DestinationPort.String() {
-		t.Errorf("unexpected rule: %v", rules[0])
-	}
-
-	if rules[0].Protocol != ruleUDP.Protocol {
-		t.Errorf("unexpected rule: %v", rules[0])
-	}
-}
-
-func TestManager_ExtendRules(t *testing.T) {
-	fw := &MockDNATFirewall{}
-	mgr := NewManager(fw)
-
-	port, _ := firewall.NewPort(8080)
-	ruleTCP := firewall.ForwardRule{
-		Protocol:          firewall.ProtocolTCP,
-		DestinationPort:   *port,
-		TranslatedAddress: netip.MustParseAddr("172.16.254.1"),
-		TranslatedPort:    *port,
-	}
-
-	ruleUDP := firewall.ForwardRule{
-		Protocol:          firewall.ProtocolUDP,
-		DestinationPort:   *port,
-		TranslatedAddress: netip.MustParseAddr("172.16.254.2"),
-		TranslatedPort:    *port,
-	}
-
-	if err := mgr.Update([]firewall.ForwardRule{ruleTCP}); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	if err := mgr.Update([]firewall.ForwardRule{ruleTCP, ruleUDP}); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	rules := mgr.Rules()
-	if len(rules) != 2 {
-		t.Errorf("unexpected rules count: %d", len(rules))
-	}
-}
-
-func TestManager_UnderlingError(t *testing.T) {
-	fw := &MockDNATFirewall{}
-	mgr := NewManager(fw)
-
-	port, _ := firewall.NewPort(8080)
-	ruleTCP := firewall.ForwardRule{
-		Protocol:          firewall.ProtocolTCP,
-		DestinationPort:   *port,
-		TranslatedAddress: netip.MustParseAddr("172.16.254.1"),
-		TranslatedPort:    *port,
-	}
-
-	ruleUDP := firewall.ForwardRule{
-		Protocol:          firewall.ProtocolUDP,
-		DestinationPort:   *port,
-		TranslatedAddress: netip.MustParseAddr("172.16.254.2"),
-		TranslatedPort:    *port,
-	}
-
-	if err := mgr.Update([]firewall.ForwardRule{ruleTCP}); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	fw.forceToThrowErrors()
-
-	if err := mgr.Update([]firewall.ForwardRule{ruleTCP, ruleUDP}); err == nil {
-		t.Errorf("expected error")
-	}
-
-	rules := mgr.Rules()
-	if len(rules) != 1 {
-		t.Errorf("unexpected rules count: %d", len(rules))
-	}
-}
-
-func TestManager_Cleanup(t *testing.T) {
-	fw := &MockDNATFirewall{}
-	mgr := NewManager(fw)
-
-	port, _ := firewall.NewPort(8080)
-	ruleTCP := firewall.ForwardRule{
-		Protocol:          firewall.ProtocolTCP,
-		DestinationPort:   *port,
-		TranslatedAddress: netip.MustParseAddr("172.16.254.1"),
-		TranslatedPort:    *port,
-	}
-
-	if err := mgr.Update([]firewall.ForwardRule{ruleTCP}); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	if err := mgr.Update([]firewall.ForwardRule{}); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	rules := mgr.Rules()
-	if len(rules) != 0 {
-		t.Errorf("unexpected rules count: %d", len(rules))
-	}
-}
-
-func TestManager_DeleteBrokenRule(t *testing.T) {
-	fw := &MockDNATFirewall{}
-
-	// force to throw errors when Add DNAT Rule
-	fw.forceToThrowErrors()
-	mgr := NewManager(fw)
-
-	port, _ := firewall.NewPort(8080)
-	ruleTCP := firewall.ForwardRule{
-		Protocol:          firewall.ProtocolTCP,
-		DestinationPort:   *port,
-		TranslatedAddress: netip.MustParseAddr("172.16.254.1"),
-		TranslatedPort:    *port,
-	}
-
-	if err := mgr.Update([]firewall.ForwardRule{ruleTCP}); err == nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	rules := mgr.Rules()
-	if len(rules) != 0 {
-		t.Errorf("unexpected rules count: %d", len(rules))
-	}
-
-	// simulate that to remove a broken rule
-	if err := mgr.Update([]firewall.ForwardRule{}); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	if err := mgr.Close(); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-}
-
-func TestManager_Close(t *testing.T) {
-	fw := &MockDNATFirewall{}
-	mgr := NewManager(fw)
-
-	port, _ := firewall.NewPort(8080)
-	ruleTCP := firewall.ForwardRule{
-		Protocol:          firewall.ProtocolTCP,
-		DestinationPort:   *port,
-		TranslatedAddress: netip.MustParseAddr("172.16.254.1"),
-		TranslatedPort:    *port,
-	}
-
-	if err := mgr.Update([]firewall.ForwardRule{ruleTCP}); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	if err := mgr.Close(); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	rules := mgr.Rules()
-	if len(rules) != 0 {
-		t.Errorf("unexpected rules count: %d", len(rules))
-	}
-}
diff --git a/client/internal/message_convert.go b/client/internal/message_convert.go
deleted file mode 100644
index 60f19e228..000000000
--- a/client/internal/message_convert.go
+++ /dev/null
@@ -1,43 +0,0 @@
-package internal
-
-import (
-	"errors"
-	"fmt"
-	"net"
-	"net/netip"
-
-	firewallManager "github.com/netbirdio/netbird/client/firewall/manager"
-	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
-)
-
-func convertPortInfo(portInfo *mgmProto.PortInfo) (*firewallManager.Port, error) {
-	if portInfo == nil {
-		return nil, errors.New("portInfo cannot be nil")
-	}
-
-	if portInfo.GetPort() != 0 {
-		return firewallManager.NewPort(int(portInfo.GetPort()))
-	}
-
-	if portInfo.GetRange() != nil {
-		return firewallManager.NewPort(int(portInfo.GetRange().Start), int(portInfo.GetRange().End))
-	}
-
-	return nil, fmt.Errorf("invalid portInfo: %v", portInfo)
-}
-
-func convertToIP(rawIP []byte) (netip.Addr, error) {
-	if rawIP == nil {
-		return netip.Addr{}, errors.New("input bytes cannot be nil")
-	}
-
-	if len(rawIP) != net.IPv4len && len(rawIP) != net.IPv6len {
-		return netip.Addr{}, fmt.Errorf("invalid IP length: %d", len(rawIP))
-	}
-
-	if len(rawIP) == net.IPv4len {
-		return netip.AddrFrom4([4]byte(rawIP)), nil
-	}
-
-	return netip.AddrFrom16([16]byte(rawIP)), nil
-}
diff --git a/client/internal/peer/status.go b/client/internal/peer/status.go
index 826bf6fe0..6c44178e1 100644
--- a/client/internal/peer/status.go
+++ b/client/internal/peer/status.go
@@ -18,9 +18,7 @@ import (
 	"google.golang.org/protobuf/types/known/durationpb"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
-	firewall "github.com/netbirdio/netbird/client/firewall/manager"
 	"github.com/netbirdio/netbird/client/iface/configurer"
-	"github.com/netbirdio/netbird/client/internal/ingressgw"
 	"github.com/netbirdio/netbird/client/internal/relay"
 	"github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/route"
@@ -161,7 +159,6 @@ type FullStatus struct {
 	RosenpassState        RosenpassState
 	Relays                []relay.ProbeResult
 	NSGroupStates         []NSGroupState
-	NumOfForwardingRules  int
 	LazyConnectionEnabled bool
 	Events                []*proto.SystemEvent
 }
@@ -247,8 +244,6 @@ type Status struct {
 	// read it without taking mux.
 	networksRevision atomic.Uint64
 
-	ingressGwMgr *ingressgw.Manager
-
 	routeIDLookup routeIDLookup
 	wgIface       WGIfaceStatus
 }
@@ -276,12 +271,6 @@ func (d *Status) SetRelayMgr(manager *relayClient.Manager) {
 	d.relayMgr = manager
 }
 
-func (d *Status) SetIngressGwMgr(ingressGwMgr *ingressgw.Manager) {
-	d.mux.Lock()
-	defer d.mux.Unlock()
-	d.ingressGwMgr = ingressGwMgr
-}
-
 // ReplaceOfflinePeers replaces
 func (d *Status) ReplaceOfflinePeers(replacement []State) {
 	d.mux.Lock()
@@ -332,18 +321,6 @@ func (d *Status) GetPeer(peerPubKey string) (State, error) {
 	return state, nil
 }
 
-func (d *Status) PeerByIP(ip string) (string, bool) {
-	d.mux.RLock()
-	defer d.mux.RUnlock()
-
-	for _, state := range d.peers {
-		if state.IP == ip {
-			return state.FQDN, true
-		}
-	}
-	return "", false
-}
-
 // PeerStateByIP returns the full peer State for the given tunnel IP.
 // Matches against either the IPv4 (State.IP) or IPv6 (State.IPv6) tunnel
 // address so dual-stack peers are reachable on either family. Only
@@ -1163,16 +1140,6 @@ func (d *Status) GetRelayStates() []relay.ProbeResult {
 	return relayStates
 }
 
-func (d *Status) ForwardingRules() []firewall.ForwardRule {
-	d.mux.RLock()
-	defer d.mux.RUnlock()
-	if d.ingressGwMgr == nil {
-		return nil
-	}
-
-	return d.ingressGwMgr.Rules()
-}
-
 func (d *Status) GetDNSStates() []NSGroupState {
 	d.mux.RLock()
 	defer d.mux.RUnlock()
@@ -1207,7 +1174,6 @@ func (d *Status) GetFullStatus() FullStatus {
 		Relays:                d.GetRelayStates(),
 		RosenpassState:        d.GetRosenpassState(),
 		NSGroupStates:         d.GetDNSStates(),
-		NumOfForwardingRules:  len(d.ForwardingRules()),
 		LazyConnectionEnabled: d.GetLazyConnection(),
 	}
 
@@ -1579,7 +1545,6 @@ func (fs FullStatus) ToProto() *proto.FullStatus {
 	pbFullStatus.LocalPeerState.WgPort = int32(fs.LocalPeerState.WgPort)
 	pbFullStatus.LocalPeerState.RosenpassPermissive = fs.RosenpassState.Permissive
 	pbFullStatus.LocalPeerState.RosenpassEnabled = fs.RosenpassState.Enabled
-	pbFullStatus.NumberOfForwardingRules = int32(fs.NumOfForwardingRules)
 	pbFullStatus.LazyConnectionEnabled = fs.LazyConnectionEnabled
 
 	pbFullStatus.LocalPeerState.Networks = maps.Keys(fs.LocalPeerState.Routes)
diff --git a/client/internal/routemanager/ipfwdstate/ipfwdstate.go b/client/internal/routemanager/ipfwdstate/ipfwdstate.go
index 3d571e16b..22f7bd07a 100644
--- a/client/internal/routemanager/ipfwdstate/ipfwdstate.go
+++ b/client/internal/routemanager/ipfwdstate/ipfwdstate.go
@@ -19,8 +19,7 @@ type IPForwardingState struct {
 
 	// routingV4/routingV6 track whether the routing path currently holds a
 	// reference, so repeated EnableRouting calls (one per network-map update)
-	// hold at most one reference per family and an unpaired DisableRouting
-	// can't release references held by DNAT rules.
+	// hold at most one reference per family.
 	routingV4 bool
 	routingV6 bool
 
@@ -95,31 +94,6 @@ func (f *IPForwardingState) ReleaseRouting() error {
 	return nil
 }
 
-// RequestForwarding enables the family's forwarding sysctl on first request.
-func (f *IPForwardingState) RequestForwarding(v6 bool) error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-
-	if v6 {
-		return f.requestV6()
-	}
-	return f.requestV4()
-}
-
-// ReleaseForwarding decrements the family counter. The last v6 release restores
-// what enable captured. v4 stays on: net.ipv4.ip_forward is co-owned by other
-// tooling (docker, k8s, libvirt).
-func (f *IPForwardingState) ReleaseForwarding(v6 bool) error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-
-	if v6 {
-		return f.releaseV6()
-	}
-	f.releaseV4()
-	return nil
-}
-
 func (f *IPForwardingState) requestV4() error {
 	if f.v4Count == 0 {
 		if err := systemops.EnableV4IPForwarding(); err != nil {
diff --git a/client/internal/routemanager/ipfwdstate/ipfwdstate_privileged_linux_test.go b/client/internal/routemanager/ipfwdstate/ipfwdstate_privileged_linux_test.go
index b4615ff02..75209965c 100644
--- a/client/internal/routemanager/ipfwdstate/ipfwdstate_privileged_linux_test.go
+++ b/client/internal/routemanager/ipfwdstate/ipfwdstate_privileged_linux_test.go
@@ -10,8 +10,7 @@ import (
 )
 
 // TestRequestRoutingV6ToV4Transition verifies that a v4-only routing request
-// releases a previously held routing-owned v6 reference without touching
-// references held by DNAT rules.
+// releases a previously held routing-owned v6 reference.
 func TestRequestRoutingV6ToV4Transition(t *testing.T) {
 	f := NewIPForwardingState("wt-fwd-test")
 
@@ -25,13 +24,6 @@ func TestRequestRoutingV6ToV4Transition(t *testing.T) {
 	assert.Equal(t, 1, v4, "v4 reference kept")
 	assert.Equal(t, 0, v6, "routing-owned v6 reference released")
 
-	// A DNAT-held reference survives a v4-only routing request.
-	require.NoError(t, f.RequestForwarding(true), "dnat v6 reference")
-	require.NoError(t, f.RequestRouting(false), "repeat v4-only request")
-	_, v6 = f.Counts()
-	assert.Equal(t, 1, v6, "dnat-held v6 reference survives")
-	require.NoError(t, f.ReleaseForwarding(true), "release dnat v6 reference")
-
 	require.NoError(t, f.ReleaseRouting(), "release routing")
 	v4, v6 = f.Counts()
 	assert.Equal(t, 0, v4, "all v4 references released")
diff --git a/client/proto/daemon.pb.go b/client/proto/daemon.pb.go
index 7f3ce1bbf..ec0cd6258 100644
--- a/client/proto/daemon.pb.go
+++ b/client/proto/daemon.pb.go
@@ -2176,17 +2176,20 @@ func (x *SSHServerState) GetSessions() []*SSHSessionInfo {
 
 // FullStatus contains the full state held by the Status instance
 type FullStatus struct {
-	state                   protoimpl.MessageState `protogen:"open.v1"`
-	ManagementState         *ManagementState       `protobuf:"bytes,1,opt,name=managementState,proto3" json:"managementState,omitempty"`
-	SignalState             *SignalState           `protobuf:"bytes,2,opt,name=signalState,proto3" json:"signalState,omitempty"`
-	LocalPeerState          *LocalPeerState        `protobuf:"bytes,3,opt,name=localPeerState,proto3" json:"localPeerState,omitempty"`
-	Peers                   []*PeerState           `protobuf:"bytes,4,rep,name=peers,proto3" json:"peers,omitempty"`
-	Relays                  []*RelayState          `protobuf:"bytes,5,rep,name=relays,proto3" json:"relays,omitempty"`
-	DnsServers              []*NSGroupState        `protobuf:"bytes,6,rep,name=dns_servers,json=dnsServers,proto3" json:"dns_servers,omitempty"`
-	NumberOfForwardingRules int32                  `protobuf:"varint,8,opt,name=NumberOfForwardingRules,proto3" json:"NumberOfForwardingRules,omitempty"`
-	Events                  []*SystemEvent         `protobuf:"bytes,7,rep,name=events,proto3" json:"events,omitempty"`
-	LazyConnectionEnabled   bool                   `protobuf:"varint,9,opt,name=lazyConnectionEnabled,proto3" json:"lazyConnectionEnabled,omitempty"`
-	SshServerState          *SSHServerState        `protobuf:"bytes,10,opt,name=sshServerState,proto3" json:"sshServerState,omitempty"`
+	state           protoimpl.MessageState `protogen:"open.v1"`
+	ManagementState *ManagementState       `protobuf:"bytes,1,opt,name=managementState,proto3" json:"managementState,omitempty"`
+	SignalState     *SignalState           `protobuf:"bytes,2,opt,name=signalState,proto3" json:"signalState,omitempty"`
+	LocalPeerState  *LocalPeerState        `protobuf:"bytes,3,opt,name=localPeerState,proto3" json:"localPeerState,omitempty"`
+	Peers           []*PeerState           `protobuf:"bytes,4,rep,name=peers,proto3" json:"peers,omitempty"`
+	Relays          []*RelayState          `protobuf:"bytes,5,rep,name=relays,proto3" json:"relays,omitempty"`
+	DnsServers      []*NSGroupState        `protobuf:"bytes,6,rep,name=dns_servers,json=dnsServers,proto3" json:"dns_servers,omitempty"`
+	// Unused; the ingress port-forwarding feature was discontinued.
+	//
+	// Deprecated: Marked as deprecated in daemon.proto.
+	NumberOfForwardingRules int32           `protobuf:"varint,8,opt,name=NumberOfForwardingRules,proto3" json:"NumberOfForwardingRules,omitempty"`
+	Events                  []*SystemEvent  `protobuf:"bytes,7,rep,name=events,proto3" json:"events,omitempty"`
+	LazyConnectionEnabled   bool            `protobuf:"varint,9,opt,name=lazyConnectionEnabled,proto3" json:"lazyConnectionEnabled,omitempty"`
+	SshServerState          *SSHServerState `protobuf:"bytes,10,opt,name=sshServerState,proto3" json:"sshServerState,omitempty"`
 	// networksRevision bumps whenever the set of routed networks (route and
 	// exit-node candidates) or their selected state changes. The UI fingerprints
 	// on it to know when to re-fetch ListNetworks via the push stream, instead
@@ -2268,6 +2271,7 @@ func (x *FullStatus) GetDnsServers() []*NSGroupState {
 	return nil
 }
 
+// Deprecated: Marked as deprecated in daemon.proto.
 func (x *FullStatus) GetNumberOfForwardingRules() int32 {
 	if x != nil {
 		return x.NumberOfForwardingRules
@@ -2600,7 +2604,10 @@ func (x *Network) GetResolvedIPs() map[string]*IPList {
 	return nil
 }
 
-// ForwardingRules
+// PortInfo, ForwardingRule and ForwardingRulesResponse are unused; the ingress
+// port-forwarding feature was discontinued.
+//
+// Deprecated: Marked as deprecated in daemon.proto.
 type PortInfo struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// Types that are valid to be assigned to PortSelection:
@@ -2683,6 +2690,7 @@ func (*PortInfo_Port) isPortInfo_PortSelection() {}
 
 func (*PortInfo_Range_) isPortInfo_PortSelection() {}
 
+// Deprecated: Marked as deprecated in daemon.proto.
 type ForwardingRule struct {
 	state              protoimpl.MessageState `protogen:"open.v1"`
 	Protocol           string                 `protobuf:"bytes,1,opt,name=protocol,proto3" json:"protocol,omitempty"`
@@ -2759,6 +2767,7 @@ func (x *ForwardingRule) GetTranslatedPort() *PortInfo {
 	return nil
 }
 
+// Deprecated: Marked as deprecated in daemon.proto.
 type ForwardingRulesResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Rules         []*ForwardingRule      `protobuf:"bytes,1,rep,name=rules,proto3" json:"rules,omitempty"`
@@ -7303,7 +7312,7 @@ const file_daemon_proto_rawDesc = "" +
 	"\fportForwards\x18\x05 \x03(\tR\fportForwards\"^\n" +
 	"\x0eSSHServerState\x12\x18\n" +
 	"\aenabled\x18\x01 \x01(\bR\aenabled\x122\n" +
-	"\bsessions\x18\x02 \x03(\v2\x16.daemon.SSHSessionInfoR\bsessions\"\xdb\x04\n" +
+	"\bsessions\x18\x02 \x03(\v2\x16.daemon.SSHSessionInfoR\bsessions\"\xdf\x04\n" +
 	"\n" +
 	"FullStatus\x12A\n" +
 	"\x0fmanagementState\x18\x01 \x01(\v2\x17.daemon.ManagementStateR\x0fmanagementState\x125\n" +
@@ -7312,8 +7321,8 @@ const file_daemon_proto_rawDesc = "" +
 	"\x05peers\x18\x04 \x03(\v2\x11.daemon.PeerStateR\x05peers\x12*\n" +
 	"\x06relays\x18\x05 \x03(\v2\x12.daemon.RelayStateR\x06relays\x125\n" +
 	"\vdns_servers\x18\x06 \x03(\v2\x14.daemon.NSGroupStateR\n" +
-	"dnsServers\x128\n" +
-	"\x17NumberOfForwardingRules\x18\b \x01(\x05R\x17NumberOfForwardingRules\x12+\n" +
+	"dnsServers\x12<\n" +
+	"\x17NumberOfForwardingRules\x18\b \x01(\x05B\x02\x18\x01R\x17NumberOfForwardingRules\x12+\n" +
 	"\x06events\x18\a \x03(\v2\x13.daemon.SystemEventR\x06events\x124\n" +
 	"\x15lazyConnectionEnabled\x18\t \x01(\bR\x15lazyConnectionEnabled\x12>\n" +
 	"\x0esshServerState\x18\n" +
@@ -7339,22 +7348,22 @@ const file_daemon_proto_rawDesc = "" +
 	"\vresolvedIPs\x18\x05 \x03(\v2 .daemon.Network.ResolvedIPsEntryR\vresolvedIPs\x1aN\n" +
 	"\x10ResolvedIPsEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12$\n" +
-	"\x05value\x18\x02 \x01(\v2\x0e.daemon.IPListR\x05value:\x028\x01\"\x92\x01\n" +
+	"\x05value\x18\x02 \x01(\v2\x0e.daemon.IPListR\x05value:\x028\x01\"\x96\x01\n" +
 	"\bPortInfo\x12\x14\n" +
 	"\x04port\x18\x01 \x01(\rH\x00R\x04port\x12.\n" +
 	"\x05range\x18\x02 \x01(\v2\x16.daemon.PortInfo.RangeH\x00R\x05range\x1a/\n" +
 	"\x05Range\x12\x14\n" +
 	"\x05start\x18\x01 \x01(\rR\x05start\x12\x10\n" +
-	"\x03end\x18\x02 \x01(\rR\x03endB\x0f\n" +
-	"\rportSelection\"\x80\x02\n" +
+	"\x03end\x18\x02 \x01(\rR\x03end:\x02\x18\x01B\x0f\n" +
+	"\rportSelection\"\x84\x02\n" +
 	"\x0eForwardingRule\x12\x1a\n" +
 	"\bprotocol\x18\x01 \x01(\tR\bprotocol\x12:\n" +
 	"\x0fdestinationPort\x18\x02 \x01(\v2\x10.daemon.PortInfoR\x0fdestinationPort\x12,\n" +
 	"\x11translatedAddress\x18\x03 \x01(\tR\x11translatedAddress\x12.\n" +
 	"\x12translatedHostname\x18\x04 \x01(\tR\x12translatedHostname\x128\n" +
-	"\x0etranslatedPort\x18\x05 \x01(\v2\x10.daemon.PortInfoR\x0etranslatedPort\"G\n" +
+	"\x0etranslatedPort\x18\x05 \x01(\v2\x10.daemon.PortInfoR\x0etranslatedPort:\x02\x18\x01\"K\n" +
 	"\x17ForwardingRulesResponse\x12,\n" +
-	"\x05rules\x18\x01 \x03(\v2\x16.daemon.ForwardingRuleR\x05rules\"\x84\x02\n" +
+	"\x05rules\x18\x01 \x03(\v2\x16.daemon.ForwardingRuleR\x05rules:\x02\x18\x01\"\x84\x02\n" +
 	"\x12DebugBundleRequest\x12\x1c\n" +
 	"\tanonymize\x18\x01 \x01(\bR\tanonymize\x12\x1e\n" +
 	"\n" +
@@ -7705,7 +7714,7 @@ const file_daemon_proto_rawDesc = "" +
 	"\n" +
 	"EXPOSE_UDP\x10\x03\x12\x0e\n" +
 	"\n" +
-	"EXPOSE_TLS\x10\x042\xa3\x1c\n" +
+	"EXPOSE_TLS\x10\x042\xa6\x1c\n" +
 	"\rDaemonService\x126\n" +
 	"\x05Login\x12\x14.daemon.LoginRequest\x1a\x15.daemon.LoginResponse\"\x00\x12K\n" +
 	"\fWaitSSOLogin\x12\x1b.daemon.WaitSSOLoginRequest\x1a\x1c.daemon.WaitSSOLoginResponse\"\x00\x12-\n" +
@@ -7716,8 +7725,8 @@ const file_daemon_proto_rawDesc = "" +
 	"\tGetConfig\x12\x18.daemon.GetConfigRequest\x1a\x19.daemon.GetConfigResponse\"\x00\x12K\n" +
 	"\fListNetworks\x12\x1b.daemon.ListNetworksRequest\x1a\x1c.daemon.ListNetworksResponse\"\x00\x12Q\n" +
 	"\x0eSelectNetworks\x12\x1d.daemon.SelectNetworksRequest\x1a\x1e.daemon.SelectNetworksResponse\"\x00\x12S\n" +
-	"\x10DeselectNetworks\x12\x1d.daemon.SelectNetworksRequest\x1a\x1e.daemon.SelectNetworksResponse\"\x00\x12J\n" +
-	"\x0fForwardingRules\x12\x14.daemon.EmptyRequest\x1a\x1f.daemon.ForwardingRulesResponse\"\x00\x12H\n" +
+	"\x10DeselectNetworks\x12\x1d.daemon.SelectNetworksRequest\x1a\x1e.daemon.SelectNetworksResponse\"\x00\x12M\n" +
+	"\x0fForwardingRules\x12\x14.daemon.EmptyRequest\x1a\x1f.daemon.ForwardingRulesResponse\"\x03\x88\x02\x01\x12H\n" +
 	"\vDebugBundle\x12\x1a.daemon.DebugBundleRequest\x1a\x1b.daemon.DebugBundleResponse\"\x00\x12H\n" +
 	"\vGetLogLevel\x12\x1a.daemon.GetLogLevelRequest\x1a\x1b.daemon.GetLogLevelResponse\"\x00\x12H\n" +
 	"\vSetLogLevel\x12\x1a.daemon.SetLogLevelRequest\x1a\x1b.daemon.SetLogLevelResponse\"\x00\x12E\n" +
diff --git a/client/proto/daemon.proto b/client/proto/daemon.proto
index 3953f9c15..39a8ea7c6 100644
--- a/client/proto/daemon.proto
+++ b/client/proto/daemon.proto
@@ -45,7 +45,10 @@ service DaemonService {
   // Deselect specific routes
   rpc DeselectNetworks(SelectNetworksRequest) returns (SelectNetworksResponse) {}
 
-  rpc ForwardingRules(EmptyRequest) returns (ForwardingRulesResponse) {}
+  // Unused; the ingress port-forwarding feature was discontinued.
+  rpc ForwardingRules(EmptyRequest) returns (ForwardingRulesResponse) {
+    option deprecated = true;
+  }
 
   // DebugBundle creates a debug bundle
   rpc DebugBundle(DebugBundleRequest) returns (DebugBundleResponse) {}
@@ -468,7 +471,8 @@ message FullStatus {
   repeated PeerState peers = 4;
   repeated RelayState relays = 5;
   repeated NSGroupState dns_servers = 6;
-  int32 NumberOfForwardingRules = 8;
+  // Unused; the ingress port-forwarding feature was discontinued.
+  int32 NumberOfForwardingRules = 8 [deprecated = true];
 
   repeated SystemEvent events = 7;
 
@@ -511,8 +515,11 @@ message Network {
   map<string, IPList> resolvedIPs = 5;
 }
 
-// ForwardingRules
+// PortInfo, ForwardingRule and ForwardingRulesResponse are unused; the ingress
+// port-forwarding feature was discontinued.
 message PortInfo {
+  option deprecated = true;
+
   oneof portSelection {
     uint32 port = 1;
     Range range = 2;
@@ -525,6 +532,8 @@ message PortInfo {
 }
 
 message ForwardingRule {
+  option deprecated = true;
+
   string protocol = 1;
   PortInfo destinationPort = 2;
   string translatedAddress = 3;
@@ -533,10 +542,11 @@ message ForwardingRule {
 }
 
 message ForwardingRulesResponse {
+  option deprecated = true;
+
   repeated ForwardingRule rules = 1;
 }
 
-
 // DebugBundler
 message DebugBundleRequest {
   bool anonymize = 1;
diff --git a/client/proto/daemon_grpc.pb.go b/client/proto/daemon_grpc.pb.go
index 2d01d474d..c9b291e14 100644
--- a/client/proto/daemon_grpc.pb.go
+++ b/client/proto/daemon_grpc.pb.go
@@ -95,6 +95,8 @@ type DaemonServiceClient interface {
 	SelectNetworks(ctx context.Context, in *SelectNetworksRequest, opts ...grpc.CallOption) (*SelectNetworksResponse, error)
 	// Deselect specific routes
 	DeselectNetworks(ctx context.Context, in *SelectNetworksRequest, opts ...grpc.CallOption) (*SelectNetworksResponse, error)
+	// Deprecated: Do not use.
+	// Unused; the ingress port-forwarding feature was discontinued.
 	ForwardingRules(ctx context.Context, in *EmptyRequest, opts ...grpc.CallOption) (*ForwardingRulesResponse, error)
 	// DebugBundle creates a debug bundle
 	DebugBundle(ctx context.Context, in *DebugBundleRequest, opts ...grpc.CallOption) (*DebugBundleResponse, error)
@@ -290,6 +292,7 @@ func (c *daemonServiceClient) DeselectNetworks(ctx context.Context, in *SelectNe
 	return out, nil
 }
 
+// Deprecated: Do not use.
 func (c *daemonServiceClient) ForwardingRules(ctx context.Context, in *EmptyRequest, opts ...grpc.CallOption) (*ForwardingRulesResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ForwardingRulesResponse)
@@ -705,6 +708,8 @@ type DaemonServiceServer interface {
 	SelectNetworks(context.Context, *SelectNetworksRequest) (*SelectNetworksResponse, error)
 	// Deselect specific routes
 	DeselectNetworks(context.Context, *SelectNetworksRequest) (*SelectNetworksResponse, error)
+	// Deprecated: Do not use.
+	// Unused; the ingress port-forwarding feature was discontinued.
 	ForwardingRules(context.Context, *EmptyRequest) (*ForwardingRulesResponse, error)
 	// DebugBundle creates a debug bundle
 	DebugBundle(context.Context, *DebugBundleRequest) (*DebugBundleResponse, error)
diff --git a/client/server/forwardingrules.go b/client/server/forwardingrules.go
deleted file mode 100644
index 3d706c36d..000000000
--- a/client/server/forwardingrules.go
+++ /dev/null
@@ -1,54 +0,0 @@
-package server
-
-import (
-	"context"
-
-	firewall "github.com/netbirdio/netbird/client/firewall/manager"
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-func (s *Server) ForwardingRules(context.Context, *proto.EmptyRequest) (*proto.ForwardingRulesResponse, error) {
-	s.mutex.Lock()
-	defer s.mutex.Unlock()
-
-	rules := s.statusRecorder.ForwardingRules()
-	responseRules := make([]*proto.ForwardingRule, 0, len(rules))
-	for _, rule := range rules {
-		respRule := &proto.ForwardingRule{
-			Protocol:           string(rule.Protocol),
-			DestinationPort:    portToProto(rule.DestinationPort),
-			TranslatedAddress:  rule.TranslatedAddress.String(),
-			TranslatedHostname: s.hostNameByTranslateAddress(rule.TranslatedAddress.String()),
-			TranslatedPort:     portToProto(rule.TranslatedPort),
-		}
-		responseRules = append(responseRules, respRule)
-
-	}
-
-	return &proto.ForwardingRulesResponse{Rules: responseRules}, nil
-}
-
-func (s *Server) hostNameByTranslateAddress(ip string) string {
-	hostName, ok := s.statusRecorder.PeerByIP(ip)
-	if !ok {
-		return ip
-	}
-
-	return hostName
-}
-
-func portToProto(port firewall.Port) *proto.PortInfo {
-	var portInfo proto.PortInfo
-
-	if !port.IsRange {
-		portInfo.PortSelection = &proto.PortInfo_Port{Port: uint32(port.Values[0])}
-	} else {
-		portInfo.PortSelection = &proto.PortInfo_Range_{
-			Range: &proto.PortInfo_Range{
-				Start: uint32(port.Values[0]),
-				End:   uint32(port.Values[1]),
-			},
-		}
-	}
-	return &portInfo
-}
diff --git a/client/server/server_privileged_test.go b/client/server/server_privileged_test.go
index aa6e99026..bea2e8568 100644
--- a/client/server/server_privileged_test.go
+++ b/client/server/server_privileged_test.go
@@ -10,9 +10,9 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
 	"github.com/stretchr/testify/require"
 	"go.opentelemetry.io/otel"
+	"go.uber.org/mock/gomock"
 
 	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator/validator"
 
@@ -36,7 +36,6 @@ import (
 	"github.com/netbirdio/netbird/management/server"
 	"github.com/netbirdio/netbird/management/server/activity"
 	nbcache "github.com/netbirdio/netbird/management/server/cache"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
 	"github.com/netbirdio/netbird/management/server/store"
@@ -200,8 +199,8 @@ func startManagement(t *testing.T, signalAddr string, counter *int) (*grpc.Serve
 
 	requestBuffer := server.NewAccountRequestBuffer(context.Background(), store)
 	peersUpdateManager := update_channel.NewPeersUpdateManager(metrics)
-	networkMapController := controller.NewController(context.Background(), store, metrics, peersUpdateManager, requestBuffer, server.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), manager.NewEphemeralManager(store, peersManager), config, nil)
-	accountManager, err := server.BuildManager(context.Background(), config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, ia, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManagerMock, false, cacheStore)
+	networkMapController := controller.NewController(context.Background(), store, metrics, peersUpdateManager, requestBuffer, server.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", manager.NewEphemeralManager(store, peersManager), config, nil)
+	accountManager, err := server.BuildManager(context.Background(), config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, ia, metrics, settingsMockManager, permissionsManagerMock, false, cacheStore)
 	if err != nil {
 		return nil, "", err
 	}
diff --git a/client/status/status.go b/client/status/status.go
index 1c204cdb1..e0585b8f0 100644
--- a/client/status/status.go
+++ b/client/status/status.go
@@ -140,28 +140,27 @@ type SSHServerStateOutput struct {
 }
 
 type OutputOverview struct {
-	Peers                   PeersStateOutput           `json:"peers" yaml:"peers"`
-	CliVersion              string                     `json:"cliVersion" yaml:"cliVersion"`
-	DaemonVersion           string                     `json:"daemonVersion" yaml:"daemonVersion"`
-	DaemonStatus            DaemonStatus               `json:"daemonStatus" yaml:"daemonStatus"`
-	ManagementState         ManagementStateOutput      `json:"management" yaml:"management"`
-	SignalState             SignalStateOutput          `json:"signal" yaml:"signal"`
-	Relays                  RelayStateOutput           `json:"relays" yaml:"relays"`
-	IP                      string                     `json:"netbirdIp" yaml:"netbirdIp"`
-	IPv6                    string                     `json:"netbirdIpv6,omitempty" yaml:"netbirdIpv6,omitempty"`
-	PubKey                  string                     `json:"publicKey" yaml:"publicKey"`
-	KernelInterface         bool                       `json:"usesKernelInterface" yaml:"usesKernelInterface"`
-	WgPort                  int                        `json:"wireguardPort" yaml:"wireguardPort"`
-	FQDN                    string                     `json:"fqdn" yaml:"fqdn"`
-	RosenpassEnabled        bool                       `json:"quantumResistance" yaml:"quantumResistance"`
-	RosenpassPermissive     bool                       `json:"quantumResistancePermissive" yaml:"quantumResistancePermissive"`
-	Networks                []string                   `json:"networks" yaml:"networks"`
-	NumberOfForwardingRules int                        `json:"forwardingRules" yaml:"forwardingRules"`
-	NSServerGroups          []NsServerGroupStateOutput `json:"dnsServers" yaml:"dnsServers"`
-	Events                  []SystemEventOutput        `json:"events" yaml:"events"`
-	LazyConnectionEnabled   bool                       `json:"lazyConnectionEnabled" yaml:"lazyConnectionEnabled"`
-	ProfileName             string                     `json:"profileName" yaml:"profileName"`
-	SSHServerState          SSHServerStateOutput       `json:"sshServer" yaml:"sshServer"`
+	Peers                 PeersStateOutput           `json:"peers" yaml:"peers"`
+	CliVersion            string                     `json:"cliVersion" yaml:"cliVersion"`
+	DaemonVersion         string                     `json:"daemonVersion" yaml:"daemonVersion"`
+	DaemonStatus          DaemonStatus               `json:"daemonStatus" yaml:"daemonStatus"`
+	ManagementState       ManagementStateOutput      `json:"management" yaml:"management"`
+	SignalState           SignalStateOutput          `json:"signal" yaml:"signal"`
+	Relays                RelayStateOutput           `json:"relays" yaml:"relays"`
+	IP                    string                     `json:"netbirdIp" yaml:"netbirdIp"`
+	IPv6                  string                     `json:"netbirdIpv6,omitempty" yaml:"netbirdIpv6,omitempty"`
+	PubKey                string                     `json:"publicKey" yaml:"publicKey"`
+	KernelInterface       bool                       `json:"usesKernelInterface" yaml:"usesKernelInterface"`
+	WgPort                int                        `json:"wireguardPort" yaml:"wireguardPort"`
+	FQDN                  string                     `json:"fqdn" yaml:"fqdn"`
+	RosenpassEnabled      bool                       `json:"quantumResistance" yaml:"quantumResistance"`
+	RosenpassPermissive   bool                       `json:"quantumResistancePermissive" yaml:"quantumResistancePermissive"`
+	Networks              []string                   `json:"networks" yaml:"networks"`
+	NSServerGroups        []NsServerGroupStateOutput `json:"dnsServers" yaml:"dnsServers"`
+	Events                []SystemEventOutput        `json:"events" yaml:"events"`
+	LazyConnectionEnabled bool                       `json:"lazyConnectionEnabled" yaml:"lazyConnectionEnabled"`
+	ProfileName           string                     `json:"profileName" yaml:"profileName"`
+	SSHServerState        SSHServerStateOutput       `json:"sshServer" yaml:"sshServer"`
 	// SessionExpiresAt is the absolute UTC instant at which the peer's SSO
 	// session expires. nil when the peer is not SSO-tracked or login
 	// expiration is disabled. Pointer (rather than zero-value time.Time) so
@@ -190,28 +189,27 @@ func ConvertToStatusOutputOverview(pbFullStatus *proto.FullStatus, opts ConvertO
 	peersOverview := mapPeers(pbFullStatus.GetPeers(), opts.StatusFilter, opts.PrefixNamesFilter, opts.PrefixNamesFilterMap, opts.IPsFilter, opts.ConnectionTypeFilter)
 
 	overview := OutputOverview{
-		Peers:                   peersOverview,
-		CliVersion:              version.NetbirdVersion(),
-		DaemonVersion:           opts.DaemonVersion,
-		DaemonStatus:            opts.DaemonStatus,
-		ManagementState:         managementOverview,
-		SignalState:             signalOverview,
-		Relays:                  relayOverview,
-		IP:                      pbFullStatus.GetLocalPeerState().GetIP(),
-		IPv6:                    pbFullStatus.GetLocalPeerState().GetIpv6(),
-		PubKey:                  pbFullStatus.GetLocalPeerState().GetPubKey(),
-		KernelInterface:         pbFullStatus.GetLocalPeerState().GetKernelInterface(),
-		WgPort:                  int(pbFullStatus.GetLocalPeerState().GetWgPort()),
-		FQDN:                    pbFullStatus.GetLocalPeerState().GetFqdn(),
-		RosenpassEnabled:        pbFullStatus.GetLocalPeerState().GetRosenpassEnabled(),
-		RosenpassPermissive:     pbFullStatus.GetLocalPeerState().GetRosenpassPermissive(),
-		Networks:                pbFullStatus.GetLocalPeerState().GetNetworks(),
-		NumberOfForwardingRules: int(pbFullStatus.GetNumberOfForwardingRules()),
-		NSServerGroups:          mapNSGroups(pbFullStatus.GetDnsServers()),
-		Events:                  mapEvents(pbFullStatus.GetEvents()),
-		LazyConnectionEnabled:   pbFullStatus.GetLazyConnectionEnabled(),
-		ProfileName:             opts.ProfileName,
-		SSHServerState:          sshServerOverview,
+		Peers:                 peersOverview,
+		CliVersion:            version.NetbirdVersion(),
+		DaemonVersion:         opts.DaemonVersion,
+		DaemonStatus:          opts.DaemonStatus,
+		ManagementState:       managementOverview,
+		SignalState:           signalOverview,
+		Relays:                relayOverview,
+		IP:                    pbFullStatus.GetLocalPeerState().GetIP(),
+		IPv6:                  pbFullStatus.GetLocalPeerState().GetIpv6(),
+		PubKey:                pbFullStatus.GetLocalPeerState().GetPubKey(),
+		KernelInterface:       pbFullStatus.GetLocalPeerState().GetKernelInterface(),
+		WgPort:                int(pbFullStatus.GetLocalPeerState().GetWgPort()),
+		FQDN:                  pbFullStatus.GetLocalPeerState().GetFqdn(),
+		RosenpassEnabled:      pbFullStatus.GetLocalPeerState().GetRosenpassEnabled(),
+		RosenpassPermissive:   pbFullStatus.GetLocalPeerState().GetRosenpassPermissive(),
+		Networks:              pbFullStatus.GetLocalPeerState().GetNetworks(),
+		NSServerGroups:        mapNSGroups(pbFullStatus.GetDnsServers()),
+		Events:                mapEvents(pbFullStatus.GetEvents()),
+		LazyConnectionEnabled: pbFullStatus.GetLazyConnectionEnabled(),
+		ProfileName:           opts.ProfileName,
+		SSHServerState:        sshServerOverview,
 	}
 	if !opts.SessionExpiresAt.IsZero() {
 		t := opts.SessionExpiresAt
@@ -573,11 +571,6 @@ func (o *OutputOverview) GeneralSummary(showURL bool, showRelays bool, showNameS
 		)
 	}
 
-	var forwardingRulesString string
-	if o.NumberOfForwardingRules > 0 {
-		forwardingRulesString = fmt.Sprintf("Forwarding rules: %d\n", o.NumberOfForwardingRules)
-	}
-
 	goos := runtime.GOOS
 	goarch := runtime.GOARCH
 	goarm := ""
@@ -619,7 +612,6 @@ func (o *OutputOverview) GeneralSummary(showURL bool, showRelays bool, showNameS
 			"SSH Server: %s\n"+
 			"Networks: %s\n"+
 			"%s"+
-			"%s"+
 			"Peers count: %s\n",
 		fmt.Sprintf("%s/%s%s", goos, goarch, goarm),
 		daemonVersion,
@@ -638,7 +630,6 @@ func (o *OutputOverview) GeneralSummary(showURL bool, showRelays bool, showNameS
 		lazyConnectionEnabledStatus,
 		sshServerStatus,
 		networks,
-		forwardingRulesString,
 		sessionExpiryString,
 		peersCountString,
 	)
@@ -691,7 +682,6 @@ func ToProtoFullStatus(fullStatus peer.FullStatus) *proto.FullStatus {
 	pbFullStatus.LocalPeerState.RosenpassPermissive = fullStatus.RosenpassState.Permissive
 	pbFullStatus.LocalPeerState.RosenpassEnabled = fullStatus.RosenpassState.Enabled
 	pbFullStatus.LocalPeerState.Networks = maps.Keys(fullStatus.LocalPeerState.Routes)
-	pbFullStatus.NumberOfForwardingRules = int32(fullStatus.NumOfForwardingRules)
 	pbFullStatus.LazyConnectionEnabled = fullStatus.LazyConnectionEnabled
 
 	for _, peerState := range fullStatus.Peers {
diff --git a/client/status/status_test.go b/client/status/status_test.go
index 2babd9342..1580aca6d 100644
--- a/client/status/status_test.go
+++ b/client/status/status_test.go
@@ -378,7 +378,6 @@ func TestParsingToJSON(t *testing.T) {
           "networks": [
             "10.10.0.0/24"
           ],
-          "forwardingRules": 0,
           "dnsServers": [
             {
               "servers": [
@@ -496,7 +495,6 @@ quantumResistance: false
 quantumResistancePermissive: false
 networks:
     - 10.10.0.0/24
-forwardingRules: 0
 dnsServers:
     - servers:
         - 8.8.8.8:53
diff --git a/client/ui/frontend/WAILS-API.md b/client/ui/frontend/WAILS-API.md
index 494812d35..6cc1dd79c 100644
--- a/client/ui/frontend/WAILS-API.md
+++ b/client/ui/frontend/WAILS-API.md
@@ -10,7 +10,7 @@ Every method returns `$CancellablePromise<T>` (a Wails3 wrapper around `Promise`
 // Services
 import {
   Connection, Peers, ProfileSwitcher, Profiles,
-  Settings, Networks, Forwarding, Debug, Update, WindowManager,
+  Settings, Networks, Debug, Update, WindowManager,
   I18n, Preferences,
 } from "@bindings/services";
 
@@ -20,7 +20,6 @@ import type {
   Profile, ProfileRef, ActiveProfile,
   Config, ConfigParams, SetConfigParams, Features,
   Network, SelectNetworksParams,
-  ForwardingRule, PortInfo, PortRange,
   LoginParams, LoginResult, LogoutParams, WaitSSOParams, UpParams,
   DebugBundleParams, DebugBundleResult, LogLevel,
   UpdateResult, UpdateAvailable, UpdateProgress,
@@ -129,14 +128,6 @@ Networks.Deselect(p: SelectNetworksParams): Promise<void>
 
 Exit-node filter: `range === "0.0.0.0/0" || range === "::/0"`. Domain network: `domains.length > 0`. CIDR overlap check is client-side.
 
-## `Forwarding`
-
-```ts
-Forwarding.List(): Promise<ForwardingRule[]>
-```
-
-`PortInfo` is a daemon-side oneof — exactly one of `port?: number` or `range?: PortRange` is populated. `protocol` is the lowercase daemon string (`"tcp"` / `"udp"`).
-
 ## `Debug`
 
 ```ts
@@ -269,12 +260,6 @@ The tray also reads a tray-only synthetic `"Error"` for icon purposes; the front
 
 `Network`: `{ id, range: string; selected: boolean; domains: string[]; resolvedIps: Record<string, string[]> }`.
 
-`ForwardingRule`: `{ protocol: string; destinationPort: PortInfo; translatedAddress, translatedHostname: string; translatedPort: PortInfo }`.
-
-`PortInfo`: `{ port?: number | null; range?: PortRange | null }` (exactly one populated).
-
-`PortRange`: `{ start, end: number }` (inclusive).
-
 `LoginParams`: `{ profileName, username, managementUrl, setupKey, preSharedKey, hostname, hint: string }`.
 
 `LoginResult`: `{ needsSsoLogin: boolean; userCode, verificationUri, verificationUriComplete: string }`.
diff --git a/client/ui/main.go b/client/ui/main.go
index 74a87b4df..764562fe7 100644
--- a/client/ui/main.go
+++ b/client/ui/main.go
@@ -336,7 +336,6 @@ func registerServices(app *application.App, conn *Conn, s registeredServices) {
 	app.RegisterService(application.NewService(services.NewSession(s.authSession, s.bundle, s.prefStore)))
 	app.RegisterService(application.NewService(s.settings))
 	app.RegisterService(application.NewService(s.networks))
-	app.RegisterService(application.NewService(services.NewForwarding(conn)))
 	app.RegisterService(application.NewService(s.profiles))
 	app.RegisterService(application.NewService(services.NewDebug(conn)))
 	app.RegisterService(application.NewService(s.update))
diff --git a/client/ui/services/forwarding.go b/client/ui/services/forwarding.go
deleted file mode 100644
index 4ba979ad0..000000000
--- a/client/ui/services/forwarding.go
+++ /dev/null
@@ -1,83 +0,0 @@
-//go:build !android && !ios && !freebsd && !js
-
-package services
-
-import (
-	"context"
-
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-// PortRange is a port range; both ends are inclusive.
-type PortRange struct {
-	Start uint32 `json:"start"`
-	End   uint32 `json:"end"`
-}
-
-// PortInfo holds exactly one of Port or Range (the daemon's oneof).
-type PortInfo struct {
-	Port  *uint32    `json:"port,omitempty"`
-	Range *PortRange `json:"range,omitempty"`
-}
-
-// ForwardingRule is one entry from the daemon's reverse-proxy table.
-type ForwardingRule struct {
-	Protocol           string   `json:"protocol"`
-	DestinationPort    PortInfo `json:"destinationPort"`
-	TranslatedAddress  string   `json:"translatedAddress"`
-	TranslatedHostname string   `json:"translatedHostname"`
-	TranslatedPort     PortInfo `json:"translatedPort"`
-}
-
-// Forwarding groups the daemon RPCs that surface exposed/forwarded services.
-type Forwarding struct {
-	conn DaemonConn
-}
-
-func NewForwarding(conn DaemonConn) *Forwarding {
-	return &Forwarding{conn: conn}
-}
-
-func (s *Forwarding) List(ctx context.Context) ([]ForwardingRule, error) {
-	cli, err := s.conn.Client()
-	if err != nil {
-		return nil, err
-	}
-	resp, err := cli.ForwardingRules(ctx, &proto.EmptyRequest{})
-	if err != nil {
-		return nil, err
-	}
-	out := make([]ForwardingRule, 0, len(resp.GetRules()))
-	for _, r := range resp.GetRules() {
-		out = append(out, forwardingRuleFromProto(r))
-	}
-	return out, nil
-}
-
-func forwardingRuleFromProto(r *proto.ForwardingRule) ForwardingRule {
-	return ForwardingRule{
-		Protocol:           r.GetProtocol(),
-		DestinationPort:    portInfoFromProto(r.GetDestinationPort()),
-		TranslatedAddress:  r.GetTranslatedAddress(),
-		TranslatedHostname: r.GetTranslatedHostname(),
-		TranslatedPort:     portInfoFromProto(r.GetTranslatedPort()),
-	}
-}
-
-func portInfoFromProto(p *proto.PortInfo) PortInfo {
-	if p == nil {
-		return PortInfo{}
-	}
-	switch sel := p.GetPortSelection().(type) {
-	case *proto.PortInfo_Port:
-		port := sel.Port
-		return PortInfo{Port: &port}
-	case *proto.PortInfo_Range_:
-		r := sel.Range
-		if r == nil {
-			return PortInfo{}
-		}
-		return PortInfo{Range: &PortRange{Start: r.GetStart(), End: r.GetEnd()}}
-	}
-	return PortInfo{}
-}
diff --git a/go.mod b/go.mod
index 35e254f8e..eeb73cd68 100644
--- a/go.mod
+++ b/go.mod
@@ -85,7 +85,7 @@ require (
 	github.com/mitchellh/hashstructure/v2 v2.0.2
 	github.com/moby/moby/api v1.54.1
 	github.com/netbirdio/go-nat v0.0.0-20260821095157-6b2c8c5c74e8
-	github.com/netbirdio/management-integrations/integrations v0.0.0-20260803100840-78e79ba20f87
+	github.com/netbirdio/management-integrations/integrations v0.0.0-20261006132740-6e6b0cb01f2e
 	github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45
 	github.com/oapi-codegen/runtime v1.1.2
 	github.com/okta/okta-sdk-golang/v2 v2.18.0
diff --git a/go.sum b/go.sum
index c193a388f..115bb3373 100644
--- a/go.sum
+++ b/go.sum
@@ -519,8 +519,8 @@ github.com/netbirdio/go-nat v0.0.0-20260821095157-6b2c8c5c74e8 h1:pBxXEsxcsO3qVU
 github.com/netbirdio/go-nat v0.0.0-20260821095157-6b2c8c5c74e8/go.mod h1:mFViabv4PpnoDw9w7W21a7xux6APA4q7KQZRsv4BCl8=
 github.com/netbirdio/ice/v4 v4.0.0-20250908184934-6202be846b51 h1:Ov4qdafATOgGMB1wbSuh+0aAHcwz9hdvB6VZjh1mVMI=
 github.com/netbirdio/ice/v4 v4.0.0-20250908184934-6202be846b51/go.mod h1:ZSIbPdBn5hePO8CpF1PekH2SfpTxg1PDhEwtbqZS7R8=
-github.com/netbirdio/management-integrations/integrations v0.0.0-20260803100840-78e79ba20f87 h1:iJeUvSMC0BTpkw7u4JyWcY4/3dl7fEL9DR/TpKf2+1w=
-github.com/netbirdio/management-integrations/integrations v0.0.0-20260803100840-78e79ba20f87/go.mod h1:pmsCPx1S0nuZRxCextGpc9AV4hLgGSuTsc4NMuwGeCo=
+github.com/netbirdio/management-integrations/integrations v0.0.0-20261006132740-6e6b0cb01f2e h1:SnDCreUnY+QDxKPueUoNrniMALCu2VFkXTCr/RIZjdg=
+github.com/netbirdio/management-integrations/integrations v0.0.0-20261006132740-6e6b0cb01f2e/go.mod h1:n47r67ZSPgwSmT/Z1o48JjZQW9YJ6m/6Bd/uAXkL3Pg=
 github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502 h1:3tHlFmhTdX9axERMVN63dqyFqnvuD+EMJHzM7mNGON8=
 github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502/go.mod h1:CIMRFEJVL+0DS1a3Nx06NaMn4Dz63Ng6O7dl0qH0zVM=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45 h1:ujgviVYmx243Ksy7NdSwrdGPSRNE3pb8kEDSpH0QuAQ=
diff --git a/management/internals/controllers/network_map/controller/controller.go b/management/internals/controllers/network_map/controller/controller.go
index 9727ff958..b9c27e57e 100644
--- a/management/internals/controllers/network_map/controller/controller.go
+++ b/management/internals/controllers/network_map/controller/controller.go
@@ -24,7 +24,6 @@ import (
 	"github.com/netbirdio/netbird/management/internals/shared/requestbuffer"
 	"github.com/netbirdio/netbird/management/server/account"
 	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/posture"
 	"github.com/netbirdio/netbird/management/server/settings"
@@ -60,8 +59,6 @@ type Controller struct {
 
 	requestBuffer account.RequestBuffer
 
-	proxyController port_forwarding.Controller
-
 	integratedPeerValidator integrated_validator.IntegratedValidator
 
 	serverSupportedSyncMessageVersion sharedgrpc.SyncMessageVersion
@@ -87,7 +84,7 @@ type bufferAffectedUpdate struct {
 
 var _ network_map.Controller = (*Controller)(nil)
 
-func NewController(ctx context.Context, store store.Store, metrics telemetry.AppMetrics, peersUpdateManager network_map.PeersUpdateManager, requestBuffer account.RequestBuffer, integratedPeerValidator integrated_validator.IntegratedValidator, settingsManager settings.Manager, dnsDomain string, proxyController port_forwarding.Controller, ephemeralPeersManager ephemeral.Manager, config *config.Config, nmdataStore *networkmapdb.NetworkMapDBStoreImpl) *Controller {
+func NewController(ctx context.Context, store store.Store, metrics telemetry.AppMetrics, peersUpdateManager network_map.PeersUpdateManager, requestBuffer account.RequestBuffer, integratedPeerValidator integrated_validator.IntegratedValidator, settingsManager settings.Manager, dnsDomain string, ephemeralPeersManager ephemeral.Manager, config *config.Config, nmdataStore *networkmapdb.NetworkMapDBStoreImpl) *Controller {
 	nMetrics, err := newMetrics(metrics.UpdateChannelMetrics())
 	if err != nil {
 		log.Fatal(fmt.Errorf("error creating metrics: %w", err))
@@ -104,11 +101,10 @@ func NewController(ctx context.Context, store store.Store, metrics telemetry.App
 		dnsDomain:               dnsDomain,
 		config:                  config,
 
-		proxyController:                              proxyController,
 		EphemeralPeersManager:                        ephemeralPeersManager,
 		serverSupportedSyncMessageVersion:            sharedgrpc.SyncMessageVersionFromConfig(config.HighestSupportedSyncMessageVersion),
 		perAccountServerSupportedSyncMessageVersions: sharedgrpc.SyncMessageVersionsFromMap(config.PerAccountHighestSupportedSyncMessageVersion),
-		nmdataStore:                                  nmdataStore,
+		nmdataStore: nmdataStore,
 	}
 
 	if nmdataStore != nil {
@@ -226,12 +222,6 @@ func (c *Controller) sendUpdateAccountPeers(ctx context.Context, accountID strin
 	routers := account.GetResourceRoutersMap()
 	groupIDToUserIDs := account.GetActiveGroupUsers()
 
-	proxyNetworkMaps, err := c.proxyController.GetProxyNetworkMapsAll(ctx, accountID, account.Peers)
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to get proxy network maps: %v", err)
-		return fmt.Errorf("failed to get proxy network maps: %v", err)
-	}
-
 	extraSetting, err := c.settingsManager.GetExtraSettings(ctx, accountID)
 	if err != nil {
 		return fmt.Errorf("failed to get flow enabled status: %v", err)
@@ -273,7 +263,6 @@ func (c *Controller) sendUpdateAccountPeers(ctx context.Context, accountID strin
 			start = time.Now()
 
 			peerGroups := account.GetPeerGroups(p.ID)
-			proxyNetworkMap := proxyNetworkMaps[p.ID]
 			var update *proto.SyncResponse
 
 			commonSyncMessageVersion := sharedgrpc.HighestCommonSyncMessageVersion(
@@ -294,10 +283,7 @@ func (c *Controller) sendUpdateAccountPeers(ctx context.Context, accountID strin
 				c.metrics.CountCalcPeerNetworkMapDuration(time.Since(start))
 
 				start = time.Now()
-				// proxyNetworkMap rides the envelope as a ProxyPatch sidecar;
-				// the client merges it into Calculate()'s output the same
-				// way the legacy server did via NetworkMap.Merge.
-				update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(p), nil, nil, components, proxyNetworkMap, dnsDomain, postureChecks, types.TwinAccountSettings(account.Settings), extraSetting, maps.Keys(peerGroups), dnsFwdPort)
+				update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(p), nil, nil, components, dnsDomain, postureChecks, types.TwinAccountSettings(account.Settings), extraSetting, maps.Keys(peerGroups), dnsFwdPort)
 				c.metrics.CountToComponentSyncResponseDuration(time.Since(start))
 
 				c.peersUpdateManager.SendUpdate(ctx, p.ID, &network_map.UpdateMessage{
@@ -313,10 +299,6 @@ func (c *Controller) sendUpdateAccountPeers(ctx context.Context, accountID strin
 
 			c.metrics.CountCalcPeerNetworkMapDuration(time.Since(start))
 
-			if proxyNetworkMap != nil {
-				nmap.Merge(proxyNetworkMap)
-			}
-
 			start = time.Now()
 			update = grpc.ToSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(p), nil, nil, nmap, dnsDomain, postureChecks, dnsCache, types.TwinAccountSettings(account.Settings), extraSetting, maps.Keys(peerGroups), dnsFwdPort)
 			c.metrics.CountToSyncResponseDuration(time.Since(start))
@@ -451,7 +433,7 @@ func (c *Controller) sendUpdatesFromData(ctx context.Context, accountID string,
 				c.metrics.CountCalcPeerNetworkMapDuration(time.Since(start))
 
 				start = time.Now()
-				update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, p, nil, nil, components, nil, dnsDomain, postureChecks, nmData.AccountSettings, extraSettings, peerGroups, dnsFwdPort)
+				update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, p, nil, nil, components, dnsDomain, postureChecks, nmData.AccountSettings, extraSettings, peerGroups, dnsFwdPort)
 				c.metrics.CountToComponentSyncResponseDuration(time.Since(start))
 
 				c.peersUpdateManager.SendUpdate(ctx, p.ID, &network_map.UpdateMessage{
@@ -684,12 +666,6 @@ func (c *Controller) sendUpdateForAffectedPeers(ctx context.Context, accountID s
 	routers := account.GetResourceRoutersMap()
 	groupIDToUserIDs := account.GetActiveGroupUsers()
 
-	proxyNetworkMaps, err := c.proxyController.GetProxyNetworkMapsAll(ctx, accountID, account.Peers)
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to get proxy network maps: %v", err)
-		return fmt.Errorf("failed to get proxy network maps: %v", err)
-	}
-
 	extraSetting, err := c.settingsManager.GetExtraSettings(ctx, accountID)
 	if err != nil {
 		return fmt.Errorf("failed to get flow enabled status: %v", err)
@@ -722,7 +698,6 @@ func (c *Controller) sendUpdateForAffectedPeers(ctx context.Context, accountID s
 			start = time.Now()
 
 			peerGroups := account.GetPeerGroups(p.ID)
-			proxyNetworkMap := proxyNetworkMaps[p.ID]
 			var update *proto.SyncResponse
 
 			commonSyncMessageVersion := sharedgrpc.HighestCommonSyncMessageVersion(
@@ -743,10 +718,7 @@ func (c *Controller) sendUpdateForAffectedPeers(ctx context.Context, accountID s
 				c.metrics.CountCalcPeerNetworkMapDuration(time.Since(start))
 
 				start = time.Now()
-				// proxyNetworkMap rides the envelope as a ProxyPatch sidecar;
-				// the client merges it into Calculate()'s output the same
-				// way the legacy server did via NetworkMap.Merge.
-				update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(p), nil, nil, components, proxyNetworkMap, dnsDomain, postureChecks, types.TwinAccountSettings(account.Settings), extraSetting, maps.Keys(peerGroups), dnsFwdPort)
+				update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(p), nil, nil, components, dnsDomain, postureChecks, types.TwinAccountSettings(account.Settings), extraSetting, maps.Keys(peerGroups), dnsFwdPort)
 				c.metrics.CountToComponentSyncResponseDuration(time.Since(start))
 
 				c.peersUpdateManager.SendUpdate(ctx, p.ID, &network_map.UpdateMessage{
@@ -762,10 +734,6 @@ func (c *Controller) sendUpdateForAffectedPeers(ctx context.Context, accountID s
 
 			c.metrics.CountCalcPeerNetworkMapDuration(time.Since(start))
 
-			if proxyNetworkMap != nil {
-				nmap.Merge(proxyNetworkMap)
-			}
-
 			start = time.Now()
 			update = grpc.ToSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(p), nil, nil, nmap, dnsDomain, postureChecks, dnsCache, types.TwinAccountSettings(account.Settings), extraSetting, maps.Keys(peerGroups), dnsFwdPort)
 			c.metrics.CountToSyncResponseDuration(time.Since(start))
@@ -843,19 +811,12 @@ func (c *Controller) UpdateAccountPeer(ctx context.Context, accountId string, pe
 		return fmt.Errorf("failed to get posture checks for peer %s: %v", peerId, err)
 	}
 
-	proxyNetworkMaps, err := c.proxyController.GetProxyNetworkMaps(ctx, account.Id, peer.ID, account.Peers)
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to get proxy network maps: %v", err)
-		return err
-	}
-
 	accountZones, err := c.repo.GetAccountZones(ctx, account.Id)
 	if err != nil {
 		log.WithContext(ctx).Errorf("failed to get account zones: %v", err)
 		return err
 	}
 
-	proxyNetworkMap := proxyNetworkMaps[peer.ID]
 	extraSettings, err := c.settingsManager.GetExtraSettings(ctx, peer.AccountID)
 	if err != nil {
 		return fmt.Errorf("failed to get extra settings: %v", err)
@@ -881,10 +842,7 @@ func (c *Controller) UpdateAccountPeer(ctx context.Context, accountId string, pe
 		components := account.GetPeerNetworkMapComponents(
 			ctx, peer.ID, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, groupIDToUserIDs)
 
-		// proxyNetworkMap rides the envelope as a ProxyPatch sidecar;
-		// the client merges it into Calculate()'s output the same
-		// way the legacy server did via NetworkMap.Merge.
-		update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(peer), nil, nil, components, proxyNetworkMap, dnsDomain, postureChecks, types.TwinAccountSettings(account.Settings), extraSettings, maps.Keys(peerGroups), dnsFwdPort)
+		update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(peer), nil, nil, components, dnsDomain, postureChecks, types.TwinAccountSettings(account.Settings), extraSettings, maps.Keys(peerGroups), dnsFwdPort)
 
 		c.peersUpdateManager.SendUpdate(ctx, peer.ID, &network_map.UpdateMessage{
 			Update:      update,
@@ -897,10 +855,6 @@ func (c *Controller) UpdateAccountPeer(ctx context.Context, accountId string, pe
 	nmap := account.GetPeerNetworkMapFromComponents(
 		ctx, peer.ID, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, c.accountManagerMetrics, groupIDToUserIDs)
 
-	if proxyNetworkMap != nil {
-		nmap.Merge(proxyNetworkMap)
-	}
-
 	update = grpc.ToSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(peer), nil, nil, nmap, dnsDomain, postureChecks, dnsCache, types.TwinAccountSettings(account.Settings), extraSettings, maps.Keys(peerGroups), dnsFwdPort)
 
 	c.peersUpdateManager.SendUpdate(ctx, peer.ID, &network_map.UpdateMessage{
@@ -951,17 +905,16 @@ func (c *Controller) BufferUpdateAccountPeers(ctx context.Context, accountID str
 
 // GetValidatedPeerWithComponents is the components-format counterpart of
 // GetValidatedPeerWithMap. It returns raw NetworkMapComponents for capable
-// peers along with the proxy NetworkMap fragment (BYOP / port-forwarding
-// data the legacy server folds in via NetworkMap.Merge). The gRPC layer
-// encodes both into the wire envelope. Callers must gate on capability
-// themselves before dispatching here — this method does NOT branch on it.
-func (c *Controller) GetValidatedPeerWithComponents(ctx context.Context, isRequiresApproval bool, accountID string, peer *nbpeer.Peer) (*nbpeer.Peer, *types.NetworkMapComponents, *types.NetworkMap, []*nmdata.PostureChecks, int64, error) {
+// peers, which the gRPC layer encodes into the wire envelope. Callers must
+// gate on capability themselves before dispatching here — this method does
+// NOT branch on it.
+func (c *Controller) GetValidatedPeerWithComponents(ctx context.Context, isRequiresApproval bool, accountID string, peer *nbpeer.Peer) (*nbpeer.Peer, *types.NetworkMapComponents, []*nmdata.PostureChecks, int64, error) {
 	if isRequiresApproval {
 		network, err := c.repo.GetAccountNetwork(ctx, accountID)
 		if err != nil {
-			return nil, nil, nil, nil, 0, err
+			return nil, nil, nil, 0, err
 		}
-		return peer, &types.NetworkMapComponents{Network: types.TwinNetwork(network)}, nil, nil, 0, nil
+		return peer, &types.NetworkMapComponents{Network: types.TwinNetwork(network)}, nil, 0, nil
 	}
 
 	if nmData := c.getNetworkMapData(ctx, accountID); nmData != nil {
@@ -970,39 +923,29 @@ func (c *Controller) GetValidatedPeerWithComponents(ctx context.Context, isRequi
 
 	account, err := c.requestBuffer.GetAccountWithBackpressure(ctx, accountID)
 	if err != nil {
-		return nil, nil, nil, nil, 0, err
+		return nil, nil, nil, 0, err
 	}
 
 	// it's possible that the peer gets deleted between the call to "sendInitialSync()" and here, bail out in this case
 	if _, ok := account.Peers[peer.ID]; !ok {
-		return nil, nil, nil, nil, 0, fmt.Errorf("peer '%s' no longer exists", peer.ID)
+		return nil, nil, nil, 0, fmt.Errorf("peer '%s' no longer exists", peer.ID)
 	}
 
 	c.injectAllProxyPolicies(ctx, account)
 
 	approvedPeersMap, err := c.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, types.TwinGroups(maps.Values(account.Groups)), types.TwinPeers(maps.Values(account.Peers)), account.Settings.Extra)
 	if err != nil {
-		return nil, nil, nil, nil, 0, err
+		return nil, nil, nil, 0, err
 	}
 
 	postureChecks, err := c.getPeerPostureChecks(account, peer.ID)
 	if err != nil {
-		return nil, nil, nil, nil, 0, err
+		return nil, nil, nil, 0, err
 	}
 
 	accountZones, err := c.repo.GetAccountZones(ctx, account.Id)
 	if err != nil {
-		return nil, nil, nil, nil, 0, err
-	}
-
-	// Fetch the proxy network map fragment for this peer alongside the
-	// components — same single-account-load path the streaming controller
-	// uses, so initial-sync delivers BYOP/forwarding patches synchronously
-	// instead of waiting for the next streaming push.
-	proxyNetworkMaps, err := c.proxyController.GetProxyNetworkMaps(ctx, account.Id, peer.ID, account.Peers)
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to get proxy network maps: %v", err)
-		return nil, nil, nil, nil, 0, err
+		return nil, nil, nil, 0, err
 	}
 
 	dnsDomain := c.GetDNSDomain(account.Settings)
@@ -1014,13 +957,12 @@ func (c *Controller) GetValidatedPeerWithComponents(ctx context.Context, isRequi
 	components := account.GetPeerNetworkMapComponents(ctx, peer.ID, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, groupIDToUserIDs)
 	dnsFwdPort := computeForwarderPort(maps.Values(account.Peers), network_map.DnsForwarderPortMinVersion)
 
-	return peer, components, proxyNetworkMaps[peer.ID], postureChecks, dnsFwdPort, nil
+	return peer, components, postureChecks, dnsFwdPort, nil
 }
 
 // getValidatedPeerWithComponentsFromData is the account-free variant of
-// GetValidatedPeerWithComponents. The proxy network map fragment is omitted
-// like on the other nmdata paths.
-func (c *Controller) getValidatedPeerWithComponentsFromData(ctx context.Context, accountID string, peer *nbpeer.Peer, nmData *networkmap.NetworkMapData) (*nbpeer.Peer, *types.NetworkMapComponents, *types.NetworkMap, []*nmdata.PostureChecks, int64, error) {
+// GetValidatedPeerWithComponents.
+func (c *Controller) getValidatedPeerWithComponentsFromData(ctx context.Context, accountID string, peer *nbpeer.Peer, nmData *networkmap.NetworkMapData) (*nbpeer.Peer, *types.NetworkMapComponents, []*nmdata.PostureChecks, int64, error) {
 	postureChecks := peerPostureChecksFromData(nmData, peer.ID)
 
 	dnsDomain := c.getDNSDomainFromData(nmData.AccountSettings)
@@ -1029,7 +971,7 @@ func (c *Controller) getValidatedPeerWithComponentsFromData(ctx context.Context,
 	components := nmData.GetPeerNetworkMapComponents(peer.ID, peersCustomZone)
 	dnsFwdPort := ComputeForwarderPortFromData(nmData.Peers, network_map.DnsForwarderPortMinVersion)
 
-	return peer, components, nil, postureChecks, dnsFwdPort, nil
+	return peer, components, postureChecks, dnsFwdPort, nil
 }
 
 // BufferUpdateAffectedPeers accumulates peer IDs and flushes them after the buffer interval.
@@ -1173,22 +1115,11 @@ func (c *Controller) GetValidatedPeerWithMap(ctx context.Context, isRequiresAppr
 	dnsDomain := c.GetDNSDomain(account.Settings)
 	peersCustomZone := account.GetPeersCustomZone(ctx, dnsDomain)
 
-	proxyNetworkMaps, err := c.proxyController.GetProxyNetworkMaps(ctx, account.Id, peerID, account.Peers)
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to get proxy network maps: %v", err)
-		return nil, nil, 0, err
-	}
-
 	resourcePolicies := account.GetResourcePoliciesMap()
 	routers := account.GetResourceRoutersMap()
 	groupIDToUserIDs := account.GetActiveGroupUsers()
 	networkMap := account.GetPeerNetworkMapFromComponents(ctx, peerID, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, c.accountManagerMetrics, groupIDToUserIDs)
 
-	proxyNetworkMap, ok := proxyNetworkMaps[peerID]
-	if ok {
-		networkMap.Merge(proxyNetworkMap)
-	}
-
 	dnsFwdPort := computeForwarderPort(maps.Values(account.Peers), network_map.DnsForwarderPortMinVersion)
 
 	return networkMap, postureChecks, dnsFwdPort, nil
@@ -1457,23 +1388,12 @@ func (c *Controller) GetNetworkMap(ctx context.Context, peerID string) (*types.N
 	dnsDomain := c.GetDNSDomain(account.Settings)
 	peersCustomZone := account.GetPeersCustomZone(ctx, dnsDomain)
 
-	proxyNetworkMaps, err := c.proxyController.GetProxyNetworkMaps(ctx, account.Id, peerID, account.Peers)
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to get proxy network maps: %v", err)
-		return nil, err
-	}
-
 	c.injectAllProxyPolicies(ctx, account)
 	resourcePolicies := account.GetResourcePoliciesMap()
 	routers := account.GetResourceRoutersMap()
 	groupIDToUserIDs := account.GetActiveGroupUsers()
 	networkMap := account.GetPeerNetworkMapFromComponents(ctx, peer.ID, peersCustomZone, accountZones, validatedPeers, resourcePolicies, routers, nil, groupIDToUserIDs)
 
-	proxyNetworkMap, ok := proxyNetworkMaps[peer.ID]
-	if ok {
-		networkMap.Merge(proxyNetworkMap)
-	}
-
 	return networkMap, nil
 }
 
diff --git a/management/internals/controllers/network_map/controller/controller_test.go b/management/internals/controllers/network_map/controller/controller_test.go
index dfbbb2915..74e2553d6 100644
--- a/management/internals/controllers/network_map/controller/controller_test.go
+++ b/management/internals/controllers/network_map/controller/controller_test.go
@@ -122,11 +122,10 @@ func TestGetValidatedPeerWithComponents_DeletedPeer(t *testing.T) {
 	}
 
 	mockrequestBuffer.EXPECT().GetAccountWithBackpressure(gomock.Any(), gomock.Any()).Return(&types.Account{}, nil)
-	peer, components, netmap, posturechecks, dnsforwardPort, err := c.GetValidatedPeerWithComponents(context.TODO(), false, "test-account-id", &nbpeer.Peer{ID: "test-peer-id"})
+	peer, components, posturechecks, dnsforwardPort, err := c.GetValidatedPeerWithComponents(context.TODO(), false, "test-account-id", &nbpeer.Peer{ID: "test-peer-id"})
 
 	assert.Nil(t, peer)
 	assert.Nil(t, components)
-	assert.Nil(t, netmap)
 	assert.Nil(t, posturechecks)
 	assert.Equal(t, int64(0), dnsforwardPort)
 	assert.NotNil(t, err)
diff --git a/management/internals/controllers/network_map/controller/repository_mock.go b/management/internals/controllers/network_map/controller/repository_mock.go
index 5246eef4b..9c6b1af4c 100644
--- a/management/internals/controllers/network_map/controller/repository_mock.go
+++ b/management/internals/controllers/network_map/controller/repository_mock.go
@@ -89,6 +89,21 @@ func (mr *MockRepositoryMockRecorder) GetAccountPeers(ctx, accountID any) *gomoc
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountPeers", reflect.TypeOf((*MockRepository)(nil).GetAccountPeers), ctx, accountID)
 }
 
+// GetAccountServices mocks base method.
+func (m *MockRepository) GetAccountServices(ctx context.Context, accountID string) ([]*service.Service, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAccountServices", ctx, accountID)
+	ret0, _ := ret[0].([]*service.Service)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAccountServices indicates an expected call of GetAccountServices.
+func (mr *MockRepositoryMockRecorder) GetAccountServices(ctx, accountID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountServices", reflect.TypeOf((*MockRepository)(nil).GetAccountServices), ctx, accountID)
+}
+
 // GetAccountZones mocks base method.
 func (m *MockRepository) GetAccountZones(ctx context.Context, accountID string) ([]*zones.Zone, error) {
 	m.ctrl.T.Helper()
diff --git a/management/internals/controllers/network_map/interface.go b/management/internals/controllers/network_map/interface.go
index 1e8c219b3..f447387b4 100644
--- a/management/internals/controllers/network_map/interface.go
+++ b/management/internals/controllers/network_map/interface.go
@@ -24,7 +24,7 @@ type Controller interface {
 	UpdateAccountPeer(ctx context.Context, accountId string, peerId string) error
 	BufferUpdateAccountPeers(ctx context.Context, accountID string, reason types.UpdateReason) error
 	GetValidatedPeerWithMap(ctx context.Context, isRequiresApproval bool, accountID string, peerID string) (*types.NetworkMap, []*nmdata.PostureChecks, int64, error)
-	GetValidatedPeerWithComponents(ctx context.Context, isRequiresApproval bool, accountID string, p *nbpeer.Peer) (*nbpeer.Peer, *types.NetworkMapComponents, *types.NetworkMap, []*nmdata.PostureChecks, int64, error)
+	GetValidatedPeerWithComponents(ctx context.Context, isRequiresApproval bool, accountID string, p *nbpeer.Peer) (*nbpeer.Peer, *types.NetworkMapComponents, []*nmdata.PostureChecks, int64, error)
 	GetDNSDomain(settings *types.Settings) string
 	StartWarmup(context.Context)
 	GetNetworkMap(ctx context.Context, peerID string) (*types.NetworkMap, error)
diff --git a/management/internals/controllers/network_map/interface_mock.go b/management/internals/controllers/network_map/interface_mock.go
index 8b104dfa0..5dcd241e1 100644
--- a/management/internals/controllers/network_map/interface_mock.go
+++ b/management/internals/controllers/network_map/interface_mock.go
@@ -127,16 +127,15 @@ func (mr *MockControllerMockRecorder) GetNetworkMap(ctx, peerID any) *gomock.Cal
 }
 
 // GetValidatedPeerWithComponents mocks base method.
-func (m *MockController) GetValidatedPeerWithComponents(ctx context.Context, isRequiresApproval bool, accountID string, p *peer.Peer) (*peer.Peer, *types.NetworkMapComponents, *types.NetworkMap, []*nmdata.PostureChecks, int64, error) {
+func (m *MockController) GetValidatedPeerWithComponents(ctx context.Context, isRequiresApproval bool, accountID string, p *peer.Peer) (*peer.Peer, *types.NetworkMapComponents, []*nmdata.PostureChecks, int64, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetValidatedPeerWithComponents", ctx, isRequiresApproval, accountID, p)
 	ret0, _ := ret[0].(*peer.Peer)
 	ret1, _ := ret[1].(*types.NetworkMapComponents)
-	ret2, _ := ret[2].(*types.NetworkMap)
-	ret3, _ := ret[3].([]*nmdata.PostureChecks)
-	ret4, _ := ret[4].(int64)
-	ret5, _ := ret[5].(error)
-	return ret0, ret1, ret2, ret3, ret4, ret5
+	ret2, _ := ret[2].([]*nmdata.PostureChecks)
+	ret3, _ := ret[3].(int64)
+	ret4, _ := ret[4].(error)
+	return ret0, ret1, ret2, ret3, ret4
 }
 
 // GetValidatedPeerWithComponents indicates an expected call of GetValidatedPeerWithComponents.
diff --git a/management/internals/controllers/network_map/nmaptest/canonicalize.go b/management/internals/controllers/network_map/nmaptest/canonicalize.go
index ec6614d81..643105b89 100644
--- a/management/internals/controllers/network_map/nmaptest/canonicalize.go
+++ b/management/internals/controllers/network_map/nmaptest/canonicalize.go
@@ -123,7 +123,6 @@ func canonicalize(nm *proto.NetworkMap) {
 	slices.SortFunc(nm.Routes, cmpRoute)
 	slices.SortFunc(nm.FirewallRules, cmpFirewallRule)
 	slices.SortFunc(nm.RoutesFirewallRules, cmpRouteFirewallRule)
-	slices.SortFunc(nm.ForwardingRules, cmpForwardingRule)
 
 	for _, r := range nm.FirewallRules {
 		slices.SortFunc(r.SourcePrefixes, bytes.Compare)
@@ -353,16 +352,6 @@ func cmpRouteFirewallRule(a, b *proto.RouteFirewallRule) int {
 	return boolCmp(a.IsDynamic, b.IsDynamic)
 }
 
-func cmpForwardingRule(a, b *proto.ForwardingRule) int {
-	if a == nil || b == nil {
-		return boolCmp(a == nil, b == nil)
-	}
-	if c := cmp.Compare(int32(a.Protocol), int32(b.Protocol)); c != 0 {
-		return c
-	}
-	return bytes.Compare(a.TranslatedAddress, b.TranslatedAddress)
-}
-
 func portInfoKey(pi *proto.PortInfo) string {
 	if pi == nil {
 		return ""
diff --git a/management/internals/controllers/network_map/nmaptest/runner.go b/management/internals/controllers/network_map/nmaptest/runner.go
index ffce6483e..b6fc81df6 100644
--- a/management/internals/controllers/network_map/nmaptest/runner.go
+++ b/management/internals/controllers/network_map/nmaptest/runner.go
@@ -243,7 +243,7 @@ func computeMode(t *testing.T, ctx context.Context, mode Mode, nmData *networkma
 	case ModeEnvelope:
 		components := nmData.GetPeerNetworkMapComponents(peerID, zone)
 		peerGroups := maps.Keys(nmData.GetPeerGroups(peerID))
-		resp := mgmtgrpc.ToComponentSyncResponse(ctx, nil, nil, nil, peer, nil, nil, components, nil,
+		resp := mgmtgrpc.ToComponentSyncResponse(ctx, nil, nil, nil, peer, nil, nil, components,
 			dnsDomain, nil, nmData.AccountSettings, nil, peerGroups, dnsFwdPort)
 		res, err := networkmap.EnvelopeToNetworkMap(ctx, resp.NetworkMapEnvelope, peer.Key, dnsDomain, false)
 		require.NoError(t, err, "expand envelope")
diff --git a/management/internals/server/controllers.go b/management/internals/server/controllers.go
index a9293d266..d9c8ee9d8 100644
--- a/management/internals/server/controllers.go
+++ b/management/internals/server/controllers.go
@@ -5,8 +5,6 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
-	"github.com/netbirdio/management-integrations/integrations"
-
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
 	proxymanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy/manager"
 
@@ -20,7 +18,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/auth"
 	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator"
 	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator/validator"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	nbjwt "github.com/netbirdio/netbird/shared/auth/jwt"
 )
@@ -52,12 +49,6 @@ func (s *BaseServer) IntegratedValidator() integrated_validator.IntegratedValida
 	})
 }
 
-func (s *BaseServer) ProxyController() port_forwarding.Controller {
-	return Create(s, func() port_forwarding.Controller {
-		return integrations.NewController(s.Store())
-	})
-}
-
 func (s *BaseServer) SecretsManager() grpc.SecretsManager {
 	return Create(s, func() grpc.SecretsManager {
 		secretsManager, err := grpc.NewTimeBasedAuthSecretsManager(s.PeersUpdateManager(), s.Config.TURNConfig, s.Config.Relay, s.SettingsManager(), s.GroupsManager())
@@ -123,7 +114,7 @@ func (s *BaseServer) EphemeralManager() ephemeral.Manager {
 
 func (s *BaseServer) NetworkMapController() network_map.Controller {
 	return Create(s, func() network_map.Controller {
-		return nmapcontroller.NewController(context.Background(), s.Store(), s.Metrics(), s.PeersUpdateManager(), s.AccountRequestBuffer(), s.IntegratedValidator(), s.SettingsManager(), s.DNSDomain(), s.ProxyController(), s.EphemeralManager(), s.Config, s.NetworkMapStore())
+		return nmapcontroller.NewController(context.Background(), s.Store(), s.Metrics(), s.PeersUpdateManager(), s.AccountRequestBuffer(), s.IntegratedValidator(), s.SettingsManager(), s.DNSDomain(), s.EphemeralManager(), s.Config, s.NetworkMapStore())
 	})
 }
 
diff --git a/management/internals/server/modules.go b/management/internals/server/modules.go
index 4840e40ad..f548e9238 100644
--- a/management/internals/server/modules.go
+++ b/management/internals/server/modules.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/netbirdio/management-integrations/integrations"
 
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/peers"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain/manager"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
@@ -20,7 +21,6 @@ import (
 	recordsManager "github.com/netbirdio/netbird/management/internals/modules/zones/records/manager"
 	"github.com/netbirdio/netbird/management/server"
 	"github.com/netbirdio/netbird/management/server/account"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/server/geolocation"
 	"github.com/netbirdio/netbird/management/server/groups"
 	"github.com/netbirdio/netbird/management/server/idp"
@@ -96,7 +96,7 @@ func (s *BaseServer) PeersManager() peers.Manager {
 
 func (s *BaseServer) AccountManager() account.Manager {
 	return Create(s, func() account.Manager {
-		accountManager, err := server.BuildManager(context.Background(), s.Config, s.Store(), s.NetworkMapController(), s.JobManager(), s.IdpManager(), s.mgmtSingleAccModeDomain, s.EventStore(), s.GeoLocationManager(), s.userDeleteFromIDPEnabled, s.IntegratedValidator(), s.Metrics(), s.ProxyController(), s.SettingsManager(), s.PermissionsManager(), s.Config.DisableDefaultPolicy, s.CacheStore())
+		accountManager, err := server.BuildManager(context.Background(), s.Config, s.Store(), s.NetworkMapController(), s.JobManager(), s.IdpManager(), s.mgmtSingleAccModeDomain, s.EventStore(), s.GeoLocationManager(), s.userDeleteFromIDPEnabled, s.IntegratedValidator(), s.Metrics(), s.SettingsManager(), s.PermissionsManager(), s.Config.DisableDefaultPolicy, s.CacheStore())
 		if err != nil {
 			log.Fatalf("failed to create account service: %v", err)
 		}
diff --git a/management/internals/shared/grpc/components_encoder.go b/management/internals/shared/grpc/components_encoder.go
index a2aad19b6..a4516be52 100644
--- a/management/internals/shared/grpc/components_encoder.go
+++ b/management/internals/shared/grpc/components_encoder.go
@@ -28,10 +28,6 @@ type ComponentsEnvelopeInput struct {
 	// SshAuth.UserIDClaim when reconstructing the NetworkMap. Empty value
 	// is OK — client treats empty as "no SshAuth to build".
 	UserIDClaim string
-	// ProxyPatch carries pre-expanded NetworkMap fragments injected by
-	// external controllers (BYOP/port-forwarding). Nil when no proxy data
-	// is present; encoder skips the field in that case.
-	ProxyPatch *proto.ProxyPatch
 }
 
 // EncodeNetworkMapEnvelope converts NetworkMapComponents into the component
@@ -69,7 +65,6 @@ func EncodeNetworkMapEnvelope(in ComponentsEnvelopeInput) *proto.NetworkMapEnvel
 					DnsForwarderPort: in.DNSForwarderPort,
 					UserIdClaim:      in.UserIDClaim,
 					AccountSettings:  &proto.AccountSettingsCompact{},
-					ProxyPatch:       in.ProxyPatch,
 				},
 			},
 		}
@@ -101,7 +96,6 @@ func EncodeNetworkMapEnvelope(in ComponentsEnvelopeInput) *proto.NetworkMapEnvel
 		AccountSettings:     toAccountSettingsCompact(c.AccountSettings),
 		DnsForwarderPort:    in.DNSForwarderPort,
 		UserIdClaim:         in.UserIDClaim,
-		ProxyPatch:          in.ProxyPatch,
 		DnsSettings:         enc.encodeDNSSettings(c.DNSSettings),
 		DnsDomain:           in.DNSDomain,
 		CustomZoneDomain:    c.CustomZoneDomain,
diff --git a/management/internals/shared/grpc/components_encoder_test.go b/management/internals/shared/grpc/components_encoder_test.go
index 6ee554e8b..a6421af11 100644
--- a/management/internals/shared/grpc/components_encoder_test.go
+++ b/management/internals/shared/grpc/components_encoder_test.go
@@ -713,66 +713,6 @@ func TestEncodeNetworkMapEnvelope_GroupIDToUserIDs(t *testing.T) {
 	assert.ElementsMatch(t, []string{"user-4"}, full.GroupIdToUserIds["group-users"].UserIds)
 }
 
-func TestToProxyPatch_EmptyInputReturnsNil(t *testing.T) {
-	assert.Nil(t, toProxyPatch(nil, "netbird.cloud", false, false, false))
-	assert.Nil(t, toProxyPatch(&types.NetworkMap{}, "netbird.cloud", false, false, false),
-		"empty NetworkMap (no peers, rules, routes etc) → nil patch so proto3 omits the field")
-}
-
-func TestToProxyPatch_PopulatesAllFields(t *testing.T) {
-	nm := &types.NetworkMap{
-		Peers: []*nmdata.Peer{{
-			ID: "ext-peer", Key: testWgKeyA, IP: netip.AddrFrom4([4]byte{100, 64, 0, 9}),
-			DNSLabel: "extpeer", Meta: nmdata.PeerSystemMeta{WtVersion: "0.40.0"},
-		}},
-		FirewallRules: []*types.FirewallRule{{
-			PeerIP: "100.64.0.9", Action: "accept", Direction: 0, Protocol: "tcp",
-		}},
-	}
-
-	patch := toProxyPatch(nm, "netbird.cloud", false, false, false)
-
-	require.NotNil(t, patch)
-	assert.Len(t, patch.Peers, 1)
-	assert.Len(t, patch.FirewallRules, 1)
-}
-
-// TestEncodeNetworkMapEnvelope_ProxyPatchPropagated covers the ProxyPatch
-// pass-through in both encoder branches (normal path + nil-Components
-// graceful-degrade). Guards against a regression that drops `ProxyPatch:`
-// from one of the envelope struct literals.
-func TestEncodeNetworkMapEnvelope_ProxyPatchPropagated(t *testing.T) {
-	patch := &proto.ProxyPatch{
-		ForwardingRules: []*proto.ForwardingRule{{
-			Protocol:          proto.RuleProtocol_TCP,
-			DestinationPort:   &proto.PortInfo{PortSelection: &proto.PortInfo_Port{Port: 80}},
-			TranslatedAddress: net.IPv4(10, 0, 0, 1).To4(),
-			TranslatedPort:    &proto.PortInfo{PortSelection: &proto.PortInfo_Port{Port: 8080}},
-		}},
-	}
-
-	t.Run("normal_path", func(t *testing.T) {
-		c := newTestComponents()
-		full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{
-			Components: c,
-			ProxyPatch: patch,
-		}).GetFull()
-
-		require.NotNil(t, full.ProxyPatch, "ProxyPatch must propagate through the normal encode path")
-		assert.Len(t, full.ProxyPatch.ForwardingRules, 1)
-	})
-
-	t.Run("empty_components_graceful_degrade", func(t *testing.T) {
-		full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{
-			Components: emptyNetworkMapComponents(),
-			ProxyPatch: patch,
-		}).GetFull()
-
-		require.NotNil(t, full.ProxyPatch, "ProxyPatch must propagate through the nil-Components branch too")
-		assert.Len(t, full.ProxyPatch.ForwardingRules, 1)
-	})
-}
-
 func TestEncodeNetworkMapEnvelope_NilComponentsGracefulDegrade(t *testing.T) {
 	// nil Components → minimal envelope, no crash. Matches the legacy
 	// behaviour for missing/unvalidated peers.
diff --git a/management/internals/shared/grpc/components_envelope_response.go b/management/internals/shared/grpc/components_envelope_response.go
index cdd2a7f37..cbf9bb477 100644
--- a/management/internals/shared/grpc/components_envelope_response.go
+++ b/management/internals/shared/grpc/components_envelope_response.go
@@ -9,7 +9,6 @@ import (
 	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
 	"github.com/netbirdio/netbird/management/server/types"
 	sharedgrpc "github.com/netbirdio/netbird/shared/management/grpc"
-	"github.com/netbirdio/netbird/shared/management/networkmap"
 	nmdata "github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
@@ -34,7 +33,6 @@ func ToComponentSyncResponse(
 	turnCredentials *Token,
 	relayCredentials *Token,
 	components *types.NetworkMapComponents,
-	proxyPatch *types.NetworkMap,
 	dnsName string,
 	checks []*nmdata.PostureChecks,
 	settings *nmdata.AccountSettingsInfo,
@@ -51,9 +49,6 @@ func ToComponentSyncResponse(
 	enableSSH := computeSSHEnabledForPeer(components, peer)
 	peerConfig := toPeerConfig(peer, components.Network, dnsName, settings, httpConfig, deviceFlowConfig, enableSSH, components.ForceRoutingPeerDNSResolution)
 
-	includeIPv6 := peer.SupportsIPv6() && peer.IPv6.IsValid()
-	useSourcePrefixes := peer.SupportsSourcePrefixes()
-
 	userIDClaim := auth.DefaultUserIDClaim
 	if httpConfig != nil && httpConfig.AuthUserIDClaim != "" {
 		userIDClaim = httpConfig.AuthUserIDClaim
@@ -65,7 +60,6 @@ func ToComponentSyncResponse(
 		DNSDomain:        dnsName,
 		DNSForwarderPort: dnsFwdPort,
 		UserIDClaim:      userIDClaim,
-		ProxyPatch:       toProxyPatch(proxyPatch, dnsName, includeIPv6, useSourcePrefixes, peer.ProxyMeta.Embedded),
 	})
 
 	resp := &proto.SyncResponse{
@@ -91,43 +85,6 @@ func ToComponentSyncResponse(
 	return resp
 }
 
-// toProxyPatch converts a proxy-injected *types.NetworkMap into the wire
-// patch the components envelope ships alongside. Returns nil when there are
-// no fragments to merge — proto3 omits a nil message field, so the receiver
-// sees no patch and skips the merge step entirely.
-//
-// We reuse the legacy proto-conversion helpers (toProtocolRoutes,
-// toProtocolFirewallRules, toProtocolRoutesFirewallRules,
-// appendRemotePeerConfig, ForwardingRule.ToProto) because the proxy
-// delivers fragments pre-expanded — there's no raw component shape to
-// derive them from. Components purity isn't violated: proxy data isn't
-// policy-graph-derived, it's externally injected post-Calculate, so the
-// client merges it on top of its locally-computed NetworkMap.
-func toProxyPatch(nm *types.NetworkMap, dnsName string, includeIPv6, useSourcePrefixes, localIsProxy bool) *proto.ProxyPatch {
-	if nm == nil {
-		return nil
-	}
-	if len(nm.Peers) == 0 && len(nm.OfflinePeers) == 0 && len(nm.FirewallRules) == 0 &&
-		len(nm.Routes) == 0 && len(nm.RoutesFirewallRules) == 0 && len(nm.ForwardingRules) == 0 {
-		return nil
-	}
-
-	patch := &proto.ProxyPatch{
-		Peers:              networkmap.AppendRemotePeerConfig(nil, nm.Peers, dnsName, includeIPv6, localIsProxy),
-		OfflinePeers:       networkmap.AppendRemotePeerConfig(nil, nm.OfflinePeers, dnsName, includeIPv6, localIsProxy),
-		FirewallRules:      networkmap.ToProtocolFirewallRules(nm.FirewallRules, includeIPv6, useSourcePrefixes),
-		Routes:             networkmap.ToProtocolRoutes(nm.Routes),
-		RouteFirewallRules: networkmap.ToProtocolRoutesFirewallRules(nm.RoutesFirewallRules),
-	}
-	if len(nm.ForwardingRules) > 0 {
-		patch.ForwardingRules = make([]*proto.ForwardingRule, 0, len(nm.ForwardingRules))
-		for _, r := range nm.ForwardingRules {
-			patch.ForwardingRules = append(patch.ForwardingRules, r.ToProto())
-		}
-	}
-	return patch
-}
-
 // computeSSHEnabledForPeer mirrors the SSH-server-activation bit that
 // Calculate() folds into NetworkMap.EnableSSH. Components-format peers
 // receive a freshly-computed PeerConfig.SshConfig.SshEnabled at sync time;
diff --git a/management/internals/shared/grpc/conversion.go b/management/internals/shared/grpc/conversion.go
index 96bd9f1f4..908118aff 100644
--- a/management/internals/shared/grpc/conversion.go
+++ b/management/internals/shared/grpc/conversion.go
@@ -199,14 +199,6 @@ func ToSyncResponse(ctx context.Context, config *nbconfig.Config, httpConfig *nb
 	response.NetworkMap.RoutesFirewallRules = routesFirewallRules
 	response.NetworkMap.RoutesFirewallRulesIsEmpty = len(routesFirewallRules) == 0
 
-	if networkMap.ForwardingRules != nil {
-		forwardingRules := make([]*proto.ForwardingRule, 0, len(networkMap.ForwardingRules))
-		for _, rule := range networkMap.ForwardingRules {
-			forwardingRules = append(forwardingRules, rule.ToProto())
-		}
-		response.NetworkMap.ForwardingRules = forwardingRules
-	}
-
 	if networkMap.AuthorizedUsers != nil {
 		hashedUsers, machineUsers := networkmap.BuildAuthorizedUsersProto(ctx, networkMap.AuthorizedUsers)
 		userIDClaim := auth.DefaultUserIDClaim
diff --git a/management/internals/shared/grpc/server.go b/management/internals/shared/grpc/server.go
index c178b6fa1..6e95a8998 100644
--- a/management/internals/shared/grpc/server.go
+++ b/management/internals/shared/grpc/server.go
@@ -955,12 +955,12 @@ func (s *Server) sendInitialSync(ctx context.Context, peerKey wgtypes.Key, peer
 		// stops doing duplicate work. Deferred until the client-side
 		// decoder lands and there's a real deployment of capability=3 peers
 		// worth optimizing for.
-		freshPeer, components, proxyPatch, freshPostureChecks, freshDnsFwdPort, err := s.networkMapController.GetValidatedPeerWithComponents(ctx, false, peer.AccountID, peer)
+		freshPeer, components, freshPostureChecks, freshDnsFwdPort, err := s.networkMapController.GetValidatedPeerWithComponents(ctx, false, peer.AccountID, peer)
 		if err != nil {
 			log.WithContext(ctx).Errorf("failed to build components for peer %s on initial sync: %v", peer.ID, err)
 			return status.Errorf(codes.Internal, "failed to build initial sync envelope")
 		}
-		plainResp = ToComponentSyncResponse(ctx, s.config, s.config.HttpConfig, s.config.DeviceAuthorizationFlow, types.TwinPeer(freshPeer), turnToken, relayToken, components, proxyPatch, dnsName, freshPostureChecks, types.TwinAccountSettings(settings), settings.Extra, peerGroups, freshDnsFwdPort)
+		plainResp = ToComponentSyncResponse(ctx, s.config, s.config.HttpConfig, s.config.DeviceAuthorizationFlow, types.TwinPeer(freshPeer), turnToken, relayToken, components, dnsName, freshPostureChecks, types.TwinAccountSettings(settings), settings.Extra, peerGroups, freshDnsFwdPort)
 	} else {
 		plainResp = ToSyncResponse(ctx, s.config, s.config.HttpConfig, s.config.DeviceAuthorizationFlow, types.TwinPeer(peer), turnToken, relayToken, networkMap, dnsName, postureChecks, nil, types.TwinAccountSettings(settings), settings.Extra, peerGroups, dnsFwdPort)
 	}
diff --git a/management/server/account.go b/management/server/account.go
index 038c5d8db..1b7e4d66c 100644
--- a/management/server/account.go
+++ b/management/server/account.go
@@ -35,7 +35,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/geolocation"
 	"github.com/netbirdio/netbird/management/server/idp"
 	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/permissions"
@@ -84,7 +83,6 @@ type DefaultAccountManager struct {
 
 	requestBuffer *AccountRequestBuffer
 
-	proxyController port_forwarding.Controller
 	settingsManager settings.Manager
 	serviceManager  service.Manager
 
@@ -225,7 +223,6 @@ func BuildManager(
 	userDeleteFromIDPEnabled bool,
 	integratedPeerValidator integrated_validator.IntegratedValidator,
 	metrics telemetry.AppMetrics,
-	proxyController port_forwarding.Controller,
 	settingsManager settings.Manager,
 	permissionsManager permissions.Manager,
 	disableDefaultPolicy bool,
@@ -253,7 +250,6 @@ func BuildManager(
 		integratedPeerValidator:  integratedPeerValidator,
 		metrics:                  metrics,
 		requestBuffer:            NewAccountRequestBuffer(ctx, store),
-		proxyController:          proxyController,
 		settingsManager:          settingsManager,
 		permissionsManager:       permissionsManager,
 		disableDefaultPolicy:     disableDefaultPolicy,
diff --git a/management/server/account_test.go b/management/server/account_test.go
index 6067b6023..7dc02b428 100644
--- a/management/server/account_test.go
+++ b/management/server/account_test.go
@@ -49,7 +49,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/http/testing/testing_tools"
 	"github.com/netbirdio/netbird/management/server/idp"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
@@ -3661,8 +3660,8 @@ func buildTestManager(t testing.TB, store store.Store, nmdataStore *networkmapdb
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nmdataStore)
-	manager, err := BuildManager(ctx, &config.Config{}, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nmdataStore)
+	manager, err := BuildManager(ctx, &config.Config{}, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	if err != nil {
 		return nil, nil, err
 	}
diff --git a/management/server/dns_test.go b/management/server/dns_test.go
index d21864cbb..bd1b4c923 100644
--- a/management/server/dns_test.go
+++ b/management/server/dns_test.go
@@ -16,7 +16,6 @@ import (
 	ephemeral_manager "github.com/netbirdio/netbird/management/internals/modules/peers/ephemeral/manager"
 	"github.com/netbirdio/netbird/management/internals/server/config"
 	"github.com/netbirdio/netbird/management/server/cache"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
@@ -234,9 +233,9 @@ func createDNSManager(t *testing.T) (*DefaultAccountManager, error) {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.test", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nil)
+	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.test", ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nil)
 
-	return BuildManager(context.Background(), nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	return BuildManager(context.Background(), nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 }
 
 func createDNSStore(t *testing.T) (store.Store, error) {
diff --git a/management/server/http/testing/testing_tools/channel/channel.go b/management/server/http/testing/testing_tools/channel/channel.go
index c3f6a06e0..3f2056c32 100644
--- a/management/server/http/testing/testing_tools/channel/channel.go
+++ b/management/server/http/testing/testing_tools/channel/channel.go
@@ -29,7 +29,6 @@ import (
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/update_channel"
 	"github.com/netbirdio/netbird/management/internals/modules/peers"
 	ephemeral_manager "github.com/netbirdio/netbird/management/internals/modules/peers/ephemeral/manager"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 
 	"github.com/netbirdio/netbird/management/server"
@@ -88,7 +87,6 @@ func BuildApiBlackBoxWithDBState(t testing_tools.TB, sqlFile string, expectedPee
 
 	geoMock := &geolocation.Mock{}
 	validatorMock := server.MockIntegratedValidator{}
-	proxyController := integrations.NewController(store)
 	userManager := users.NewManager(store)
 	permissionsManager := permissions.NewManager(store)
 	settingsManager := settings.NewManager(store, userManager, integrations.NewManager(&activity.InMemoryEventStore{}), permissionsManager, settings.IdpConfig{})
@@ -102,8 +100,8 @@ func BuildApiBlackBoxWithDBState(t testing_tools.TB, sqlFile string, expectedPee
 	}
 
 	requestBuffer := server.NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, peersUpdateManager, requestBuffer, server.MockIntegratedValidator{}, settingsManager, "", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peersManager), &config.Config{}, nil)
-	am, err := server.BuildManager(ctx, nil, store, networkMapController, jobManager, nil, "", &activity.InMemoryEventStore{}, geoMock, false, validatorMock, metrics, proxyController, settingsManager, permissionsManager, false, cacheStore)
+	networkMapController := controller.NewController(ctx, store, metrics, peersUpdateManager, requestBuffer, server.MockIntegratedValidator{}, settingsManager, "", ephemeral_manager.NewEphemeralManager(store, peersManager), &config.Config{}, nil)
+	am, err := server.BuildManager(ctx, nil, store, networkMapController, jobManager, nil, "", &activity.InMemoryEventStore{}, geoMock, false, validatorMock, metrics, settingsManager, permissionsManager, false, cacheStore)
 	if err != nil {
 		t.Fatalf("Failed to create manager: %v", err)
 	}
@@ -228,7 +226,6 @@ func BuildApiBlackBoxWithDBStateAndPeerChannel(t testing_tools.TB, sqlFile strin
 
 	geoMock := &geolocation.Mock{}
 	validatorMock := server.MockIntegratedValidator{}
-	proxyController := integrations.NewController(store)
 	userManager := users.NewManager(store)
 	permissionsManager := permissions.NewManager(store)
 	settingsManager := settings.NewManager(store, userManager, integrations.NewManager(&activity.InMemoryEventStore{}), permissionsManager, settings.IdpConfig{})
@@ -242,8 +239,8 @@ func BuildApiBlackBoxWithDBStateAndPeerChannel(t testing_tools.TB, sqlFile strin
 	}
 
 	requestBuffer := server.NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, peersUpdateManager, requestBuffer, server.MockIntegratedValidator{}, settingsManager, "", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peersManager), &config.Config{}, nil)
-	am, err := server.BuildManager(ctx, nil, store, networkMapController, jobManager, nil, "", &activity.InMemoryEventStore{}, geoMock, false, validatorMock, metrics, proxyController, settingsManager, permissionsManager, false, cacheStore)
+	networkMapController := controller.NewController(ctx, store, metrics, peersUpdateManager, requestBuffer, server.MockIntegratedValidator{}, settingsManager, "", ephemeral_manager.NewEphemeralManager(store, peersManager), &config.Config{}, nil)
+	am, err := server.BuildManager(ctx, nil, store, networkMapController, jobManager, nil, "", &activity.InMemoryEventStore{}, geoMock, false, validatorMock, metrics, settingsManager, permissionsManager, false, cacheStore)
 	if err != nil {
 		t.Fatalf("Failed to create manager: %v", err)
 	}
diff --git a/management/server/identity_provider_test.go b/management/server/identity_provider_test.go
index c7a8af1d2..bb576a71f 100644
--- a/management/server/identity_provider_test.go
+++ b/management/server/identity_provider_test.go
@@ -23,7 +23,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/idp"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
@@ -112,8 +111,8 @@ func createManagerWithEmbeddedIdPModeAndSetup(
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, testStore)
-	networkMapController := controller.NewController(ctx, testStore, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(testStore, peersManager), &config.Config{}, nil)
-	manager, err := BuildManager(ctx, &config.Config{}, testStore, networkMapController, job.NewJobManager(nil, testStore, peersManager), idpManager, singleAccountModeDomain, eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	networkMapController := controller.NewController(ctx, testStore, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", ephemeral_manager.NewEphemeralManager(testStore, peersManager), &config.Config{}, nil)
+	manager, err := BuildManager(ctx, &config.Config{}, testStore, networkMapController, job.NewJobManager(nil, testStore, peersManager), idpManager, singleAccountModeDomain, eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	if err != nil {
 		return nil, nil, err
 	}
diff --git a/management/server/integrations/port_forwarding/controller.go b/management/server/integrations/port_forwarding/controller.go
deleted file mode 100644
index f2ce81839..000000000
--- a/management/server/integrations/port_forwarding/controller.go
+++ /dev/null
@@ -1,38 +0,0 @@
-package port_forwarding
-
-import (
-	"context"
-
-	"github.com/netbirdio/netbird/management/server/peer"
-	nbtypes "github.com/netbirdio/netbird/management/server/types"
-)
-
-type Controller interface {
-	SendUpdate(ctx context.Context, accountID string, affectedProxyID string, affectedPeerIDs []string, accountPeers map[string]*peer.Peer)
-	GetProxyNetworkMaps(ctx context.Context, accountID, peerID string, accountPeers map[string]*peer.Peer) (map[string]*nbtypes.NetworkMap, error)
-	GetProxyNetworkMapsAll(ctx context.Context, accountID string, accountPeers map[string]*peer.Peer) (map[string]*nbtypes.NetworkMap, error)
-	IsPeerInIngressPorts(ctx context.Context, accountID, peerID string) (bool, error)
-}
-
-type ControllerMock struct {
-}
-
-func NewControllerMock() *ControllerMock {
-	return &ControllerMock{}
-}
-
-func (c *ControllerMock) SendUpdate(ctx context.Context, accountID string, affectedProxyID string, affectedPeerIDs []string, accountPeers map[string]*peer.Peer) {
-	// noop
-}
-
-func (c *ControllerMock) GetProxyNetworkMaps(ctx context.Context, accountID, peerID string, accountPeers map[string]*peer.Peer) (map[string]*nbtypes.NetworkMap, error) {
-	return make(map[string]*nbtypes.NetworkMap), nil
-}
-
-func (c *ControllerMock) GetProxyNetworkMapsAll(ctx context.Context, accountID string, accountPeers map[string]*peer.Peer) (map[string]*nbtypes.NetworkMap, error) {
-	return make(map[string]*nbtypes.NetworkMap), nil
-}
-
-func (c *ControllerMock) IsPeerInIngressPorts(ctx context.Context, accountID, peerID string) (bool, error) {
-	return false, nil
-}
diff --git a/management/server/management_proto_test.go b/management/server/management_proto_test.go
index 4f8aa8265..4e21ea7a3 100644
--- a/management/server/management_proto_test.go
+++ b/management/server/management_proto_test.go
@@ -12,9 +12,9 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
@@ -31,7 +31,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/groups"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/permissions"
@@ -376,9 +375,9 @@ func startManagementForTest(t *testing.T, testFile string, config *config.Config
 		return nil, nil, "", cleanup, err
 	}
 
-	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), ephemeralMgr, config, nil)
+	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", ephemeralMgr, config, nil)
 	accountManager, err := BuildManager(ctx, nil, store, networkMapController, jobManager, nil, "",
-		eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+		eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 
 	if err != nil {
 		cleanup()
diff --git a/management/server/management_test.go b/management/server/management_test.go
index 3a8d6ecc2..4d27e6edc 100644
--- a/management/server/management_test.go
+++ b/management/server/management_test.go
@@ -10,10 +10,10 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
 	pb "github.com/golang/protobuf/proto" //nolint
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
+	"go.uber.org/mock/gomock"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
@@ -30,7 +30,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/activity"
 	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/groups"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
@@ -216,7 +215,7 @@ func startServer(
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := server.NewAccountRequestBuffer(ctx, str)
-	networkMapController := controller.NewController(ctx, str, metrics, updateManager, requestBuffer, server.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(str, peers.NewManager(str, permissionsManager)), config, nil)
+	networkMapController := controller.NewController(ctx, str, metrics, updateManager, requestBuffer, server.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", ephemeral_manager.NewEphemeralManager(str, peers.NewManager(str, permissionsManager)), config, nil)
 
 	accountManager, err := server.BuildManager(
 		context.Background(),
@@ -231,7 +230,6 @@ func startServer(
 		false,
 		server.MockIntegratedValidator{},
 		metrics,
-		port_forwarding.NewControllerMock(),
 		settingsMockManager,
 		permissionsManager,
 		false,
diff --git a/management/server/nameserver_test.go b/management/server/nameserver_test.go
index 1460893cf..1e24390be 100644
--- a/management/server/nameserver_test.go
+++ b/management/server/nameserver_test.go
@@ -18,7 +18,6 @@ import (
 	"github.com/netbirdio/netbird/management/internals/server/config"
 	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/management/server/cache"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/permissions"
@@ -803,9 +802,9 @@ func createNSManager(t *testing.T) (*DefaultAccountManager, error) {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nil)
+	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nil)
 
-	return BuildManager(context.Background(), nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	return BuildManager(context.Background(), nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 }
 
 func createNSStore(t *testing.T) (store.Store, error) {
diff --git a/management/server/peer.go b/management/server/peer.go
index 5d5863fa7..8d99bebb0 100644
--- a/management/server/peer.go
+++ b/management/server/peer.go
@@ -1839,15 +1839,6 @@ func deletePeers(ctx context.Context, am *DefaultAccountManager, transaction sto
 
 // validatePeerDelete checks if the peer can be deleted.
 func (am *DefaultAccountManager) validatePeerDelete(ctx context.Context, transaction store.Store, accountId, peerId string) error {
-	linkedInIngressPorts, err := am.proxyController.IsPeerInIngressPorts(ctx, accountId, peerId)
-	if err != nil {
-		return err
-	}
-
-	if linkedInIngressPorts {
-		return status.Errorf(status.PreconditionFailed, "peer is linked to ingress ports: %s", peerId)
-	}
-
 	linked, router := isPeerLinkedToNetworkRouter(ctx, transaction, accountId, peerId)
 	if linked {
 		return status.Errorf(status.PreconditionFailed, "peer is linked to a network router: %s", router.ID)
diff --git a/management/server/peer_test.go b/management/server/peer_test.go
index 5307300d6..ec4f0ef01 100644
--- a/management/server/peer_test.go
+++ b/management/server/peer_test.go
@@ -40,7 +40,6 @@ import (
 	nbcontext "github.com/netbirdio/netbird/management/server/context"
 	peershandler "github.com/netbirdio/netbird/management/server/http/handlers/peers"
 	"github.com/netbirdio/netbird/management/server/http/testing/testing_tools"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
@@ -1226,20 +1225,6 @@ func TestToSyncResponse(t *testing.T) {
 		FirewallRules: []*types.FirewallRule{
 			{PeerIP: "192.168.1.2", Direction: types.FirewallRuleDirectionIN, Action: string(types.PolicyTrafficActionAccept), Protocol: string(types.PolicyRuleProtocolTCP), Port: "80"},
 		},
-		ForwardingRules: []*types.ForwardingRule{
-			{
-				RuleProtocol: "tcp",
-				DestinationPorts: types.RulePortRange{
-					Start: 1000,
-					End:   2000,
-				},
-				TranslatedAddress: net.IPv4(192, 168, 1, 2),
-				TranslatedPorts: types.RulePortRange{
-					Start: 11000,
-					End:   12000,
-				},
-			},
-		},
 	}
 	dnsName := "example.com"
 	checks := []*nmdata.PostureChecks{
@@ -1334,14 +1319,6 @@ func TestToSyncResponse(t *testing.T) {
 	// assert posture checks
 	assert.Equal(t, 1, len(response.Checks))
 	assert.Equal(t, "/usr/bin/netbird", response.Checks[0].Files[0])
-	// assert network map ForwardingRules
-	assert.Equal(t, 1, len(response.NetworkMap.ForwardingRules))
-	assert.Equal(t, proto.RuleProtocol_TCP, response.NetworkMap.ForwardingRules[0].Protocol)
-	assert.Equal(t, uint32(1000), response.NetworkMap.ForwardingRules[0].DestinationPort.GetRange().Start)
-	assert.Equal(t, uint32(2000), response.NetworkMap.ForwardingRules[0].DestinationPort.GetRange().End)
-	assert.Equal(t, net.IPv4(192, 168, 1, 2).To4(), net.IP(response.NetworkMap.ForwardingRules[0].TranslatedAddress))
-	assert.Equal(t, uint32(11000), response.NetworkMap.ForwardingRules[0].TranslatedPort.GetRange().Start)
-	assert.Equal(t, uint32(12000), response.NetworkMap.ForwardingRules[0].TranslatedPort.GetRange().End)
 }
 
 func Test_RegisterPeerByUser(t *testing.T) {
@@ -1373,9 +1350,9 @@ func Test_RegisterPeerByUser(t *testing.T) {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, s)
-	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{}, nil)
+	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{}, nil)
 
-	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	assert.NoError(t, err)
 
 	existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
@@ -1464,9 +1441,9 @@ func Test_RegisterPeerBySetupKey(t *testing.T) {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, s)
-	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{}, nil)
+	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{}, nil)
 
-	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	assert.NoError(t, err)
 
 	existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
@@ -1623,9 +1600,9 @@ func Test_RegisterPeerRollbackOnFailure(t *testing.T) {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, s)
-	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{}, nil)
+	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{}, nil)
 
-	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	assert.NoError(t, err)
 
 	existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
@@ -1708,9 +1685,9 @@ func Test_LoginPeer(t *testing.T) {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, s)
-	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{}, nil)
+	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{}, nil)
 
-	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	assert.NoError(t, err)
 
 	existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
diff --git a/management/server/route_test.go b/management/server/route_test.go
index 69b9aec6c..d4bfa417e 100644
--- a/management/server/route_test.go
+++ b/management/server/route_test.go
@@ -18,7 +18,6 @@ import (
 	"github.com/netbirdio/netbird/management/internals/server/config"
 	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/management/server/cache"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
@@ -1301,9 +1300,9 @@ func createRouterManager(t *testing.T) (*DefaultAccountManager, *update_channel.
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nil)
+	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nil)
 
-	am, err := BuildManager(ctx, nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	am, err := BuildManager(ctx, nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	if err != nil {
 		return nil, nil, err
 	}
diff --git a/management/server/types/account_networkmapdata.go b/management/server/types/account_networkmapdata.go
index 80052d393..4ebd23f95 100644
--- a/management/server/types/account_networkmapdata.go
+++ b/management/server/types/account_networkmapdata.go
@@ -213,8 +213,7 @@ func twinPeer(p *nbpeer.Peer) *nmdata.Peer {
 	}
 }
 
-// TwinPeer converts a real peer to its slim nmdata twin. Exported for the
-// port-forwarding integration, which builds proxy NetworkMaps holding twins.
+// TwinPeer converts a real peer to its slim nmdata twin.
 func TwinPeer(p *nbpeer.Peer) *nmdata.Peer {
 	return twinPeer(p)
 }
diff --git a/management/server/types/aliases.go b/management/server/types/aliases.go
index 452a2746d..fa9af12f8 100644
--- a/management/server/types/aliases.go
+++ b/management/server/types/aliases.go
@@ -15,7 +15,6 @@ import (
 type FirewallRule = sharedtypes.FirewallRule
 
 type NetworkMap = sharedtypes.NetworkMap
-type ForwardingRule = sharedtypes.ForwardingRule
 
 type PolicyTrafficActionType = sharedtypes.PolicyTrafficActionType
 type PolicyRuleProtocolType = sharedtypes.PolicyRuleProtocolType
diff --git a/management/server/types/legacynmap/aliases.go b/management/server/types/legacynmap/aliases.go
index 82a18192b..6b8f9574b 100644
--- a/management/server/types/legacynmap/aliases.go
+++ b/management/server/types/legacynmap/aliases.go
@@ -10,7 +10,6 @@ type (
 
 	DNSSettings       = types.DNSSettings
 	FirewallRule      = sharedtypes.FirewallRule
-	ForwardingRule    = sharedtypes.ForwardingRule
 	Group             = types.Group
 	Network           = types.Network
 	Policy            = types.Policy
diff --git a/management/server/types/legacynmap/converters.go b/management/server/types/legacynmap/converters.go
index 34e709413..d1cae6b63 100644
--- a/management/server/types/legacynmap/converters.go
+++ b/management/server/types/legacynmap/converters.go
@@ -19,7 +19,6 @@ type NetworkMap struct {
 	OfflinePeers        []*ComponentPeer
 	FirewallRules       []*FirewallRule
 	RoutesFirewallRules []*RouteFirewallRule
-	ForwardingRules     []*ForwardingRule
 	AuthorizedUsers     map[string]map[string]struct{}
 	EnableSSH           bool
 	// ForceRoutingPeerDNSResolution forces the peer to run/use routing-peer DNS
diff --git a/management/server/types/legacynmap/equivalence_test.go b/management/server/types/legacynmap/equivalence_test.go
index d12e666b8..20770e29b 100644
--- a/management/server/types/legacynmap/equivalence_test.go
+++ b/management/server/types/legacynmap/equivalence_test.go
@@ -320,7 +320,6 @@ func canonicalize(nm *proto.NetworkMap) {
 	slices.SortFunc(nm.Routes, cmpRoute)
 	slices.SortFunc(nm.FirewallRules, cmpFirewallRule)
 	slices.SortFunc(nm.RoutesFirewallRules, cmpRouteFirewallRule)
-	slices.SortFunc(nm.ForwardingRules, cmpForwardingRule)
 
 	for _, r := range nm.FirewallRules {
 		slices.SortFunc(r.SourcePrefixes, bytes.Compare)
@@ -550,16 +549,6 @@ func cmpRouteFirewallRule(a, b *proto.RouteFirewallRule) int {
 	return boolCmp(a.IsDynamic, b.IsDynamic)
 }
 
-func cmpForwardingRule(a, b *proto.ForwardingRule) int {
-	if a == nil || b == nil {
-		return boolCmp(a == nil, b == nil)
-	}
-	if c := cmp.Compare(int32(a.Protocol), int32(b.Protocol)); c != 0 {
-		return c
-	}
-	return bytes.Compare(a.TranslatedAddress, b.TranslatedAddress)
-}
-
 func portInfoKey(pi *proto.PortInfo) string {
 	if pi == nil {
 		return ""
@@ -591,7 +580,6 @@ func describeDivergence(legacy, updated *proto.NetworkMap, accountID, peerID str
 		{"Routes", len(legacy.Routes), len(updated.Routes), func() string { return diffLists(legacy.Routes, updated.Routes) }},
 		{"FirewallRules", len(legacy.FirewallRules), len(updated.FirewallRules), func() string { return diffLists(legacy.FirewallRules, updated.FirewallRules) }},
 		{"RoutesFirewallRules", len(legacy.RoutesFirewallRules), len(updated.RoutesFirewallRules), func() string { return diffLists(legacy.RoutesFirewallRules, updated.RoutesFirewallRules) }},
-		{"ForwardingRules", len(legacy.ForwardingRules), len(updated.ForwardingRules), func() string { return diffLists(legacy.ForwardingRules, updated.ForwardingRules) }},
 	}
 	for _, l := range lens {
 		if l.a != l.b {
diff --git a/management/server/types/legacynmap/proto_legacy.go b/management/server/types/legacynmap/proto_legacy.go
index 74451b268..36dc35401 100644
--- a/management/server/types/legacynmap/proto_legacy.go
+++ b/management/server/types/legacynmap/proto_legacy.go
@@ -186,14 +186,6 @@ func ToProtoNetworkMap(
 	pm.RoutesFirewallRules = routesFirewallRules
 	pm.RoutesFirewallRulesIsEmpty = len(routesFirewallRules) == 0
 
-	if nm.ForwardingRules != nil {
-		forwardingRules := make([]*proto.ForwardingRule, 0, len(nm.ForwardingRules))
-		for _, rule := range nm.ForwardingRules {
-			forwardingRules = append(forwardingRules, rule.ToProto())
-		}
-		pm.ForwardingRules = forwardingRules
-	}
-
 	if nm.AuthorizedUsers != nil {
 		hashedUsers, machineUsers := networkmap.BuildAuthorizedUsersProto(ctx, nm.AuthorizedUsers)
 		userIDClaim := auth.DefaultUserIDClaim
diff --git a/shared/management/client/client_test.go b/shared/management/client/client_test.go
index e6335dccb..c1d394e7e 100644
--- a/shared/management/client/client_test.go
+++ b/shared/management/client/client_test.go
@@ -10,10 +10,10 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
@@ -35,7 +35,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/activity"
 	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/groups"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/mock_server"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
@@ -128,8 +127,8 @@ func startManagement(t *testing.T) (*grpc.Server, net.Listener) {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := mgmt.NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, mgmt.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peersManger), config, nil)
-	accountManager, err := mgmt.BuildManager(context.Background(), config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, ia, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManagerMock, false, cacheStore)
+	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, mgmt.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", ephemeral_manager.NewEphemeralManager(store, peersManger), config, nil)
+	accountManager, err := mgmt.BuildManager(context.Background(), config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, ia, metrics, settingsMockManager, permissionsManagerMock, false, cacheStore)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/shared/management/client/rest/client.go b/shared/management/client/rest/client.go
index 6154a6637..7dea4a3f0 100644
--- a/shared/management/client/rest/client.go
+++ b/shared/management/client/rest/client.go
@@ -127,10 +127,6 @@ type Client struct {
 	// see more: https://docs.netbird.io/api/resources/identity-providers
 	IdentityProviders *IdentityProvidersAPI
 
-	// Ingress NetBird Ingress Peers APIs
-	// see more: https://docs.netbird.io/api/resources/ingress-ports
-	Ingress *IngressAPI
-
 	// Instance NetBird Instance API
 	// see more: https://docs.netbird.io/api/resources/instance
 	Instance *InstanceAPI
@@ -207,7 +203,6 @@ func (c *Client) initialize() {
 	c.OktaScimIDP = &OktaScimIDPAPI{c}
 	c.EventStreaming = &EventStreamingAPI{c}
 	c.IdentityProviders = &IdentityProvidersAPI{c}
-	c.Ingress = &IngressAPI{c}
 	c.Instance = &InstanceAPI{c}
 	c.ReverseProxyServices = &ReverseProxyServicesAPI{c}
 	c.ReverseProxyClusters = &ReverseProxyClustersAPI{c}
diff --git a/shared/management/client/rest/ingress.go b/shared/management/client/rest/ingress.go
deleted file mode 100644
index f69288d7e..000000000
--- a/shared/management/client/rest/ingress.go
+++ /dev/null
@@ -1,92 +0,0 @@
-package rest
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-
-	"github.com/netbirdio/netbird/shared/management/http/api"
-)
-
-// IngressAPI APIs for Ingress Peers, do not use directly
-type IngressAPI struct {
-	c *Client
-}
-
-// List all ingress peers
-// See more: https://docs.netbird.io/api/resources/ingress#list-all-ingress-peers
-func (a *IngressAPI) List(ctx context.Context) ([]api.IngressPeer, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/ingress/peers", nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[[]api.IngressPeer](resp)
-	return ret, err
-}
-
-// Get ingress peer info
-// See more: https://docs.netbird.io/api/resources/ingress#retrieve-an-ingress-peer
-func (a *IngressAPI) Get(ctx context.Context, ingressPeerID string) (*api.IngressPeer, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/ingress/peers/"+ingressPeerID, nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.IngressPeer](resp)
-	return &ret, err
-}
-
-// Create new ingress peer
-// See more: https://docs.netbird.io/api/resources/ingress#create-an-ingress-peer
-func (a *IngressAPI) Create(ctx context.Context, request api.PostApiIngressPeersJSONRequestBody) (*api.IngressPeer, error) {
-	requestBytes, err := json.Marshal(request)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := a.c.NewRequest(ctx, "POST", "/api/ingress/peers", bytes.NewReader(requestBytes), nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.IngressPeer](resp)
-	return &ret, err
-}
-
-// Update update ingress peer
-// See more: https://docs.netbird.io/api/resources/ingress#update-an-ingress-peer
-func (a *IngressAPI) Update(ctx context.Context, ingressPeerID string, request api.PutApiIngressPeersIngressPeerIdJSONRequestBody) (*api.IngressPeer, error) {
-	requestBytes, err := json.Marshal(request)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := a.c.NewRequest(ctx, "PUT", "/api/ingress/peers/"+ingressPeerID, bytes.NewReader(requestBytes), nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.IngressPeer](resp)
-	return &ret, err
-}
-
-// Delete delete ingress peer
-// See more: https://docs.netbird.io/api/resources/ingress#delete-an-ingress-peer
-func (a *IngressAPI) Delete(ctx context.Context, ingressPeerID string) error {
-	resp, err := a.c.NewRequest(ctx, "DELETE", "/api/ingress/peers/"+ingressPeerID, nil, nil)
-	if err != nil {
-		return err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-
-	return nil
-}
diff --git a/shared/management/client/rest/ingress_test.go b/shared/management/client/rest/ingress_test.go
deleted file mode 100644
index c915db094..000000000
--- a/shared/management/client/rest/ingress_test.go
+++ /dev/null
@@ -1,184 +0,0 @@
-//go:build integration
-
-package rest_test
-
-import (
-	"context"
-	"encoding/json"
-	"io"
-	"net/http"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/shared/management/client/rest"
-	"github.com/netbirdio/netbird/shared/management/http/api"
-	"github.com/netbirdio/netbird/shared/management/http/util"
-)
-
-var testIngressPeer = api.IngressPeer{
-	Connected: true,
-	Enabled:   true,
-	Id:        "Test",
-}
-
-func TestIngress_List_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/ingress/peers", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal([]api.IngressPeer{testIngressPeer})
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Ingress.List(context.Background())
-		require.NoError(t, err)
-		assert.Len(t, ret, 1)
-		assert.Equal(t, testIngressPeer, ret[0])
-	})
-}
-
-func TestIngress_List_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/ingress/peers", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "No", Code: 400})
-			w.WriteHeader(400)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Ingress.List(context.Background())
-		assert.Error(t, err)
-		assert.Equal(t, "No", err.Error())
-		assert.Empty(t, ret)
-	})
-}
-
-func TestIngress_Get_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/ingress/peers/Test", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(testIngressPeer)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Ingress.Get(context.Background(), "Test")
-		require.NoError(t, err)
-		assert.Equal(t, testIngressPeer, *ret)
-	})
-}
-
-func TestIngress_Get_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/ingress/peers/Test", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "No", Code: 400})
-			w.WriteHeader(400)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Ingress.Get(context.Background(), "Test")
-		assert.Error(t, err)
-		assert.Equal(t, "No", err.Error())
-		assert.Empty(t, ret)
-	})
-}
-
-func TestIngress_Create_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/ingress/peers", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "POST", r.Method)
-			reqBytes, err := io.ReadAll(r.Body)
-			require.NoError(t, err)
-			var req api.PostApiIngressPeersJSONRequestBody
-			err = json.Unmarshal(reqBytes, &req)
-			require.NoError(t, err)
-			assert.Equal(t, "peer-id", req.PeerId)
-			retBytes, _ := json.Marshal(testIngressPeer)
-			_, err = w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Ingress.Create(context.Background(), api.PostApiIngressPeersJSONRequestBody{
-			PeerId: "peer-id",
-		})
-		require.NoError(t, err)
-		assert.Equal(t, testIngressPeer, *ret)
-	})
-}
-
-func TestIngress_Create_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/ingress/peers", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "No", Code: 400})
-			w.WriteHeader(400)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Ingress.Create(context.Background(), api.PostApiIngressPeersJSONRequestBody{
-			PeerId: "peer-id",
-		})
-		assert.Error(t, err)
-		assert.Equal(t, "No", err.Error())
-		assert.Nil(t, ret)
-	})
-}
-
-func TestIngress_Update_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/ingress/peers/Test", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "PUT", r.Method)
-			reqBytes, err := io.ReadAll(r.Body)
-			require.NoError(t, err)
-			var req api.PutApiIngressPeersIngressPeerIdJSONRequestBody
-			err = json.Unmarshal(reqBytes, &req)
-			require.NoError(t, err)
-			assert.Equal(t, true, req.Enabled)
-			retBytes, _ := json.Marshal(testIngressPeer)
-			_, err = w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Ingress.Update(context.Background(), "Test", api.PutApiIngressPeersIngressPeerIdJSONRequestBody{
-			Enabled: true,
-		})
-		require.NoError(t, err)
-		assert.Equal(t, testIngressPeer, *ret)
-	})
-}
-
-func TestIngress_Update_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/ingress/peers/Test", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "No", Code: 400})
-			w.WriteHeader(400)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Ingress.Update(context.Background(), "Test", api.PutApiIngressPeersIngressPeerIdJSONRequestBody{
-			Enabled: true,
-		})
-		assert.Error(t, err)
-		assert.Equal(t, "No", err.Error())
-		assert.Nil(t, ret)
-	})
-}
-
-func TestIngress_Delete_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/ingress/peers/Test", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "DELETE", r.Method)
-			w.WriteHeader(200)
-		})
-		err := c.Ingress.Delete(context.Background(), "Test")
-		require.NoError(t, err)
-	})
-}
-
-func TestIngress_Delete_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/ingress/peers/Test", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "Not found", Code: 404})
-			w.WriteHeader(404)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		err := c.Ingress.Delete(context.Background(), "Test")
-		assert.Error(t, err)
-		assert.Equal(t, "Not found", err.Error())
-	})
-}
diff --git a/shared/management/client/rest/peers.go b/shared/management/client/rest/peers.go
index b22bcae67..30faff925 100644
--- a/shared/management/client/rest/peers.go
+++ b/shared/management/client/rest/peers.go
@@ -125,98 +125,6 @@ func (a *PeersAPI) CreateTemporaryAccess(ctx context.Context, peerID string, req
 	return &ret, err
 }
 
-// PeerIngressPortsAPI APIs for Peer Ingress Ports, do not use directly
-type PeerIngressPortsAPI struct {
-	c      *Client
-	peerID string
-}
-
-// IngressPorts APIs for peer ingress ports
-func (a *PeersAPI) IngressPorts(peerID string) *PeerIngressPortsAPI {
-	return &PeerIngressPortsAPI{
-		c:      a.c,
-		peerID: peerID,
-	}
-}
-
-// List list all ingress port allocations for a peer
-// See more: https://docs.netbird.io/api/resources/peers#list-all-ingress-port-allocations
-func (a *PeerIngressPortsAPI) List(ctx context.Context) ([]api.IngressPortAllocation, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/peers/"+a.peerID+"/ingress/ports", nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[[]api.IngressPortAllocation](resp)
-	return ret, err
-}
-
-// Get get ingress port allocation info
-// See more: https://docs.netbird.io/api/resources/peers#retrieve-an-ingress-port-allocation
-func (a *PeerIngressPortsAPI) Get(ctx context.Context, allocationID string) (*api.IngressPortAllocation, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/peers/"+a.peerID+"/ingress/ports/"+allocationID, nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.IngressPortAllocation](resp)
-	return &ret, err
-}
-
-// Create create new ingress port allocation
-// See more: https://docs.netbird.io/api/resources/peers#create-an-ingress-port-allocation
-func (a *PeerIngressPortsAPI) Create(ctx context.Context, request api.PostApiPeersPeerIdIngressPortsJSONRequestBody) (*api.IngressPortAllocation, error) {
-	requestBytes, err := json.Marshal(request)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := a.c.NewRequest(ctx, "POST", "/api/peers/"+a.peerID+"/ingress/ports", bytes.NewReader(requestBytes), nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.IngressPortAllocation](resp)
-	return &ret, err
-}
-
-// Update update ingress port allocation
-// See more: https://docs.netbird.io/api/resources/peers#update-an-ingress-port-allocation
-func (a *PeerIngressPortsAPI) Update(ctx context.Context, allocationID string, request api.PutApiPeersPeerIdIngressPortsAllocationIdJSONRequestBody) (*api.IngressPortAllocation, error) {
-	requestBytes, err := json.Marshal(request)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := a.c.NewRequest(ctx, "PUT", "/api/peers/"+a.peerID+"/ingress/ports/"+allocationID, bytes.NewReader(requestBytes), nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.IngressPortAllocation](resp)
-	return &ret, err
-}
-
-// Delete delete ingress port allocation
-// See more: https://docs.netbird.io/api/resources/peers#delete-an-ingress-port-allocation
-func (a *PeerIngressPortsAPI) Delete(ctx context.Context, allocationID string) error {
-	resp, err := a.c.NewRequest(ctx, "DELETE", "/api/peers/"+a.peerID+"/ingress/ports/"+allocationID, nil, nil)
-	if err != nil {
-		return err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-
-	return nil
-}
-
 // PeerJobsAPI APIs for Peer Jobs, do not use directly
 type PeerJobsAPI struct {
 	c      *Client
diff --git a/shared/management/client/rest/peers_test.go b/shared/management/client/rest/peers_test.go
index 5724b57f9..7370b238b 100644
--- a/shared/management/client/rest/peers_test.go
+++ b/shared/management/client/rest/peers_test.go
@@ -31,11 +31,6 @@ var (
 		Name: "test-peer",
 	}
 
-	testIngressPortAllocation = api.IngressPortAllocation{
-		Enabled: true,
-		Id:      "alloc-1",
-	}
-
 	testJobResponse = api.JobResponse{
 		Id:     "job-1",
 		Status: "pending",
@@ -221,146 +216,6 @@ func TestPeers_CreateTemporaryAccess_Err(t *testing.T) {
 	})
 }
 
-func TestPeerIngressPorts_List_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/peers/Test/ingress/ports", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal([]api.IngressPortAllocation{testIngressPortAllocation})
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Peers.IngressPorts("Test").List(context.Background())
-		require.NoError(t, err)
-		assert.Len(t, ret, 1)
-		assert.Equal(t, testIngressPortAllocation, ret[0])
-	})
-}
-
-func TestPeerIngressPorts_List_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/peers/Test/ingress/ports", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "No", Code: 400})
-			w.WriteHeader(400)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Peers.IngressPorts("Test").List(context.Background())
-		assert.Error(t, err)
-		assert.Equal(t, "No", err.Error())
-		assert.Empty(t, ret)
-	})
-}
-
-func TestPeerIngressPorts_Get_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/peers/Test/ingress/ports/alloc-1", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(testIngressPortAllocation)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Peers.IngressPorts("Test").Get(context.Background(), "alloc-1")
-		require.NoError(t, err)
-		assert.Equal(t, testIngressPortAllocation, *ret)
-	})
-}
-
-func TestPeerIngressPorts_Get_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/peers/Test/ingress/ports/alloc-1", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "No", Code: 400})
-			w.WriteHeader(400)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Peers.IngressPorts("Test").Get(context.Background(), "alloc-1")
-		assert.Error(t, err)
-		assert.Equal(t, "No", err.Error())
-		assert.Empty(t, ret)
-	})
-}
-
-func TestPeerIngressPorts_Create_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/peers/Test/ingress/ports", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "POST", r.Method)
-			retBytes, _ := json.Marshal(testIngressPortAllocation)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Peers.IngressPorts("Test").Create(context.Background(), api.PostApiPeersPeerIdIngressPortsJSONRequestBody{})
-		require.NoError(t, err)
-		assert.Equal(t, testIngressPortAllocation, *ret)
-	})
-}
-
-func TestPeerIngressPorts_Create_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/peers/Test/ingress/ports", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "No", Code: 400})
-			w.WriteHeader(400)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Peers.IngressPorts("Test").Create(context.Background(), api.PostApiPeersPeerIdIngressPortsJSONRequestBody{})
-		assert.Error(t, err)
-		assert.Equal(t, "No", err.Error())
-		assert.Nil(t, ret)
-	})
-}
-
-func TestPeerIngressPorts_Update_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/peers/Test/ingress/ports/alloc-1", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "PUT", r.Method)
-			retBytes, _ := json.Marshal(testIngressPortAllocation)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Peers.IngressPorts("Test").Update(context.Background(), "alloc-1", api.PutApiPeersPeerIdIngressPortsAllocationIdJSONRequestBody{})
-		require.NoError(t, err)
-		assert.Equal(t, testIngressPortAllocation, *ret)
-	})
-}
-
-func TestPeerIngressPorts_Update_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/peers/Test/ingress/ports/alloc-1", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "No", Code: 400})
-			w.WriteHeader(400)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Peers.IngressPorts("Test").Update(context.Background(), "alloc-1", api.PutApiPeersPeerIdIngressPortsAllocationIdJSONRequestBody{})
-		assert.Error(t, err)
-		assert.Equal(t, "No", err.Error())
-		assert.Nil(t, ret)
-	})
-}
-
-func TestPeerIngressPorts_Delete_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/peers/Test/ingress/ports/alloc-1", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "DELETE", r.Method)
-			w.WriteHeader(200)
-		})
-		err := c.Peers.IngressPorts("Test").Delete(context.Background(), "alloc-1")
-		require.NoError(t, err)
-	})
-}
-
-func TestPeerIngressPorts_Delete_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/peers/Test/ingress/ports/alloc-1", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "Not found", Code: 404})
-			w.WriteHeader(404)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		err := c.Peers.IngressPorts("Test").Delete(context.Background(), "alloc-1")
-		assert.Error(t, err)
-		assert.Equal(t, "Not found", err.Error())
-	})
-}
-
 func TestPeerJobs_List_200(t *testing.T) {
 	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
 		mux.HandleFunc("/api/peers/Test/jobs", func(w http.ResponseWriter, r *http.Request) {
diff --git a/shared/management/http/api/openapi.yml b/shared/management/http/api/openapi.yml
index 90b87462f..a8e0a7a56 100644
--- a/shared/management/http/api/openapi.yml
+++ b/shared/management/http/api/openapi.yml
@@ -31,9 +31,6 @@ tags:
     description: View information about the account and network events.
   - name: Accounts
     description: View information about the accounts.
-  - name: Ingress Ports
-    description: Interact with and view information about the ingress peers and ports.
-    x-cloud-only: true
   - name: Identity Providers
     description: Interact with and view information about identity providers.
   - name: Services
@@ -2439,222 +2436,6 @@ components:
         - initiator_email
         - target_id
         - meta
-    IngressPeerCreateRequest:
-      type: object
-      properties:
-        peer_id:
-          description: ID of the peer that is used as an ingress peer
-          type: string
-          example: ch8i4ug6lnn4g9hqv7m0
-        enabled:
-          description: Defines if an ingress peer is enabled
-          type: boolean
-          example: true
-        fallback:
-          description: Defines if an ingress peer can be used as a fallback if no ingress peer can be found in the region of the forwarded peer
-          type: boolean
-          example: true
-      required:
-        - peer_id
-        - enabled
-        - fallback
-    IngressPeerUpdateRequest:
-      type: object
-      properties:
-        enabled:
-          description: Defines if an ingress peer is enabled
-          type: boolean
-          example: true
-        fallback:
-          description: Defines if an ingress peer can be used as a fallback if no ingress peer can be found in the region of the forwarded peer
-          type: boolean
-          example: true
-      required:
-        - enabled
-        - fallback
-    IngressPeer:
-      type: object
-      properties:
-        id:
-          description: ID of the ingress peer
-          type: string
-          example: ch8i4ug6lnn4g9hqv7m0
-        peer_id:
-          description: ID of the peer that is used as an ingress peer
-          type: string
-          example: x7p3kqf2rdd8j5zxw4n9
-        ingress_ip:
-          description: Ingress IP address of the ingress peer where the traffic arrives
-          type: string
-          example: 192.34.0.123
-        available_ports:
-          $ref: '#/components/schemas/AvailablePorts'
-        enabled:
-          description: Indicates if an ingress peer is enabled
-          type: boolean
-          example: true
-        connected:
-          description: Indicates if an ingress peer is connected to the management server
-          type: boolean
-          example: true
-        fallback:
-          description: Indicates if an ingress peer can be used as a fallback if no ingress peer can be found in the region of the forwarded peer
-          type: boolean
-          example: true
-        region:
-          description: Region of the ingress peer
-          type: string
-          example: germany
-      required:
-        - id
-        - peer_id
-        - ingress_ip
-        - available_ports
-        - enabled
-        - connected
-        - fallback
-        - region
-    AvailablePorts:
-      type: object
-      properties:
-        tcp:
-          description: Number of available TCP  ports left on the ingress peer
-          type: integer
-          example: 45765
-        udp:
-          description: Number of available UDP ports left on the ingress peer
-          type: integer
-          example: 50000
-      required:
-        - tcp
-        - udp
-    IngressPortAllocationRequest:
-      type: object
-      properties:
-        name:
-          description: Name of the ingress port allocation
-          type: string
-          example: Ingress Port Allocation 1
-        enabled:
-          description: Indicates if an ingress port allocation is enabled
-          type: boolean
-          example: true
-        port_ranges:
-          description: List of port ranges that are forwarded by the ingress peer
-          type: array
-          items:
-            $ref: '#/components/schemas/IngressPortAllocationRequestPortRange'
-        direct_port:
-          description: Direct port allocation
-          $ref: '#/components/schemas/IngressPortAllocationRequestDirectPort'
-      required:
-        - name
-        - enabled
-    IngressPortAllocationRequestPortRange:
-      type: object
-      properties:
-        start:
-          description: The starting port of the range of forwarded ports
-          type: integer
-          example: 80
-        end:
-          description: The ending port of the range of forwarded ports
-          type: integer
-          example: 320
-        protocol:
-          description: The protocol accepted by the port range
-          type: string
-          enum: [ "tcp", "udp", "tcp/udp" ]
-          example: tcp
-      required:
-        - start
-        - end
-        - protocol
-    IngressPortAllocationRequestDirectPort:
-      type: object
-      properties:
-        count:
-          description: The number of ports to be forwarded
-          type: integer
-          example: 5
-        protocol:
-          description: The protocol accepted by the port
-          type: string
-          enum: [ "tcp", "udp", "tcp/udp" ]
-          example: udp
-      required:
-        - count
-        - protocol
-    IngressPortAllocation:
-      type: object
-      properties:
-        id:
-          description: ID of the ingress port allocation
-          type: string
-          example: ch8i4ug6lnn4g9hqv7m0
-        name:
-          description: Name of the ingress port allocation
-          type: string
-          example: Ingress Peer Allocation 1
-        ingress_peer_id:
-          description: ID of the ingress peer that forwards the ports
-          type: string
-          example: x7p3kqf2rdd8j5zxw4n9
-        region:
-          description: Region of the ingress peer
-          type: string
-          example: germany
-        enabled:
-          description: Indicates if an ingress port allocation is enabled
-          type: boolean
-          example: true
-        ingress_ip:
-          description: Ingress IP address of the ingress peer where the traffic arrives
-          type: string
-          example: 192.34.0.123
-        port_range_mappings:
-          description: List of port ranges that are allowed to be used by the ingress peer
-          type: array
-          items:
-            $ref: '#/components/schemas/IngressPortAllocationPortMapping'
-      required:
-        - id
-        - name
-        - ingress_peer_id
-        - region
-        - enabled
-        - ingress_ip
-        - port_range_mappings
-    IngressPortAllocationPortMapping:
-      type: object
-      properties:
-        translated_start:
-          description: The starting port of the translated range of forwarded ports
-          type: integer
-          example: 80
-        translated_end:
-          description: The ending port of the translated range of forwarded ports
-          type: integer
-          example: 320
-        ingress_start:
-          description: The starting port of the range of ingress ports mapped to the forwarded ports
-          type: integer
-          example: 1080
-        ingress_end:
-          description: The ending port of the range of ingress ports mapped to the forwarded ports
-          type: integer
-          example: 1320
-        protocol:
-          description: Protocol accepted by the ports
-          type: string
-          enum: [ "tcp", "udp", "tcp/udp" ]
-          example: tcp
-      required:
-        - translated_start
-        - translated_end
-        - ingress_start
-        - ingress_end
-        - protocol
     NetworkTrafficLocation:
       type: object
       properties:
@@ -7719,341 +7500,6 @@ paths:
           "$ref": "#/components/responses/forbidden"
         '500':
           "$ref": "#/components/responses/internal_error"
-  /api/peers/{peerId}/ingress/ports:
-    get:
-      x-cloud-only: true
-      summary: List all Port Allocations
-      description: Returns a list of all ingress port allocations for a peer
-      tags: [ Ingress Ports ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      parameters:
-        - in: path
-          name: peerId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of a peer
-        - in: query
-          name: name
-          schema:
-            type: string
-          description: Filters ingress port allocations by name
-      responses:
-        '200':
-          description: A JSON Array of Ingress Port Allocations
-          content:
-            application/json:
-              schema:
-                type: array
-                items:
-                  $ref: '#/components/schemas/IngressPortAllocation'
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '500':
-          "$ref": "#/components/responses/internal_error"
-    post:
-      x-cloud-only: true
-      summary: Create a Port Allocation
-      description: Creates a new ingress port allocation for a peer
-      tags: [ Ingress Ports ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      parameters:
-        - in: path
-          name: peerId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of a peer
-      requestBody:
-        description: New Ingress Port Allocation request
-        content:
-          'application/json':
-            schema:
-              $ref: '#/components/schemas/IngressPortAllocationRequest'
-      responses:
-        '200':
-          description: A Ingress Port Allocation object
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/IngressPortAllocation'
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '500':
-          "$ref": "#/components/responses/internal_error"
-  /api/peers/{peerId}/ingress/ports/{allocationId}:
-    get:
-      x-cloud-only: true
-      summary: Retrieve a Port Allocation
-      description: Get information about an ingress port allocation
-      tags: [ Ingress Ports ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      parameters:
-        - in: path
-          name: peerId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of a peer
-        - in: path
-          name: allocationId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of an ingress port allocation
-      responses:
-        '200':
-          description: A Ingress Port Allocation object
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/IngressPortAllocation'
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '500':
-          "$ref": "#/components/responses/internal_error"
-    put:
-      x-cloud-only: true
-      summary: Update a Port Allocation
-      description: Update information about an ingress port allocation
-      tags: [ Ingress Ports ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      parameters:
-        - in: path
-          name: peerId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of a peer
-        - in: path
-          name: allocationId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of an ingress port allocation
-      requestBody:
-        description: update an ingress port allocation
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/IngressPortAllocationRequest'
-      responses:
-        '200':
-          description: A Ingress Port Allocation object
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/IngressPortAllocation'
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '500':
-          "$ref": "#/components/responses/internal_error"
-    delete:
-      x-cloud-only: true
-      summary: Delete a Port Allocation
-      description: Delete an ingress port allocation
-      tags: [ Ingress Ports ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      parameters:
-        - in: path
-          name: peerId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of a peer
-        - in: path
-          name: allocationId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of an ingress port allocation
-      responses:
-        '200':
-          description: Delete status code
-          content: { }
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '500':
-          "$ref": "#/components/responses/internal_error"
-  /api/ingress/peers:
-    get:
-      x-cloud-only: true
-      summary: List all Ingress Peers
-      description: Returns a list of all ingress peers
-      tags: [ Ingress Ports ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      responses:
-        '200':
-          description: A JSON Array of Ingress Peers
-          content:
-            application/json:
-              schema:
-                type: array
-                items:
-                  $ref: '#/components/schemas/IngressPeer'
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '500':
-          "$ref": "#/components/responses/internal_error"
-    post:
-      x-cloud-only: true
-      summary: Create a Ingress Peer
-      description: Creates a new ingress peer
-      tags: [ Ingress Ports ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      requestBody:
-        description: New Ingress Peer request
-        content:
-          'application/json':
-            schema:
-              $ref: '#/components/schemas/IngressPeerCreateRequest'
-      responses:
-        '200':
-          description: A Ingress Peer object
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/IngressPeer'
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '500':
-          "$ref": "#/components/responses/internal_error"
-  /api/ingress/peers/{ingressPeerId}:
-    get:
-      x-cloud-only: true
-      summary: Retrieve a Ingress Peer
-      description: Get information about an ingress peer
-      tags: [ Ingress Ports ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      parameters:
-        - in: path
-          name: ingressPeerId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of an ingress peer
-      responses:
-        '200':
-          description: A Ingress Peer object
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/IngressPeer'
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '500':
-          "$ref": "#/components/responses/internal_error"
-    put:
-      x-cloud-only: true
-      summary: Update a Ingress Peer
-      description: Update information about an ingress peer
-      tags: [ Ingress Ports ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      parameters:
-        - in: path
-          name: ingressPeerId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of an ingress peer
-      requestBody:
-        description: update an ingress peer
-        content:
-          'application/json':
-            schema:
-              $ref: '#/components/schemas/IngressPeerUpdateRequest'
-      responses:
-        '200':
-          description: A Ingress Peer object
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/IngressPeer'
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '500':
-          "$ref": "#/components/responses/internal_error"
-    delete:
-      x-cloud-only: true
-      summary: Delete a Ingress Peer
-      description: Delete an ingress peer
-      tags: [ Ingress Ports ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      parameters:
-        - in: path
-          name: ingressPeerId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of an ingress peer
-      responses:
-        '200':
-          description: Delete status code
-          content: { }
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '500':
-          "$ref": "#/components/responses/internal_error"
   /api/setup-keys:
     get:
       summary: List all Setup Keys
diff --git a/shared/management/http/api/types.gen.go b/shared/management/http/api/types.gen.go
index 009a9a7a7..9be676a91 100644
--- a/shared/management/http/api/types.gen.go
+++ b/shared/management/http/api/types.gen.go
@@ -608,69 +608,6 @@ func (e IdentityProviderType) Valid() bool {
 	}
 }
 
-// Defines values for IngressPortAllocationPortMappingProtocol.
-const (
-	IngressPortAllocationPortMappingProtocolTcp    IngressPortAllocationPortMappingProtocol = "tcp"
-	IngressPortAllocationPortMappingProtocolTcpudp IngressPortAllocationPortMappingProtocol = "tcp/udp"
-	IngressPortAllocationPortMappingProtocolUdp    IngressPortAllocationPortMappingProtocol = "udp"
-)
-
-// Valid indicates whether the value is a known member of the IngressPortAllocationPortMappingProtocol enum.
-func (e IngressPortAllocationPortMappingProtocol) Valid() bool {
-	switch e {
-	case IngressPortAllocationPortMappingProtocolTcp:
-		return true
-	case IngressPortAllocationPortMappingProtocolTcpudp:
-		return true
-	case IngressPortAllocationPortMappingProtocolUdp:
-		return true
-	default:
-		return false
-	}
-}
-
-// Defines values for IngressPortAllocationRequestDirectPortProtocol.
-const (
-	IngressPortAllocationRequestDirectPortProtocolTcp    IngressPortAllocationRequestDirectPortProtocol = "tcp"
-	IngressPortAllocationRequestDirectPortProtocolTcpudp IngressPortAllocationRequestDirectPortProtocol = "tcp/udp"
-	IngressPortAllocationRequestDirectPortProtocolUdp    IngressPortAllocationRequestDirectPortProtocol = "udp"
-)
-
-// Valid indicates whether the value is a known member of the IngressPortAllocationRequestDirectPortProtocol enum.
-func (e IngressPortAllocationRequestDirectPortProtocol) Valid() bool {
-	switch e {
-	case IngressPortAllocationRequestDirectPortProtocolTcp:
-		return true
-	case IngressPortAllocationRequestDirectPortProtocolTcpudp:
-		return true
-	case IngressPortAllocationRequestDirectPortProtocolUdp:
-		return true
-	default:
-		return false
-	}
-}
-
-// Defines values for IngressPortAllocationRequestPortRangeProtocol.
-const (
-	IngressPortAllocationRequestPortRangeProtocolTcp    IngressPortAllocationRequestPortRangeProtocol = "tcp"
-	IngressPortAllocationRequestPortRangeProtocolTcpudp IngressPortAllocationRequestPortRangeProtocol = "tcp/udp"
-	IngressPortAllocationRequestPortRangeProtocolUdp    IngressPortAllocationRequestPortRangeProtocol = "udp"
-)
-
-// Valid indicates whether the value is a known member of the IngressPortAllocationRequestPortRangeProtocol enum.
-func (e IngressPortAllocationRequestPortRangeProtocol) Valid() bool {
-	switch e {
-	case IngressPortAllocationRequestPortRangeProtocolTcp:
-		return true
-	case IngressPortAllocationRequestPortRangeProtocolTcpudp:
-		return true
-	case IngressPortAllocationRequestPortRangeProtocolUdp:
-		return true
-	default:
-		return false
-	}
-}
-
 // Defines values for IntegrationResponsePlatform.
 const (
 	IntegrationResponsePlatformDatadog     IntegrationResponsePlatform = "datadog"
@@ -2600,15 +2537,6 @@ type AgentNetworkUsageBucket struct {
 	TotalTokens int64 `json:"total_tokens"`
 }
 
-// AvailablePorts defines model for AvailablePorts.
-type AvailablePorts struct {
-	// Tcp Number of available TCP  ports left on the ingress peer
-	Tcp int `json:"tcp"`
-
-	// Udp Number of available UDP ports left on the ingress peer
-	Udp int `json:"udp"`
-}
-
 // AzureIntegration defines model for AzureIntegration.
 type AzureIntegration struct {
 	// ClientId Azure AD application (client) ID
@@ -3461,139 +3389,6 @@ type IdpIntegrationSyncLog struct {
 	Timestamp time.Time `json:"timestamp"`
 }
 
-// IngressPeer defines model for IngressPeer.
-type IngressPeer struct {
-	AvailablePorts AvailablePorts `json:"available_ports"`
-
-	// Connected Indicates if an ingress peer is connected to the management server
-	Connected bool `json:"connected"`
-
-	// Enabled Indicates if an ingress peer is enabled
-	Enabled bool `json:"enabled"`
-
-	// Fallback Indicates if an ingress peer can be used as a fallback if no ingress peer can be found in the region of the forwarded peer
-	Fallback bool `json:"fallback"`
-
-	// Id ID of the ingress peer
-	Id string `json:"id"`
-
-	// IngressIp Ingress IP address of the ingress peer where the traffic arrives
-	IngressIp string `json:"ingress_ip"`
-
-	// PeerId ID of the peer that is used as an ingress peer
-	PeerId string `json:"peer_id"`
-
-	// Region Region of the ingress peer
-	Region string `json:"region"`
-}
-
-// IngressPeerCreateRequest defines model for IngressPeerCreateRequest.
-type IngressPeerCreateRequest struct {
-	// Enabled Defines if an ingress peer is enabled
-	Enabled bool `json:"enabled"`
-
-	// Fallback Defines if an ingress peer can be used as a fallback if no ingress peer can be found in the region of the forwarded peer
-	Fallback bool `json:"fallback"`
-
-	// PeerId ID of the peer that is used as an ingress peer
-	PeerId string `json:"peer_id"`
-}
-
-// IngressPeerUpdateRequest defines model for IngressPeerUpdateRequest.
-type IngressPeerUpdateRequest struct {
-	// Enabled Defines if an ingress peer is enabled
-	Enabled bool `json:"enabled"`
-
-	// Fallback Defines if an ingress peer can be used as a fallback if no ingress peer can be found in the region of the forwarded peer
-	Fallback bool `json:"fallback"`
-}
-
-// IngressPortAllocation defines model for IngressPortAllocation.
-type IngressPortAllocation struct {
-	// Enabled Indicates if an ingress port allocation is enabled
-	Enabled bool `json:"enabled"`
-
-	// Id ID of the ingress port allocation
-	Id string `json:"id"`
-
-	// IngressIp Ingress IP address of the ingress peer where the traffic arrives
-	IngressIp string `json:"ingress_ip"`
-
-	// IngressPeerId ID of the ingress peer that forwards the ports
-	IngressPeerId string `json:"ingress_peer_id"`
-
-	// Name Name of the ingress port allocation
-	Name string `json:"name"`
-
-	// PortRangeMappings List of port ranges that are allowed to be used by the ingress peer
-	PortRangeMappings []IngressPortAllocationPortMapping `json:"port_range_mappings"`
-
-	// Region Region of the ingress peer
-	Region string `json:"region"`
-}
-
-// IngressPortAllocationPortMapping defines model for IngressPortAllocationPortMapping.
-type IngressPortAllocationPortMapping struct {
-	// IngressEnd The ending port of the range of ingress ports mapped to the forwarded ports
-	IngressEnd int `json:"ingress_end"`
-
-	// IngressStart The starting port of the range of ingress ports mapped to the forwarded ports
-	IngressStart int `json:"ingress_start"`
-
-	// Protocol Protocol accepted by the ports
-	Protocol IngressPortAllocationPortMappingProtocol `json:"protocol"`
-
-	// TranslatedEnd The ending port of the translated range of forwarded ports
-	TranslatedEnd int `json:"translated_end"`
-
-	// TranslatedStart The starting port of the translated range of forwarded ports
-	TranslatedStart int `json:"translated_start"`
-}
-
-// IngressPortAllocationPortMappingProtocol Protocol accepted by the ports
-type IngressPortAllocationPortMappingProtocol string
-
-// IngressPortAllocationRequest defines model for IngressPortAllocationRequest.
-type IngressPortAllocationRequest struct {
-	DirectPort *IngressPortAllocationRequestDirectPort `json:"direct_port,omitempty"`
-
-	// Enabled Indicates if an ingress port allocation is enabled
-	Enabled bool `json:"enabled"`
-
-	// Name Name of the ingress port allocation
-	Name string `json:"name"`
-
-	// PortRanges List of port ranges that are forwarded by the ingress peer
-	PortRanges *[]IngressPortAllocationRequestPortRange `json:"port_ranges,omitempty"`
-}
-
-// IngressPortAllocationRequestDirectPort defines model for IngressPortAllocationRequestDirectPort.
-type IngressPortAllocationRequestDirectPort struct {
-	// Count The number of ports to be forwarded
-	Count int `json:"count"`
-
-	// Protocol The protocol accepted by the port
-	Protocol IngressPortAllocationRequestDirectPortProtocol `json:"protocol"`
-}
-
-// IngressPortAllocationRequestDirectPortProtocol The protocol accepted by the port
-type IngressPortAllocationRequestDirectPortProtocol string
-
-// IngressPortAllocationRequestPortRange defines model for IngressPortAllocationRequestPortRange.
-type IngressPortAllocationRequestPortRange struct {
-	// End The ending port of the range of forwarded ports
-	End int `json:"end"`
-
-	// Protocol The protocol accepted by the port range
-	Protocol IngressPortAllocationRequestPortRangeProtocol `json:"protocol"`
-
-	// Start The starting port of the range of forwarded ports
-	Start int `json:"start"`
-}
-
-// IngressPortAllocationRequestPortRangeProtocol The protocol accepted by the port range
-type IngressPortAllocationRequestPortRangeProtocol string
-
 // InstanceStatus Instance status information
 type InstanceStatus struct {
 	// SetupRequired Indicates whether the instance requires initial setup
@@ -6314,12 +6109,6 @@ type GetApiPeersParams struct {
 	Mac *string `form:"mac,omitempty" json:"mac,omitempty"`
 }
 
-// GetApiPeersPeerIdIngressPortsParams defines parameters for GetApiPeersPeerIdIngressPorts.
-type GetApiPeersPeerIdIngressPortsParams struct {
-	// Name Filters ingress port allocations by name
-	Name *string `form:"name,omitempty" json:"name,omitempty"`
-}
-
 // GetApiUsersParams defines parameters for GetApiUsers.
 type GetApiUsersParams struct {
 	// ServiceUser Filters users and returns either regular users or service users
@@ -6401,12 +6190,6 @@ type PostApiIdentityProvidersJSONRequestBody = IdentityProviderRequest
 // PutApiIdentityProvidersIdpIdJSONRequestBody defines body for PutApiIdentityProvidersIdpId for application/json ContentType.
 type PutApiIdentityProvidersIdpIdJSONRequestBody = IdentityProviderRequest
 
-// PostApiIngressPeersJSONRequestBody defines body for PostApiIngressPeers for application/json ContentType.
-type PostApiIngressPeersJSONRequestBody = IngressPeerCreateRequest
-
-// PutApiIngressPeersIngressPeerIdJSONRequestBody defines body for PutApiIngressPeersIngressPeerId for application/json ContentType.
-type PutApiIngressPeersIngressPeerIdJSONRequestBody = IngressPeerUpdateRequest
-
 // CreateAzureIntegrationJSONRequestBody defines body for CreateAzureIntegration for application/json ContentType.
 type CreateAzureIntegrationJSONRequestBody = CreateAzureIntegrationRequest
 
@@ -6515,12 +6298,6 @@ type PutApiNetworksNetworkIdRoutersRouterIdJSONRequestBody = NetworkRouterReques
 // PutApiPeersPeerIdJSONRequestBody defines body for PutApiPeersPeerId for application/json ContentType.
 type PutApiPeersPeerIdJSONRequestBody = PeerRequest
 
-// PostApiPeersPeerIdIngressPortsJSONRequestBody defines body for PostApiPeersPeerIdIngressPorts for application/json ContentType.
-type PostApiPeersPeerIdIngressPortsJSONRequestBody = IngressPortAllocationRequest
-
-// PutApiPeersPeerIdIngressPortsAllocationIdJSONRequestBody defines body for PutApiPeersPeerIdIngressPortsAllocationId for application/json ContentType.
-type PutApiPeersPeerIdIngressPortsAllocationIdJSONRequestBody = IngressPortAllocationRequest
-
 // PostApiPeersPeerIdJobsJSONRequestBody defines body for PostApiPeersPeerIdJobs for application/json ContentType.
 type PostApiPeersPeerIdJobsJSONRequestBody = JobRequest
 
diff --git a/shared/management/networkmap/envelope.go b/shared/management/networkmap/envelope.go
index fd9dd6bbd..b2fbbef08 100644
--- a/shared/management/networkmap/envelope.go
+++ b/shared/management/networkmap/envelope.go
@@ -15,7 +15,7 @@ import (
 //   - NetworkMap is the *proto.NetworkMap shape the engine reads today via
 //     update.GetNetworkMap() — built from the envelope's components by
 //     running Calculate() locally + converting back through the shared
-//     proto helpers + merging the optional ProxyPatch.
+//     proto helpers.
 //   - Components is the *types.NetworkMapComponents the engine retains so
 //     future incremental delta updates have a base to apply changes
 //     against. The client keeps it under its sync lock.
@@ -26,8 +26,8 @@ type EnvelopeResult struct {
 
 // EnvelopeToNetworkMap is the full client-side pipeline: decode the
 // component envelope back to a typed NetworkMapComponents, run Calculate()
-// locally to produce the typed NetworkMap, convert it to the wire form the
-// engine consumes, and fold in any ProxyPatch the server attached.
+// locally to produce the typed NetworkMap and convert it to the wire form the
+// engine consumes.
 //
 // localPeerKey is the receiving peer's WG pub key (used to derive
 // includeIPv6 / useSourcePrefixes from the receiving peer's own record in
@@ -107,74 +107,12 @@ func EnvelopeToNetworkMap(ctx context.Context, env *proto.NetworkMapEnvelope, lo
 		}
 	}
 
-	if typedNM.ForwardingRules != nil {
-		forwardingRules := make([]*proto.ForwardingRule, 0, len(typedNM.ForwardingRules))
-		for _, rule := range typedNM.ForwardingRules {
-			forwardingRules = append(forwardingRules, rule.ToProto())
-		}
-		protoNM.ForwardingRules = forwardingRules
-	}
-
-	// Merge the proxy patch the server attached. Mirrors the legacy
-	// NetworkMap.Merge step that the server runs after Calculate().
-	if full != nil && full.ProxyPatch != nil {
-		mergeProxyPatch(protoNM, full.ProxyPatch)
-	}
-
 	return &EnvelopeResult{
 		NetworkMap: protoNM,
 		Components: components,
 	}, nil
 }
 
-// mergeProxyPatch folds a ProxyPatch's pre-expanded fragments into the
-// proto.NetworkMap that Calculate() produced. Mirrors types.NetworkMap.Merge
-// — same six collections, deduplicated where the legacy merge dedupes.
-func mergeProxyPatch(nm *proto.NetworkMap, patch *proto.ProxyPatch) {
-	nm.RemotePeers = appendUniquePeers(nm.RemotePeers, patch.Peers)
-	nm.OfflinePeers = appendUniquePeers(nm.OfflinePeers, patch.OfflinePeers)
-	nm.FirewallRules = append(nm.FirewallRules, patch.FirewallRules...)
-	nm.Routes = append(nm.Routes, patch.Routes...)
-	nm.RoutesFirewallRules = append(nm.RoutesFirewallRules, patch.RouteFirewallRules...)
-	nm.ForwardingRules = append(nm.ForwardingRules, patch.ForwardingRules...)
-	if len(nm.RemotePeers) > 0 {
-		nm.RemotePeersIsEmpty = false
-	}
-	if len(nm.FirewallRules) > 0 {
-		nm.FirewallRulesIsEmpty = false
-	}
-	if len(nm.RoutesFirewallRules) > 0 {
-		nm.RoutesFirewallRulesIsEmpty = false
-	}
-}
-
-// appendUniquePeers dedupes by WgPubKey — mirrors legacy
-// mergeUniquePeersByID's intent (legacy keyed off Peer.ID; in proto form the
-// closest stable identifier is WgPubKey).
-func appendUniquePeers(dst, extra []*proto.RemotePeerConfig) []*proto.RemotePeerConfig {
-	if len(extra) == 0 {
-		return dst
-	}
-	seen := make(map[string]struct{}, len(dst))
-	for _, p := range dst {
-		if p == nil {
-			continue
-		}
-		seen[p.WgPubKey] = struct{}{}
-	}
-	for _, p := range extra {
-		if p == nil {
-			continue
-		}
-		if _, ok := seen[p.WgPubKey]; ok {
-			continue
-		}
-		seen[p.WgPubKey] = struct{}{}
-		dst = append(dst, p)
-	}
-	return dst
-}
-
 func trimKey(s string) string {
 	if len(s) > 12 {
 		return s[:12]
diff --git a/shared/management/proto/management.pb.go b/shared/management/proto/management.pb.go
index 60cfc71fe..de0fdd84d 100644
--- a/shared/management/proto/management.pb.go
+++ b/shared/management/proto/management.pb.go
@@ -2739,8 +2739,11 @@ type NetworkMap struct {
 	// RoutesFirewallRules represents a list of routes firewall rules to be applied to peer
 	RoutesFirewallRules []*RouteFirewallRule `protobuf:"bytes,10,rep,name=routesFirewallRules,proto3" json:"routesFirewallRules,omitempty"`
 	// RoutesFirewallRulesIsEmpty indicates whether RouteFirewallRule array is empty or not to bypass protobuf null and empty array equality.
-	RoutesFirewallRulesIsEmpty bool              `protobuf:"varint,11,opt,name=routesFirewallRulesIsEmpty,proto3" json:"routesFirewallRulesIsEmpty,omitempty"`
-	ForwardingRules            []*ForwardingRule `protobuf:"bytes,12,rep,name=forwardingRules,proto3" json:"forwardingRules,omitempty"`
+	RoutesFirewallRulesIsEmpty bool `protobuf:"varint,11,opt,name=routesFirewallRulesIsEmpty,proto3" json:"routesFirewallRulesIsEmpty,omitempty"`
+	// Unused; the ingress port-forwarding feature was discontinued.
+	//
+	// Deprecated: Do not use.
+	ForwardingRules []*ForwardingRule `protobuf:"bytes,12,rep,name=forwardingRules,proto3" json:"forwardingRules,omitempty"`
 	// SSHAuth represents SSH authorization configuration
 	SshAuth *SSHAuth `protobuf:"bytes,13,opt,name=sshAuth,proto3" json:"sshAuth,omitempty"`
 }
@@ -2854,6 +2857,7 @@ func (x *NetworkMap) GetRoutesFirewallRulesIsEmpty() bool {
 	return false
 }
 
+// Deprecated: Do not use.
 func (x *NetworkMap) GetForwardingRules() []*ForwardingRule {
 	if x != nil {
 		return x.ForwardingRules
@@ -4401,19 +4405,18 @@ func (x *RouteFirewallRule) GetRouteID() string {
 	return ""
 }
 
+// ForwardingRule is unused; the ingress port-forwarding feature was discontinued.
+//
+// Deprecated: Do not use.
 type ForwardingRule struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	// Protocol of the forwarding rule
-	Protocol RuleProtocol `protobuf:"varint,1,opt,name=protocol,proto3,enum=management.RuleProtocol" json:"protocol,omitempty"`
-	// portInfo is the ingress destination port information, where the traffic arrives in the gateway node
-	DestinationPort *PortInfo `protobuf:"bytes,2,opt,name=destinationPort,proto3" json:"destinationPort,omitempty"`
-	// IP address of the translated address (remote peer) to send traffic to
-	TranslatedAddress []byte `protobuf:"bytes,3,opt,name=translatedAddress,proto3" json:"translatedAddress,omitempty"`
-	// Translated port information, where the traffic should be forwarded to
-	TranslatedPort *PortInfo `protobuf:"bytes,4,opt,name=translatedPort,proto3" json:"translatedPort,omitempty"`
+	Protocol          RuleProtocol `protobuf:"varint,1,opt,name=protocol,proto3,enum=management.RuleProtocol" json:"protocol,omitempty"`
+	DestinationPort   *PortInfo    `protobuf:"bytes,2,opt,name=destinationPort,proto3" json:"destinationPort,omitempty"`
+	TranslatedAddress []byte       `protobuf:"bytes,3,opt,name=translatedAddress,proto3" json:"translatedAddress,omitempty"`
+	TranslatedPort    *PortInfo    `protobuf:"bytes,4,opt,name=translatedPort,proto3" json:"translatedPort,omitempty"`
 }
 
 func (x *ForwardingRule) Reset() {
@@ -4907,8 +4910,8 @@ func (*NetworkMapEnvelope_Delta) isNetworkMapEnvelope_Payload() {}
 // client decodes it into a types.NetworkMapComponents and runs Calculate()
 // locally to produce the same NetworkMap the legacy server path would have
 // produced. Every field carries RAW component data — no server-side
-// expansion (firewall rules, DNS config, SSH auth, route firewall rules,
-// forwarding rules) is shipped; the client computes those itself.
+// expansion (firewall rules, DNS config, SSH auth, route firewall rules)
+// is shipped; the client computes those itself.
 type NetworkMapComponentsFull struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -4973,11 +4976,9 @@ type NetworkMapComponentsFull struct {
 	// proto.DNSConfig.ForwarderPort). Computed by the controller from peer
 	// versions; clients fold it into their Calculate() DNS output.
 	DnsForwarderPort int64 `protobuf:"varint,23,opt,name=dns_forwarder_port,json=dnsForwarderPort,proto3" json:"dns_forwarder_port,omitempty"`
-	// Pre-expanded NetworkMap fragments injected post-Calculate by external
-	// controllers (BYOP / port-forwarding proxies). The receiving client
-	// merges these into its locally-computed NetworkMap the same way the
-	// legacy server does via NetworkMap.Merge — so downstream consumers see
-	// a unified merged result regardless of source.
+	// Unused; the ingress port-forwarding feature was discontinued.
+	//
+	// Deprecated: Do not use.
 	ProxyPatch *ProxyPatch `protobuf:"bytes,24,opt,name=proxy_patch,json=proxyPatch,proto3" json:"proxy_patch,omitempty"`
 	// SSH UserIDClaim — server-side HttpServerConfig.AuthUserIDClaim, or
 	// "sub" by default. Populated in proto.SSHAuth.UserIDClaim when the
@@ -5179,6 +5180,7 @@ func (x *NetworkMapComponentsFull) GetDnsForwarderPort() int64 {
 	return 0
 }
 
+// Deprecated: Do not use.
 func (x *NetworkMapComponentsFull) GetProxyPatch() *ProxyPatch {
 	if x != nil {
 		return x.ProxyPatch
@@ -5193,11 +5195,9 @@ func (x *NetworkMapComponentsFull) GetUserIdClaim() string {
 	return ""
 }
 
-// ProxyPatch carries NetworkMap fragments that don't fit the component-graph
-// model — they're pre-expanded by external controllers (BYOP /
-// port-forwarding proxies) and injected post-Calculate. Fields use the
-// legacy wire types because the proxy delivers them pre-formed; there is
-// no raw component shape to convert from. Empty when no proxy is active.
+// ProxyPatch is unused; the ingress port-forwarding feature was discontinued.
+//
+// Deprecated: Do not use.
 type ProxyPatch struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -7185,7 +7185,7 @@ var file_management_proto_rawDesc = []byte{
 	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x22, 0x0a,
 	0x0c, 0x61, 0x6c, 0x77, 0x61, 0x79, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x18, 0x02, 0x20,
 	0x01, 0x28, 0x08, 0x52, 0x0c, 0x61, 0x6c, 0x77, 0x61, 0x79, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74,
-	0x65, 0x22, 0xe8, 0x05, 0x0a, 0x0a, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70,
+	0x65, 0x22, 0xec, 0x05, 0x0a, 0x0a, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70,
 	0x12, 0x16, 0x0a, 0x06, 0x53, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04,
 	0x52, 0x06, 0x53, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x12, 0x36, 0x0a, 0x0a, 0x70, 0x65, 0x65, 0x72,
 	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d,
@@ -7224,444 +7224,445 @@ var file_management_proto_rawDesc = []byte{
 	0x73, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x49, 0x73,
 	0x45, 0x6d, 0x70, 0x74, 0x79, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x52, 0x1a, 0x72, 0x6f, 0x75,
 	0x74, 0x65, 0x73, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73,
-	0x49, 0x73, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x44, 0x0a, 0x0f, 0x66, 0x6f, 0x72, 0x77, 0x61,
+	0x49, 0x73, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x48, 0x0a, 0x0f, 0x66, 0x6f, 0x72, 0x77, 0x61,
 	0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x18, 0x0c, 0x20, 0x03, 0x28, 0x0b,
 	0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x46, 0x6f,
-	0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x52, 0x0f, 0x66, 0x6f,
-	0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x12, 0x2d, 0x0a,
-	0x07, 0x73, 0x73, 0x68, 0x41, 0x75, 0x74, 0x68, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x13,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x53, 0x48, 0x41,
-	0x75, 0x74, 0x68, 0x52, 0x07, 0x73, 0x73, 0x68, 0x41, 0x75, 0x74, 0x68, 0x22, 0x82, 0x02, 0x0a,
-	0x07, 0x53, 0x53, 0x48, 0x41, 0x75, 0x74, 0x68, 0x12, 0x20, 0x0a, 0x0b, 0x55, 0x73, 0x65, 0x72,
-	0x49, 0x44, 0x43, 0x6c, 0x61, 0x69, 0x6d, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x55,
-	0x73, 0x65, 0x72, 0x49, 0x44, 0x43, 0x6c, 0x61, 0x69, 0x6d, 0x12, 0x28, 0x0a, 0x0f, 0x41, 0x75,
-	0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x55, 0x73, 0x65, 0x72, 0x73, 0x18, 0x02, 0x20,
-	0x03, 0x28, 0x0c, 0x52, 0x0f, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x55,
-	0x73, 0x65, 0x72, 0x73, 0x12, 0x4a, 0x0a, 0x0d, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f,
-	0x75, 0x73, 0x65, 0x72, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x53, 0x48, 0x41, 0x75, 0x74, 0x68,
-	0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x55, 0x73, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74,
-	0x72, 0x79, 0x52, 0x0c, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x55, 0x73, 0x65, 0x72, 0x73,
-	0x1a, 0x5f, 0x0a, 0x11, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x55, 0x73, 0x65, 0x72, 0x73,
-	0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x34, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x55, 0x73, 0x65, 0x72, 0x49,
-	0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38,
-	0x01, 0x22, 0x2e, 0x0a, 0x12, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x55, 0x73, 0x65, 0x72,
-	0x49, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x69, 0x6e, 0x64, 0x65, 0x78,
-	0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0d, 0x52, 0x07, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x65,
-	0x73, 0x22, 0xf0, 0x01, 0x0a, 0x10, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72,
-	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x1a, 0x0a, 0x08, 0x77, 0x67, 0x50, 0x75, 0x62, 0x4b,
-	0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x77, 0x67, 0x50, 0x75, 0x62, 0x4b,
-	0x65, 0x79, 0x12, 0x1e, 0x0a, 0x0a, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x49, 0x70, 0x73,
-	0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0a, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x49,
-	0x70, 0x73, 0x12, 0x33, 0x0a, 0x09, 0x73, 0x73, 0x68, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x2e, 0x53, 0x53, 0x48, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x09, 0x73, 0x73,
-	0x68, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x66, 0x71, 0x64, 0x6e, 0x18,
-	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x66, 0x71, 0x64, 0x6e, 0x12, 0x22, 0x0a, 0x0c, 0x61,
-	0x67, 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x0c, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12,
-	0x33, 0x0a, 0x09, 0x6c, 0x61, 0x7a, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x18, 0x06, 0x20, 0x01,
-	0x28, 0x0e, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x4c, 0x61, 0x7a, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x09, 0x6c, 0x61, 0x7a, 0x79, 0x53,
-	0x74, 0x61, 0x74, 0x65, 0x22, 0x7e, 0x0a, 0x09, 0x53, 0x53, 0x48, 0x43, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x12, 0x1e, 0x0a, 0x0a, 0x73, 0x73, 0x68, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x73, 0x73, 0x68, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65,
-	0x64, 0x12, 0x1c, 0x0a, 0x09, 0x73, 0x73, 0x68, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x73, 0x73, 0x68, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x12,
-	0x33, 0x0a, 0x09, 0x6a, 0x77, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x03, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x4a, 0x57, 0x54, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x09, 0x6a, 0x77, 0x74, 0x43, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x22, 0x20, 0x0a, 0x1e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75,
-	0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0xbf, 0x01, 0x0a, 0x17, 0x44, 0x65, 0x76, 0x69, 0x63,
-	0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c,
-	0x6f, 0x77, 0x12, 0x48, 0x0a, 0x08, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x0e, 0x32, 0x2c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
-	0x74, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64,
-	0x65, 0x72, 0x52, 0x08, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x12, 0x42, 0x0a, 0x0e,
-	0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
-	0x74, 0x2e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x52, 0x0e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x22, 0x16, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x12, 0x0a, 0x0a, 0x06,
-	0x48, 0x4f, 0x53, 0x54, 0x45, 0x44, 0x10, 0x00, 0x22, 0x1e, 0x0a, 0x1c, 0x50, 0x4b, 0x43, 0x45,
-	0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f,
-	0x77, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x5b, 0x0a, 0x15, 0x50, 0x4b, 0x43, 0x45,
-	0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f,
-	0x77, 0x12, 0x42, 0x0a, 0x0e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0xbc, 0x03, 0x0a, 0x0e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64,
-	0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x1a, 0x0a, 0x08, 0x43, 0x6c, 0x69, 0x65,
-	0x6e, 0x74, 0x49, 0x44, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x43, 0x6c, 0x69, 0x65,
-	0x6e, 0x74, 0x49, 0x44, 0x12, 0x26, 0x0a, 0x0c, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x53, 0x65,
-	0x63, 0x72, 0x65, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x02, 0x18, 0x01, 0x52, 0x0c,
-	0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x16, 0x0a, 0x06,
-	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x44, 0x6f,
-	0x6d, 0x61, 0x69, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x41, 0x75, 0x64, 0x69, 0x65, 0x6e, 0x63, 0x65,
-	0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x41, 0x75, 0x64, 0x69, 0x65, 0x6e, 0x63, 0x65,
-	0x12, 0x2e, 0x0a, 0x12, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x45, 0x6e,
-	0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x44, 0x65,
-	0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74,
-	0x12, 0x24, 0x0a, 0x0d, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e,
-	0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x45, 0x6e,
-	0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x18,
-	0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x12, 0x1e, 0x0a, 0x0a,
-	0x55, 0x73, 0x65, 0x49, 0x44, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08,
-	0x52, 0x0a, 0x55, 0x73, 0x65, 0x49, 0x44, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x34, 0x0a, 0x15,
-	0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x64,
-	0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x52, 0x15, 0x41, 0x75, 0x74,
-	0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69,
-	0x6e, 0x74, 0x12, 0x22, 0x0a, 0x0c, 0x52, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x55, 0x52,
-	0x4c, 0x73, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x52, 0x65, 0x64, 0x69, 0x72, 0x65,
-	0x63, 0x74, 0x55, 0x52, 0x4c, 0x73, 0x12, 0x2e, 0x0a, 0x12, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c,
-	0x65, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x18, 0x0b, 0x20, 0x01,
-	0x28, 0x08, 0x52, 0x12, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x6d, 0x70,
-	0x74, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x1c, 0x0a, 0x09, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x46,
-	0x6c, 0x61, 0x67, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x09, 0x4c, 0x6f, 0x67, 0x69, 0x6e,
-	0x46, 0x6c, 0x61, 0x67, 0x22, 0x93, 0x02, 0x0a, 0x05, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x12, 0x0e,
-	0x0a, 0x02, 0x49, 0x44, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x49, 0x44, 0x12, 0x18,
-	0x0a, 0x07, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x07, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x12, 0x20, 0x0a, 0x0b, 0x4e, 0x65, 0x74, 0x77,
-	0x6f, 0x72, 0x6b, 0x54, 0x79, 0x70, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0b, 0x4e,
-	0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x54, 0x79, 0x70, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x50, 0x65,
-	0x65, 0x72, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x50, 0x65, 0x65, 0x72, 0x12, 0x16,
-	0x0a, 0x06, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x18, 0x05, 0x20, 0x01, 0x28, 0x03, 0x52, 0x06,
-	0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x12, 0x1e, 0x0a, 0x0a, 0x4d, 0x61, 0x73, 0x71, 0x75, 0x65,
-	0x72, 0x61, 0x64, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x4d, 0x61, 0x73, 0x71,
-	0x75, 0x65, 0x72, 0x61, 0x64, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x4e, 0x65, 0x74, 0x49, 0x44, 0x18,
-	0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x4e, 0x65, 0x74, 0x49, 0x44, 0x12, 0x18, 0x0a, 0x07,
-	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x44,
-	0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x1c, 0x0a, 0x09, 0x6b, 0x65, 0x65, 0x70, 0x52, 0x6f,
-	0x75, 0x74, 0x65, 0x18, 0x09, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x6b, 0x65, 0x65, 0x70, 0x52,
-	0x6f, 0x75, 0x74, 0x65, 0x12, 0x24, 0x0a, 0x0d, 0x73, 0x6b, 0x69, 0x70, 0x41, 0x75, 0x74, 0x6f,
-	0x41, 0x70, 0x70, 0x6c, 0x79, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x73, 0x6b, 0x69,
-	0x70, 0x41, 0x75, 0x74, 0x6f, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x22, 0xde, 0x01, 0x0a, 0x09, 0x44,
-	0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x24, 0x0a, 0x0d, 0x53, 0x65, 0x72, 0x76,
-	0x69, 0x63, 0x65, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x0d, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x12, 0x47,
-	0x0a, 0x10, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75,
-	0x70, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72,
-	0x47, 0x72, 0x6f, 0x75, 0x70, 0x52, 0x10, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65,
-	0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x38, 0x0a, 0x0b, 0x43, 0x75, 0x73, 0x74, 0x6f,
-	0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d,
-	0x5a, 0x6f, 0x6e, 0x65, 0x52, 0x0b, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65,
-	0x73, 0x12, 0x28, 0x0a, 0x0d, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x50, 0x6f,
-	0x72, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x42, 0x02, 0x18, 0x01, 0x52, 0x0d, 0x46, 0x6f,
-	0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x50, 0x6f, 0x72, 0x74, 0x22, 0xb8, 0x01, 0x0a, 0x0a,
-	0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x44, 0x6f,
-	0x6d, 0x61, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x44, 0x6f, 0x6d, 0x61,
-	0x69, 0x6e, 0x12, 0x32, 0x0a, 0x07, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x18, 0x02, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x2e, 0x53, 0x69, 0x6d, 0x70, 0x6c, 0x65, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x52, 0x07, 0x52,
-	0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x12, 0x32, 0x0a, 0x14, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68,
-	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x03,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x14, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x44, 0x6f, 0x6d, 0x61,
-	0x69, 0x6e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x2a, 0x0a, 0x10, 0x4e, 0x6f,
-	0x6e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x61, 0x74, 0x69, 0x76, 0x65, 0x18, 0x04,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x4e, 0x6f, 0x6e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
-	0x74, 0x61, 0x74, 0x69, 0x76, 0x65, 0x22, 0x74, 0x0a, 0x0c, 0x53, 0x69, 0x6d, 0x70, 0x6c, 0x65,
-	0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x54, 0x79,
-	0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x04, 0x54, 0x79, 0x70, 0x65, 0x12, 0x14,
-	0x0a, 0x05, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x43,
-	0x6c, 0x61, 0x73, 0x73, 0x12, 0x10, 0x0a, 0x03, 0x54, 0x54, 0x4c, 0x18, 0x04, 0x20, 0x01, 0x28,
-	0x03, 0x52, 0x03, 0x54, 0x54, 0x4c, 0x12, 0x14, 0x0a, 0x05, 0x52, 0x44, 0x61, 0x74, 0x61, 0x18,
-	0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x52, 0x44, 0x61, 0x74, 0x61, 0x22, 0xb3, 0x01, 0x0a,
-	0x0f, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70,
-	0x12, 0x38, 0x0a, 0x0b, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x18,
-	0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x0b, 0x4e,
-	0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x50, 0x72,
-	0x69, 0x6d, 0x61, 0x72, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x50, 0x72, 0x69,
-	0x6d, 0x61, 0x72, 0x79, 0x12, 0x18, 0x0a, 0x07, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18,
-	0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x32,
-	0x0a, 0x14, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x45,
-	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x14, 0x53, 0x65,
-	0x61, 0x72, 0x63, 0x68, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x45, 0x6e, 0x61, 0x62, 0x6c,
-	0x65, 0x64, 0x22, 0x48, 0x0a, 0x0a, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72,
-	0x12, 0x0e, 0x0a, 0x02, 0x49, 0x50, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x49, 0x50,
-	0x12, 0x16, 0x0a, 0x06, 0x4e, 0x53, 0x54, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03,
-	0x52, 0x06, 0x4e, 0x53, 0x54, 0x79, 0x70, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x50, 0x6f, 0x72, 0x74,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52, 0x04, 0x50, 0x6f, 0x72, 0x74, 0x22, 0xfb, 0x02, 0x0a,
-	0x0c, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x12, 0x1a, 0x0a,
-	0x06, 0x50, 0x65, 0x65, 0x72, 0x49, 0x50, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x02, 0x18,
-	0x01, 0x52, 0x06, 0x50, 0x65, 0x65, 0x72, 0x49, 0x50, 0x12, 0x37, 0x0a, 0x09, 0x44, 0x69, 0x72,
-	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x19, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x44, 0x69,
-	0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x09, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x12, 0x2e, 0x0a, 0x06, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01,
-	0x28, 0x0e, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x52, 0x75, 0x6c, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x41, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x12, 0x34, 0x0a, 0x08, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x04,
-	0x20, 0x01, 0x28, 0x0e, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
-	0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08,
-	0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x12, 0x0a, 0x04, 0x50, 0x6f, 0x72, 0x74,
-	0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x30, 0x0a, 0x08,
-	0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74,
-	0x49, 0x6e, 0x66, 0x6f, 0x52, 0x08, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x1a,
-	0x0a, 0x08, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x44, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0c,
-	0x52, 0x08, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x44, 0x12, 0x26, 0x0a, 0x0e, 0x63, 0x75,
-	0x73, 0x74, 0x6f, 0x6d, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x08, 0x20, 0x01,
-	0x28, 0x0d, 0x52, 0x0e, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63,
-	0x6f, 0x6c, 0x12, 0x26, 0x0a, 0x0e, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x72, 0x65, 0x66,
-	0x69, 0x78, 0x65, 0x73, 0x18, 0x09, 0x20, 0x03, 0x28, 0x0c, 0x52, 0x0e, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x65, 0x73, 0x22, 0x38, 0x0a, 0x0e, 0x4e, 0x65,
-	0x74, 0x77, 0x6f, 0x72, 0x6b, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x14, 0x0a, 0x05,
-	0x6e, 0x65, 0x74, 0x49, 0x50, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6e, 0x65, 0x74,
-	0x49, 0x50, 0x12, 0x10, 0x0a, 0x03, 0x6d, 0x61, 0x63, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x03, 0x6d, 0x61, 0x63, 0x22, 0x1e, 0x0a, 0x06, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x73, 0x12, 0x14,
-	0x0a, 0x05, 0x46, 0x69, 0x6c, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x05, 0x46,
-	0x69, 0x6c, 0x65, 0x73, 0x22, 0x96, 0x01, 0x0a, 0x08, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66,
-	0x6f, 0x12, 0x14, 0x0a, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x48,
-	0x00, 0x52, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x32, 0x0a, 0x05, 0x72, 0x61, 0x6e, 0x67, 0x65,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x2e, 0x52, 0x61, 0x6e,
-	0x67, 0x65, 0x48, 0x00, 0x52, 0x05, 0x72, 0x61, 0x6e, 0x67, 0x65, 0x1a, 0x2f, 0x0a, 0x05, 0x52,
-	0x61, 0x6e, 0x67, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x0d, 0x52, 0x05, 0x73, 0x74, 0x61, 0x72, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x6e,
-	0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x03, 0x65, 0x6e, 0x64, 0x42, 0x0f, 0x0a, 0x0d,
-	0x70, 0x6f, 0x72, 0x74, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x87, 0x03,
-	0x0a, 0x11, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52,
-	0x75, 0x6c, 0x65, 0x12, 0x22, 0x0a, 0x0c, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x61, 0x6e,
-	0x67, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x12, 0x2e, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52,
-	0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x74, 0x69,
-	0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65,
-	0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x34, 0x0a, 0x08, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x18, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f,
-	0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12,
-	0x30, 0x0a, 0x08, 0x70, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x18, 0x05, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50,
-	0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x08, 0x70, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66,
-	0x6f, 0x12, 0x1c, 0x0a, 0x09, 0x69, 0x73, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x18, 0x06,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x69, 0x73, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x12,
-	0x18, 0x0a, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x09,
-	0x52, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x26, 0x0a, 0x0e, 0x63, 0x75, 0x73,
-	0x74, 0x6f, 0x6d, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x08, 0x20, 0x01, 0x28,
-	0x0d, 0x52, 0x0e, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f,
-	0x6c, 0x12, 0x1a, 0x0a, 0x08, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x44, 0x18, 0x09, 0x20,
-	0x01, 0x28, 0x0c, 0x52, 0x08, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x44, 0x12, 0x18, 0x0a,
-	0x07, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x49, 0x44, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07,
-	0x52, 0x6f, 0x75, 0x74, 0x65, 0x49, 0x44, 0x22, 0xf2, 0x01, 0x0a, 0x0e, 0x46, 0x6f, 0x72, 0x77,
-	0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x12, 0x34, 0x0a, 0x08, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x18, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x50, 0x72,
-	0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c,
-	0x12, 0x3e, 0x0a, 0x0f, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50,
-	0x6f, 0x72, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52,
-	0x0f, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x6f, 0x72, 0x74,
-	0x12, 0x2c, 0x0a, 0x11, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x41, 0x64,
-	0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x11, 0x74, 0x72, 0x61,
-	0x6e, 0x73, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x3c,
-	0x0a, 0x0e, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x50, 0x6f, 0x72, 0x74,
-	0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x0e, 0x74, 0x72,
-	0x61, 0x6e, 0x73, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x50, 0x6f, 0x72, 0x74, 0x22, 0x8b, 0x02, 0x0a,
-	0x14, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x0d, 0x52, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x36, 0x0a, 0x08, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1a, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x50,
-	0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f,
-	0x6c, 0x12, 0x10, 0x0a, 0x03, 0x70, 0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03,
-	0x70, 0x69, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18,
-	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12,
-	0x1f, 0x0a, 0x0b, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x05,
-	0x20, 0x03, 0x28, 0x09, 0x52, 0x0a, 0x75, 0x73, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73,
-	0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x1f, 0x0a, 0x0b, 0x6e, 0x61, 0x6d, 0x65,
-	0x5f, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6e,
-	0x61, 0x6d, 0x65, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x12, 0x1f, 0x0a, 0x0b, 0x6c, 0x69, 0x73,
-	0x74, 0x65, 0x6e, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0a,
-	0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x50, 0x6f, 0x72, 0x74, 0x22, 0xa1, 0x01, 0x0a, 0x15, 0x45,
-	0x78, 0x70, 0x6f, 0x73, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f,
-	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76,
-	0x69, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69,
-	0x63, 0x65, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x73, 0x65,
-	0x72, 0x76, 0x69, 0x63, 0x65, 0x55, 0x72, 0x6c, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61,
-	0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
-	0x12, 0x2c, 0x0a, 0x12, 0x70, 0x6f, 0x72, 0x74, 0x5f, 0x61, 0x75, 0x74, 0x6f, 0x5f, 0x61, 0x73,
-	0x73, 0x69, 0x67, 0x6e, 0x65, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x70, 0x6f,
-	0x72, 0x74, 0x41, 0x75, 0x74, 0x6f, 0x41, 0x73, 0x73, 0x69, 0x67, 0x6e, 0x65, 0x64, 0x22, 0x2c,
-	0x0a, 0x12, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x22, 0x15, 0x0a, 0x13,
-	0x52, 0x65, 0x6e, 0x65, 0x77, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x22, 0x2b, 0x0a, 0x11, 0x53, 0x74, 0x6f, 0x70, 0x45, 0x78, 0x70, 0x6f, 0x73,
-	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61,
-	0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
-	0x22, 0x14, 0x0a, 0x12, 0x53, 0x74, 0x6f, 0x70, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x9a, 0x01, 0x0a, 0x12, 0x4e, 0x65, 0x74, 0x77, 0x6f,
-	0x72, 0x6b, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x76, 0x65, 0x6c, 0x6f, 0x70, 0x65, 0x12, 0x3a, 0x0a,
-	0x04, 0x66, 0x75, 0x6c, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
-	0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c,
-	0x6c, 0x48, 0x00, 0x52, 0x04, 0x66, 0x75, 0x6c, 0x6c, 0x12, 0x3d, 0x0a, 0x05, 0x64, 0x65, 0x6c,
-	0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70,
-	0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x44, 0x65, 0x6c, 0x74, 0x61, 0x48,
-	0x00, 0x52, 0x05, 0x64, 0x65, 0x6c, 0x74, 0x61, 0x42, 0x09, 0x0a, 0x07, 0x70, 0x61, 0x79, 0x6c,
-	0x6f, 0x61, 0x64, 0x22, 0x92, 0x0f, 0x0a, 0x18, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d,
-	0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c,
-	0x12, 0x16, 0x0a, 0x06, 0x73, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04,
-	0x52, 0x06, 0x73, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x12, 0x37, 0x0a, 0x0b, 0x70, 0x65, 0x65, 0x72,
-	0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x43,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0a, 0x70, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x12, 0x34, 0x0a, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18, 0x03, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x07,
-	0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x12, 0x4d, 0x0a, 0x10, 0x61, 0x63, 0x63, 0x6f, 0x75,
-	0x6e, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41,
-	0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x43, 0x6f,
-	0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x0f, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x53, 0x65,
-	0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x41, 0x0a, 0x0c, 0x64, 0x6e, 0x73, 0x5f, 0x73, 0x65,
-	0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x44, 0x4e, 0x53, 0x53, 0x65, 0x74,
-	0x74, 0x69, 0x6e, 0x67, 0x73, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x0b, 0x64, 0x6e,
-	0x73, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x64, 0x6e, 0x73,
-	0x5f, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x64,
-	0x6e, 0x73, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x2c, 0x0a, 0x12, 0x63, 0x75, 0x73, 0x74,
-	0x6f, 0x6d, 0x5f, 0x7a, 0x6f, 0x6e, 0x65, 0x5f, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x07,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65,
-	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x25, 0x0a, 0x0e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x5f,
-	0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0d,
-	0x61, 0x67, 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x2d, 0x0a,
-	0x05, 0x70, 0x65, 0x65, 0x72, 0x73, 0x18, 0x09, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f,
-	0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x05, 0x70, 0x65, 0x65, 0x72, 0x73, 0x12, 0x2e, 0x0a, 0x13,
-	0x72, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x5f, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65,
-	0x78, 0x65, 0x73, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x0d, 0x52, 0x11, 0x72, 0x6f, 0x75, 0x74, 0x65,
-	0x72, 0x50, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x12, 0x35, 0x0a, 0x08,
-	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x18, 0x0b, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x19,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x6c, 0x69,
-	0x63, 0x79, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x08, 0x70, 0x6f, 0x6c, 0x69, 0x63,
-	0x69, 0x65, 0x73, 0x12, 0x30, 0x0a, 0x06, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x0c, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x2e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x06, 0x67,
-	0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x2c, 0x0a, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18,
-	0x0d, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x61, 0x77, 0x52, 0x06, 0x72, 0x6f, 0x75,
-	0x74, 0x65, 0x73, 0x12, 0x4b, 0x0a, 0x11, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65,
-	0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x0e, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x61, 0x6d, 0x65,
-	0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x52, 0x61, 0x77, 0x52, 0x10,
-	0x6e, 0x61, 0x6d, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73,
-	0x12, 0x40, 0x0a, 0x0f, 0x61, 0x6c, 0x6c, 0x5f, 0x64, 0x6e, 0x73, 0x5f, 0x72, 0x65, 0x63, 0x6f,
-	0x72, 0x64, 0x73, 0x18, 0x0f, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x69, 0x6d, 0x70, 0x6c, 0x65, 0x52, 0x65, 0x63,
-	0x6f, 0x72, 0x64, 0x52, 0x0d, 0x61, 0x6c, 0x6c, 0x44, 0x6e, 0x73, 0x52, 0x65, 0x63, 0x6f, 0x72,
-	0x64, 0x73, 0x12, 0x3b, 0x0a, 0x0d, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x7a, 0x6f,
-	0x6e, 0x65, 0x73, 0x18, 0x10, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e,
-	0x65, 0x52, 0x0c, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5a, 0x6f, 0x6e, 0x65, 0x73, 0x12,
-	0x4b, 0x0a, 0x11, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x73, 0x18, 0x11, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x61, 0x77, 0x52, 0x10, 0x6e, 0x65, 0x74, 0x77,
-	0x6f, 0x72, 0x6b, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x55, 0x0a, 0x0b,
-	0x72, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x73, 0x5f, 0x6d, 0x61, 0x70, 0x18, 0x12, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x34, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e,
-	0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65,
-	0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x73, 0x4d,
-	0x61, 0x70, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0a, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x73,
-	0x4d, 0x61, 0x70, 0x12, 0x71, 0x0a, 0x15, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f,
-	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x5f, 0x6d, 0x61, 0x70, 0x18, 0x13, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x3d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x42, 0x02, 0x18, 0x01,
+	0x52, 0x0f, 0x66, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65,
+	0x73, 0x12, 0x2d, 0x0a, 0x07, 0x73, 0x73, 0x68, 0x41, 0x75, 0x74, 0x68, 0x18, 0x0d, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x13, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x53, 0x53, 0x48, 0x41, 0x75, 0x74, 0x68, 0x52, 0x07, 0x73, 0x73, 0x68, 0x41, 0x75, 0x74, 0x68,
+	0x22, 0x82, 0x02, 0x0a, 0x07, 0x53, 0x53, 0x48, 0x41, 0x75, 0x74, 0x68, 0x12, 0x20, 0x0a, 0x0b,
+	0x55, 0x73, 0x65, 0x72, 0x49, 0x44, 0x43, 0x6c, 0x61, 0x69, 0x6d, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0b, 0x55, 0x73, 0x65, 0x72, 0x49, 0x44, 0x43, 0x6c, 0x61, 0x69, 0x6d, 0x12, 0x28,
+	0x0a, 0x0f, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x55, 0x73, 0x65, 0x72,
+	0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0c, 0x52, 0x0f, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
+	0x7a, 0x65, 0x64, 0x55, 0x73, 0x65, 0x72, 0x73, 0x12, 0x4a, 0x0a, 0x0d, 0x6d, 0x61, 0x63, 0x68,
+	0x69, 0x6e, 0x65, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x25, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x53, 0x48,
+	0x41, 0x75, 0x74, 0x68, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x55, 0x73, 0x65, 0x72,
+	0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0c, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x55,
+	0x73, 0x65, 0x72, 0x73, 0x1a, 0x5f, 0x0a, 0x11, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x55,
+	0x73, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x34, 0x0a, 0x05, 0x76,
+	0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x55,
+	0x73, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x2e, 0x0a, 0x12, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
+	0x55, 0x73, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x69,
+	0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0d, 0x52, 0x07, 0x69, 0x6e,
+	0x64, 0x65, 0x78, 0x65, 0x73, 0x22, 0xf0, 0x01, 0x0a, 0x10, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65,
+	0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x1a, 0x0a, 0x08, 0x77, 0x67,
+	0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x77, 0x67,
+	0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x12, 0x1e, 0x0a, 0x0a, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65,
+	0x64, 0x49, 0x70, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0a, 0x61, 0x6c, 0x6c, 0x6f,
+	0x77, 0x65, 0x64, 0x49, 0x70, 0x73, 0x12, 0x33, 0x0a, 0x09, 0x73, 0x73, 0x68, 0x43, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x53, 0x48, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x52, 0x09, 0x73, 0x73, 0x68, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x66,
+	0x71, 0x64, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x66, 0x71, 0x64, 0x6e, 0x12,
+	0x22, 0x0a, 0x0c, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18,
+	0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72, 0x73,
+	0x69, 0x6f, 0x6e, 0x12, 0x33, 0x0a, 0x09, 0x6c, 0x61, 0x7a, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65,
+	0x18, 0x06, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x4c, 0x61, 0x7a, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x09, 0x6c,
+	0x61, 0x7a, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x22, 0x7e, 0x0a, 0x09, 0x53, 0x53, 0x48, 0x43,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x1e, 0x0a, 0x0a, 0x73, 0x73, 0x68, 0x45, 0x6e, 0x61, 0x62,
+	0x6c, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x73, 0x73, 0x68, 0x45, 0x6e,
+	0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x1c, 0x0a, 0x09, 0x73, 0x73, 0x68, 0x50, 0x75, 0x62, 0x4b,
+	0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x73, 0x73, 0x68, 0x50, 0x75, 0x62,
+	0x4b, 0x65, 0x79, 0x12, 0x33, 0x0a, 0x09, 0x6a, 0x77, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x4a, 0x57, 0x54, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x09, 0x6a,
+	0x77, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0x20, 0x0a, 0x1e, 0x44, 0x65, 0x76, 0x69,
+	0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46,
+	0x6c, 0x6f, 0x77, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0xbf, 0x01, 0x0a, 0x17, 0x44,
+	0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x12, 0x48, 0x0a, 0x08, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64,
+	0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68,
+	0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x2e, 0x70, 0x72,
+	0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x52, 0x08, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72,
+	0x12, 0x42, 0x0a, 0x0e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x52, 0x0e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x22, 0x16, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72,
+	0x12, 0x0a, 0x0a, 0x06, 0x48, 0x4f, 0x53, 0x54, 0x45, 0x44, 0x10, 0x00, 0x22, 0x1e, 0x0a, 0x1c,
+	0x50, 0x4b, 0x43, 0x45, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x5b, 0x0a, 0x15,
+	0x50, 0x4b, 0x43, 0x45, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x12, 0x42, 0x0a, 0x0e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65,
+	0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x76, 0x69,
+	0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0e, 0x50, 0x72, 0x6f, 0x76, 0x69,
+	0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0xbc, 0x03, 0x0a, 0x0e, 0x50, 0x72,
+	0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x1a, 0x0a, 0x08,
+	0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49, 0x44, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
+	0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49, 0x44, 0x12, 0x26, 0x0a, 0x0c, 0x43, 0x6c, 0x69, 0x65,
+	0x6e, 0x74, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x02,
+	0x18, 0x01, 0x52, 0x0c, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74,
+	0x12, 0x16, 0x0a, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x41, 0x75, 0x64, 0x69,
+	0x65, 0x6e, 0x63, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x41, 0x75, 0x64, 0x69,
+	0x65, 0x6e, 0x63, 0x65, 0x12, 0x2e, 0x0a, 0x12, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75,
+	0x74, 0x68, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x12, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x45, 0x6e, 0x64, 0x70,
+	0x6f, 0x69, 0x6e, 0x74, 0x12, 0x24, 0x0a, 0x0d, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x45, 0x6e, 0x64,
+	0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x54, 0x6f, 0x6b,
+	0x65, 0x6e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x53, 0x63,
+	0x6f, 0x70, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x53, 0x63, 0x6f, 0x70, 0x65,
+	0x12, 0x1e, 0x0a, 0x0a, 0x55, 0x73, 0x65, 0x49, 0x44, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x08,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x55, 0x73, 0x65, 0x49, 0x44, 0x54, 0x6f, 0x6b, 0x65, 0x6e,
+	0x12, 0x34, 0x0a, 0x15, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x15, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e,
+	0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x22, 0x0a, 0x0c, 0x52, 0x65, 0x64, 0x69, 0x72, 0x65,
+	0x63, 0x74, 0x55, 0x52, 0x4c, 0x73, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x52, 0x65,
+	0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x55, 0x52, 0x4c, 0x73, 0x12, 0x2e, 0x0a, 0x12, 0x44, 0x69,
+	0x73, 0x61, 0x62, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x4c, 0x6f, 0x67, 0x69, 0x6e,
+	0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x50,
+	0x72, 0x6f, 0x6d, 0x70, 0x74, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x1c, 0x0a, 0x09, 0x4c, 0x6f,
+	0x67, 0x69, 0x6e, 0x46, 0x6c, 0x61, 0x67, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x09, 0x4c,
+	0x6f, 0x67, 0x69, 0x6e, 0x46, 0x6c, 0x61, 0x67, 0x22, 0x93, 0x02, 0x0a, 0x05, 0x52, 0x6f, 0x75,
+	0x74, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x49, 0x44, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02,
+	0x49, 0x44, 0x12, 0x18, 0x0a, 0x07, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x07, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x12, 0x20, 0x0a, 0x0b,
+	0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x54, 0x79, 0x70, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x03, 0x52, 0x0b, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x54, 0x79, 0x70, 0x65, 0x12, 0x12,
+	0x0a, 0x04, 0x50, 0x65, 0x65, 0x72, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x50, 0x65,
+	0x65, 0x72, 0x12, 0x16, 0x0a, 0x06, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x18, 0x05, 0x20, 0x01,
+	0x28, 0x03, 0x52, 0x06, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x12, 0x1e, 0x0a, 0x0a, 0x4d, 0x61,
+	0x73, 0x71, 0x75, 0x65, 0x72, 0x61, 0x64, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a,
+	0x4d, 0x61, 0x73, 0x71, 0x75, 0x65, 0x72, 0x61, 0x64, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x4e, 0x65,
+	0x74, 0x49, 0x44, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x4e, 0x65, 0x74, 0x49, 0x44,
+	0x12, 0x18, 0x0a, 0x07, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28,
+	0x09, 0x52, 0x07, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x1c, 0x0a, 0x09, 0x6b, 0x65,
+	0x65, 0x70, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x18, 0x09, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x6b,
+	0x65, 0x65, 0x70, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x12, 0x24, 0x0a, 0x0d, 0x73, 0x6b, 0x69, 0x70,
+	0x41, 0x75, 0x74, 0x6f, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x0d, 0x73, 0x6b, 0x69, 0x70, 0x41, 0x75, 0x74, 0x6f, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x22, 0xde,
+	0x01, 0x0a, 0x09, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x24, 0x0a, 0x0d,
+	0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x08, 0x52, 0x0d, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x45, 0x6e, 0x61, 0x62,
+	0x6c, 0x65, 0x12, 0x47, 0x0a, 0x10, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72,
+	0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x52, 0x10, 0x4e, 0x61, 0x6d, 0x65, 0x53,
+	0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x38, 0x0a, 0x0b, 0x43,
+	0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x75,
+	0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x52, 0x0b, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d,
+	0x5a, 0x6f, 0x6e, 0x65, 0x73, 0x12, 0x28, 0x0a, 0x0d, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64,
+	0x65, 0x72, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x42, 0x02, 0x18, 0x01,
+	0x52, 0x0d, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x50, 0x6f, 0x72, 0x74, 0x22,
+	0xb8, 0x01, 0x0a, 0x0a, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x12, 0x16,
+	0x0a, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06,
+	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x32, 0x0a, 0x07, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64,
+	0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x69, 0x6d, 0x70, 0x6c, 0x65, 0x52, 0x65, 0x63, 0x6f, 0x72,
+	0x64, 0x52, 0x07, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x12, 0x32, 0x0a, 0x14, 0x53, 0x65,
+	0x61, 0x72, 0x63, 0x68, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c,
+	0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x14, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68,
+	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x2a,
+	0x0a, 0x10, 0x4e, 0x6f, 0x6e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x61, 0x74, 0x69,
+	0x76, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x4e, 0x6f, 0x6e, 0x41, 0x75, 0x74,
+	0x68, 0x6f, 0x72, 0x69, 0x74, 0x61, 0x74, 0x69, 0x76, 0x65, 0x22, 0x74, 0x0a, 0x0c, 0x53, 0x69,
+	0x6d, 0x70, 0x6c, 0x65, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x4e, 0x61,
+	0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x12,
+	0x0a, 0x04, 0x54, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x04, 0x54, 0x79,
+	0x70, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x05, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x12, 0x10, 0x0a, 0x03, 0x54, 0x54, 0x4c, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x03, 0x54, 0x54, 0x4c, 0x12, 0x14, 0x0a, 0x05, 0x52, 0x44,
+	0x61, 0x74, 0x61, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x52, 0x44, 0x61, 0x74, 0x61,
+	0x22, 0xb3, 0x01, 0x0a, 0x0f, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47,
+	0x72, 0x6f, 0x75, 0x70, 0x12, 0x38, 0x0a, 0x0b, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76,
+	0x65, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65,
+	0x72, 0x52, 0x0b, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x18,
+	0x0a, 0x07, 0x50, 0x72, 0x69, 0x6d, 0x61, 0x72, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x07, 0x50, 0x72, 0x69, 0x6d, 0x61, 0x72, 0x79, 0x12, 0x18, 0x0a, 0x07, 0x44, 0x6f, 0x6d, 0x61,
+	0x69, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x44, 0x6f, 0x6d, 0x61, 0x69,
+	0x6e, 0x73, 0x12, 0x32, 0x0a, 0x14, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x44, 0x6f, 0x6d, 0x61,
+	0x69, 0x6e, 0x73, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x14, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x45,
+	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x22, 0x48, 0x0a, 0x0a, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x12, 0x0e, 0x0a, 0x02, 0x49, 0x50, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x02, 0x49, 0x50, 0x12, 0x16, 0x0a, 0x06, 0x4e, 0x53, 0x54, 0x79, 0x70, 0x65, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x03, 0x52, 0x06, 0x4e, 0x53, 0x54, 0x79, 0x70, 0x65, 0x12, 0x12, 0x0a, 0x04,
+	0x50, 0x6f, 0x72, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52, 0x04, 0x50, 0x6f, 0x72, 0x74,
+	0x22, 0xfb, 0x02, 0x0a, 0x0c, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c,
+	0x65, 0x12, 0x1a, 0x0a, 0x06, 0x50, 0x65, 0x65, 0x72, 0x49, 0x50, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x42, 0x02, 0x18, 0x01, 0x52, 0x06, 0x50, 0x65, 0x65, 0x72, 0x49, 0x50, 0x12, 0x37, 0x0a,
+	0x09, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e,
+	0x32, 0x19, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75,
+	0x6c, 0x65, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x09, 0x44, 0x69, 0x72,
+	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x2e, 0x0a, 0x06, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06,
+	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x34, 0x0a, 0x08, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63,
+	0x6f, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63,
+	0x6f, 0x6c, 0x52, 0x08, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x12, 0x0a, 0x04,
+	0x50, 0x6f, 0x72, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x50, 0x6f, 0x72, 0x74,
+	0x12, 0x30, 0x0a, 0x08, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x18, 0x06, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x08, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e,
+	0x66, 0x6f, 0x12, 0x1a, 0x0a, 0x08, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x44, 0x18, 0x07,
+	0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x44, 0x12, 0x26,
+	0x0a, 0x0e, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c,
+	0x18, 0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0e, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x50, 0x72,
+	0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x26, 0x0a, 0x0e, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x65, 0x73, 0x18, 0x09, 0x20, 0x03, 0x28, 0x0c, 0x52, 0x0e,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x65, 0x73, 0x22, 0x38,
+	0x0a, 0x0e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73,
+	0x12, 0x14, 0x0a, 0x05, 0x6e, 0x65, 0x74, 0x49, 0x50, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x05, 0x6e, 0x65, 0x74, 0x49, 0x50, 0x12, 0x10, 0x0a, 0x03, 0x6d, 0x61, 0x63, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x03, 0x6d, 0x61, 0x63, 0x22, 0x1e, 0x0a, 0x06, 0x43, 0x68, 0x65, 0x63,
+	0x6b, 0x73, 0x12, 0x14, 0x0a, 0x05, 0x46, 0x69, 0x6c, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28,
+	0x09, 0x52, 0x05, 0x46, 0x69, 0x6c, 0x65, 0x73, 0x22, 0x96, 0x01, 0x0a, 0x08, 0x50, 0x6f, 0x72,
+	0x74, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x14, 0x0a, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0d, 0x48, 0x00, 0x52, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x32, 0x0a, 0x05, 0x72,
+	0x61, 0x6e, 0x67, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f,
+	0x2e, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x48, 0x00, 0x52, 0x05, 0x72, 0x61, 0x6e, 0x67, 0x65, 0x1a,
+	0x2f, 0x0a, 0x05, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x72,
+	0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x05, 0x73, 0x74, 0x61, 0x72, 0x74, 0x12, 0x10,
+	0x0a, 0x03, 0x65, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x03, 0x65, 0x6e, 0x64,
+	0x42, 0x0f, 0x0a, 0x0d, 0x70, 0x6f, 0x72, 0x74, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x22, 0x87, 0x03, 0x0a, 0x11, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x46, 0x69, 0x72, 0x65, 0x77,
+	0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x12, 0x22, 0x0a, 0x0c, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x12, 0x2e, 0x0a, 0x06, 0x61,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x16, 0x2e, 0x6d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x41, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x20, 0x0a, 0x0b, 0x64,
+	0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x0b, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x34, 0x0a,
+	0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32,
+	0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c,
+	0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x63, 0x6f, 0x6c, 0x12, 0x30, 0x0a, 0x08, 0x70, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x18,
+	0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x08, 0x70, 0x6f, 0x72,
+	0x74, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x1c, 0x0a, 0x09, 0x69, 0x73, 0x44, 0x79, 0x6e, 0x61, 0x6d,
+	0x69, 0x63, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x69, 0x73, 0x44, 0x79, 0x6e, 0x61,
+	0x6d, 0x69, 0x63, 0x12, 0x18, 0x0a, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x07,
+	0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x26, 0x0a,
+	0x0e, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18,
+	0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0e, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x50, 0x72, 0x6f,
+	0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x1a, 0x0a, 0x08, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49,
+	0x44, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49,
+	0x44, 0x12, 0x18, 0x0a, 0x07, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x49, 0x44, 0x18, 0x0a, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x07, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x49, 0x44, 0x22, 0xf6, 0x01, 0x0a, 0x0e,
+	0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x12, 0x34,
+	0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e,
+	0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75,
+	0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x3e, 0x0a, 0x0f, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49,
+	0x6e, 0x66, 0x6f, 0x52, 0x0f, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x50, 0x6f, 0x72, 0x74, 0x12, 0x2c, 0x0a, 0x11, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x6c, 0x61, 0x74,
+	0x65, 0x64, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52,
+	0x11, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x41, 0x64, 0x64, 0x72, 0x65,
+	0x73, 0x73, 0x12, 0x3c, 0x0a, 0x0e, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x6c, 0x61, 0x74, 0x65, 0x64,
+	0x50, 0x6f, 0x72, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f,
+	0x52, 0x0e, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x50, 0x6f, 0x72, 0x74,
+	0x3a, 0x02, 0x18, 0x01, 0x22, 0x8b, 0x02, 0x0a, 0x14, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x53,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x12, 0x0a,
+	0x04, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x04, 0x70, 0x6f, 0x72,
+	0x74, 0x12, 0x36, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x0e, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+	0x2e, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52,
+	0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x10, 0x0a, 0x03, 0x70, 0x69, 0x6e,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x70, 0x69, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x70,
+	0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70,
+	0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x1f, 0x0a, 0x0b, 0x75, 0x73, 0x65, 0x72, 0x5f,
+	0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0a, 0x75, 0x73,
+	0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61,
+	0x69, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
+	0x12, 0x1f, 0x0a, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x18,
+	0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6e, 0x61, 0x6d, 0x65, 0x50, 0x72, 0x65, 0x66, 0x69,
+	0x78, 0x12, 0x1f, 0x0a, 0x0b, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x5f, 0x70, 0x6f, 0x72, 0x74,
+	0x18, 0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0a, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x50, 0x6f,
+	0x72, 0x74, 0x22, 0xa1, 0x01, 0x0a, 0x15, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x53, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x21, 0x0a, 0x0c,
+	0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12,
+	0x1f, 0x0a, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x55, 0x72, 0x6c,
+	0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x2c, 0x0a, 0x12, 0x70, 0x6f, 0x72, 0x74,
+	0x5f, 0x61, 0x75, 0x74, 0x6f, 0x5f, 0x61, 0x73, 0x73, 0x69, 0x67, 0x6e, 0x65, 0x64, 0x18, 0x04,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x70, 0x6f, 0x72, 0x74, 0x41, 0x75, 0x74, 0x6f, 0x41, 0x73,
+	0x73, 0x69, 0x67, 0x6e, 0x65, 0x64, 0x22, 0x2c, 0x0a, 0x12, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x45,
+	0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x16, 0x0a, 0x06,
+	0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f,
+	0x6d, 0x61, 0x69, 0x6e, 0x22, 0x15, 0x0a, 0x13, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x45, 0x78, 0x70,
+	0x6f, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x2b, 0x0a, 0x11, 0x53,
+	0x74, 0x6f, 0x70, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x22, 0x14, 0x0a, 0x12, 0x53, 0x74, 0x6f, 0x70,
+	0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x9a,
+	0x01, 0x0a, 0x12, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x76,
+	0x65, 0x6c, 0x6f, 0x70, 0x65, 0x12, 0x3a, 0x0a, 0x04, 0x66, 0x75, 0x6c, 0x6c, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+	0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f,
+	0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x48, 0x00, 0x52, 0x04, 0x66, 0x75, 0x6c,
+	0x6c, 0x12, 0x3d, 0x0a, 0x05, 0x64, 0x65, 0x6c, 0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x25, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65,
+	0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e,
+	0x74, 0x73, 0x44, 0x65, 0x6c, 0x74, 0x61, 0x48, 0x00, 0x52, 0x05, 0x64, 0x65, 0x6c, 0x74, 0x61,
+	0x42, 0x09, 0x0a, 0x07, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x22, 0x96, 0x0f, 0x0a, 0x18,
 	0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e,
-	0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x74, 0x72,
-	0x79, 0x52, 0x13, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x6f, 0x6c, 0x69, 0x63,
-	0x69, 0x65, 0x73, 0x4d, 0x61, 0x70, 0x12, 0x6a, 0x0a, 0x14, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f,
-	0x69, 0x64, 0x5f, 0x74, 0x6f, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x14,
-	0x20, 0x03, 0x28, 0x0b, 0x32, 0x3a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
-	0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70,
-	0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x2e, 0x47, 0x72, 0x6f, 0x75, 0x70,
-	0x49, 0x64, 0x54, 0x6f, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79,
-	0x52, 0x10, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x54, 0x6f, 0x55, 0x73, 0x65, 0x72, 0x49,
-	0x64, 0x73, 0x12, 0x28, 0x0a, 0x10, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x5f, 0x75, 0x73,
-	0x65, 0x72, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x15, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x61, 0x6c,
-	0x6c, 0x6f, 0x77, 0x65, 0x64, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x73, 0x12, 0x6e, 0x0a, 0x14,
-	0x70, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x5f, 0x66, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x5f, 0x70,
-	0x65, 0x65, 0x72, 0x73, 0x18, 0x16, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x3c, 0x2e, 0x6d, 0x61, 0x6e,
+	0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x65, 0x72, 0x69,
+	0x61, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x06, 0x73, 0x65, 0x72, 0x69, 0x61, 0x6c,
+	0x12, 0x37, 0x0a, 0x0b, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0a, 0x70,
+	0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x34, 0x0a, 0x07, 0x6e, 0x65, 0x74,
+	0x77, 0x6f, 0x72, 0x6b, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x4e,
+	0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x12,
+	0x4d, 0x0a, 0x10, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x74, 0x69,
+	0x6e, 0x67, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x53, 0x65,
+	0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x0f, 0x61,
+	0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x41,
+	0x0a, 0x0c, 0x64, 0x6e, 0x73, 0x5f, 0x73, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x05,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x44, 0x4e, 0x53, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x43, 0x6f, 0x6d,
+	0x70, 0x61, 0x63, 0x74, 0x52, 0x0b, 0x64, 0x6e, 0x73, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67,
+	0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x64, 0x6e, 0x73, 0x5f, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18,
+	0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x64, 0x6e, 0x73, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
+	0x12, 0x2c, 0x0a, 0x12, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5f, 0x7a, 0x6f, 0x6e, 0x65, 0x5f,
+	0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x63, 0x75,
+	0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x25,
+	0x0a, 0x0e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x73,
+	0x18, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0d, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72,
+	0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x2d, 0x0a, 0x05, 0x70, 0x65, 0x65, 0x72, 0x73, 0x18, 0x09,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x05, 0x70,
+	0x65, 0x65, 0x72, 0x73, 0x12, 0x2e, 0x0a, 0x13, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x5f, 0x70,
+	0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x18, 0x0a, 0x20, 0x03, 0x28,
+	0x0d, 0x52, 0x11, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x50, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64,
+	0x65, 0x78, 0x65, 0x73, 0x12, 0x35, 0x0a, 0x08, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73,
+	0x18, 0x0b, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63,
+	0x74, 0x52, 0x08, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x12, 0x30, 0x0a, 0x06, 0x67,
+	0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x0c, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x43, 0x6f,
+	0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x06, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x2c, 0x0a,
+	0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x0d, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65,
+	0x52, 0x61, 0x77, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x4b, 0x0a, 0x11, 0x6e,
+	0x61, 0x6d, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73,
+	0x18, 0x0e, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72,
+	0x6f, 0x75, 0x70, 0x52, 0x61, 0x77, 0x52, 0x10, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x65, 0x72, 0x76,
+	0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x40, 0x0a, 0x0f, 0x61, 0x6c, 0x6c, 0x5f,
+	0x64, 0x6e, 0x73, 0x5f, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x18, 0x0f, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53,
+	0x69, 0x6d, 0x70, 0x6c, 0x65, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x52, 0x0d, 0x61, 0x6c, 0x6c,
+	0x44, 0x6e, 0x73, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x12, 0x3b, 0x0a, 0x0d, 0x61, 0x63,
+	0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x7a, 0x6f, 0x6e, 0x65, 0x73, 0x18, 0x10, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43,
+	0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x52, 0x0c, 0x61, 0x63, 0x63, 0x6f, 0x75,
+	0x6e, 0x74, 0x5a, 0x6f, 0x6e, 0x65, 0x73, 0x12, 0x4b, 0x0a, 0x11, 0x6e, 0x65, 0x74, 0x77, 0x6f,
+	0x72, 0x6b, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x11, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52,
+	0x61, 0x77, 0x52, 0x10, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x73, 0x12, 0x55, 0x0a, 0x0b, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x73, 0x5f,
+	0x6d, 0x61, 0x70, 0x18, 0x12, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x34, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61,
+	0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x2e,
+	0x52, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x73, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52,
+	0x0a, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x73, 0x4d, 0x61, 0x70, 0x12, 0x71, 0x0a, 0x15, 0x72,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73,
+	0x5f, 0x6d, 0x61, 0x70, 0x18, 0x13, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x3d, 0x2e, 0x6d, 0x61, 0x6e,
 	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d,
 	0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c,
-	0x2e, 0x50, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x46, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x50, 0x65,
-	0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x12, 0x70, 0x6f, 0x73, 0x74, 0x75, 0x72,
-	0x65, 0x46, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x73, 0x12, 0x2c, 0x0a, 0x12,
-	0x64, 0x6e, 0x73, 0x5f, 0x66, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x5f, 0x70, 0x6f,
-	0x72, 0x74, 0x18, 0x17, 0x20, 0x01, 0x28, 0x03, 0x52, 0x10, 0x64, 0x6e, 0x73, 0x46, 0x6f, 0x72,
-	0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x37, 0x0a, 0x0b, 0x70, 0x72,
-	0x6f, 0x78, 0x79, 0x5f, 0x70, 0x61, 0x74, 0x63, 0x68, 0x18, 0x18, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f,
-	0x78, 0x79, 0x50, 0x61, 0x74, 0x63, 0x68, 0x52, 0x0a, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x61,
-	0x74, 0x63, 0x68, 0x12, 0x22, 0x0a, 0x0d, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x5f, 0x63,
-	0x6c, 0x61, 0x69, 0x6d, 0x18, 0x19, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x75, 0x73, 0x65, 0x72,
-	0x49, 0x64, 0x43, 0x6c, 0x61, 0x69, 0x6d, 0x1a, 0x5c, 0x0a, 0x0f, 0x52, 0x6f, 0x75, 0x74, 0x65,
-	0x72, 0x73, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65,
-	0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x33, 0x0a, 0x05,
-	0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
-	0x52, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75,
-	0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x5d, 0x0a, 0x18, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x74, 0x72,
-	0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03,
-	0x6b, 0x65, 0x79, 0x12, 0x2b, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x64, 0x73, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
-	0x3a, 0x02, 0x38, 0x01, 0x1a, 0x5b, 0x0a, 0x15, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x54,
-	0x6f, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a,
+	0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65,
+	0x73, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x13, 0x72, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x4d, 0x61, 0x70, 0x12, 0x6a,
+	0x0a, 0x14, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x5f, 0x74, 0x6f, 0x5f, 0x75, 0x73,
+	0x65, 0x72, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x14, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x3a, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72,
+	0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46, 0x75,
+	0x6c, 0x6c, 0x2e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x54, 0x6f, 0x55, 0x73, 0x65, 0x72,
+	0x49, 0x64, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x10, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x49,
+	0x64, 0x54, 0x6f, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x73, 0x12, 0x28, 0x0a, 0x10, 0x61, 0x6c,
+	0x6c, 0x6f, 0x77, 0x65, 0x64, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x15,
+	0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x55, 0x73, 0x65,
+	0x72, 0x49, 0x64, 0x73, 0x12, 0x6e, 0x0a, 0x14, 0x70, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x5f,
+	0x66, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x5f, 0x70, 0x65, 0x65, 0x72, 0x73, 0x18, 0x16, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x3c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e,
+	0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x2e, 0x50, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65,
+	0x46, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79,
+	0x52, 0x12, 0x70, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x46, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x50,
+	0x65, 0x65, 0x72, 0x73, 0x12, 0x2c, 0x0a, 0x12, 0x64, 0x6e, 0x73, 0x5f, 0x66, 0x6f, 0x72, 0x77,
+	0x61, 0x72, 0x64, 0x65, 0x72, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x17, 0x20, 0x01, 0x28, 0x03,
+	0x52, 0x10, 0x64, 0x6e, 0x73, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x50, 0x6f,
+	0x72, 0x74, 0x12, 0x3b, 0x0a, 0x0b, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x5f, 0x70, 0x61, 0x74, 0x63,
+	0x68, 0x18, 0x18, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x61, 0x74, 0x63, 0x68, 0x42,
+	0x02, 0x18, 0x01, 0x52, 0x0a, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x61, 0x74, 0x63, 0x68, 0x12,
+	0x22, 0x0a, 0x0d, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x5f, 0x63, 0x6c, 0x61, 0x69, 0x6d,
+	0x18, 0x19, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x43, 0x6c,
+	0x61, 0x69, 0x6d, 0x1a, 0x5c, 0x0a, 0x0f, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x73, 0x4d, 0x61,
+	0x70, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x33, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x6f, 0x75, 0x74,
+	0x65, 0x72, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38,
+	0x01, 0x1a, 0x5d, 0x0a, 0x18, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x6f, 0x6c,
+	0x69, 0x63, 0x69, 0x65, 0x73, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a,
 	0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12,
-	0x2c, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x55, 0x73, 0x65, 0x72,
-	0x49, 0x44, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38,
-	0x01, 0x1a, 0x5f, 0x0a, 0x17, 0x50, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x46, 0x61, 0x69, 0x6c,
-	0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03,
-	0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x2e,
-	0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x18, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x49,
-	0x6e, 0x64, 0x65, 0x78, 0x53, 0x65, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02,
-	0x38, 0x01, 0x4a, 0x04, 0x08, 0x1a, 0x10, 0x33, 0x22, 0x87, 0x03, 0x0a, 0x0a, 0x50, 0x72, 0x6f,
-	0x78, 0x79, 0x50, 0x61, 0x74, 0x63, 0x68, 0x12, 0x32, 0x0a, 0x05, 0x70, 0x65, 0x65, 0x72, 0x73,
-	0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x52, 0x05, 0x70, 0x65, 0x65, 0x72, 0x73, 0x12, 0x41, 0x0a, 0x0d, 0x6f,
-	0x66, 0x66, 0x6c, 0x69, 0x6e, 0x65, 0x5f, 0x70, 0x65, 0x65, 0x72, 0x73, 0x18, 0x02, 0x20, 0x03,
+	0x2b, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x49, 0x64, 0x73, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01,
+	0x1a, 0x5b, 0x0a, 0x15, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x54, 0x6f, 0x55, 0x73, 0x65,
+	0x72, 0x49, 0x64, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x2c, 0x0a, 0x05, 0x76,
+	0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x49, 0x44, 0x4c, 0x69,
+	0x73, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x5f, 0x0a,
+	0x17, 0x50, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x46, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x50, 0x65,
+	0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x2e, 0x0a, 0x05, 0x76, 0x61,
+	0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78,
+	0x53, 0x65, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x4a, 0x04,
+	0x08, 0x1a, 0x10, 0x33, 0x22, 0x8b, 0x03, 0x0a, 0x0a, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x61,
+	0x74, 0x63, 0x68, 0x12, 0x32, 0x0a, 0x05, 0x70, 0x65, 0x65, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03,
 	0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
 	0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x52, 0x0c, 0x6f, 0x66, 0x66, 0x6c, 0x69, 0x6e, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73, 0x12, 0x3f,
-	0x0a, 0x0e, 0x66, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x5f, 0x72, 0x75, 0x6c, 0x65, 0x73,
-	0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65,
-	0x52, 0x0d, 0x66, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x12,
-	0x29, 0x0a, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32,
-	0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x6f, 0x75,
-	0x74, 0x65, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x4f, 0x0a, 0x14, 0x72, 0x6f,
-	0x75, 0x74, 0x65, 0x5f, 0x66, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x5f, 0x72, 0x75, 0x6c,
-	0x65, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x46, 0x69, 0x72, 0x65, 0x77,
-	0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x52, 0x12, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x46, 0x69,
-	0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x12, 0x45, 0x0a, 0x10, 0x66,
-	0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x5f, 0x72, 0x75, 0x6c, 0x65, 0x73, 0x18,
-	0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x2e, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c,
-	0x65, 0x52, 0x0f, 0x66, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c,
-	0x65, 0x73, 0x22, 0x94, 0x01, 0x0a, 0x16, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x53, 0x65,
+	0x52, 0x05, 0x70, 0x65, 0x65, 0x72, 0x73, 0x12, 0x41, 0x0a, 0x0d, 0x6f, 0x66, 0x66, 0x6c, 0x69,
+	0x6e, 0x65, 0x5f, 0x70, 0x65, 0x65, 0x72, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x6d, 0x6f,
+	0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0c, 0x6f, 0x66,
+	0x66, 0x6c, 0x69, 0x6e, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73, 0x12, 0x3f, 0x0a, 0x0e, 0x66, 0x69,
+	0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x5f, 0x72, 0x75, 0x6c, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x52, 0x0d, 0x66, 0x69,
+	0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x12, 0x29, 0x0a, 0x06, 0x72,
+	0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x6d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x06,
+	0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x4f, 0x0a, 0x14, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x5f,
+	0x66, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x5f, 0x72, 0x75, 0x6c, 0x65, 0x73, 0x18, 0x05,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52,
+	0x75, 0x6c, 0x65, 0x52, 0x12, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61,
+	0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x12, 0x45, 0x0a, 0x10, 0x66, 0x6f, 0x72, 0x77, 0x61,
+	0x72, 0x64, 0x69, 0x6e, 0x67, 0x5f, 0x72, 0x75, 0x6c, 0x65, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x46,
+	0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x52, 0x0f, 0x66,
+	0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x3a, 0x02,
+	0x18, 0x01, 0x22, 0x94, 0x01, 0x0a, 0x16, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x53, 0x65,
 	0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x12, 0x41, 0x0a,
 	0x1d, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x5f, 0x65, 0x78, 0x70, 0x69,
 	0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x01,
diff --git a/shared/management/proto/management.proto b/shared/management/proto/management.proto
index c3d75af11..f7febfe9a 100644
--- a/shared/management/proto/management.proto
+++ b/shared/management/proto/management.proto
@@ -471,7 +471,8 @@ message NetworkMap {
   // RoutesFirewallRulesIsEmpty indicates whether RouteFirewallRule array is empty or not to bypass protobuf null and empty array equality.
   bool routesFirewallRulesIsEmpty = 11;
 
-  repeated ForwardingRule forwardingRules = 12;
+  // Unused; the ingress port-forwarding feature was discontinued.
+  repeated ForwardingRule forwardingRules = 12 [deprecated = true];
 
   // SSHAuth represents SSH authorization configuration
   SSHAuth sshAuth = 13;
@@ -752,17 +753,13 @@ message RouteFirewallRule {
   string RouteID = 10;
 }
 
+// ForwardingRule is unused; the ingress port-forwarding feature was discontinued.
 message ForwardingRule {
-  // Protocol of the forwarding rule
+  option deprecated = true;
+
   RuleProtocol protocol = 1;
-
-  // portInfo is the ingress destination port information, where the traffic arrives in the gateway node
   PortInfo destinationPort = 2;
-
-  // IP address of the translated address (remote peer) to send traffic to
   bytes translatedAddress = 3;
-
-  // Translated port information, where the traffic should be forwarded to
   PortInfo translatedPort = 4;
 }
 
@@ -808,7 +805,7 @@ message StopExposeResponse {}
 // Component-based NetworkMap wire format (PeerCapabilityComponentNetworkMap).
 //
 // Peers that advertise this capability receive NetworkMap building blocks
-// (peers + groups + policies + routes + dns + ssh + forwarding) and run the
+// (peers + groups + policies + routes + dns + ssh) and run the
 // expansion (Calculate) locally instead of receiving a fully-expanded
 // NetworkMap from the server.
 // =====================================================================
@@ -826,8 +823,8 @@ message NetworkMapEnvelope {
 // client decodes it into a types.NetworkMapComponents and runs Calculate()
 // locally to produce the same NetworkMap the legacy server path would have
 // produced. Every field carries RAW component data — no server-side
-// expansion (firewall rules, DNS config, SSH auth, route firewall rules,
-// forwarding rules) is shipped; the client computes those itself.
+// expansion (firewall rules, DNS config, SSH auth, route firewall rules)
+// is shipped; the client computes those itself.
 message NetworkMapComponentsFull {
   uint64 serial = 1;
 
@@ -911,12 +908,8 @@ message NetworkMapComponentsFull {
   // versions; clients fold it into their Calculate() DNS output.
   int64 dns_forwarder_port = 23;
 
-  // Pre-expanded NetworkMap fragments injected post-Calculate by external
-  // controllers (BYOP / port-forwarding proxies). The receiving client
-  // merges these into its locally-computed NetworkMap the same way the
-  // legacy server does via NetworkMap.Merge — so downstream consumers see
-  // a unified merged result regardless of source.
-  ProxyPatch proxy_patch = 24;
+  // Unused; the ingress port-forwarding feature was discontinued.
+  ProxyPatch proxy_patch = 24 [deprecated = true];
 
   // SSH UserIDClaim — server-side HttpServerConfig.AuthUserIDClaim, or
   // "sub" by default. Populated in proto.SSHAuth.UserIDClaim when the
@@ -929,12 +922,10 @@ message NetworkMapComponentsFull {
   reserved 26 to 50;
 }
 
-// ProxyPatch carries NetworkMap fragments that don't fit the component-graph
-// model — they're pre-expanded by external controllers (BYOP /
-// port-forwarding proxies) and injected post-Calculate. Fields use the
-// legacy wire types because the proxy delivers them pre-formed; there is
-// no raw component shape to convert from. Empty when no proxy is active.
+// ProxyPatch is unused; the ingress port-forwarding feature was discontinued.
 message ProxyPatch {
+  option deprecated = true;
+
   repeated RemotePeerConfig peers = 1;
   repeated RemotePeerConfig offline_peers = 2;
   repeated FirewallRule firewall_rules = 3;
diff --git a/shared/management/types/network.go b/shared/management/types/network.go
index 1269bac4c..ab61d7cb2 100644
--- a/shared/management/types/network.go
+++ b/shared/management/types/network.go
@@ -1,13 +1,8 @@
 package types
 
 import (
-	"net"
-
-	"golang.org/x/exp/maps"
-
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
-	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
 const (
@@ -25,7 +20,6 @@ type NetworkMap struct {
 	OfflinePeers        []*nmdata.Peer
 	FirewallRules       []*FirewallRule
 	RoutesFirewallRules []*RouteFirewallRule
-	ForwardingRules     []*ForwardingRule
 	AuthorizedUsers     map[string]map[string]struct{}
 	EnableSSH           bool
 	// ForceRoutingPeerDNSResolution forces the peer to run/use routing-peer DNS
@@ -33,101 +27,3 @@ type NetworkMap struct {
 	// domain targets.
 	ForceRoutingPeerDNSResolution bool
 }
-
-func (nm *NetworkMap) Merge(other *NetworkMap) {
-	nm.Peers = mergeUniquePeersByID(nm.Peers, other.Peers)
-	nm.Routes = mergeUnique(nm.Routes, other.Routes)
-	nm.OfflinePeers = mergeUniquePeersByID(nm.OfflinePeers, other.OfflinePeers)
-	nm.FirewallRules = mergeUnique(nm.FirewallRules, other.FirewallRules)
-	nm.RoutesFirewallRules = mergeUnique(nm.RoutesFirewallRules, other.RoutesFirewallRules)
-	nm.ForwardingRules = mergeUnique(nm.ForwardingRules, other.ForwardingRules)
-	nm.ForceRoutingPeerDNSResolution = nm.ForceRoutingPeerDNSResolution || other.ForceRoutingPeerDNSResolution
-}
-
-func mergeUniquePeersByID(peers1, peers2 []*nmdata.Peer) []*nmdata.Peer {
-	result := make(map[string]*nmdata.Peer)
-	for _, peer := range peers1 {
-		result[peer.ID] = peer
-	}
-	for _, peer := range peers2 {
-		if _, ok := result[peer.ID]; !ok {
-			result[peer.ID] = peer
-		}
-	}
-
-	return maps.Values(result)
-}
-
-type ForwardingRule struct {
-	RuleProtocol      string
-	DestinationPorts  RulePortRange
-	TranslatedAddress net.IP
-	TranslatedPorts   RulePortRange
-}
-
-func (f *ForwardingRule) ToProto() *proto.ForwardingRule {
-	var protocol proto.RuleProtocol
-	switch f.RuleProtocol {
-	case "icmp":
-		protocol = proto.RuleProtocol_ICMP
-	case "tcp":
-		protocol = proto.RuleProtocol_TCP
-	case "udp":
-		protocol = proto.RuleProtocol_UDP
-	case "all":
-		protocol = proto.RuleProtocol_ALL
-	default:
-		protocol = proto.RuleProtocol_UNKNOWN
-	}
-	return &proto.ForwardingRule{
-		Protocol:          protocol,
-		DestinationPort:   f.DestinationPorts.ToProto(),
-		TranslatedAddress: ipToBytes(f.TranslatedAddress),
-		TranslatedPort:    f.TranslatedPorts.ToProto(),
-	}
-}
-
-func (f *ForwardingRule) Equal(other *ForwardingRule) bool {
-	return f.RuleProtocol == other.RuleProtocol &&
-		f.DestinationPorts.Equal(&other.DestinationPorts) &&
-		f.TranslatedAddress.Equal(other.TranslatedAddress) &&
-		f.TranslatedPorts.Equal(&other.TranslatedPorts)
-}
-
-func ipToBytes(ip net.IP) []byte {
-	if ip4 := ip.To4(); ip4 != nil {
-		return ip4
-	}
-	return ip.To16()
-}
-
-type comparableObject[T any] interface {
-	Equal(other T) bool
-}
-
-func mergeUnique[T comparableObject[T]](arr1, arr2 []T) []T {
-	var result []T
-
-	for _, item := range arr1 {
-		if !containsEqual(result, item) {
-			result = append(result, item)
-		}
-	}
-
-	for _, item := range arr2 {
-		if !containsEqual(result, item) {
-			result = append(result, item)
-		}
-	}
-
-	return result
-}
-
-func containsEqual[T comparableObject[T]](slice []T, element T) bool {
-	for _, item := range slice {
-		if item.Equal(element) {
-			return true
-		}
-	}
-	return false
-}
diff --git a/shared/management/types/network_test.go b/shared/management/types/network_test.go
deleted file mode 100644
index 631f38836..000000000
--- a/shared/management/types/network_test.go
+++ /dev/null
@@ -1,41 +0,0 @@
-package types
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-type mergeTestObject struct {
-	value int
-}
-
-func (t mergeTestObject) Equal(other mergeTestObject) bool {
-	return t.value == other.value
-}
-
-func Test_MergeUniqueArraysWithoutDuplicates(t *testing.T) {
-	arr1 := []mergeTestObject{{value: 1}, {value: 2}}
-	arr2 := []mergeTestObject{{value: 2}, {value: 3}}
-	result := mergeUnique(arr1, arr2)
-	assert.Len(t, result, 3)
-	assert.Contains(t, result, mergeTestObject{value: 1})
-	assert.Contains(t, result, mergeTestObject{value: 2})
-	assert.Contains(t, result, mergeTestObject{value: 3})
-}
-
-func Test_MergeUniqueHandlesEmptyArrays(t *testing.T) {
-	arr1 := []mergeTestObject{}
-	arr2 := []mergeTestObject{}
-	result := mergeUnique(arr1, arr2)
-	assert.Empty(t, result)
-}
-
-func Test_MergeUniqueHandlesOneEmptyArray(t *testing.T) {
-	arr1 := []mergeTestObject{{value: 1}, {value: 2}}
-	arr2 := []mergeTestObject{}
-	result := mergeUnique(arr1, arr2)
-	assert.Len(t, result, 2)
-	assert.Contains(t, result, mergeTestObject{value: 1})
-	assert.Contains(t, result, mergeTestObject{value: 2})
-}

From 51a9d32cfcf053b652e4588297e6c6ef8708ffac Mon Sep 17 00:00:00 2001
From: Edward <43848523+thomashacker@users.noreply.github.com>
Date: Tue, 6 Oct 2026 16:59:26 +0200
Subject: [PATCH 13/70] [client] Warn on missing translations and check
 placeholders (#8090)

---
 .github/workflows/ui-translations.yml |   5 +-
 client/ui/i18n/check-translations.mjs | 130 +++++++++++++++++++-------
 2 files changed, 99 insertions(+), 36 deletions(-)

diff --git a/.github/workflows/ui-translations.yml b/.github/workflows/ui-translations.yml
index 24b7c9de2..9ac524495 100644
--- a/.github/workflows/ui-translations.yml
+++ b/.github/workflows/ui-translations.yml
@@ -36,7 +36,8 @@ jobs:
         with:
           node-version: "22"
 
-      # English (en) is the source of truth for translation keys; every other
-      # locale declared in _index.json must carry the exact same key set.
+      # English (en) is the source of truth for translation keys. Locales declared
+      # in _index.json fail on orphaned keys or placeholder mismatches; missing
+      # keys only warn, since they fall back to English at runtime.
       - name: Check translation key parity
         run: node client/ui/i18n/check-translations.mjs
diff --git a/client/ui/i18n/check-translations.mjs b/client/ui/i18n/check-translations.mjs
index bd076e0e0..a6b666337 100644
--- a/client/ui/i18n/check-translations.mjs
+++ b/client/ui/i18n/check-translations.mjs
@@ -1,13 +1,20 @@
 #!/usr/bin/env node
-// Validates that every shipped translation bundle carries exactly the same set
-// of keys as the English source of truth. English (en) defines the keys; every
-// other locale declared in _index.json must match it 1:1:
+// Validates every shipped translation bundle against the English source of
+// truth. English (en) defines the keys; for every other locale declared in
+// _index.json:
 //
-//   - no missing keys — a missing key silently falls back to English at runtime
-//     (see i18n bundle fallback), so the gap never surfaces to users or CI
-//     without this check;
-//   - no orphaned keys — keys left behind after an English key is renamed or
-//     removed are dead weight and a sign the locale is drifting.
+//   - missing keys are reported as a warning, not a failure — a missing key
+//     falls back to English at runtime (see i18n bundle fallback), and Crowdin
+//     exports only translated strings (skip_untranslated_strings in
+//     crowdin.yml), so a locale is routinely behind English until translators
+//     catch up;
+//   - orphaned keys fail — keys left behind after an English key is renamed or
+//     removed are dead weight and a sign the locale is drifting;
+//   - empty messages fail — a present key with an empty, whitespace-only or
+//     missing message renders blank instead of falling back to English;
+//   - placeholder mismatches fail — a translation must use exactly the
+//     {placeholders} of its English string, otherwise a value silently never
+//     renders (or a literal "{name}" leaks into the UI).
 //
 // Pure Node, no dependencies, so it runs without installing the frontend
 // toolchain.
@@ -23,17 +30,40 @@ const SOURCE = "en";
 const localesDir = join(dirname(fileURLToPath(import.meta.url)), "locales");
 const isCI = Boolean(process.env.GITHUB_ACTIONS);
 
+// Matches the i18next interpolation configured in the frontend
+// (prefix "{", suffix "}") and the Go bundle's applyPlaceholders.
+const PLACEHOLDER = /\{([^{}\s]+)\}/g;
+
 function readJSON(path) {
     return JSON.parse(readFileSync(path, "utf8"));
 }
 
-function keysOf(langCode) {
-    return Object.keys(readJSON(join(localesDir, langCode, "common.json")));
+function messagesOf(langCode) {
+    const entries = readJSON(join(localesDir, langCode, "common.json"));
+    const messages = new Map();
+    for (const [key, entry] of Object.entries(entries)) {
+        // null marks an unusable entry (missing or non-string message).
+        messages.set(key, typeof entry?.message === "string" ? entry.message : null);
+    }
+    return messages;
 }
 
-// Emit a GitHub Actions annotation so failures render inline on the PR diff.
-function annotate(file, message) {
-    if (isCI) console.log(`::error file=${file}::${message}`);
+function placeholdersOf(message) {
+    // Code-point order: placeholder names are identifiers, not prose.
+    return [...new Set([...message.matchAll(PLACEHOLDER)].map((m) => m[1]))].sort((a, b) => {
+        if (a < b) return -1;
+        if (a > b) return 1;
+        return 0;
+    });
+}
+
+function formatPlaceholders(names) {
+    return names.length ? names.map((n) => `{${n}}`).join(", ") : "none";
+}
+
+// Emit a GitHub Actions annotation so findings render inline on the PR diff.
+function annotate(level, file, message) {
+    if (isCI) console.log(`::${level} file=${file}::${message}`);
 }
 
 const index = readJSON(join(localesDir, "_index.json"));
@@ -44,8 +74,13 @@ if (!declared.includes(SOURCE)) {
     process.exit(1);
 }
 
-const sourceKeys = keysOf(SOURCE);
-const sourceSet = new Set(sourceKeys);
+const source = messagesOf(SOURCE);
+const sourceKeys = [...source.keys()];
+const emptySource = sourceKeys.filter((k) => !source.get(k)?.trim());
+if (emptySource.length) {
+    console.error(`FATAL: ${SOURCE}/common.json has empty or missing messages: ${emptySource.join(", ")}`);
+    process.exit(1);
+}
 console.log(`Source of truth: ${SOURCE}/common.json — ${sourceKeys.length} keys\n`);
 
 let failed = false;
@@ -54,40 +89,67 @@ for (const code of declared) {
     if (code === SOURCE) continue;
     const file = `client/ui/i18n/locales/${code}/common.json`;
 
-    let keys;
+    let messages;
     try {
-        keys = keysOf(code);
+        messages = messagesOf(code);
     } catch (e) {
         failed = true;
         const msg = `bundle is declared in _index.json but common.json is missing or invalid (${e.message})`;
         console.error(`✗ ${code}: ${msg}`);
-        annotate("client/ui/i18n/locales/_index.json", `${code}: ${msg}`);
+        annotate("error", "client/ui/i18n/locales/_index.json", `${code}: ${msg}`);
         continue;
     }
 
-    const set = new Set(keys);
-    const missing = sourceKeys.filter((k) => !set.has(k));
-    const extra = keys.filter((k) => !sourceSet.has(k));
-
-    if (missing.length === 0 && extra.length === 0) {
-        console.log(`✓ ${code}: ${keys.length} keys`);
-        continue;
+    const missing = sourceKeys.filter((k) => !messages.has(k));
+    const extra = [...messages.keys()].filter((k) => !source.has(k));
+    const empty = [];
+    const badPlaceholders = [];
+    for (const [key, message] of messages) {
+        if (!source.has(key)) continue;
+        if (!message?.trim()) {
+            empty.push(key);
+            continue;
+        }
+        const want = placeholdersOf(source.get(key));
+        const got = placeholdersOf(message);
+        if (want.length !== got.length || want.some((name, i) => name !== got[i])) {
+            badPlaceholders.push(`${key} (expected ${formatPlaceholders(want)}, got ${formatPlaceholders(got)})`);
+        }
     }
 
-    failed = true;
-    console.error(`✗ ${code}: ${keys.length} keys (expected ${sourceKeys.length})`);
+    const translated = sourceKeys.length - missing.length - empty.length;
+    const coverage = Math.floor((translated / sourceKeys.length) * 100);
+    const hasErrors = extra.length > 0 || empty.length > 0 || badPlaceholders.length > 0;
+    let mark = "✓";
+    if (hasErrors) mark = "✗";
+    else if (missing.length) mark = "⚠";
+    const log = hasErrors ? console.error : console.log;
+    log(`${mark} ${code}: ${translated}/${sourceKeys.length} keys translated (${coverage}%)`);
+
     if (missing.length) {
-        console.error(`    missing ${missing.length}: ${missing.join(", ")}`);
-        annotate(file, `Missing ${missing.length} key(s) present in ${SOURCE}: ${missing.join(", ")}`);
+        console.warn(`    missing ${missing.length} (falls back to English): ${missing.join(", ")}`);
+        annotate("warning", file, `Missing ${missing.length} key(s) present in ${SOURCE}, shown in English: ${missing.join(", ")}`);
     }
     if (extra.length) {
+        failed = true;
         console.error(`    extra ${extra.length}: ${extra.join(", ")}`);
-        annotate(file, `Has ${extra.length} key(s) not present in ${SOURCE}: ${extra.join(", ")}`);
+        annotate("error", file, `Has ${extra.length} key(s) not present in ${SOURCE}: ${extra.join(", ")}`);
+    }
+    if (empty.length) {
+        failed = true;
+        console.error(`    empty message ${empty.length} (renders blank): ${empty.join(", ")}`);
+        annotate("error", file, `Empty or missing message in ${empty.length} key(s), renders blank: ${empty.join(", ")}`);
+    }
+    if (badPlaceholders.length) {
+        failed = true;
+        console.error(`    placeholder mismatch ${badPlaceholders.length}: ${badPlaceholders.join("; ")}`);
+        annotate("error", file, `Placeholders differ from ${SOURCE} in ${badPlaceholders.length} key(s): ${badPlaceholders.join("; ")}`);
     }
 }
 
-// Locale directories present on disk but not declared in _index.json are never
-// loaded by the app — surface them so dead translation files don't rot silently.
+// Locale directories present on disk but not declared in _index.json are not
+// offered in the language picker — surface them so dead translation files don't
+// rot silently.
 const onDisk = readdirSync(localesDir, { withFileTypes: true })
     .filter((e) => e.isDirectory())
     .map((e) => e.name);
@@ -98,7 +160,7 @@ if (undeclared.length) {
 
 console.log();
 if (failed) {
-    console.error("Translation check FAILED — every locale must match the English key set.");
+    console.error("Translation check FAILED — fix orphaned keys, empty messages and placeholder mismatches above.");
     process.exit(1);
 }
-console.log("Translation check passed — all locales match the English key set.");
+console.log("Translation check passed — no orphaned keys, empty messages or placeholder mismatches.");

From d3d27dc08d40959fc0685c4979c4da67a643257d Mon Sep 17 00:00:00 2001
From: Edward <43848523+thomashacker@users.noreply.github.com>
Date: Tue, 6 Oct 2026 17:00:21 +0200
Subject: [PATCH 14/70] [client] Only offer locales listed in _index.json
 (#8091)

---
 client/ui/frontend/src/lib/i18n.ts | 23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/client/ui/frontend/src/lib/i18n.ts b/client/ui/frontend/src/lib/i18n.ts
index 87cc996dd..25f2b282a 100644
--- a/client/ui/frontend/src/lib/i18n.ts
+++ b/client/ui/frontend/src/lib/i18n.ts
@@ -40,14 +40,29 @@ function detectBrowserLanguage(available: string[]): string | null {
     return null;
 }
 
-// An empty persisted language code is the Go-side signal for first run.
+// Only locales listed in _index.json are shipped. A bundle on disk without an
+// _index.json row (e.g. a new Crowdin language not released yet) must not be
+// auto-detected or loaded, matching the Go side, which rejects saving it.
+async function shippedLanguages(): Promise<string[]> {
+    const onDisk = Object.keys(resources);
+    try {
+        const listed = new Set<string>((await I18n.Languages()).map((l) => l.code));
+        return onDisk.filter((code) => listed.has(code));
+    } catch (e) {
+        console.warn("load shipped languages failed, using all bundled locales", e);
+        return onDisk;
+    }
+}
+
+// An empty persisted language code is the Go-side signal for first run. A
+// persisted code that is no longer shipped is treated the same way.
 export async function initI18n(): Promise<void> {
-    const available = Object.keys(resources);
+    const available = await shippedLanguages();
     let language = "en";
     let firstRun = false;
     try {
         const prefs = await Preferences.Get();
-        if (prefs?.language) {
+        if (prefs?.language && available.includes(prefs.language)) {
             language = prefs.language;
         } else {
             firstRun = true;
@@ -68,7 +83,7 @@ export async function initI18n(): Promise<void> {
         fallbackLng: "en",
         defaultNS: "common",
         ns: ["common"],
-        resources,
+        resources: Object.fromEntries(available.map((code) => [code, resources[code]])),
         interpolation: {
             prefix: "{",
             suffix: "}",

From 2b9c36dc4901d888f4f16c3feb45d223c4beacbc Mon Sep 17 00:00:00 2001
From: Zoltan Papp <zoltan.pmail@gmail.com>
Date: Tue, 6 Oct 2026 17:33:54 +0200
Subject: [PATCH 15/70] [client] Close the UI before InstallValidate in the MSI
 (#7395)

* [client] Close the UI before InstallValidate in the MSI

The WiX CloseApplication action runs deferred, right before InstallFiles.
By then InstallValidate has already asked Restart Manager about the files
in use. When msiexec runs as LocalSystem (third-party deployment tools,
scheduled tasks) and netbird-ui.exe runs in the interactive user's
session, Restart Manager reports a session mismatch, so the installer
schedules the UI binary for replacement on the next reboot and returns
3010. Killing the UI afterwards is too late, the file stays on the old
version until a real reboot happens.

Replace the CloseApplication with an immediate WixQuietExec custom action
running taskkill /F /IM netbird-ui.exe, scheduled before InstallValidate.
The file is no longer held open when the in-use check runs, InstallFiles
overwrites it directly and no reboot is scheduled. Return is ignored
because taskkill exits non-zero when no UI is running. The action also
runs on uninstall so removal does not require a reboot either.

* Keep the deferred UI close as a fallback for the immediate taskkill

The immediate taskkill runs with the token of whoever launched msiexec. A
non-SYSTEM install cannot terminate a UI running in another user's session,
so keep the deferred CloseApplication, which runs as LocalSystem, to stop it
before InstallFiles. When taskkill already succeeded it finds no process.

* Document why the UI kill runs before InstallValidate
---
 client/netbird.wxs | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/client/netbird.wxs b/client/netbird.wxs
index f30a7aa7e..156b4ff27 100644
--- a/client/netbird.wxs
+++ b/client/netbird.wxs
@@ -76,6 +76,14 @@
 		<util:CloseApplication Id="CloseNetBird" CloseMessage="no" Target="netbird.exe" RebootPrompt="no" />
 		<util:CloseApplication Id="CloseNetBirdUI" CloseMessage="no" Target="netbird-ui.exe" RebootPrompt="no" TerminateProcess="0" />
 
+		<!-- Kill the UI before InstallValidate, otherwise its Restart Manager
+		     check sees netbird-ui.exe in use and schedules the replacement for
+		     the next reboot (3010). Keep it immediate and before InstallValidate.
+		     CloseNetBirdUI above stays as a deferred LocalSystem fallback for UIs
+		     in other sessions that this action cannot terminate. -->
+		<SetProperty Id="WixQuietExecCmdLine" Value="&quot;[System64Folder]taskkill.exe&quot; /F /IM netbird-ui.exe" Before="KillNetBirdUI" Sequence="execute" />
+		<CustomAction Id="KillNetBirdUI" BinaryRef="Wix4UtilCA_$(sys.BUILDARCHSHORT)" DllEntry="WixQuietExec" Execute="immediate" Return="ignore" />
+
 		<!-- WebView2 evergreen runtime detection.
 		     Probe both the per-machine and per-user EdgeUpdate keys; if either
 		     reports a non-empty `pv` value the runtime is already installed
@@ -104,6 +112,7 @@
 			Return="check" />
 
 		<InstallExecuteSequence>
+			<Custom Action="KillNetBirdUI" Before="InstallValidate" />
 			<Custom Action="InstallWebView2" Before="InstallFinalize"
 				Condition="NOT WEBVIEW2_VERSION_HKLM AND NOT WEBVIEW2_VERSION_HKCU AND NOT REMOVE" />
 		</InstallExecuteSequence>

From e2a2d379c5c3cd24a1fb5ca2e758cc09d304294d Mon Sep 17 00:00:00 2001
From: Viktor Liu <17948409+lixmal@users.noreply.github.com>
Date: Wed, 7 Oct 2026 02:10:44 +0900
Subject: [PATCH 16/70] [infrastructure] Exempt Crowdin service PRs from title
 and docs checks (#7170)

---
 .github/workflows/docs-ack.yml       | 2 ++
 .github/workflows/pr-title-check.yml | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/.github/workflows/docs-ack.yml b/.github/workflows/docs-ack.yml
index 7e34e2f8a..edd1eebff 100644
--- a/.github/workflows/docs-ack.yml
+++ b/.github/workflows/docs-ack.yml
@@ -12,6 +12,8 @@ jobs:
   docs-ack:
     name: Require docs PR URL or explicit "not needed"
     runs-on: ubuntu-latest
+    # Crowdin's translation-sync service PRs are auto-generated without the PR template.
+    if: github.event.pull_request.user.login != 'netbirddev'
 
     steps:
       - name: Read PR body
diff --git a/.github/workflows/pr-title-check.yml b/.github/workflows/pr-title-check.yml
index 24d81b50f..5b769e2f7 100644
--- a/.github/workflows/pr-title-check.yml
+++ b/.github/workflows/pr-title-check.yml
@@ -7,6 +7,8 @@ on:
 jobs:
   check-title:
     runs-on: ubuntu-latest
+    # Crowdin's translation-sync service PRs are auto-generated with a fixed title.
+    if: github.event.pull_request.user.login != 'netbirddev'
     steps:
       - name: Validate PR title prefix
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

From ae7ad5e0c8a31638752c2838257353d31be874f2 Mon Sep 17 00:00:00 2001
From: dmitri-netbird <dmitri.external@netbird.io>
Date: Wed, 7 Oct 2026 10:21:24 +0200
Subject: [PATCH 17/70] [management] Return permission-denied error when setup
 key is expired or invalid (#8086)

* return permission-denied error when setup key is expired or invalid

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* fix tests, don't return permission-denied on internal errors

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* return not found error when key fetch failed

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* normalise errors returned from each call-site of GetSetupKeyBySecret

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* return PermissionDenied after isValid() check failure

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

---------

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
---
 management/server/peer.go                      | 8 ++++----
 management/server/peer_test.go                 | 6 +++++-
 management/server/store/sql_store_setup_key.go | 2 +-
 3 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/management/server/peer.go b/management/server/peer.go
index 8d99bebb0..f3a5ebf46 100644
--- a/management/server/peer.go
+++ b/management/server/peer.go
@@ -710,11 +710,11 @@ func (am *DefaultAccountManager) handleUserAddedPeer(ctx context.Context, accoun
 func (am *DefaultAccountManager) handleSetupKeyAddedPeer(ctx context.Context, encodedHashedKey string, peer *nbpeer.Peer, opEvent *activity.Event, config *peerAddAuthConfig) error {
 	sk, err := am.Store.GetSetupKeyBySecret(ctx, store.LockingStrengthNone, encodedHashedKey)
 	if err != nil {
-		return status.Errorf(status.NotFound, "couldn't add peer: setup key is invalid")
+		return err
 	}
 
 	if !sk.IsValid() {
-		return status.Errorf(status.NotFound, "couldn't add peer: setup key is invalid")
+		return status.Errorf(status.PermissionDenied, "couldn't add peer: setup key is invalid")
 	}
 
 	if !sk.AllowExtraDNSLabels && len(peer.ExtraDNSLabels) > 0 {
@@ -915,12 +915,12 @@ func (am *DefaultAccountManager) AddPeer(ctx context.Context, accountID, setupKe
 			case addedBySetupKey:
 				sk, err := transaction.GetSetupKeyBySecret(ctx, store.LockingStrengthUpdate, encodedHashedKey)
 				if err != nil {
-					return fmt.Errorf("failed to get setup key: %w", err)
+					return err
 				}
 
 				// we validate at the end to not block the setup key for too long
 				if !sk.IsValid() {
-					return status.Errorf(status.PreconditionFailed, "couldn't add peer: setup key is invalid")
+					return status.Errorf(status.PermissionDenied, "couldn't add peer: setup key is invalid")
 				}
 
 				err = transaction.IncrementSetupKeyUsage(ctx, peerAddConfig.SetupKeyID)
diff --git a/management/server/peer_test.go b/management/server/peer_test.go
index ec4f0ef01..fa3be9a58 100644
--- a/management/server/peer_test.go
+++ b/management/server/peer_test.go
@@ -1495,7 +1495,7 @@ func Test_RegisterPeerBySetupKey(t *testing.T) {
 			name:                      "Absent setup key",
 			existingSetupKeyID:        "AAAAAAAA-38F5-4553-B31E-DD66C696CEBB",
 			expectAddPeerError:        true,
-			errorType:                 status.NotFound,
+			errorType:                 status.PermissionDenied,
 			expectedErrorMsgSubstring: "couldn't add peer: setup key is invalid",
 		},
 	}
@@ -2642,6 +2642,8 @@ func TestHandleSetupKeyAddedPeer(t *testing.T) {
 
 		err = manager.handleSetupKeyAddedPeer(context.Background(), encodedHashedKey, peer, opEvent, config)
 		require.Error(t, err)
+		require.IsType(t, &status.Error{}, err)
+		require.Equal(t, err.(*status.Error).ErrorType, status.PermissionDenied)
 		assert.Contains(t, err.Error(), "setup key is invalid")
 	})
 
@@ -2662,6 +2664,8 @@ func TestHandleSetupKeyAddedPeer(t *testing.T) {
 
 		err = manager.handleSetupKeyAddedPeer(context.Background(), encodedHashedKey, peer, opEvent, config)
 		require.Error(t, err)
+		require.IsType(t, &status.Error{}, err)
+		require.Equal(t, err.(*status.Error).ErrorType, status.PermissionDenied)
 		assert.Contains(t, err.Error(), "setup key is invalid")
 	})
 
diff --git a/management/server/store/sql_store_setup_key.go b/management/server/store/sql_store_setup_key.go
index 3857f6e8c..ac42ef725 100644
--- a/management/server/store/sql_store_setup_key.go
+++ b/management/server/store/sql_store_setup_key.go
@@ -127,7 +127,7 @@ func (s *SqlStore) GetSetupKeyBySecret(ctx context.Context, lockStrength Locking
 
 	if result.Error != nil {
 		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.PreconditionFailed, "setup key not found")
+			return nil, status.Errorf(status.PermissionDenied, "couldn't add peer: setup key is invalid")
 		}
 		log.WithContext(ctx).Errorf("failed to get setup key by secret from store: %v", result.Error)
 		return nil, status.Errorf(status.Internal, "failed to get setup key by secret from store")

From 5433e92183e9d9d723101095bd88de5b559b68ca Mon Sep 17 00:00:00 2001
From: Riccardo Manfrin <3090891+riccardomanfrin@users.noreply.github.com>
Date: Wed, 7 Oct 2026 15:17:15 +0200
Subject: [PATCH 18/70] [client] Stop one unreachable relay from churning the
 others (#8098)

* [client] Pass the home relay client into isForeignServer

isForeignServer read m.relayClient directly, so it was only safe while the
caller held relayClientMu, and that dependency was invisible at the call site.
Taking the client as a parameter makes the requirement explicit and lets a
caller narrow the window it holds the lock for.

Pure refactor, no behavior change: the single caller passes m.relayClient while
still holding the read lock.

* [client] Release the relay client lock before dialing a foreign server

OpenConn held relayClientMu for its whole body, dial included. Dialing a foreign
relay takes as long as that server's connect timeout, and onServerDisconnected
needs the same mutex in write mode; a pending writer also blocks later readers,
so a single unreachable relay stalled every relay operation on the node for the
duration of the dial.

On a routing peer this stalled the disconnect handling of an unrelated relay for
a full dial timeout. By the time the eviction ran, the track had already been
rebuilt, so it dropped a working client and the next OpenConn built a duplicate
connection to a server the peer was already connected to.

Read the home client under the lock, then release it and dial unlocked.

* [client] Keep a reconnected foreign relay client on a late disconnect notice

evictForeignRelay deleted the track by server address without checking which
client the entry held. The disconnect notice is delivered on its own goroutine
and carries only the address, so it can arrive after the track has been rebuilt:
the eviction then dropped a live client, and the next OpenConn built a second
connection to a server the peer was already connected to. The relay answers a
duplicate peer ID by closing the existing connection, which tears down every
relayed channel on it, including the peers whose active path it is.

Skip the eviction when the stored client is still connected.

* [client] Drop the comments added with the previous commits

Comment-only change, no behavior change.

* [client] Cover the foreign relay stall and the late disconnect notice

Two regression tests, both failing on the unfixed code:

TestOpenConn_DoesNotHoldRelayClientLockAcrossDial dials a listener that accepts
and never answers, then calls onServerDisconnected and fails if it does not
return. On the unfixed code the writer waits out the whole dial.

TestEvictForeignRelay_KeepsConnectedClient opens a real connection to a second
relay and then replays a disconnect notice for that address. On the unfixed code
the live client is dropped from the map.

Both reuse the existing stallingRelayListener and relay server helpers.

* [client] Keep a foreign relay track whose dial is still in progress

openConnVia publishes the track before dialing and fills relayClient only once
the dial finishes, so the readiness guard did not cover the dial-in-progress
window: a disconnect notice arriving there deleted a track whose client was
about to connect. That client then became unreachable through the map, so
cleanUpUnusedRelays could not close it either, and the next OpenConn dialed a
duplicate the relay answers by closing the first - the churn this branch is
meant to remove.

Skip the eviction while relayClient is still nil, the same signal
cleanUpUnusedRelays already uses to leave an in-flight dial alone.

Reported by cubic on PR #8098.
---
 shared/relay/client/manager.go                |  35 +++-
 .../client/manager_foreign_stall_test.go      | 160 ++++++++++++++++++
 2 files changed, 186 insertions(+), 9 deletions(-)
 create mode 100644 shared/relay/client/manager_foreign_stall_test.go

diff --git a/shared/relay/client/manager.go b/shared/relay/client/manager.go
index fc69e8fea..518a4a5fe 100644
--- a/shared/relay/client/manager.go
+++ b/shared/relay/client/manager.go
@@ -167,13 +167,14 @@ func (m *Manager) Serve() error {
 // Ignored for the local home-server path. TLS verification still uses the FQDN via SNI.
 func (m *Manager) OpenConn(ctx context.Context, serverAddress, peerKey string, serverIP netip.Addr) (*Conn, error) {
 	m.relayClientMu.RLock()
-	defer m.relayClientMu.RUnlock()
+	homeClient := m.relayClient
+	m.relayClientMu.RUnlock()
 
-	if m.relayClient == nil {
+	if homeClient == nil {
 		return nil, ErrRelayClientNotConnected
 	}
 
-	foreign, err := m.isForeignServer(serverAddress)
+	foreign, err := m.isForeignServer(homeClient, serverAddress)
 	if err != nil {
 		return nil, err
 	}
@@ -181,7 +182,7 @@ func (m *Manager) OpenConn(ctx context.Context, serverAddress, peerKey string, s
 	var netConn *Conn
 	if !foreign {
 		log.Debugf("open peer connection via permanent server: %s", peerKey)
-		netConn, err = m.relayClient.OpenConn(ctx, peerKey)
+		netConn, err = homeClient.OpenConn(ctx, peerKey)
 	} else {
 		log.Debugf("open peer connection via foreign server: %s", serverAddress)
 		netConn, err = m.openConnVia(ctx, serverAddress, peerKey, serverIP)
@@ -399,10 +400,26 @@ func (m *Manager) onServerDisconnected(serverAddress string) {
 func (m *Manager) evictForeignRelay(serverAddress string) {
 	m.relayClientsMutex.Lock()
 	defer m.relayClientsMutex.Unlock()
-	if _, ok := m.relayClients[serverAddress]; ok {
-		delete(m.relayClients, serverAddress)
-		log.Debugf("evicted disconnected foreign relay client: %s", serverAddress)
+
+	rt, ok := m.relayClients[serverAddress]
+	if !ok {
+		return
 	}
+
+	rt.RLock()
+	client := rt.relayClient
+	rt.RUnlock()
+	if client == nil {
+		log.Debugf("keeping foreign relay track with a dial in progress: %s", serverAddress)
+		return
+	}
+	if client.Ready() {
+		log.Debugf("keeping reconnected foreign relay client: %s", serverAddress)
+		return
+	}
+
+	delete(m.relayClients, serverAddress)
+	log.Debugf("evicted disconnected foreign relay client: %s", serverAddress)
 }
 
 func (m *Manager) listenGuardEvent(ctx context.Context) {
@@ -427,8 +444,8 @@ func (m *Manager) storeClient(client *Client) {
 	m.relayClient.SetOnDisconnectListener(m.onServerDisconnected)
 }
 
-func (m *Manager) isForeignServer(address string) (bool, error) {
-	rAddr, err := m.relayClient.ServerInstanceURL()
+func (m *Manager) isForeignServer(homeClient *Client, address string) (bool, error) {
+	rAddr, err := homeClient.ServerInstanceURL()
 	if err != nil {
 		return false, fmt.Errorf("relay client not connected")
 	}
diff --git a/shared/relay/client/manager_foreign_stall_test.go b/shared/relay/client/manager_foreign_stall_test.go
new file mode 100644
index 000000000..431629414
--- /dev/null
+++ b/shared/relay/client/manager_foreign_stall_test.go
@@ -0,0 +1,160 @@
+package client
+
+import (
+	"context"
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/iface"
+	"github.com/netbirdio/netbird/relay/server"
+)
+
+// startManagerTestRelay starts a relay server on address and returns a Manager that
+// uses it as its home relay.
+func startManagerTestRelay(t *testing.T, ctx context.Context, address, peerID string) *Manager {
+	t.Helper()
+
+	cfg := server.ListenerConfig{Address: address}
+	srv, err := server.NewServer(newManagerTestServerConfig(cfg.Address))
+	require.NoError(t, err)
+
+	errChan := make(chan error, 1)
+	go func() {
+		if err := srv.Listen(cfg); err != nil {
+			errChan <- err
+		}
+	}()
+	t.Cleanup(func() {
+		_ = srv.Shutdown(context.Background())
+	})
+	require.NoError(t, waitForServerToStart(errChan))
+
+	m := NewManager(ctx, toURL(cfg), peerID, iface.DefaultMTU)
+	require.NoError(t, m.Serve())
+	return m
+}
+
+// TestOpenConn_DoesNotHoldRelayClientLockAcrossDial asserts that dialing an
+// unreachable foreign relay does not stall the relay bookkeeping of the whole node.
+// onServerDisconnected needs relayClientMu in write mode, and a pending writer also
+// blocks later readers, so holding the lock across the dial made one unreachable
+// relay freeze every relay operation for as long as that server's connect timeout.
+func TestOpenConn_DoesNotHoldRelayClientLockAcrossDial(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	m := startManagerTestRelay(t, ctx, "localhost:52801", "alice")
+	stalling := stallingRelayListener(t)
+
+	dialDone := make(chan struct{})
+	go func() {
+		defer close(dialDone)
+		_, _ = m.OpenConn(ctx, stalling, "bob", netip.Addr{})
+	}()
+
+	// The track is published before the dial starts, so its presence means the dial
+	// is in flight and the lock, if taken, is held.
+	require.Eventually(t, func() bool {
+		m.relayClientsMutex.RLock()
+		defer m.relayClientsMutex.RUnlock()
+		_, ok := m.relayClients[stalling]
+		return ok
+	}, 5*time.Second, 5*time.Millisecond, "the foreign relay dial did not start")
+
+	writerDone := make(chan struct{})
+	go func() {
+		defer close(writerDone)
+		m.onServerDisconnected("rel://192.0.2.1:1234")
+	}()
+
+	select {
+	case <-writerDone:
+	case <-time.After(2 * time.Second):
+		t.Fatal("onServerDisconnected blocked on an in-progress foreign relay dial")
+	}
+
+	cancel()
+	select {
+	case <-dialDone:
+	case <-time.After(5 * time.Second):
+		t.Fatal("OpenConn did not return after context cancellation")
+	}
+}
+
+// TestEvictForeignRelay_KeepsConnectedClient asserts that a disconnect notice naming a
+// server whose track has since been rebuilt does not drop the live client. Evicting it
+// makes the next OpenConn build a duplicate connection, which the relay answers by
+// closing the existing one and with it every relayed channel on that server.
+func TestEvictForeignRelay_KeepsConnectedClient(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	alice := startManagerTestRelay(t, ctx, "localhost:52802", "alice")
+	bob := startManagerTestRelay(t, ctx, "localhost:52803", "bob")
+
+	bobsSrvAddr, _, err := bob.RelayInstanceAddress()
+	require.NoError(t, err)
+
+	_, err = alice.OpenConn(ctx, bobsSrvAddr, "bob", netip.Addr{})
+	require.NoError(t, err, "alice must reach bob over bob's relay")
+
+	alice.relayClientsMutex.RLock()
+	rt, tracked := alice.relayClients[bobsSrvAddr]
+	alice.relayClientsMutex.RUnlock()
+	require.True(t, tracked, "the foreign relay must be tracked after OpenConn")
+	rt.RLock()
+	require.True(t, rt.relayClient.Ready(), "the foreign relay client must be connected")
+	rt.RUnlock()
+
+	// A disconnect notice for the same address, delivered late.
+	alice.evictForeignRelay(bobsSrvAddr)
+
+	alice.relayClientsMutex.RLock()
+	_, stillTracked := alice.relayClients[bobsSrvAddr]
+	alice.relayClientsMutex.RUnlock()
+	require.True(t, stillTracked, "a late disconnect notice must not evict a connected foreign relay client")
+}
+
+// TestEvictForeignRelay_KeepsDialInProgress asserts that a disconnect notice arriving
+// while a new dial for the same server is still running does not delete the track.
+// openConnVia publishes the track before dialing and only fills relayClient once the
+// dial finishes, so an eviction in that window orphans the client that is about to
+// connect: it is no longer reachable through the map, cleanUpUnusedRelays cannot close
+// it, and the next OpenConn dials a duplicate the relay answers by closing the first.
+func TestEvictForeignRelay_KeepsDialInProgress(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	m := NewManager(ctx, nil, "alice", iface.DefaultMTU)
+	stalling := stallingRelayListener(t)
+
+	dialDone := make(chan struct{})
+	go func() {
+		defer close(dialDone)
+		_, _ = m.openConnVia(ctx, stalling, "bob", netip.Addr{})
+	}()
+
+	require.Eventually(t, func() bool {
+		m.relayClientsMutex.RLock()
+		defer m.relayClientsMutex.RUnlock()
+		_, ok := m.relayClients[stalling]
+		return ok
+	}, 5*time.Second, 5*time.Millisecond, "the foreign relay dial did not start")
+
+	m.evictForeignRelay(stalling)
+
+	m.relayClientsMutex.RLock()
+	_, stillTracked := m.relayClients[stalling]
+	m.relayClientsMutex.RUnlock()
+	require.True(t, stillTracked, "a disconnect notice must not evict a track whose dial is still in progress")
+
+	cancel()
+	select {
+	case <-dialDone:
+	case <-time.After(5 * time.Second):
+		t.Fatal("openConnVia did not return after context cancellation")
+	}
+}

From 6a3821711372cea40ee3bc6b5c5ca4479cfaada3 Mon Sep 17 00:00:00 2001
From: Bethuel Mmbaga <bethuelmbaga12@gmail.com>
Date: Wed, 7 Oct 2026 18:39:25 +0300
Subject: [PATCH 19/70] [management] Add a MySQL to Postgres migration tool
 (#8095)

---
 .../workflows/check-license-dependencies.yml  |   4 +-
 .goreleaser.yaml                              |  26 +
 tools/mysql-migrate/LICENSE                   | 661 ++++++++++++++++++
 tools/mysql-migrate/copy.go                   | 357 ++++++++++
 tools/mysql-migrate/main.go                   | 242 +++++++
 tools/mysql-migrate/main_test.go              | 225 ++++++
 6 files changed, 1513 insertions(+), 2 deletions(-)
 create mode 100644 tools/mysql-migrate/LICENSE
 create mode 100644 tools/mysql-migrate/copy.go
 create mode 100644 tools/mysql-migrate/main.go
 create mode 100644 tools/mysql-migrate/main_test.go

diff --git a/.github/workflows/check-license-dependencies.yml b/.github/workflows/check-license-dependencies.yml
index 81d293e4f..27c59f8d6 100644
--- a/.github/workflows/check-license-dependencies.yml
+++ b/.github/workflows/check-license-dependencies.yml
@@ -34,7 +34,7 @@ jobs:
           while IFS= read -r dir; do
             echo "=== Checking $dir ==="
             # Search for problematic imports, excluding test files
-            RESULTS=$(grep -r "github.com/netbirdio/netbird/\(management\|signal\|relay\|proxy\)" "$dir" --include="*.go" 2>/dev/null | grep -v "_test.go" | grep -v "test_" | grep -v "/test/" | grep -v "tools/idp-migrate/" || true)
+            RESULTS=$(grep -r "github.com/netbirdio/netbird/\(management\|signal\|relay\|proxy\)" "$dir" --include="*.go" 2>/dev/null | grep -v "_test.go" | grep -v "test_" | grep -v "/test/" | grep -v "tools/idp-migrate/" | grep -v "tools/mysql-migrate/" || true)
             if [ -n "$RESULTS" ]; then
               echo "❌ Found problematic dependencies:"
               echo "$RESULTS"
@@ -93,7 +93,7 @@ jobs:
                 IMPORTERS=$(go list -json -deps ./... 2>/dev/null | jq -r "select(.Imports[]? == \"$package\") | .ImportPath")
 
                 # Check if any importer is NOT in management/signal/relay
-                BSD_IMPORTER=$(echo "$IMPORTERS" | grep -v "github.com/netbirdio/netbird/\(management\|signal\|relay\|proxy\|combined\|tools/idp-migrate\)" | head -1)
+                BSD_IMPORTER=$(echo "$IMPORTERS" | grep -v "github.com/netbirdio/netbird/\(management\|signal\|relay\|proxy\|combined\|tools/idp-migrate\|tools/mysql-migrate\)" | head -1)
 
                 if [ -n "$BSD_IMPORTER" ]; then
                   echo "❌ $package ($license) is imported by BSD-licensed code: $BSD_IMPORTER"
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 59d8274e9..0e9b11bc5 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -216,6 +216,28 @@ builds:
       - -s -w -X github.com/netbirdio/netbird/version.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}} -X main.builtBy=goreleaser
     mod_timestamp: "{{ .CommitTimestamp }}"
 
+  - id: netbird-mysql-migrate
+    dir: tools/mysql-migrate
+    env:
+      - CGO_ENABLED=1
+      - >-
+        {{- if eq .Runtime.Goos "linux" }}
+          {{- if eq .Arch "arm64"}}CC=aarch64-linux-gnu-gcc{{- end }}
+          {{- if eq .Arch "arm"}}CC=arm-linux-gnueabihf-gcc{{- end }}
+        {{- end }}
+    binary: netbird-mysql-migrate
+    goos:
+      - linux
+    goarch:
+      - amd64
+      - arm64
+      - arm
+    goarm:
+      - 7
+    ldflags:
+      - -s -w -X github.com/netbirdio/netbird/version.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}} -X main.builtBy=goreleaser
+    mod_timestamp: "{{ .CommitTimestamp }}"
+
 universal_binaries:
   - id: netbird
 
@@ -232,6 +254,10 @@ archives:
     builds:
       - netbird-idp-migrate
     name_template: "netbird-idp-migrate_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+  - id: netbird-mysql-migrate
+    builds:
+      - netbird-mysql-migrate
+    name_template: "netbird-mysql-migrate_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
 
 nfpms:
   - maintainer: Netbird <dev@netbird.io>
diff --git a/tools/mysql-migrate/LICENSE b/tools/mysql-migrate/LICENSE
new file mode 100644
index 000000000..be3f7b28e
--- /dev/null
+++ b/tools/mysql-migrate/LICENSE
@@ -0,0 +1,661 @@
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.
diff --git a/tools/mysql-migrate/copy.go b/tools/mysql-migrate/copy.go
new file mode 100644
index 000000000..85e0c5e91
--- /dev/null
+++ b/tools/mysql-migrate/copy.go
@@ -0,0 +1,357 @@
+package main
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"math"
+	"slices"
+	"strconv"
+	"strings"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgtype"
+)
+
+type dialect struct {
+	quote        func(string) string
+	tablesQuery  string
+	columnsQuery string
+}
+
+var mysqlDialect = dialect{
+	quote:        func(name string) string { return "`" + name + "`" },
+	tablesQuery:  `SELECT table_name FROM information_schema.tables WHERE table_schema = DATABASE() AND table_type = 'BASE TABLE'`,
+	columnsQuery: `SELECT column_name FROM information_schema.columns WHERE table_schema = DATABASE() AND table_name = ?`,
+}
+
+var sqliteDialect = dialect{
+	quote:        func(name string) string { return `"` + name + `"` },
+	tablesQuery:  `SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%'`,
+	columnsQuery: `SELECT name FROM pragma_table_info(?)`,
+}
+
+type column struct {
+	name   string
+	pgType string
+}
+
+// copyStore copies the tables the source shares with the target schema;
+// source-only tables are legacy and skipped.
+func copyStore(ctx context.Context, src *sql.DB, d dialect, tx pgx.Tx, skip map[string]bool) (int, int64, error) {
+	srcTables, err := queryStrings(ctx, src, d.tablesQuery)
+	if err != nil {
+		return 0, 0, fmt.Errorf("list source tables: %w", err)
+	}
+	dstTables, err := pgStrings(ctx, tx, `SELECT table_name FROM information_schema.tables WHERE table_schema = current_schema() AND table_type = 'BASE TABLE'`)
+	if err != nil {
+		return 0, 0, fmt.Errorf("list target tables: %w", err)
+	}
+
+	var tables []string
+	for _, t := range srcTables {
+		if !skip[t] && slices.Contains(dstTables, t) {
+			tables = append(tables, t)
+		}
+	}
+	if len(tables) == 0 {
+		return 0, 0, fmt.Errorf("no NetBird tables found in the source")
+	}
+
+	ordered, err := parentsFirst(ctx, tx, tables)
+	if err != nil {
+		return 0, 0, err
+	}
+
+	var total int64
+	for _, table := range ordered {
+		n, err := copyTable(ctx, src, d, tx, table)
+		if err != nil {
+			return 0, 0, fmt.Errorf("table %s: %w", table, err)
+		}
+		total += n
+	}
+
+	if err := resetSequences(ctx, tx, tables); err != nil {
+		return 0, 0, err
+	}
+	return len(tables), total, nil
+}
+
+func copyTable(ctx context.Context, src *sql.DB, d dialect, tx pgx.Tx, table string) (int64, error) {
+	cols, err := targetColumns(ctx, tx, table)
+	if err != nil {
+		return 0, err
+	}
+	srcCols, err := queryStrings(ctx, src, d.columnsQuery, table)
+	if err != nil {
+		return 0, fmt.Errorf("list source columns: %w", err)
+	}
+
+	names := make([]string, len(cols))
+	quoted := make([]string, len(cols))
+	var missing []string
+	for i, c := range cols {
+		names[i] = c.name
+		quoted[i] = d.quote(c.name)
+		if !slices.Contains(srcCols, c.name) {
+			missing = append(missing, c.name)
+		}
+	}
+	if len(missing) > 0 {
+		return 0, fmt.Errorf("source lacks columns %v; start the management server once with this release before migrating", missing)
+	}
+
+	var hasRows bool
+	if err := tx.QueryRow(ctx, fmt.Sprintf("SELECT EXISTS (SELECT 1 FROM %s)", pgx.Identifier{table}.Sanitize())).Scan(&hasRows); err != nil {
+		return 0, err
+	}
+	if hasRows {
+		return 0, fmt.Errorf("target already holds data")
+	}
+
+	rows, err := src.QueryContext(ctx, fmt.Sprintf("SELECT %s FROM %s", strings.Join(quoted, ", "), d.quote(table)))
+	if err != nil {
+		return 0, fmt.Errorf("read source: %w", err)
+	}
+	defer rows.Close()
+
+	return tx.CopyFrom(ctx, pgx.Identifier{table}, names, newRowSource(rows, cols))
+}
+
+func targetColumns(ctx context.Context, tx pgx.Tx, table string) ([]column, error) {
+	rows, err := tx.Query(ctx, `SELECT column_name, data_type FROM information_schema.columns
+		WHERE table_schema = current_schema() AND table_name = $1 ORDER BY ordinal_position`, table)
+	if err != nil {
+		return nil, err
+	}
+	return pgx.CollectRows(rows, func(row pgx.CollectableRow) (column, error) {
+		var c column
+		err := row.Scan(&c.name, &c.pgType)
+		return c, err
+	})
+}
+
+func parentsFirst(ctx context.Context, tx pgx.Tx, tables []string) ([]string, error) {
+	rows, err := tx.Query(ctx, `SELECT child.relname, parent.relname FROM pg_constraint c
+		JOIN pg_class child ON child.oid = c.conrelid
+		JOIN pg_class parent ON parent.oid = c.confrelid
+		JOIN pg_namespace n ON n.oid = child.relnamespace
+		WHERE c.contype = 'f' AND n.nspname = current_schema()`)
+	if err != nil {
+		return nil, fmt.Errorf("read foreign keys: %w", err)
+	}
+	parents := map[string][]string{}
+	var child, parent string
+	_, err = pgx.ForEachRow(rows, []any{&child, &parent}, func() error {
+		if child != parent {
+			parents[child] = append(parents[child], parent)
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, fmt.Errorf("read foreign keys: %w", err)
+	}
+
+	pending := slices.Sorted(slices.Values(tables))
+	done := make(map[string]bool, len(tables))
+	ordered := make([]string, 0, len(tables))
+	for len(pending) > 0 {
+		var next []string
+		for _, t := range pending {
+			if ready(parents[t], tables, done) {
+				ordered = append(ordered, t)
+				done[t] = true
+			} else {
+				next = append(next, t)
+			}
+		}
+		if len(next) == len(pending) {
+			return nil, fmt.Errorf("foreign keys form a cycle between %v", next)
+		}
+		pending = next
+	}
+	return ordered, nil
+}
+
+func ready(parents, tables []string, done map[string]bool) bool {
+	for _, p := range parents {
+		if slices.Contains(tables, p) && !done[p] {
+			return false
+		}
+	}
+	return true
+}
+
+// resetSequences moves serial sequences past the ids COPY inserted explicitly.
+func resetSequences(ctx context.Context, tx pgx.Tx, tables []string) error {
+	rows, err := tx.Query(ctx, `SELECT table_name, column_name, pg_get_serial_sequence(quote_ident(table_name), column_name)
+		FROM information_schema.columns
+		WHERE table_schema = current_schema() AND table_name = ANY($1)
+		AND pg_get_serial_sequence(quote_ident(table_name), column_name) IS NOT NULL`, tables)
+	if err != nil {
+		return fmt.Errorf("list sequences: %w", err)
+	}
+	type sequence struct{ table, column, name string }
+	seqs, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (sequence, error) {
+		var s sequence
+		err := row.Scan(&s.table, &s.column, &s.name)
+		return s, err
+	})
+	if err != nil {
+		return fmt.Errorf("list sequences: %w", err)
+	}
+
+	for _, s := range seqs {
+		q := fmt.Sprintf("SELECT setval('%s', COALESCE(MAX(%s), 0) + 1, false) FROM %s",
+			strings.ReplaceAll(s.name, "'", "''"), pgx.Identifier{s.column}.Sanitize(), pgx.Identifier{s.table}.Sanitize())
+		if _, err := tx.Exec(ctx, q); err != nil {
+			return fmt.Errorf("reset sequence %s: %w", s.name, err)
+		}
+	}
+	return nil
+}
+
+type rowSource struct {
+	rows *sql.Rows
+	cols []column
+	vals []any
+	ptrs []any
+}
+
+func newRowSource(rows *sql.Rows, cols []column) *rowSource {
+	r := &rowSource{rows: rows, cols: cols, vals: make([]any, len(cols)), ptrs: make([]any, len(cols))}
+	for i := range r.vals {
+		r.ptrs[i] = &r.vals[i]
+	}
+	return r
+}
+
+func (r *rowSource) Next() bool { return r.rows.Next() }
+
+func (r *rowSource) Err() error { return r.rows.Err() }
+
+func (r *rowSource) Values() ([]any, error) {
+	if err := r.rows.Scan(r.ptrs...); err != nil {
+		return nil, err
+	}
+	out := make([]any, len(r.vals))
+	for i, v := range r.vals {
+		if v == nil {
+			continue
+		}
+		converted, err := convert(v, r.cols[i].pgType)
+		if err != nil {
+			return nil, fmt.Errorf("column %s: %w", r.cols[i].name, err)
+		}
+		out[i] = converted
+	}
+	return out, nil
+}
+
+// convert adapts a non-NULL value to the target column type: MySQL and SQLite
+// return text and numbers as bytes and booleans as integers.
+func convert(v any, pgType string) (any, error) {
+	switch pgType {
+	case "boolean":
+		return toBool(v)
+	case "bytea":
+		return toBytes(v), nil
+	case "smallint", "integer", "bigint":
+		return toInt64(v)
+	case "real", "double precision":
+		return toFloat64(v)
+	case "numeric":
+		return toNumeric(v)
+	default:
+		return toText(v), nil
+	}
+}
+
+func toBool(v any) (any, error) {
+	switch b := v.(type) {
+	case int64:
+		return b != 0, nil
+	case []byte:
+		return strconv.ParseBool(string(b))
+	case string:
+		return strconv.ParseBool(b)
+	}
+	return v, nil
+}
+
+func toBytes(v any) any {
+	if s, ok := v.(string); ok {
+		return []byte(s)
+	}
+	return v
+}
+
+func toInt64(v any) (any, error) {
+	switch n := v.(type) {
+	case uint64:
+		if n > math.MaxInt64 {
+			return nil, fmt.Errorf("value %d overflows bigint", n)
+		}
+		return int64(n), nil
+	case []byte:
+		return strconv.ParseInt(string(n), 10, 64)
+	}
+	return v, nil
+}
+
+func toFloat64(v any) (any, error) {
+	if b, ok := v.([]byte); ok {
+		return strconv.ParseFloat(string(b), 64)
+	}
+	return v, nil
+}
+
+func toNumeric(v any) (any, error) {
+	var s string
+	switch x := v.(type) {
+	case []byte:
+		s = string(x)
+	case string:
+		s = x
+	default:
+		return v, nil
+	}
+	var n pgtype.Numeric
+	if err := n.Scan(s); err != nil {
+		return nil, err
+	}
+	return n, nil
+}
+
+func toText(v any) any {
+	if b, ok := v.([]byte); ok {
+		return string(b)
+	}
+	return v
+}
+
+func queryStrings(ctx context.Context, db *sql.DB, query string, args ...any) ([]string, error) {
+	rows, err := db.QueryContext(ctx, query, args...)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []string
+	for rows.Next() {
+		var s string
+		if err := rows.Scan(&s); err != nil {
+			return nil, err
+		}
+		out = append(out, s)
+	}
+	return out, rows.Err()
+}
+
+func pgStrings(ctx context.Context, tx pgx.Tx, query string) ([]string, error) {
+	rows, err := tx.Query(ctx, query)
+	if err != nil {
+		return nil, err
+	}
+	return pgx.CollectRows(rows, pgx.RowTo[string])
+}
diff --git a/tools/mysql-migrate/main.go b/tools/mysql-migrate/main.go
new file mode 100644
index 000000000..f9531c66a
--- /dev/null
+++ b/tools/mysql-migrate/main.go
@@ -0,0 +1,242 @@
+package main
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"flag"
+	"fmt"
+	"log/slog"
+	"net/url"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+	log "github.com/sirupsen/logrus"
+	"gorm.io/driver/mysql"
+	"gorm.io/driver/postgres"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+	"gorm.io/gorm/logger"
+
+	"github.com/netbirdio/netbird/idp/dex"
+	"github.com/netbirdio/netbird/management/internals/shared/db"
+	"github.com/netbirdio/netbird/management/server/activity"
+	"github.com/netbirdio/netbird/management/server/store"
+)
+
+type config struct {
+	mysqlDSN          string
+	postgresDSN       string
+	eventsPostgresDSN string
+	authPostgresDSN   string
+	eventsDB          string
+	authDB            string
+	mysqlTimezone     string
+}
+
+type storeMigration struct {
+	name       string
+	source     *sql.DB
+	dialect    dialect
+	targetDSN  string
+	schema     func(ctx context.Context, dsn string) error
+	skipTables map[string]bool
+}
+
+func main() {
+	cfg, err := parseFlags(os.Args[1:])
+	if errors.Is(err, flag.ErrHelp) {
+		return
+	}
+	if err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(2)
+	}
+
+	// Silence the store constructors' migration logs.
+	log.SetLevel(log.WarnLevel)
+
+	if err := run(context.Background(), cfg); err != nil {
+		fmt.Fprintf(os.Stderr, "migration failed: %v\n", err)
+		os.Exit(1)
+	}
+}
+
+func parseFlags(args []string) (*config, error) {
+	cfg := &config{}
+	fs := flag.NewFlagSet("netbird-mysql-migrate", flag.ContinueOnError)
+	fs.StringVar(&cfg.mysqlDSN, "mysql-dsn", "", "MySQL DSN of the management store (required)")
+	fs.StringVar(&cfg.postgresDSN, "postgres-dsn", "", "Postgres DSN to migrate all stores to (required)")
+	fs.StringVar(&cfg.eventsPostgresDSN, "events-postgres-dsn", "", "Postgres DSN for activity events (default --postgres-dsn)")
+	fs.StringVar(&cfg.authPostgresDSN, "auth-postgres-dsn", "", "Postgres DSN for the embedded IdP (default --postgres-dsn)")
+	fs.StringVar(&cfg.eventsDB, "events-db", "/var/lib/netbird/events.db", "SQLite file of the activity events, skipped when missing")
+	fs.StringVar(&cfg.authDB, "auth-db", "/var/lib/netbird/idp.db", "SQLite file of the embedded IdP, skipped when missing")
+	fs.StringVar(&cfg.mysqlTimezone, "mysql-timezone", "UTC", "time zone the management server ran in, e.g. Europe/Berlin")
+	if err := fs.Parse(args); err != nil {
+		return nil, err
+	}
+	if _, err := time.LoadLocation(cfg.mysqlTimezone); err != nil {
+		return nil, fmt.Errorf("--mysql-timezone: %w", err)
+	}
+
+	if cfg.mysqlDSN == "" || cfg.postgresDSN == "" {
+		return nil, errors.New("--mysql-dsn and --postgres-dsn are required")
+	}
+	if cfg.eventsPostgresDSN == "" {
+		cfg.eventsPostgresDSN = cfg.postgresDSN
+	}
+	if cfg.authPostgresDSN == "" {
+		cfg.authPostgresDSN = cfg.postgresDSN
+	}
+	return cfg, nil
+}
+
+func run(ctx context.Context, cfg *config) error {
+	migrations, closeSources, err := openSources(cfg)
+	if err != nil {
+		return err
+	}
+	defer closeSources()
+
+	for _, m := range migrations {
+		if err := m.schema(ctx, m.targetDSN); err != nil {
+			return fmt.Errorf("create %s schema: %w", m.name, err)
+		}
+	}
+
+	var (
+		pools []*pgxpool.Pool
+		txs   []pgx.Tx
+	)
+	// Roll back first: pool Close waits for the connections open transactions hold.
+	defer func() {
+		for _, tx := range txs {
+			_ = tx.Rollback(ctx)
+		}
+		for _, pool := range pools {
+			pool.Close()
+		}
+	}()
+
+	results := make([]string, 0, len(migrations))
+	for _, m := range migrations {
+		pool, err := pgxpool.New(ctx, m.targetDSN)
+		if err != nil {
+			return fmt.Errorf("connect %s target: %w", m.name, err)
+		}
+		pools = append(pools, pool)
+
+		tx, err := pool.Begin(ctx)
+		if err != nil {
+			return fmt.Errorf("begin %s transaction: %w", m.name, err)
+		}
+		txs = append(txs, tx)
+
+		tables, rows, err := copyStore(ctx, m.source, m.dialect, tx, m.skipTables)
+		if err != nil {
+			return fmt.Errorf("%s: %w", m.name, err)
+		}
+		results = append(results, fmt.Sprintf("%s: %d rows from %d tables", m.name, rows, tables))
+	}
+
+	// Commit last so a failure in any store leaves every target empty.
+	for i, tx := range txs {
+		if err := tx.Commit(ctx); err != nil {
+			return fmt.Errorf("commit %s: %w", migrations[i].name, err)
+		}
+	}
+
+	for _, r := range results {
+		fmt.Fprintln(os.Stdout, r)
+	}
+	fmt.Fprintln(os.Stdout, "Done. Point the store, activity and auth store settings at Postgres before starting the server.")
+	return nil
+}
+
+func openSources(cfg *config) ([]storeMigration, func(), error) {
+	var opened []*gorm.DB
+	closeAll := func() {
+		for _, g := range opened {
+			if sqlDB, err := g.DB(); err == nil {
+				_ = sqlDB.Close()
+			}
+		}
+	}
+
+	open := func(dialector gorm.Dialector) (*sql.DB, error) {
+		g, err := gorm.Open(dialector, &gorm.Config{Logger: logger.Discard})
+		if err != nil {
+			return nil, err
+		}
+		opened = append(opened, g)
+		return g.DB()
+	}
+
+	mysqlDB, err := open(mysql.Open(mysqlDSN(cfg.mysqlDSN, cfg.mysqlTimezone)))
+	if err != nil {
+		closeAll()
+		return nil, nil, fmt.Errorf("open MySQL: %w", err)
+	}
+	migrations := []storeMigration{{
+		name: "management", source: mysqlDB, dialect: mysqlDialect,
+		targetDSN: cfg.postgresDSN, schema: createManagementSchema,
+	}}
+
+	sqliteStores := []storeMigration{
+		{name: "activity", targetDSN: cfg.eventsPostgresDSN, schema: createActivitySchema},
+		{name: "auth", targetDSN: cfg.authPostgresDSN, schema: createAuthSchema, skipTables: map[string]bool{"migrations": true}},
+	}
+	for i, file := range []string{cfg.eventsDB, cfg.authDB} {
+		m := sqliteStores[i]
+		if _, err := os.Stat(file); errors.Is(err, os.ErrNotExist) {
+			fmt.Fprintf(os.Stdout, "%s: %s not found, skipping\n", m.name, file)
+			continue
+		}
+		m.source, err = open(sqlite.Open("file:" + file + "?mode=ro"))
+		if err != nil {
+			closeAll()
+			return nil, nil, fmt.Errorf("open %s: %w", file, err)
+		}
+		m.dialect = sqliteDialect
+		migrations = append(migrations, m)
+	}
+
+	return migrations, closeAll, nil
+}
+
+func mysqlDSN(dsn, timezone string) string {
+	return strings.TrimSuffix(db.MysqlDSN(dsn), "&loc=Local") + "&loc=" + url.QueryEscape(timezone)
+}
+
+func createManagementSchema(ctx context.Context, dsn string) error {
+	s, err := store.NewPostgresqlStore(ctx, dsn, nil, false)
+	if err != nil {
+		return err
+	}
+	return s.Close(ctx)
+}
+
+func createActivitySchema(_ context.Context, dsn string) error {
+	g, err := gorm.Open(postgres.Open(dsn), &gorm.Config{Logger: logger.Discard})
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if sqlDB, err := g.DB(); err == nil {
+			_ = sqlDB.Close()
+		}
+	}()
+	return g.AutoMigrate(&activity.Event{}, &activity.DeletedUser{})
+}
+
+func createAuthSchema(_ context.Context, dsn string) error {
+	cfg := dex.Storage{Type: "postgres", Config: map[string]any{"dsn": dsn}}
+	s, err := cfg.OpenStorage(slog.New(slog.DiscardHandler))
+	if err != nil {
+		return err
+	}
+	return s.Close()
+}
diff --git a/tools/mysql-migrate/main_test.go b/tools/mysql-migrate/main_test.go
new file mode 100644
index 000000000..c80fc6e4c
--- /dev/null
+++ b/tools/mysql-migrate/main_test.go
@@ -0,0 +1,225 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+	"time"
+
+	dexstorage "github.com/dexidp/dex/storage"
+	"github.com/jackc/pgx/v5/pgxpool"
+	"github.com/rs/xid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/driver/mysql"
+	"gorm.io/gorm"
+
+	"github.com/netbirdio/netbird/idp/dex"
+	"github.com/netbirdio/netbird/management/internals/shared/db"
+	"github.com/netbirdio/netbird/management/server/activity"
+	activitystore "github.com/netbirdio/netbird/management/server/activity/store"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/testutil"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/util/crypt"
+)
+
+const testAccountID = "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+
+func TestRun(t *testing.T) {
+	if os.Getenv("CI") == "true" && runtime.GOOS != "linux" {
+		t.Skip("needs Docker for the MySQL and Postgres containers")
+	}
+	// Seed in UTC to match the --mysql-timezone default.
+	time.Local = time.UTC
+	ctx := context.Background()
+	dir := t.TempDir()
+	key, err := crypt.GenerateKey()
+	require.NoError(t, err)
+
+	mysqlDSN := newMySQLDatabase(t, "run_src")
+	pgDSN := newPostgresDatabase(t, ctx, "run_dst")
+	mysqlStore := seedMySQL(t, ctx, mysqlDSN)
+	eventID := seedEvents(t, ctx, dir, key)
+	seedIdP(t, ctx, filepath.Join(dir, "idp.db"))
+
+	cfg, err := parseFlags([]string{
+		"--mysql-dsn", mysqlDSN,
+		"--postgres-dsn", pgDSN,
+		"--events-db", filepath.Join(dir, "events.db"),
+		"--auth-db", filepath.Join(dir, "idp.db"),
+	})
+	require.NoError(t, err)
+	require.NoError(t, run(ctx, cfg))
+
+	t.Run("management", func(t *testing.T) {
+		pgStore, err := store.NewPostgresqlStore(ctx, pgDSN, nil, true)
+		require.NoError(t, err)
+		t.Cleanup(func() { _ = pgStore.Close(ctx) })
+
+		assert.JSONEq(t, accountJSON(t, ctx, mysqlStore), accountJSON(t, ctx, pgStore),
+			"the account read from Postgres must match the one in MySQL")
+	})
+
+	t.Run("activity", func(t *testing.T) {
+		t.Setenv("NB_ACTIVITY_EVENT_STORE_ENGINE", "postgres")
+		t.Setenv("NB_ACTIVITY_EVENT_POSTGRES_DSN", pgDSN)
+		events, err := activitystore.NewSqlStore(ctx, dir, key)
+		require.NoError(t, err)
+		t.Cleanup(func() { _ = events.Close(ctx) })
+
+		got, err := events.Get(ctx, testAccountID, 0, 10, false)
+		require.NoError(t, err)
+		require.Len(t, got, 1, "the migrated event must be readable")
+		assert.Equal(t, eventID, got[0].ID, "the event must keep its id")
+
+		next, err := events.Save(ctx, &activity.Event{Timestamp: time.Now(), AccountID: testAccountID, InitiatorID: "u", TargetID: "p"})
+		require.NoError(t, err)
+		assert.Greater(t, next.ID, eventID, "new events must continue after the migrated ids")
+	})
+
+	t.Run("auth", func(t *testing.T) {
+		idp := dex.Storage{Type: "postgres", Config: map[string]any{"dsn": pgDSN}}
+		s, err := idp.OpenStorage(slog.New(slog.DiscardHandler))
+		require.NoError(t, err)
+		t.Cleanup(func() { _ = s.Close() })
+
+		pw, err := s.GetPassword(ctx, "admin@example.com")
+		require.NoError(t, err)
+		assert.Equal(t, []byte("hash"), pw.Hash, "the IdP password must survive the migration")
+	})
+
+	t.Run("refuses a target that holds data", func(t *testing.T) {
+		assert.ErrorContains(t, run(ctx, cfg), "target already holds data")
+	})
+}
+
+func seedMySQL(t *testing.T, ctx context.Context, dsn string) *store.SqlStore {
+	t.Helper()
+	t.Setenv("NETBIRD_STORE_ENGINE", string(types.SqliteStoreEngine))
+	seed, cleanup, err := store.NewTestStoreFromSQL(ctx, "../../management/server/testdata/extended-store.sql", t.TempDir())
+	require.NoError(t, err)
+	t.Cleanup(cleanup)
+
+	mysqlStore, err := store.NewMysqlStoreFromSqlStore(ctx, seed.(*store.SqlStore), dsn, nil)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = mysqlStore.Close(ctx) })
+	return mysqlStore
+}
+
+func seedEvents(t *testing.T, ctx context.Context, dir, key string) uint64 {
+	t.Helper()
+	events, err := activitystore.NewSqlStore(ctx, dir, key)
+	require.NoError(t, err)
+	defer events.Close(ctx)
+
+	event, err := events.Save(ctx, &activity.Event{
+		Timestamp: time.Now(), Activity: activity.PeerAddedByUser,
+		AccountID: testAccountID, InitiatorID: "user", TargetID: "peer",
+		Meta: map[string]any{"name": "peer"},
+	})
+	require.NoError(t, err)
+	return event.ID
+}
+
+func seedIdP(t *testing.T, ctx context.Context, file string) {
+	t.Helper()
+	idp := dex.Storage{Type: "sqlite3", Config: map[string]any{"file": file}}
+	s, err := idp.OpenStorage(slog.New(slog.DiscardHandler))
+	require.NoError(t, err)
+	defer s.Close()
+
+	require.NoError(t, s.CreatePassword(ctx, dexstorage.Password{
+		Email: "admin@example.com", Hash: []byte("hash"), Username: "admin", UserID: "admin-id",
+	}))
+}
+
+func accountJSON(t *testing.T, ctx context.Context, s store.Store) string {
+	t.Helper()
+	var account *types.Account
+	require.NoError(t, s.ExecuteInTransaction(ctx, func(tx store.Store) error {
+		var err error
+		account, err = tx.GetAccount(ctx, testAccountID)
+		return err
+	}))
+	out, err := json.Marshal(account)
+	require.NoError(t, err)
+	return string(out)
+}
+
+func TestMySQLTimezone(t *testing.T) {
+	if os.Getenv("CI") == "true" && runtime.GOOS != "linux" {
+		t.Skip("needs Docker for the MySQL and Postgres containers")
+	}
+	ctx := context.Background()
+	mysqlDSN := newMySQLDatabase(t, "tz_src")
+	pgDSN := newPostgresDatabase(t, ctx, "tz_dst")
+	ms := seedMySQL(t, ctx, mysqlDSN)
+	require.NoError(t, ms.GetDB().Exec("UPDATE accounts SET created_at = '2026-01-02 03:04:05' WHERE id = ?", testAccountID).Error)
+
+	cfg, err := parseFlags([]string{
+		"--mysql-dsn", mysqlDSN,
+		"--postgres-dsn", pgDSN,
+		"--mysql-timezone", "Asia/Tokyo",
+		"--events-db", filepath.Join(t.TempDir(), "none.db"),
+		"--auth-db", filepath.Join(t.TempDir(), "none.db"),
+	})
+	require.NoError(t, err)
+	require.NoError(t, run(ctx, cfg))
+
+	pool, err := pgxpool.New(ctx, pgDSN)
+	require.NoError(t, err)
+	t.Cleanup(pool.Close)
+	var got time.Time
+	require.NoError(t, pool.QueryRow(ctx, "SELECT created_at FROM accounts WHERE id = $1", testAccountID).Scan(&got))
+	want := time.Date(2026, 1, 1, 18, 4, 5, 0, time.UTC)
+	assert.True(t, want.Equal(got), "created_at must keep the instant the server wrote, got %s", got.UTC())
+}
+
+func TestParseFlagsRejectsUnknownTimezone(t *testing.T) {
+	_, err := parseFlags([]string{"--mysql-dsn", "m", "--postgres-dsn", "p", "--mysql-timezone", "Mars/Base"})
+	assert.ErrorContains(t, err, "--mysql-timezone")
+}
+
+// newMySQLDatabase creates a database unique to this run in the shared
+// container, so repeated runs (-count) don't collide, and drops it afterwards.
+func newMySQLDatabase(t *testing.T, prefix string) string {
+	t.Helper()
+	_, base, err := testutil.CreateMysqlTestContainer()
+	require.NoError(t, err)
+	admin, err := gorm.Open(mysql.Open(db.MysqlDSN(base)), &gorm.Config{})
+	require.NoError(t, err)
+	name := prefix + "_" + xid.New().String()
+	require.NoError(t, admin.Exec("CREATE DATABASE "+name).Error)
+	t.Cleanup(func() {
+		_ = admin.Exec("DROP DATABASE IF EXISTS " + name).Error
+		if sqlDB, err := admin.DB(); err == nil {
+			_ = sqlDB.Close()
+		}
+	})
+	return base[:strings.LastIndex(base, "/")] + "/" + name
+}
+
+// newPostgresDatabase is the Postgres counterpart of newMySQLDatabase.
+func newPostgresDatabase(t *testing.T, ctx context.Context, prefix string) string {
+	t.Helper()
+	_, base, err := testutil.CreatePostgresTestContainer()
+	require.NoError(t, err)
+	// Dex connects through lib/pq, which requires TLS unless told otherwise.
+	base = strings.TrimSuffix(base, "?")
+	admin, err := pgxpool.New(ctx, base+"?sslmode=disable")
+	require.NoError(t, err)
+	name := prefix + "_" + xid.New().String()
+	_, err = admin.Exec(ctx, "CREATE DATABASE "+name)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		_, _ = admin.Exec(context.Background(), "DROP DATABASE IF EXISTS "+name+" WITH (FORCE)")
+		admin.Close()
+	})
+	return base[:strings.LastIndex(base, "/")] + "/" + name + "?sslmode=disable"
+}

From 192d3d0344e926d1ce8539f0de7af2bb1b12eeb6 Mon Sep 17 00:00:00 2001
From: Nicolas Frati <nicofrati@gmail.com>
Date: Wed, 7 Oct 2026 18:17:24 +0200
Subject: [PATCH 20/70] [infrastructure] Find per-arch preflight results in the
 Red Hat certify check (#8111)

For a manifest list, preflight writes results.json only under
artifacts/<arch>/. The literal artifacts/results.json path is not a glob,
so nullglob kept it in the list and jq failed on the missing file even
though every check passed. A single globstar pattern matches both layouts.
---
 .github/workflows/redhat-certify.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/redhat-certify.yml b/.github/workflows/redhat-certify.yml
index fa0a87c64..7c26c79fb 100644
--- a/.github/workflows/redhat-certify.yml
+++ b/.github/workflows/redhat-certify.yml
@@ -154,8 +154,8 @@ jobs:
       - name: Fail if any check did not pass
         run: |
           set -euo pipefail
-          shopt -s nullglob
-          results=(artifacts/results.json artifacts/*/results.json)
+          shopt -s nullglob globstar
+          results=(artifacts/**/results.json)
           if [[ ${#results[@]} -eq 0 ]]; then
             echo "::error::preflight produced no results.json"
             exit 1

From 24cb7b75c2e1cce4fbc2e2b1d00a4db60f8bd122 Mon Sep 17 00:00:00 2001
From: dmitri-netbird <dmitri.external@netbird.io>
Date: Wed, 7 Oct 2026 19:07:31 +0200
Subject: [PATCH 21/70] [management] switch to libopenapi for managing of
 openapi-based api (#8056)

* use libopenapi OpenAPI generator

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* added a handler for v1alpha1/peers

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* wire up request validator

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* wired up spec-based validation

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* use sync validation; set base url to v1alpha1

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* moved stuff around, extracted runtime libopenapu deps into runtime_tooling

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* testing /peers path params

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* fixed tests

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* added user schemas and paths

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* use api validation in tests

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* post-merge fixes

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* deleted tmp command used to test validator integration

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* require request body in post/put requests in order to force validation

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* making linter happy

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* switch to api/v1alpha1

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* go mod tidy

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* keep the original order of middleware: metrics, cors, then auth

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* return 422 on validation errors

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* cleanups

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* more cleanups

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* v1alpha1 spec cleanups

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* no need for a double-pointer

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* more linter fixes

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* removed more double pointers

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* use di to inject api_v0 and api_v1 http routers

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* do not re-add middleware on repeated call to ApiHandler

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* calling ApiRouter() now also calls ApiV1Router()

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

---------

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
---
 go.mod                                        |  16 +-
 go.sum                                        |  44 +-
 magefiles/openapi.go                          |  31 +
 management/internals/server/boot.go           |  52 +-
 .../shared/grpc/validate_session_test.go      |  40 +-
 .../server/api/v1alpha1/groups/helpers.go     |  38 +
 management/server/api/v1alpha1/handler.go     |  38 +
 .../api/v1alpha1/peers/peers_handler.go       | 418 ++++++++
 .../api/v1alpha1/peers/peers_handler_test.go  | 445 ++++++++
 .../api/v1alpha1/users/users_handler.go       | 275 +++++
 .../api/v1alpha1/users/users_handler_test.go  | 452 ++++++++
 management/server/http/handler.go             |  35 +-
 .../http/middleware/middleware_factory.go     |  35 +
 .../testing/testing_tools/channel/channel.go  |  11 +-
 .../management/http/apiv1alpha1/bundle.yaml   | 997 ++++++++++++++++++
 .../http/apiv1alpha1/group/components.yaml    |  31 +
 .../management/http/apiv1alpha1/openapi.yaml  | 250 +++++
 .../http/apiv1alpha1/peer/components.yaml     | 257 +++++
 .../http/apiv1alpha1/peer/peer.yaml           |  93 ++
 .../http/apiv1alpha1/peer/peers.yaml          |  77 ++
 .../http/apiv1alpha1/runtime_tooling.go       |  93 ++
 shared/management/http/apiv1alpha1/tooling.go | 152 +++
 .../management/http/apiv1alpha1/types.gen.go  | 414 ++++++++
 .../apiv1alpha1/user/user_components.yaml     | 150 +++
 .../http/apiv1alpha1/user/user_paths.yaml     | 129 +++
 25 files changed, 4509 insertions(+), 64 deletions(-)
 create mode 100644 magefiles/openapi.go
 create mode 100644 management/server/api/v1alpha1/groups/helpers.go
 create mode 100644 management/server/api/v1alpha1/handler.go
 create mode 100644 management/server/api/v1alpha1/peers/peers_handler.go
 create mode 100644 management/server/api/v1alpha1/peers/peers_handler_test.go
 create mode 100644 management/server/api/v1alpha1/users/users_handler.go
 create mode 100644 management/server/api/v1alpha1/users/users_handler_test.go
 create mode 100644 management/server/http/middleware/middleware_factory.go
 create mode 100644 shared/management/http/apiv1alpha1/bundle.yaml
 create mode 100644 shared/management/http/apiv1alpha1/group/components.yaml
 create mode 100644 shared/management/http/apiv1alpha1/openapi.yaml
 create mode 100644 shared/management/http/apiv1alpha1/peer/components.yaml
 create mode 100644 shared/management/http/apiv1alpha1/peer/peer.yaml
 create mode 100644 shared/management/http/apiv1alpha1/peer/peers.yaml
 create mode 100644 shared/management/http/apiv1alpha1/runtime_tooling.go
 create mode 100644 shared/management/http/apiv1alpha1/tooling.go
 create mode 100644 shared/management/http/apiv1alpha1/types.gen.go
 create mode 100644 shared/management/http/apiv1alpha1/user/user_components.yaml
 create mode 100644 shared/management/http/apiv1alpha1/user/user_paths.yaml

diff --git a/go.mod b/go.mod
index eeb73cd68..1d6dccd75 100644
--- a/go.mod
+++ b/go.mod
@@ -61,7 +61,7 @@ require (
 	github.com/go-jose/go-jose/v4 v4.1.4
 	github.com/go-ole/go-ole v1.3.0
 	github.com/gobwas/ws v1.4.0
-	github.com/goccy/go-yaml v1.18.0
+	github.com/goccy/go-yaml v1.19.2
 	github.com/godbus/dbus/v5 v5.2.2
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/google/go-cmp v0.7.0
@@ -92,6 +92,8 @@ require (
 	github.com/ory/dockertest/v4 v4.0.0
 	github.com/oschwald/maxminddb-golang v1.12.0
 	github.com/patrickmn/go-cache v2.1.0+incompatible
+	github.com/pb33f/libopenapi v0.41.2
+	github.com/pb33f/libopenapi-validator v0.15.0
 	github.com/petermattis/goid v0.0.0-20250303134427-723919f7f203
 	github.com/pion/ice/v4 v4.0.0-00010101000000-000000000000
 	github.com/pion/logging v0.2.4
@@ -135,7 +137,7 @@ require (
 	golang.org/x/mod v0.39.0
 	golang.org/x/net v0.58.0
 	golang.org/x/oauth2 v0.36.0
-	golang.org/x/sync v0.22.0
+	golang.org/x/sync v0.23.0
 	golang.org/x/term v0.45.0
 	golang.org/x/time v0.15.0
 	google.golang.org/api v0.276.0
@@ -183,9 +185,12 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.34.2 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sts v1.38.2 // indirect
 	github.com/aws/smithy-go v1.23.0 // indirect
+	github.com/bahlo/generic-list-go v0.2.0 // indirect
+	github.com/basgys/goxml2json v1.1.1-0.20231018121955-e66ee54ceaad // indirect
 	github.com/beevik/etree v1.6.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
+	github.com/buger/jsonparser v1.1.2 // indirect
 	github.com/caddyserver/zerossl v0.1.3 // indirect
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
@@ -213,12 +218,13 @@ require (
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/analysis v0.23.0 // indirect
 	github.com/go-openapi/errors v0.22.2 // indirect
-	github.com/go-openapi/jsonpointer v0.21.1 // indirect
+	github.com/go-openapi/jsonpointer v0.23.2 // indirect
 	github.com/go-openapi/jsonreference v0.21.0 // indirect
 	github.com/go-openapi/loads v0.22.0 // indirect
 	github.com/go-openapi/spec v0.21.0 // indirect
 	github.com/go-openapi/strfmt v0.23.0 // indirect
 	github.com/go-openapi/swag v0.23.1 // indirect
+	github.com/go-openapi/swag/jsonname v0.26.1 // indirect
 	github.com/go-openapi/validate v0.24.0 // indirect
 	github.com/go-sql-driver/mysql v1.9.3 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
@@ -297,6 +303,9 @@ require (
 	github.com/openbao/openbao/api/v2 v2.5.1 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
+	github.com/pb33f/go-yaml v0.1.1 // indirect
+	github.com/pb33f/jsonpath v0.8.4 // indirect
+	github.com/pb33f/ordered-map/v2 v2.3.2 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/philhofer/fwd v1.2.0 // indirect
 	github.com/pion/dtls/v2 v2.2.10 // indirect
@@ -314,6 +323,7 @@ require (
 	github.com/russellhaering/goxmldsig v1.6.0 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
 	github.com/sagikazarmark/locafero v0.11.0 // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
 	github.com/sergi/go-diff v1.4.0 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/skeema/knownhosts v1.3.2 // indirect
diff --git a/go.sum b/go.sum
index 115bb3373..2a0b10d4e 100644
--- a/go.sum
+++ b/go.sum
@@ -93,10 +93,16 @@ github.com/aws/aws-sdk-go-v2/service/sts v1.38.2 h1:YZPjhyaGzhDQEvsffDEcpycq49nl
 github.com/aws/aws-sdk-go-v2/service/sts v1.38.2/go.mod h1:2dIN8qhQfv37BdUYGgEC8Q3tteM3zFxTI1MLO2O3J3c=
 github.com/aws/smithy-go v1.23.0 h1:8n6I3gXzWJB2DxBDnfxgBaSX6oe0d/t10qGz7OKqMCE=
 github.com/aws/smithy-go v1.23.0/go.mod h1:t1ufH5HMublsJYulve2RKmHDC15xu1f26kHCp/HgceI=
+github.com/bahlo/generic-list-go v0.2.0 h1:5sz/EEAK+ls5wF+NeqDpk5+iNdMDXrh3z3nPnH1Wvgk=
+github.com/bahlo/generic-list-go v0.2.0/go.mod h1:2KvAjgMlE5NNynlg/5iLrrCCZ2+5xWbdbCW3pNTGyYg=
+github.com/basgys/goxml2json v1.1.1-0.20231018121955-e66ee54ceaad h1:3swAvbzgfaI6nKuDDU7BiKfZRdF+h2ZwKgMHd8Ha4t8=
+github.com/basgys/goxml2json v1.1.1-0.20231018121955-e66ee54ceaad/go.mod h1:9+nBLYNWkvPcq9ep0owWUsPTLgL9ZXTsZWcCSVGGLJ0=
 github.com/beevik/etree v1.6.0 h1:u8Kwy8pp9D9XeITj2Z0XtA5qqZEmtJtuXZRQi+j03eE=
 github.com/beevik/etree v1.6.0/go.mod h1:bh4zJxiIr62SOf9pRzN7UUYaEDa9HEKafK25+sLc0Gc=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/bitly/go-simplejson v0.5.1 h1:xgwPbetQScXt1gh9BmoJ6j9JMr3TElvuIyjR8pgdoow=
+github.com/bitly/go-simplejson v0.5.1/go.mod h1:YOPVLzCfwK14b4Sff3oP1AmGhI9T9Vsg84etUnlyp+Q=
 github.com/bmatcuk/doublestar v1.1.1/go.mod h1:UD6OnuiIn0yFxxA2le/rnRU1G4RaI4UvFv1sNto9p6w=
 github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc h1:biVzkmvwrH8WK8raXaxBx6fRVTlJILwEwQGL1I/ByEI=
 github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
@@ -104,6 +110,8 @@ github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
 github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=
 github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
 github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
+github.com/buger/jsonparser v1.1.2 h1:frqHqw7otoVbk5M8LlE/L7HTnIq2v9RX6EJ48i9AxJk=
+github.com/buger/jsonparser v1.1.2/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
 github.com/c-robinson/iplib v1.0.3 h1:NG0UF0GoEsrC1/vyfX1Lx2Ss7CySWl3KqqXh3q4DdPU=
 github.com/c-robinson/iplib v1.0.3/go.mod h1:i3LuuFL1hRT5gFpBRnEydzw8R6yhGkF4szNDIbF8pgo=
 github.com/caarlos0/env/v11 v11.4.1 h1:fYwH0sWEsBSMPG7t4e/PEfTFzrWrpjyygXyUnWiSwEw=
@@ -155,6 +163,8 @@ github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/r
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/dlclark/regexp2 v1.12.0 h1:0j4c5qQmnC6XOWNjP3PIXURXN2gWx76rd3KvgdPkCz8=
+github.com/dlclark/regexp2 v1.12.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/docker/docker v28.0.1+incompatible h1:FCHjSRdXhNRFjlHMTv4jUNlIBbTeRjrWfeFuJp7jpo0=
 github.com/docker/docker v28.0.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
@@ -220,8 +230,8 @@ github.com/go-openapi/analysis v0.23.0 h1:aGday7OWupfMs+LbmLZG4k0MYXIANxcuBTYUC0
 github.com/go-openapi/analysis v0.23.0/go.mod h1:9mz9ZWaSlV8TvjQHLl2mUW2PbZtemkE8yA5v22ohupo=
 github.com/go-openapi/errors v0.22.2 h1:rdxhzcBUazEcGccKqbY1Y7NS8FDcMyIRr0934jrYnZg=
 github.com/go-openapi/errors v0.22.2/go.mod h1:+n/5UdIqdVnLIJ6Q9Se8HNGUXYaY6CN8ImWzfi/Gzp0=
-github.com/go-openapi/jsonpointer v0.21.1 h1:whnzv/pNXtK2FbX/W9yJfRmE2gsmkfahjMKB0fZvcic=
-github.com/go-openapi/jsonpointer v0.21.1/go.mod h1:50I1STOfbY1ycR8jGz8DaMeLCdXiI6aDteEdRNNzpdk=
+github.com/go-openapi/jsonpointer v0.23.2 h1:DK7R/3zAt4xTytxNkw7jARGPFI7rkaSsii58n8X45x0=
+github.com/go-openapi/jsonpointer v0.23.2/go.mod h1:noUOckXtq7b4bVkqw0sbHKieq9uEZRN7p6EF/dalc4w=
 github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
 github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
 github.com/go-openapi/loads v0.22.0 h1:ECPGd4jX1U6NApCGG1We+uEozOAvXvJSF4nnwHZ8Aco=
@@ -232,6 +242,10 @@ github.com/go-openapi/strfmt v0.23.0 h1:nlUS6BCqcnAk0pyhi9Y+kdDVZdZMHfEKQiS4HaMg
 github.com/go-openapi/strfmt v0.23.0/go.mod h1:NrtIpfKtWIygRkKVsxh7XQMDQW5HKQl6S5ik2elW+K4=
 github.com/go-openapi/swag v0.23.1 h1:lpsStH0n2ittzTnbaSloVZLuB5+fvSY/+hnagBjSNZU=
 github.com/go-openapi/swag v0.23.1/go.mod h1:STZs8TbRvEQQKUA+JZNAm3EWlgaOBGpyFDqQnDHMef0=
+github.com/go-openapi/swag/jsonname v0.26.1 h1:VReupaV6WxlAsCn0e4DUfgV6bPmINnPpyJDLqSfNPcE=
+github.com/go-openapi/swag/jsonname v0.26.1/go.mod h1:OvdW6BoWoj33pTfi7x9vFrgmT+fk7aw0BRwvCE0YOuc=
+github.com/go-openapi/testify/v2 v2.6.0 h1:5PKH2HE7YJ/LuRPQGvSxBRlFXNQhSetBLlGAgUEu3ug=
+github.com/go-openapi/testify/v2 v2.6.0/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw=
 github.com/go-openapi/validate v0.24.0 h1:LdfDKwNbpB6Vn40xhTdNZAnfLECL81w+VX3BumrGD58=
 github.com/go-openapi/validate v0.24.0/go.mod h1:iyeX1sEufmv3nPbBdX3ieNviWnOZaJ1+zquzJEf2BAQ=
 github.com/go-playground/locales v0.12.1/go.mod h1:IUMDtCfWo/w/mtMfIE/IG2K+Ey3ygWanZIBtBW0W2TM=
@@ -259,8 +273,8 @@ github.com/gobwas/pool v0.2.1 h1:xfeeEhW7pwmX8nuLVlqbzVc7udMDrwetjEv+TZIz1og=
 github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
 github.com/gobwas/ws v1.4.0 h1:CTaoG1tojrh4ucGPcoJFiAQUAsEWekEWvLy7GsVNqGs=
 github.com/gobwas/ws v1.4.0/go.mod h1:G3gNqMNtPppf5XUz7O4shetPpcZ1VJ7zt18dlUeakrc=
-github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw=
-github.com/goccy/go-yaml v1.18.0/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
+github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
+github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ=
 github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
@@ -561,6 +575,18 @@ github.com/oschwald/maxminddb-golang v1.12.0 h1:9FnTOD0YOhP7DGxGsq4glzpGy5+w7pq5
 github.com/oschwald/maxminddb-golang v1.12.0/go.mod h1:q0Nob5lTCqyQ8WT6FYgS1L7PXKVVbgiymefNwIjPzgY=
 github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaRUnok+kx1WdO15EQc=
 github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
+github.com/pb33f/go-yaml v0.1.1 h1:yWGmhVdwzionRnSc/hEJwcfq6PaZL2QdYzyReXBbX7Q=
+github.com/pb33f/go-yaml v0.1.1/go.mod h1:QvWdkHP5VjFYAeHMQUkaPQqREaQnBNOXmWzAjNrnSdo=
+github.com/pb33f/jsonpath v0.8.4 h1:Yx7fxsKl8scgERL22WhKDs2c6gYNNUonPSWEG8Y194s=
+github.com/pb33f/jsonpath v0.8.4/go.mod h1:eO6mgdhw5RgzCxm/bXTi75VUs0/cCYJzdGjMCCUEI6M=
+github.com/pb33f/libopenapi v0.41.2 h1:7/KNzJJ0o5fC/tYxDYcHjziKfg0bkBpFUfI2UDbChAo=
+github.com/pb33f/libopenapi v0.41.2/go.mod h1:mUldESjO6ownR1TCcywvoYp7e4v/bCdQyiiIqsgWne0=
+github.com/pb33f/libopenapi-validator v0.15.0 h1:5wl7/tpyewqzZ7Y5/M9CZjojlaaK2DYKPZYGIvPq7SI=
+github.com/pb33f/libopenapi-validator v0.15.0/go.mod h1:P52RfZsY/+oWjRL52mpQ8Icwual6rtkJt1qOWdAe4eM=
+github.com/pb33f/ordered-map/v2 v2.3.2 h1:wDyaZ2Pv9QLh64X4utCeD5Zoi9nIv2aW3lwv172O5PQ=
+github.com/pb33f/ordered-map/v2 v2.3.2/go.mod h1:1OhFrXu3OYw3kM+FXF+Ug3ugmmZ9LE8z0JfQMLvtV0w=
+github.com/pb33f/testify v0.1.1 h1:mnHe7uxKt8dyNYEGUspow72VjD264DB5rOJq4bz5tJw=
+github.com/pb33f/testify v0.1.1/go.mod h1:keghMqOLECF1ENzESnfM+cwPcKN5uhTOpvbtjgL6aZg=
 github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
 github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/petermattis/goid v0.0.0-20250303134427-723919f7f203 h1:E7Kmf11E4K7B5hDti2K2NqPb1nlYlGYsu02S1JNd/Bs=
@@ -638,6 +664,8 @@ github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkB
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
 github.com/sagikazarmark/locafero v0.11.0 h1:1iurJgmM9G3PA/I+wWYIOw/5SyBtxapeHDcg+AAIFXc=
 github.com/sagikazarmark/locafero v0.11.0/go.mod h1:nVIGvgyzw595SUSUE6tvCp3YYTeHs15MvlmU87WwIik=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
 github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
 github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/shirou/gopsutil/v4 v4.25.8 h1:NnAsw9lN7587WHxjJA9ryDnqhJpFH6A+wagYWTOH970=
@@ -790,6 +818,7 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.8.0/go.mod h1:mRqEX+O9/h5TFCrQhkgjo2yKi0yYA+9ecGkdQoHrywE=
+golang.org/x/crypto v0.11.0/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio=
 golang.org/x/crypto v0.12.0/go.mod h1:NF0Gs7EO5K4qLn+Ylc+fih8BSTeIjAP05siRnAh98yw=
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
@@ -828,6 +857,7 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.13.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA=
 golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
@@ -849,8 +879,8 @@ golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
+golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -897,6 +927,7 @@ golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuX
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.10.0/go.mod h1:lpqdcUyK/oCiQxvxVrppt5ggO2KCZ5QblwqPnfZ6d5o=
 golang.org/x/term v0.11.0/go.mod h1:zC9APTIj3jG3FdV/Ons+XE1riIZXG4aZ4GTHiPZJPIU=
 golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
@@ -912,6 +943,7 @@ golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
diff --git a/magefiles/openapi.go b/magefiles/openapi.go
new file mode 100644
index 000000000..e590b3ddf
--- /dev/null
+++ b/magefiles/openapi.go
@@ -0,0 +1,31 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+
+	"github.com/magefile/mage/mg"
+	"github.com/netbirdio/netbird/shared/management/http/apiv1alpha1"
+)
+
+var apiPath = filepath.Join("shared", "management", "http", "apiv1alpha1")
+
+type Openapi mg.Namespace
+
+func (Openapi) GenerateV1Bindings(generateflags *string) error {
+	bundle, model, err := apiv1alpha1.GenerateV1ApiBindings(apiv1alpha1.ApiPath)
+	if err != nil {
+		return err
+	}
+	err = os.WriteFile(filepath.Join(apiPath, "bundle.yaml"), bundle, 0644) //nolint:gosec
+	if err != nil {
+		return err
+	}
+
+	generated, err := apiv1alpha1.GenerateV1Schema(model)
+	if err != nil {
+		return err
+	}
+
+	return os.WriteFile(filepath.Join(apiPath, "types.gen.go"), generated.Source, 0644) //nolint:gosec
+}
diff --git a/management/internals/server/boot.go b/management/internals/server/boot.go
index 34c8363f1..4ced64a16 100644
--- a/management/internals/server/boot.go
+++ b/management/internals/server/boot.go
@@ -36,9 +36,11 @@ import (
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
 	"github.com/netbirdio/netbird/management/server/activity"
 	activitystore "github.com/netbirdio/netbird/management/server/activity/store"
+	"github.com/netbirdio/netbird/management/server/api/v1alpha1"
 	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	nbContext "github.com/netbirdio/netbird/management/server/context"
 	nbhttp "github.com/netbirdio/netbird/management/server/http"
+	"github.com/netbirdio/netbird/management/server/http/middleware"
 	"github.com/netbirdio/netbird/management/server/idp"
 	"github.com/netbirdio/netbird/management/server/store"
 	"github.com/netbirdio/netbird/management/server/telemetry"
@@ -47,7 +49,10 @@ import (
 	"github.com/netbirdio/netbird/util/crypt"
 )
 
-const apiPrefix = "/api"
+const (
+	apiPrefix   = "/api"
+	apiV1Prefix = "/api/v1alpha1"
+)
 
 var (
 	kaep = keepalive.EnforcementPolicy{
@@ -158,13 +163,31 @@ func (s *BaseServer) EventStore() activity.Store {
 }
 
 func (s *BaseServer) APIHandler() http.Handler {
-	return Create(s, func() http.Handler {
-		httpAPIHandler, err := nbhttp.NewAPIHandler(context.Background(), s.Router(), s.AccountManager(), s.NetworksManager(), s.ResourcesManager(), s.RoutesManager(), s.GroupsManager(), s.GeoLocationManager(), s.AuthManager(), s.Metrics(), s.PermissionsManager(), s.SettingsManager(), s.ZonesManager(), s.RecordsManager(), s.NetworkMapController(), s.IdpManager(), s.ServiceManager(), s.ReverseProxyDomainManager(), s.AccessLogsManager(), s.ReverseProxyGRPCServer(), s.Config.ReverseProxy.TrustedHTTPProxies, s.RateLimiter(), s.IsValidChildAccount, s.AgentNetworkManager(), nil)
+	_ = CreateNamed(s, "http_v1api", func() http.Handler {
+		apiv1Router := s.ApiV1Router()
+		_, err := v1alpha1.NewAPIV1Handler(context.Background(), apiv1Router, s.AccountManager(), s.NetworkMapController(), s.PermissionsManager())
 		if err != nil {
 			log.Fatalf("failed to create API handler: %v", err)
 		}
-		return httpAPIHandler
+
+		return apiv1Router
 	})
+
+	_ = CreateNamed(s, "http_v0api", func() http.Handler {
+		apiRouter := s.ApiRouter()
+		_, err := nbhttp.NewAPIHandler(
+			context.Background(), apiRouter, s.AccountManager(), s.NetworksManager(), s.ResourcesManager(), s.RoutesManager(),
+			s.GroupsManager(), s.GeoLocationManager(), s.PermissionsManager(), s.SettingsManager(), s.ZonesManager(),
+			s.RecordsManager(), s.NetworkMapController(), s.IdpManager(), s.ServiceManager(), s.ReverseProxyDomainManager(),
+			s.AccessLogsManager(), s.ReverseProxyGRPCServer(), s.Config.ReverseProxy.TrustedHTTPProxies,
+			s.AgentNetworkManager(), nil)
+		if err != nil {
+			log.Fatalf("failed to create API handler: %v", err)
+		}
+		return apiRouter
+	})
+
+	return s.Router()
 }
 
 // IDPHandler returns the HTTP handler for the embedded IdP (Dex), or nil if
@@ -177,9 +200,28 @@ func (s *BaseServer) IDPHandler() http.Handler {
 	return cors.AllowAll().Handler(embeddedIdP.Handler())
 }
 
+// Router returns the root HTTP router with the shared API middleware applied.
 func (s *BaseServer) Router() *mux.Router {
 	return Create(s, func() *mux.Router {
-		return mux.NewRouter().PathPrefix(apiPrefix).Subrouter()
+		router := mux.NewRouter()
+		router.Use(middleware.BuildMiddleware(s.RateLimiter(), s.AuthManager(), s.AccountManager(), s.Metrics(), s.IsValidChildAccount)...)
+		return router
+	})
+}
+
+// ApiV1Router returns the subrouter for the versioned API under apiV1Prefix.
+func (s *BaseServer) ApiV1Router() *mux.Router {
+	return CreateNamed(s, "apiv1_router", func() *mux.Router {
+		return s.Router().PathPrefix(apiV1Prefix).Subrouter()
+	})
+}
+
+// ApiRouter returns the subrouter for the unversioned API under apiPrefix.
+func (s *BaseServer) ApiRouter() *mux.Router {
+	return CreateNamed(s, "apiv0_router", func() *mux.Router {
+		// The nested versioned prefix must be registered before the broader apiPrefix.
+		s.ApiV1Router()
+		return s.Router().PathPrefix(apiPrefix).Subrouter()
 	})
 }
 
diff --git a/management/internals/shared/grpc/validate_session_test.go b/management/internals/shared/grpc/validate_session_test.go
index 4b36e74cf..8b4090dcc 100644
--- a/management/internals/shared/grpc/validate_session_test.go
+++ b/management/internals/shared/grpc/validate_session_test.go
@@ -1,5 +1,3 @@
-//go:build integration
-
 package grpc
 
 import (
@@ -195,7 +193,7 @@ func TestValidateSession_UserAllowed(t *testing.T) {
 
 	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
 		Domain:       "test-proxy.example.com",
-		SessionToken: token,
+		SessionToken: token, //nolint:staticcheck
 	})
 
 	require.NoError(t, err)
@@ -216,7 +214,7 @@ func TestValidateSession_UserNotInAllowedGroup(t *testing.T) {
 
 	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
 		Domain:       "restricted-proxy.example.com",
-		SessionToken: token,
+		SessionToken: token, //nolint:staticcheck
 	})
 
 	require.NoError(t, err)
@@ -240,7 +238,7 @@ func TestValidateSession_PendingApprovalUserDenied(t *testing.T) {
 
 	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
 		Domain:       "restricted-proxy.example.com",
-		SessionToken: token,
+		SessionToken: token, //nolint:staticcheck
 	})
 
 	require.NoError(t, err)
@@ -265,7 +263,7 @@ func TestValidateSession_PendingApprovalUserInAllUsersGroupDenied(t *testing.T)
 
 	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
 		Domain:       "all-users-proxy.example.com",
-		SessionToken: token,
+		SessionToken: token, //nolint:staticcheck
 	})
 
 	require.NoError(t, err)
@@ -288,7 +286,7 @@ func TestValidateSession_BlockedUserDenied(t *testing.T) {
 
 	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
 		Domain:       "restricted-proxy.example.com",
-		SessionToken: token,
+		SessionToken: token, //nolint:staticcheck
 	})
 
 	require.NoError(t, err)
@@ -312,7 +310,7 @@ func TestValidateSession_UserAllowedAfterApproval(t *testing.T) {
 	token := createSessionToken(t, proxy.SessionPrivateKey, pendingUserID, "restricted-proxy.example.com")
 	req := &proto.ValidateSessionRequest{
 		Domain:       "restricted-proxy.example.com",
-		SessionToken: token,
+		SessionToken: token, //nolint:staticcheck,
 	}
 
 	resp, err := setup.proxyService.ValidateSession(ctx, req)
@@ -345,7 +343,7 @@ func TestValidateSession_UserInDifferentAccount(t *testing.T) {
 
 	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
 		Domain:       "test-proxy.example.com",
-		SessionToken: token,
+		SessionToken: token, //nolint:staticcheck,
 	})
 
 	require.NoError(t, err)
@@ -364,7 +362,7 @@ func TestValidateSession_UserNotFound(t *testing.T) {
 
 	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
 		Domain:       "test-proxy.example.com",
-		SessionToken: token,
+		SessionToken: token, //nolint:staticcheck,
 	})
 
 	require.NoError(t, err)
@@ -383,7 +381,7 @@ func TestValidateSession_ProxyNotFound(t *testing.T) {
 
 	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
 		Domain:       "unknown-proxy.example.com",
-		SessionToken: token,
+		SessionToken: token, //nolint:staticcheck,
 	})
 
 	require.NoError(t, err)
@@ -397,7 +395,7 @@ func TestValidateSession_InvalidToken(t *testing.T) {
 
 	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
 		Domain:       "test-proxy.example.com",
-		SessionToken: "invalid-token",
+		SessionToken: "invalid-token", //nolint:staticcheck,
 	})
 
 	require.NoError(t, err)
@@ -410,7 +408,7 @@ func TestValidateSession_MissingDomain(t *testing.T) {
 	defer setup.cleanup()
 
 	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
-		SessionToken: "some-token",
+		SessionToken: "some-token", //nolint:staticcheck,
 	})
 
 	require.NoError(t, err)
@@ -491,15 +489,15 @@ func (m *testValidateSessionServiceManager) GetAllServices(_ context.Context, _,
 }
 
 func (m *testValidateSessionServiceManager) GetService(_ context.Context, _, _, _ string) (*service.Service, error) {
-	return nil, nil
+	return nil, nil //nolint:nilnil
 }
 
 func (m *testValidateSessionServiceManager) CreateService(_ context.Context, _, _ string, _ *service.Service) (*service.Service, error) {
-	return nil, nil
+	return nil, nil //nolint:nilnil
 }
 
 func (m *testValidateSessionServiceManager) UpdateService(_ context.Context, _, _ string, _ *service.Service) (*service.Service, error) {
-	return nil, nil
+	return nil, nil //nolint:nilnil
 }
 
 func (m *testValidateSessionServiceManager) DeleteService(_ context.Context, _, _, _ string) error {
@@ -543,7 +541,7 @@ func (m *testValidateSessionServiceManager) GetServiceIDByTargetID(_ context.Con
 }
 
 func (m *testValidateSessionServiceManager) CreateServiceFromPeer(_ context.Context, _, _ string, _ *service.ExposeServiceRequest) (*service.ExposeServiceResponse, error) {
-	return nil, nil
+	return nil, nil //nolint:nilnil
 }
 
 func (m *testValidateSessionServiceManager) RenewServiceFromPeer(_ context.Context, _, _, _ string) error {
@@ -571,7 +569,7 @@ func (m *testValidateSessionServiceManager) DeleteAccountCluster(_ context.Conte
 type testValidateSessionProxyManager struct{}
 
 func (m *testValidateSessionProxyManager) Connect(_ context.Context, _, _, _, _, _ string, _ *string, _ *proxy.Capabilities) (*proxy.Proxy, error) {
-	return nil, nil
+	return nil, nil //nolint:nilnil
 }
 
 func (m *testValidateSessionProxyManager) Disconnect(_ context.Context, _, _ string) error {
@@ -603,7 +601,7 @@ func (m *testValidateSessionProxyManager) CleanupStale(_ context.Context, _ time
 }
 
 func (m *testValidateSessionProxyManager) GetAccountProxy(_ context.Context, _ string) (*proxy.Proxy, error) {
-	return nil, nil
+	return nil, nil //nolint:nilnil
 }
 
 func (m *testValidateSessionProxyManager) CountAccountProxies(_ context.Context, _ string) (int64, error) {
@@ -634,6 +632,10 @@ func (m *testValidateSessionProxyManager) ClusterSupportsPrivate(_ context.Conte
 	return nil
 }
 
+func (m *testValidateSessionProxyManager) ClusterAllProxiesPrivate(_ context.Context, _ string) *bool {
+	return nil
+}
+
 func (m *testValidateSessionProxyManager) ClusterSupportsSessionCode(_ context.Context, _ string) bool {
 	return false
 }
diff --git a/management/server/api/v1alpha1/groups/helpers.go b/management/server/api/v1alpha1/groups/helpers.go
new file mode 100644
index 000000000..4b15fc9ec
--- /dev/null
+++ b/management/server/api/v1alpha1/groups/helpers.go
@@ -0,0 +1,38 @@
+package groups
+
+import (
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/http/apiv1alpha1"
+)
+
+func ToGroupsInfoMap(groups []*types.Group, idCount int) map[string][]apiv1alpha1.GroupMinimum {
+	groupsInfoMap := make(map[string][]apiv1alpha1.GroupMinimum, idCount)
+	groupsChecked := make(map[string]struct{}, len(groups)) // not sure why this is needed (left over from old implementation)
+	for _, group := range groups {
+		_, ok := groupsChecked[group.ID]
+		if ok {
+			continue
+		}
+
+		groupsChecked[group.ID] = struct{}{}
+		for _, pk := range group.Peers {
+			info := apiv1alpha1.GroupMinimum{
+				Id:             group.ID,
+				Name:           group.Name,
+				PeersCount:     len(group.Peers),
+				ResourcesCount: len(group.Resources),
+			}
+			groupsInfoMap[pk] = append(groupsInfoMap[pk], info)
+		}
+		for _, rk := range group.Resources {
+			info := apiv1alpha1.GroupMinimum{
+				Id:             group.ID,
+				Name:           group.Name,
+				PeersCount:     len(group.Peers),
+				ResourcesCount: len(group.Resources),
+			}
+			groupsInfoMap[rk.ID] = append(groupsInfoMap[rk.ID], info)
+		}
+	}
+	return groupsInfoMap
+}
diff --git a/management/server/api/v1alpha1/handler.go b/management/server/api/v1alpha1/handler.go
new file mode 100644
index 000000000..3af8f4871
--- /dev/null
+++ b/management/server/api/v1alpha1/handler.go
@@ -0,0 +1,38 @@
+package v1alpha1
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/gorilla/mux"
+
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	"github.com/netbirdio/netbird/management/server/account"
+	"github.com/netbirdio/netbird/shared/management/http/apiv1alpha1"
+
+	"github.com/netbirdio/netbird/management/server/permissions"
+
+	"github.com/netbirdio/netbird/management/server/api/v1alpha1/peers"
+	"github.com/netbirdio/netbird/management/server/api/v1alpha1/users"
+)
+
+func NewAPIV1Handler(
+	ctx context.Context,
+	router *mux.Router,
+	accountManager account.Manager,
+	networkMapController network_map.Controller,
+	permissionsManager permissions.Manager) (http.Handler, error) {
+
+	v1validatorMiddleware, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+	if err != nil {
+		return nil, err
+	}
+
+	router.Use(v1validatorMiddleware.Handler)
+
+	peersHandler := peers.NewHandler(accountManager, networkMapController, permissionsManager)
+	_ = peersHandler.WithEndpointsForRouter(router)
+
+	usersHandler := users.NewHandler(accountManager)
+	return usersHandler.WithEndpointsForRouter(router), nil
+}
diff --git a/management/server/api/v1alpha1/peers/peers_handler.go b/management/server/api/v1alpha1/peers/peers_handler.go
new file mode 100644
index 000000000..8e0593723
--- /dev/null
+++ b/management/server/api/v1alpha1/peers/peers_handler.go
@@ -0,0 +1,418 @@
+package peers
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/netip"
+
+	"github.com/gorilla/mux"
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	"github.com/netbirdio/netbird/management/server/account"
+	"github.com/netbirdio/netbird/management/server/activity"
+	"github.com/netbirdio/netbird/management/server/api/v1alpha1/groups"
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/permissions"
+	"github.com/netbirdio/netbird/shared/management/http/apiv1alpha1"
+	"github.com/netbirdio/netbird/shared/management/http/util"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+type Handler struct {
+	accountManager       account.Manager
+	permissionsManager   permissions.Manager
+	networkMapController network_map.Controller
+}
+
+// NewHandler creates a new peers Handler
+func NewHandler(accountManager account.Manager, networkMapController network_map.Controller, permissionsManager permissions.Manager) *Handler {
+	return &Handler{
+		accountManager:       accountManager,
+		networkMapController: networkMapController,
+		permissionsManager:   permissionsManager,
+	}
+}
+
+func (h *Handler) WithEndpointsForRouter(router *mux.Router) *mux.Router {
+	router.HandleFunc("/peers", h.GetAllPeers).Methods("GET", "OPTIONS")
+	router.HandleFunc("/peers/{peerId}", h.HandlePeer).Methods("GET", "PUT", "DELETE", "OPTIONS")
+	return router
+}
+
+func (h *Handler) getPeer(ctx context.Context, accountID, peerID, userID string, w http.ResponseWriter) {
+	peer, err := h.accountManager.GetPeer(ctx, accountID, peerID, userID)
+	if err != nil {
+		util.WriteError(ctx, err, w)
+		return
+	}
+
+	if peer.ProxyMeta.Embedded {
+		util.WriteError(ctx, status.Errorf(status.InvalidArgument, "not allowed to read peer"), w)
+		return
+	}
+
+	settings, err := h.accountManager.GetAccountSettings(ctx, accountID, activity.SystemInitiator)
+	if err != nil {
+		util.WriteError(ctx, err, w)
+		return
+	}
+
+	dnsDomain := h.networkMapController.GetDNSDomain(settings)
+
+	grps, _ := h.accountManager.GetPeerGroups(ctx, accountID, peerID)
+	grpsInfoMap := groups.ToGroupsInfoMap(grps, 0)
+
+	validPeers, invalidPeers, err := h.accountManager.GetValidatedPeers(ctx, accountID)
+	if err != nil {
+		log.WithContext(ctx).Errorf("failed to list approved peers: %v", err)
+		util.WriteError(ctx, fmt.Errorf("internal error"), w)
+		return
+	}
+
+	_, valid := validPeers[peer.ID]
+	reason := invalidPeers[peer.ID]
+
+	util.WriteJSONObject(ctx, w, toSinglePeerResponse(peer, grpsInfoMap[peerID], dnsDomain, valid, reason))
+}
+
+func (h *Handler) updatePeer(ctx context.Context, accountID, userID, peerID string, w http.ResponseWriter, r *http.Request) {
+	req := &apiv1alpha1.PeerRequest{}
+	err := json.NewDecoder(r.Body).Decode(req)
+	if err != nil {
+		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
+		return
+	}
+
+	update := &nbpeer.Peer{
+		ID:                          peerID,
+		SSHEnabled:                  req.SshEnabled,
+		Name:                        req.Name,
+		LoginExpirationEnabled:      req.LoginExpirationEnabled,
+		InactivityExpirationEnabled: req.InactivityExpirationEnabled,
+	}
+
+	if req.ApprovalRequired != nil {
+		// todo: looks like that we reset all status property, is it right?
+		update.Status = &nbpeer.PeerStatus{
+			RequiresApproval: *req.ApprovalRequired,
+		}
+	}
+
+	if req.Ip != nil {
+		addr, err := netip.ParseAddr(*req.Ip)
+		if err != nil {
+			util.WriteError(ctx, status.Errorf(status.InvalidArgument, "invalid IP address %s: %v", *req.Ip, err), w)
+			return
+		}
+
+		if err = h.accountManager.UpdatePeerIP(ctx, accountID, userID, peerID, addr); err != nil {
+			util.WriteError(ctx, err, w)
+			return
+		}
+	}
+
+	if req.Ipv6 != nil {
+		v6Addr, err := parseIPv6(req.Ipv6)
+		if err != nil {
+			util.WriteError(ctx, status.Errorf(status.InvalidArgument, "%v", err), w)
+			return
+		}
+		if err = h.accountManager.UpdatePeerIPv6(ctx, accountID, userID, peerID, v6Addr); err != nil {
+			util.WriteError(ctx, err, w)
+			return
+		}
+	}
+
+	peer, err := h.accountManager.UpdatePeer(ctx, accountID, userID, update)
+	if err != nil {
+		util.WriteError(ctx, err, w)
+		return
+	}
+
+	settings, err := h.accountManager.GetAccountSettings(ctx, accountID, activity.SystemInitiator)
+	if err != nil {
+		util.WriteError(ctx, err, w)
+		return
+	}
+	dnsDomain := h.networkMapController.GetDNSDomain(settings)
+
+	peerGroups, err := h.accountManager.GetPeerGroups(ctx, accountID, peer.ID)
+	if err != nil {
+		util.WriteError(ctx, err, w)
+		return
+	}
+
+	grpsInfoMap := groups.ToGroupsInfoMap(peerGroups, 0)
+
+	validPeers, invalidPeers, err := h.accountManager.GetValidatedPeers(ctx, accountID)
+	if err != nil {
+		log.WithContext(ctx).Errorf("failed to get validated peers: %v", err)
+		util.WriteError(ctx, fmt.Errorf("internal error"), w)
+		return
+	}
+
+	_, valid := validPeers[peer.ID]
+	reason := invalidPeers[peer.ID]
+
+	util.WriteJSONObject(r.Context(), w, toSinglePeerResponse(peer, grpsInfoMap[peerID], dnsDomain, valid, reason))
+}
+
+func (h *Handler) deletePeer(ctx context.Context, accountID, userID string, peerID string, w http.ResponseWriter) {
+	err := h.accountManager.DeletePeer(ctx, accountID, peerID, userID)
+	if err != nil {
+		log.WithContext(ctx).Errorf("failed to delete peer: %v", err)
+		util.WriteError(ctx, err, w)
+		return
+	}
+	util.WriteJSONObject(ctx, w, util.EmptyObject{})
+}
+
+// HandlePeer handles all peer requests for GET, PUT and DELETE operations
+func (h *Handler) HandlePeer(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	accountID, userID := userAuth.AccountId, userAuth.UserId
+	vars := mux.Vars(r)
+	peerID := vars["peerId"]
+	if len(peerID) == 0 {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "invalid peer ID"), w)
+		return
+	}
+
+	switch r.Method {
+	case http.MethodDelete:
+		h.deletePeer(r.Context(), accountID, userID, peerID, w)
+		return
+	case http.MethodGet:
+		h.getPeer(r.Context(), accountID, peerID, userID, w)
+		return
+	case http.MethodPut:
+		h.updatePeer(r.Context(), accountID, userID, peerID, w, r)
+		return
+	default:
+		util.WriteError(r.Context(), status.Errorf(status.NotFound, "unknown METHOD"), w)
+	}
+}
+
+// GetAllPeers returns a list of all peers associated with a provided account
+func (h *Handler) GetAllPeers(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	nameFilter := r.URL.Query().Get("name")
+	ipFilter := r.URL.Query().Get("ip")
+	macFilter := r.URL.Query().Get("mac")
+
+	accountID, userID := userAuth.AccountId, userAuth.UserId
+
+	peers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, nameFilter, ipFilter, macFilter)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	settings, err := h.accountManager.GetAccountSettings(r.Context(), accountID, activity.SystemInitiator)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+	dnsDomain := h.networkMapController.GetDNSDomain(settings)
+
+	grps, _ := h.accountManager.GetAllGroups(r.Context(), accountID, userID)
+
+	grpsInfoMap := groups.ToGroupsInfoMap(grps, len(peers))
+	respBody := make([]*apiv1alpha1.PeerBatch, 0, len(peers))
+	for _, peer := range peers {
+		if peer.ProxyMeta.Embedded {
+			continue
+		}
+		respBody = append(respBody, toPeerListItemResponse(peer, grpsInfoMap[peer.ID], dnsDomain, 0))
+	}
+
+	validPeersMap, invalidPeersMap, err := h.accountManager.GetValidatedPeers(r.Context(), accountID)
+	if err != nil {
+		log.WithContext(r.Context()).Errorf("failed to get validated peers: %v", err)
+		util.WriteError(r.Context(), fmt.Errorf("internal error"), w)
+		return
+	}
+	h.setApprovalRequiredFlag(respBody, validPeersMap, invalidPeersMap)
+
+	util.WriteJSONObject(r.Context(), w, respBody)
+}
+
+func (h *Handler) setApprovalRequiredFlag(respBody []*apiv1alpha1.PeerBatch, validPeersMap map[string]struct{}, invalidPeersMap map[string]string) {
+	for _, peer := range respBody {
+		_, ok := validPeersMap[peer.Id]
+		if !ok {
+			peer.ApprovalRequired = true
+
+			reason := invalidPeersMap[peer.Id]
+			peer.DisapprovalReason = &reason
+		}
+	}
+}
+
+func parseIPv6(s *string) (netip.Addr, error) {
+	if s == nil {
+		return netip.Addr{}, fmt.Errorf("IPv6 address is nil")
+	}
+	addr, err := netip.ParseAddr(*s)
+	if err != nil {
+		return netip.Addr{}, fmt.Errorf("invalid IPv6 address %s: %w", *s, err)
+	}
+	addr = addr.Unmap()
+	if !addr.Is6() {
+		return netip.Addr{}, fmt.Errorf("address %s is not IPv6", *s)
+	}
+	return addr, nil
+}
+
+func toSinglePeerResponse(peer *nbpeer.Peer, groupsInfo []apiv1alpha1.GroupMinimum, dnsDomain string, approved bool, reason string) *apiv1alpha1.Peer {
+	osVersion := peer.Meta.OSVersion
+	if osVersion == "" {
+		osVersion = peer.Meta.Core
+	}
+
+	apiPeer := &apiv1alpha1.Peer{
+		PeerMinimum: apiv1alpha1.PeerMinimum{
+			Id:   peer.ID,
+			Name: peer.Name,
+		},
+		CreatedAt:                   peer.CreatedAt,
+		Ip:                          peer.IP.String(),
+		Ipv6:                        peerIPv6String(peer),
+		ConnectionIp:                peer.Location.ConnectionIP.String(),
+		Connected:                   peer.Status.Connected,
+		LastSeen:                    peer.Status.LastSeen,
+		Os:                          fmt.Sprintf("%s %s", peer.Meta.OS, osVersion),
+		KernelVersion:               peer.Meta.KernelVersion,
+		GeonameId:                   int(peer.Location.GeoNameID),
+		Version:                     peer.Meta.WtVersion,
+		Groups:                      groupsInfo,
+		SshEnabled:                  peer.SSHEnabled,
+		Hostname:                    peer.Meta.Hostname,
+		UserId:                      peer.UserID,
+		UiVersion:                   peer.Meta.UIVersion,
+		DnsLabel:                    fqdn(peer, dnsDomain),
+		ExtraDnsLabels:              fqdnList(peer.ExtraDNSLabels, dnsDomain),
+		LoginExpirationEnabled:      peer.LoginExpirationEnabled,
+		LastLogin:                   peer.GetLastLogin(),
+		LoginExpired:                peer.Status.LoginExpired,
+		ApprovalRequired:            !approved,
+		CountryCode:                 apiv1alpha1.CountryCode(peer.Location.CountryCode),
+		CityName:                    apiv1alpha1.CityName(peer.Location.CityName),
+		SerialNumber:                peer.Meta.SystemSerialNumber,
+		InactivityExpirationEnabled: peer.InactivityExpirationEnabled,
+		Ephemeral:                   peer.Ephemeral,
+		LocalFlags: &apiv1alpha1.PeerLocalFlags{
+			BlockInbound:          &peer.Meta.Flags.BlockInbound,
+			BlockLanAccess:        &peer.Meta.Flags.BlockLANAccess,
+			DisableClientRoutes:   &peer.Meta.Flags.DisableClientRoutes,
+			DisableDns:            &peer.Meta.Flags.DisableDNS,
+			DisableFirewall:       &peer.Meta.Flags.DisableFirewall,
+			DisableServerRoutes:   &peer.Meta.Flags.DisableServerRoutes,
+			LazyConnectionEnabled: &peer.Meta.Flags.LazyConnectionEnabled,
+			RosenpassEnabled:      &peer.Meta.Flags.RosenpassEnabled,
+			RosenpassPermissive:   &peer.Meta.Flags.RosenpassPermissive,
+			ServerSshAllowed:      &peer.Meta.Flags.ServerSSHAllowed,
+			RemoteJobsAllowed:     &peer.Meta.Flags.RemoteJobsAllowed,
+		},
+	}
+
+	if !approved {
+		apiPeer.DisapprovalReason = &reason
+	}
+
+	return apiPeer
+}
+
+func toPeerListItemResponse(peer *nbpeer.Peer, groupsInfo []apiv1alpha1.GroupMinimum, dnsDomain string, accessiblePeersCount int) *apiv1alpha1.PeerBatch {
+	osVersion := peer.Meta.OSVersion
+	if osVersion == "" {
+		osVersion = peer.Meta.Core
+	}
+
+	return &apiv1alpha1.PeerBatch{
+		CreatedAt:            peer.CreatedAt,
+		AccessiblePeersCount: accessiblePeersCount,
+		Peer: apiv1alpha1.Peer{
+			PeerMinimum: apiv1alpha1.PeerMinimum{
+				Id:   peer.ID,
+				Name: peer.Name,
+			},
+			Ip:                          peer.IP.String(),
+			Ipv6:                        peerIPv6String(peer),
+			ConnectionIp:                peer.Location.ConnectionIP.String(),
+			Connected:                   peer.Status.Connected,
+			LastSeen:                    peer.Status.LastSeen,
+			Os:                          fmt.Sprintf("%s %s", peer.Meta.OS, osVersion),
+			KernelVersion:               peer.Meta.KernelVersion,
+			GeonameId:                   int(peer.Location.GeoNameID),
+			Version:                     peer.Meta.WtVersion,
+			Groups:                      groupsInfo,
+			SshEnabled:                  peer.SSHEnabled,
+			Hostname:                    peer.Meta.Hostname,
+			UserId:                      peer.UserID,
+			UiVersion:                   peer.Meta.UIVersion,
+			DnsLabel:                    fqdn(peer, dnsDomain),
+			ExtraDnsLabels:              fqdnList(peer.ExtraDNSLabels, dnsDomain),
+			LoginExpirationEnabled:      peer.LoginExpirationEnabled,
+			LastLogin:                   peer.GetLastLogin(),
+			LoginExpired:                peer.Status.LoginExpired,
+			CountryCode:                 apiv1alpha1.CountryCode(peer.Location.CountryCode),
+			CityName:                    apiv1alpha1.CityName(peer.Location.CityName),
+			SerialNumber:                peer.Meta.SystemSerialNumber,
+			InactivityExpirationEnabled: peer.InactivityExpirationEnabled,
+			Ephemeral:                   peer.Ephemeral,
+			LocalFlags: &apiv1alpha1.PeerLocalFlags{
+				BlockInbound:          &peer.Meta.Flags.BlockInbound,
+				BlockLanAccess:        &peer.Meta.Flags.BlockLANAccess,
+				DisableClientRoutes:   &peer.Meta.Flags.DisableClientRoutes,
+				DisableDns:            &peer.Meta.Flags.DisableDNS,
+				DisableFirewall:       &peer.Meta.Flags.DisableFirewall,
+				DisableServerRoutes:   &peer.Meta.Flags.DisableServerRoutes,
+				LazyConnectionEnabled: &peer.Meta.Flags.LazyConnectionEnabled,
+				RosenpassEnabled:      &peer.Meta.Flags.RosenpassEnabled,
+				RosenpassPermissive:   &peer.Meta.Flags.RosenpassPermissive,
+				ServerSshAllowed:      &peer.Meta.Flags.ServerSSHAllowed,
+				RemoteJobsAllowed:     &peer.Meta.Flags.RemoteJobsAllowed,
+			},
+		},
+	}
+}
+
+func fqdn(peer *nbpeer.Peer, dnsDomain string) string {
+	fqdn := peer.FQDN(dnsDomain)
+	if fqdn == "" {
+		return peer.DNSLabel
+	} else {
+		return fqdn
+	}
+}
+func fqdnList(extraLabels []string, dnsDomain string) []string {
+	fqdnList := make([]string, 0, len(extraLabels))
+	for _, label := range extraLabels {
+		fqdn := fmt.Sprintf("%s.%s", label, dnsDomain)
+		fqdnList = append(fqdnList, fqdn)
+	}
+	return fqdnList
+}
+
+func peerIPv6String(peer *nbpeer.Peer) *string {
+	if !peer.IPv6.IsValid() {
+		return nil
+	}
+	s := peer.IPv6.String()
+	return &s
+}
diff --git a/management/server/api/v1alpha1/peers/peers_handler_test.go b/management/server/api/v1alpha1/peers/peers_handler_test.go
new file mode 100644
index 000000000..492d0e12d
--- /dev/null
+++ b/management/server/api/v1alpha1/peers/peers_handler_test.go
@@ -0,0 +1,445 @@
+package peers
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/gorilla/mux"
+	"go.uber.org/mock/gomock"
+	"golang.org/x/exp/maps"
+
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/permissions"
+	"github.com/netbirdio/netbird/management/server/permissions/modules"
+	"github.com/netbirdio/netbird/management/server/permissions/operations"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/auth"
+	"github.com/netbirdio/netbird/shared/management/http/apiv1alpha1"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/server/mock_server"
+)
+
+const (
+	testPeerID                = "test_peer"
+	noUpdateChannelTestPeerID = "no-update-channel"
+
+	adminUser   = "admin_user"
+	regularUser = "regular_user"
+	serviceUser = "service_user"
+)
+
+func initTestMetaData(t *testing.T, peers ...*nbpeer.Peer) *Handler {
+
+	peersMap := make(map[string]*nbpeer.Peer)
+	for _, peer := range peers {
+		peersMap[peer.ID] = peer.Copy()
+	}
+
+	policy := &types.Policy{
+		ID:        "policy",
+		AccountID: "test_id",
+		Name:      "policy",
+		Enabled:   true,
+		Rules: []*types.PolicyRule{
+			{
+				ID:            "rule",
+				Name:          "rule",
+				Enabled:       true,
+				Action:        "accept",
+				Destinations:  []string{"group1"},
+				Sources:       []string{"group1"},
+				Bidirectional: true,
+				Protocol:      "all",
+				Ports:         []string{"80"},
+			},
+		},
+	}
+
+	srvUser := types.NewRegularUser(serviceUser, "", "")
+	srvUser.IsServiceUser = true
+
+	account := &types.Account{
+		Id:     "test_id",
+		Domain: "hotmail.com",
+		Peers:  peersMap,
+		Users: map[string]*types.User{
+			adminUser:   types.NewAdminUser(adminUser),
+			regularUser: types.NewRegularUser(regularUser, "", ""),
+			serviceUser: srvUser,
+		},
+		Groups: map[string]*types.Group{
+			"group1": {
+				ID:        "group1",
+				AccountID: "test_id",
+				Name:      "group1",
+				Issued:    "api",
+				Peers:     maps.Keys(peersMap),
+			},
+		},
+		Settings: &types.Settings{
+			PeerLoginExpirationEnabled: true,
+			PeerLoginExpiration:        time.Hour,
+		},
+		Policies: []*types.Policy{policy},
+		Network: &types.Network{
+			Identifier: "ciclqisab2ss43jdn8q0",
+			Net: net.IPNet{
+				IP:   net.ParseIP("100.67.0.0"),
+				Mask: net.IPv4Mask(255, 255, 0, 0),
+			},
+			Serial: 51,
+		},
+	}
+
+	ctrl := gomock.NewController(t)
+
+	networkMapController := network_map.NewMockController(ctrl)
+	networkMapController.EXPECT().
+		GetDNSDomain(gomock.Any()).
+		Return("domain").
+		AnyTimes()
+
+	ctrl2 := gomock.NewController(t)
+	permissionsManager := permissions.NewMockManager(ctrl2)
+	permissionsManager.EXPECT().ValidateAccountAccess(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(context.Background(), nil).AnyTimes()
+	permissionsManager.EXPECT().
+		ValidateUserPermissions(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Eq(modules.Peers), gomock.Eq(operations.Read)).
+		DoAndReturn(func(ctx context.Context, accountID, userID string, module modules.Module, operation operations.Operation) (bool, context.Context, error) {
+			user, ok := account.Users[userID]
+			if !ok {
+				return false, ctx, fmt.Errorf("user not found")
+			}
+			return user.HasAdminPower() || user.IsServiceUser, ctx, nil
+		}).
+		AnyTimes()
+
+	return &Handler{
+		accountManager: &mock_server.MockAccountManager{
+			UpdatePeerFunc: func(_ context.Context, accountID, userID string, update *nbpeer.Peer) (*nbpeer.Peer, error) {
+				var p *nbpeer.Peer
+				for _, peer := range peers {
+					if update.ID == peer.ID {
+						p = peer.Copy()
+						break
+					}
+				}
+				p.SSHEnabled = update.SSHEnabled
+				p.LoginExpirationEnabled = update.LoginExpirationEnabled
+				p.Name = update.Name
+				return p, nil
+			},
+			UpdatePeerIPFunc: func(_ context.Context, accountID, userID, peerID string, newIP netip.Addr) error {
+				for _, peer := range peers {
+					if peer.ID == peerID {
+						peer.IP = newIP
+						return nil
+					}
+				}
+				return fmt.Errorf("peer not found")
+			},
+			GetPeerFunc: func(_ context.Context, accountID, peerID, userID string) (*nbpeer.Peer, error) {
+				var p *nbpeer.Peer
+				for _, peer := range peers {
+					if peerID == peer.ID {
+						p = peer.Copy()
+						break
+					}
+				}
+				return p, nil
+			},
+			GetUserByIDFunc: func(ctx context.Context, id string) (*types.User, error) {
+				switch id {
+				case adminUser:
+					return account.Users[adminUser], nil
+				case regularUser:
+					return account.Users[regularUser], nil
+				case serviceUser:
+					return account.Users[serviceUser], nil
+				default:
+					return nil, fmt.Errorf("user not found")
+				}
+			},
+			GetPeersFunc: func(_ context.Context, accountID, userID, nameFilter, ipFilter, macFilter string) ([]*nbpeer.Peer, error) {
+				return peers, nil
+			},
+			GetPeerGroupsFunc: func(ctx context.Context, accountID, peerID string) ([]*types.Group, error) {
+				peersID := make([]string, len(peers))
+				for _, peer := range peers {
+					peersID = append(peersID, peer.ID)
+				}
+				return []*types.Group{
+					{
+						ID:        "group1",
+						AccountID: accountID,
+						Name:      "group1",
+						Issued:    "api",
+						Peers:     peersID,
+					},
+				}, nil
+			},
+			GetDNSDomainFunc: func(settings *types.Settings) string {
+				return "netbird.selfhosted"
+			},
+			GetAccountFunc: func(ctx context.Context, accountID string) (*types.Account, error) {
+				return account, nil
+			},
+			GetAccountByIDFunc: func(ctx context.Context, accountID string, userID string) (*types.Account, error) {
+				return account, nil
+			},
+			HasConnectedChannelFunc: func(peerID string) bool {
+				statuses := make(map[string]struct{})
+				for _, peer := range peers {
+					if peer.ID == noUpdateChannelTestPeerID {
+						break
+					}
+					statuses[peer.ID] = struct{}{}
+				}
+				_, ok := statuses[peerID]
+				return ok
+			},
+			GetAccountSettingsFunc: func(ctx context.Context, accountID string, userID string) (*types.Settings, error) {
+				return account.Settings, nil
+			},
+		},
+		networkMapController: networkMapController,
+		permissionsManager:   permissionsManager,
+	}
+}
+
+// Tests the GetAllPeers endpoint reachable in the route /api/peers
+// Use the metadata generated by initTestMetaData() to check for values
+func TestGetPeers(t *testing.T) {
+
+	peer := &nbpeer.Peer{
+		ID:                     testPeerID,
+		Key:                    "key",
+		IP:                     netip.MustParseAddr("100.64.0.1"),
+		IPv6:                   netip.MustParseAddr("fd00::1"),
+		Status:                 &nbpeer.PeerStatus{Connected: true},
+		Name:                   "PeerName",
+		LoginExpirationEnabled: false,
+		Meta: nbpeer.PeerSystemMeta{
+			Hostname:           "hostname",
+			GoOS:               "GoOS",
+			Kernel:             "kernel",
+			Core:               "core",
+			Platform:           "platform",
+			OS:                 "OS",
+			WtVersion:          "development",
+			SystemSerialNumber: "C02XJ0J0JGH7",
+		},
+	}
+
+	peer1 := peer.Copy()
+	peer1.ID = noUpdateChannelTestPeerID
+
+	expectedUpdatedPeer := peer.Copy()
+	expectedUpdatedPeer.LoginExpirationEnabled = true
+	expectedUpdatedPeer.SSHEnabled = true
+	expectedUpdatedPeer.Name = "New Name"
+
+	expectedPeer1 := peer1.Copy()
+	expectedPeer1.Status.Connected = false
+
+	tt := []struct {
+		name           string
+		expectedStatus int
+		requestType    string
+		requestPath    string
+		contentType    string
+		requestBody    io.Reader
+		expectedArray  bool
+		expectedPeer   *nbpeer.Peer
+	}{
+		{
+			name:           "GetPeersMetaData",
+			requestType:    http.MethodGet,
+			requestPath:    "/peers",
+			expectedStatus: http.StatusOK,
+			expectedArray:  true,
+			expectedPeer:   peer,
+		},
+		{
+			name:           "GetPeer with update channel",
+			requestType:    http.MethodGet,
+			requestPath:    "/peers/" + testPeerID,
+			expectedStatus: http.StatusOK,
+			expectedArray:  false,
+			expectedPeer:   peer,
+		},
+		{
+			name:           "PutPeer",
+			requestType:    http.MethodPut,
+			requestPath:    "/peers/" + testPeerID,
+			contentType:    "application/json",
+			expectedStatus: http.StatusOK,
+			expectedArray:  false,
+			requestBody:    bytes.NewBufferString("{\"login_expiration_enabled\":true,\"name\":\"New Name\",\"ssh_enabled\":true, \"inactivity_expiration_enabled\":true}"),
+			expectedPeer:   expectedUpdatedPeer,
+		},
+	}
+
+	p := initTestMetaData(t, peer, peer1)
+
+	for _, tc := range tt {
+		t.Run(tc.name, func(t *testing.T) {
+
+			recorder := httptest.NewRecorder()
+			req := httptest.NewRequest(tc.requestType, tc.requestPath, tc.requestBody)
+			req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{
+				UserId:    "admin_user",
+				Domain:    "hotmail.com",
+				AccountId: "test_id",
+			})
+			if tc.contentType != "" {
+				req.Header.Set("Content-Type", tc.contentType)
+			}
+
+			v1validator, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+			assert.NoError(t, err)
+			router := mux.NewRouter()
+			router.Use(v1validator.Handler)
+
+			router = p.WithEndpointsForRouter(router)
+			router.ServeHTTP(recorder, req)
+
+			res := recorder.Result()
+			defer res.Body.Close()
+
+			if status := recorder.Code; status != tc.expectedStatus {
+				t.Fatalf("handler returned wrong status code: got %v want %v",
+					status, http.StatusOK)
+			}
+
+			content, err := io.ReadAll(res.Body)
+			if err != nil {
+				t.Fatalf("I don't know what I expected; %v", err)
+			}
+
+			var got *apiv1alpha1.Peer
+			if tc.expectedArray {
+				respBody := []*apiv1alpha1.Peer{}
+				err = json.Unmarshal(content, &respBody)
+				if err != nil {
+					t.Fatalf("Sent content is not in correct json format; %v", err)
+				}
+
+				// hardcode this check for now as we only have two peers in this suite
+				assert.Equal(t, len(respBody), 2)
+
+				for _, peer := range respBody {
+					if peer.Id == testPeerID {
+						got = peer
+					}
+				}
+
+			} else {
+				got = &apiv1alpha1.Peer{}
+				err = json.Unmarshal(content, got)
+				if err != nil {
+					t.Fatalf("Sent content is not in correct json format; %v", err)
+				}
+			}
+
+			t.Log(got)
+
+			assert.Equal(t, tc.expectedPeer.Name, got.Name)
+			assert.Equal(t, tc.expectedPeer.Meta.WtVersion, got.Version)
+			assert.Equal(t, tc.expectedPeer.IP.String(), got.Ip)
+			assert.Equal(t, "OS core", got.Os)
+			assert.Equal(t, tc.expectedPeer.LoginExpirationEnabled, got.LoginExpirationEnabled)
+			assert.Equal(t, tc.expectedPeer.SSHEnabled, got.SshEnabled)
+			assert.Equal(t, tc.expectedPeer.Status.Connected, got.Connected)
+			assert.Equal(t, tc.expectedPeer.Meta.SystemSerialNumber, got.SerialNumber)
+		})
+	}
+}
+
+func TestPeersHandlerUpdatePeerIP(t *testing.T) {
+	testPeer := &nbpeer.Peer{
+		ID:                     testPeerID,
+		Key:                    "key",
+		IP:                     netip.MustParseAddr("100.64.0.1"),
+		IPv6:                   netip.MustParseAddr("fd00::1"),
+		Status:                 &nbpeer.PeerStatus{Connected: false, LastSeen: time.Now()},
+		Name:                   "test-host@netbird.io",
+		LoginExpirationEnabled: false,
+		UserID:                 regularUser,
+		Meta: nbpeer.PeerSystemMeta{
+			Hostname: "test-host@netbird.io",
+			Core:     "22.04",
+		},
+	}
+
+	p := initTestMetaData(t, testPeer)
+
+	tt := []struct {
+		name           string
+		peerID         string
+		requestBody    string
+		callerUserID   string
+		expectedStatus int
+		expectedIP     string
+	}{
+		{
+			name:           "update peer IP successfully",
+			peerID:         testPeerID,
+			requestBody:    `{"name":"test", "ssh_enabled":true, "login_expiration_enabled":true, "inactivity_expiration_enabled":true, "ip": "100.64.0.100"}`,
+			callerUserID:   adminUser,
+			expectedStatus: http.StatusOK,
+			expectedIP:     "100.64.0.100",
+		},
+		{
+			name:           "update peer IP with invalid IP",
+			peerID:         testPeerID,
+			requestBody:    `{"name":"test", "ssh_enabled":true, "login_expiration_enabled":true, "inactivity_expiration_enabled":true, "ip": "invalid-ip"}`,
+			callerUserID:   adminUser,
+			expectedStatus: http.StatusUnprocessableEntity,
+		},
+	}
+
+	for _, tc := range tt {
+		t.Run(tc.name, func(t *testing.T) {
+			req := httptest.NewRequest(http.MethodPut, fmt.Sprintf("/peers/%s", tc.peerID), bytes.NewBuffer([]byte(tc.requestBody)))
+			req.Header.Set("Content-Type", "application/json")
+			req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{
+				UserId:    tc.callerUserID,
+				Domain:    "hotmail.com",
+				AccountId: "test_id",
+			})
+
+			rr := httptest.NewRecorder()
+
+			v1validator, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+			assert.NoError(t, err)
+			router := mux.NewRouter()
+			router.Use(v1validator.Handler)
+
+			router = p.WithEndpointsForRouter(router)
+			router.ServeHTTP(rr, req)
+
+			assert.Equal(t, tc.expectedStatus, rr.Code)
+
+			if tc.expectedStatus == http.StatusOK && tc.expectedIP != "" {
+				var updatedPeer apiv1alpha1.Peer
+				err := json.Unmarshal(rr.Body.Bytes(), &updatedPeer)
+				require.NoError(t, err)
+				assert.Equal(t, tc.expectedIP, updatedPeer.Ip)
+			}
+		})
+	}
+}
diff --git a/management/server/api/v1alpha1/users/users_handler.go b/management/server/api/v1alpha1/users/users_handler.go
new file mode 100644
index 000000000..2322e87fd
--- /dev/null
+++ b/management/server/api/v1alpha1/users/users_handler.go
@@ -0,0 +1,275 @@
+package users
+
+import (
+	"encoding/json"
+	"net/http"
+	"strconv"
+
+	"github.com/gorilla/mux"
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/management/server/account"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/http/apiv1alpha1"
+	"github.com/netbirdio/netbird/shared/management/http/util"
+	"github.com/netbirdio/netbird/shared/management/status"
+
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+)
+
+type Handler struct {
+	accountManager account.Manager
+}
+
+func NewHandler(accountManager account.Manager) *Handler {
+	return &Handler{
+		accountManager: accountManager,
+	}
+}
+
+func (h *Handler) WithEndpointsForRouter(router *mux.Router) *mux.Router {
+	router.HandleFunc("/users", h.getAllUsers).Methods("GET", "OPTIONS")
+	router.HandleFunc("/users", h.createUser).Methods("POST", "OPTIONS")
+	router.HandleFunc("/users/{userId}", h.updateUser).Methods("PUT", "OPTIONS")
+	router.HandleFunc("/users/{userId}", h.deleteUser).Methods("DELETE", "OPTIONS")
+	return router
+}
+
+// updateUser is a PUT requests to update User data
+func (h *Handler) updateUser(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPut {
+		util.WriteErrorResponse("wrong HTTP method", http.StatusMethodNotAllowed, w)
+		return
+	}
+
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	accountID, userID := userAuth.AccountId, userAuth.UserId
+	vars := mux.Vars(r)
+	targetUserID := vars["userId"]
+	if len(targetUserID) == 0 {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "invalid user ID"), w)
+		return
+	}
+
+	existingUser, err := h.accountManager.GetUserByID(r.Context(), targetUserID)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	req := &apiv1alpha1.UserRequest{}
+	err = json.NewDecoder(r.Body).Decode(req)
+	if err != nil {
+		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
+		return
+	}
+
+	if req.AutoGroups == nil {
+		util.WriteErrorResponse("auto_groups field can't be absent", http.StatusBadRequest, w)
+		return
+	}
+
+	userRole := types.StrRoleToUserRole(req.Role)
+	if userRole == types.UserRoleUnknown {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "invalid user role"), w)
+		return
+	}
+
+	newUser, err := h.accountManager.SaveUser(r.Context(), accountID, userID, &types.User{
+		Id:                   targetUserID,
+		Role:                 userRole,
+		AutoGroups:           req.AutoGroups,
+		Blocked:              req.IsBlocked,
+		Issued:               existingUser.Issued,
+		IntegrationReference: existingUser.IntegrationReference,
+	})
+
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+	util.WriteJSONObject(r.Context(), w, toUserResponse(newUser, userID))
+}
+
+// deleteUser is a DELETE request to delete a user
+func (h *Handler) deleteUser(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodDelete {
+		util.WriteErrorResponse("wrong HTTP method", http.StatusMethodNotAllowed, w)
+		return
+	}
+
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	accountID, userID := userAuth.AccountId, userAuth.UserId
+	vars := mux.Vars(r)
+	targetUserID := vars["userId"]
+	if len(targetUserID) == 0 {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "invalid user ID"), w)
+		return
+	}
+
+	err = h.accountManager.DeleteUser(r.Context(), accountID, userID, targetUserID)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	util.WriteJSONObject(r.Context(), w, util.EmptyObject{})
+}
+
+// createUser creates a User in the system with a status "invited" (effectively this is a user invite).
+func (h *Handler) createUser(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		util.WriteErrorResponse("wrong HTTP method", http.StatusMethodNotAllowed, w)
+		return
+	}
+
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+	accountID, userID := userAuth.AccountId, userAuth.UserId
+
+	req := &apiv1alpha1.UserCreateRequest{}
+	err = json.NewDecoder(r.Body).Decode(req)
+	if err != nil {
+		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
+		return
+	}
+
+	if types.StrRoleToUserRole(req.Role) == types.UserRoleUnknown {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "unknown user role %s", req.Role), w)
+		return
+	}
+
+	email := ""
+	if req.Email != nil {
+		email = *req.Email
+	}
+
+	name := ""
+	if req.Name != nil {
+		name = *req.Name
+	}
+
+	newUser, err := h.accountManager.CreateUser(r.Context(), accountID, userID, &types.UserInfo{
+		Email:         email,
+		Name:          name,
+		Role:          req.Role,
+		AutoGroups:    req.AutoGroups,
+		IsServiceUser: req.IsServiceUser,
+		Issued:        types.UserIssuedAPI,
+	})
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+	util.WriteJSONObject(r.Context(), w, toUserResponse(newUser, userID))
+}
+
+// getAllUsers returns a list of users of the account this user belongs to.
+// It also gathers additional user data (like email and name) from the IDP manager.
+func (h *Handler) getAllUsers(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		util.WriteErrorResponse("wrong HTTP method", http.StatusMethodNotAllowed, w)
+		return
+	}
+
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	accountID, userID := userAuth.AccountId, userAuth.UserId
+	data, err := h.accountManager.GetUsersFromAccount(r.Context(), accountID, userID)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	serviceUser := r.URL.Query().Get("service_user")
+
+	users := make([]*apiv1alpha1.User, 0)
+	for _, d := range data {
+		if d.NonDeletable {
+			continue
+		}
+		if serviceUser == "" {
+			users = append(users, toUserResponse(d, userID))
+			continue
+		}
+
+		includeServiceUser, err := strconv.ParseBool(serviceUser)
+		log.WithContext(r.Context()).Tracef("Should include service user: %v", includeServiceUser)
+		if err != nil {
+			util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "invalid service_user query parameter"), w)
+			return
+		}
+		if includeServiceUser == d.IsServiceUser {
+			users = append(users, toUserResponse(d, userID))
+		}
+	}
+
+	util.WriteJSONObject(r.Context(), w, users)
+}
+
+func toUserResponse(user *types.UserInfo, currenUserID string) *apiv1alpha1.User {
+	autoGroups := user.AutoGroups
+	if autoGroups == nil {
+		autoGroups = []string{}
+	}
+
+	var userStatus apiv1alpha1.UserStatus
+	switch user.Status {
+	case "active":
+		userStatus = apiv1alpha1.UserStatusActive
+	case "invited":
+		userStatus = apiv1alpha1.UserStatusInvited
+	default:
+		userStatus = apiv1alpha1.UserStatusBlocked
+	}
+
+	if user.IsBlocked {
+		userStatus = apiv1alpha1.UserStatusBlocked
+	}
+
+	isCurrent := user.ID == currenUserID
+
+	var password *string
+	if user.Password != "" {
+		password = &user.Password
+	}
+
+	var idpID *string
+	if user.IdPID != "" {
+		idpID = &user.IdPID
+	}
+
+	return &apiv1alpha1.User{
+		Id:              user.ID,
+		Name:            user.Name,
+		Email:           user.Email,
+		Role:            user.Role,
+		AutoGroups:      autoGroups,
+		Status:          userStatus,
+		IsCurrent:       &isCurrent,
+		IsServiceUser:   &user.IsServiceUser,
+		IsBlocked:       user.IsBlocked,
+		LastLogin:       &user.LastLogin,
+		Issued:          &user.Issued,
+		PendingApproval: user.PendingApproval,
+		Password:        password,
+		IdpId:           idpID,
+	}
+}
diff --git a/management/server/api/v1alpha1/users/users_handler_test.go b/management/server/api/v1alpha1/users/users_handler_test.go
new file mode 100644
index 000000000..13fc806d5
--- /dev/null
+++ b/management/server/api/v1alpha1/users/users_handler_test.go
@@ -0,0 +1,452 @@
+package users
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gorilla/mux"
+	"github.com/stretchr/testify/assert"
+
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+	"github.com/netbirdio/netbird/management/server/mock_server"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/auth"
+	"github.com/netbirdio/netbird/shared/management/http/apiv1alpha1"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+const (
+	existingAccountID         = "existingAccountID"
+	notFoundAccountID         = "notFoundAccountID"
+	testDomain                = "hotmail.com"
+	existingUserID            = "existingUserID"
+	notFoundUserID            = "notFoundUserID"
+	serviceUserID             = "serviceUserID"
+	nonDeletableServiceUserID = "nonDeletableServiceUserID"
+	regularUserID             = "regularUserID"
+)
+
+var usersTestAccount = &types.Account{
+	Id:     existingAccountID,
+	Domain: testDomain,
+	Users: map[string]*types.User{
+		existingUserID: {
+			Id:            existingUserID,
+			Role:          "admin",
+			IsServiceUser: false,
+			AutoGroups:    []string{"group_1"},
+			Issued:        types.UserIssuedAPI,
+		},
+		regularUserID: {
+			Id:            regularUserID,
+			Role:          "user",
+			IsServiceUser: false,
+			AutoGroups:    []string{"group_1"},
+			Issued:        types.UserIssuedAPI,
+		},
+		serviceUserID: {
+			Id:            serviceUserID,
+			Role:          "user",
+			IsServiceUser: true,
+			AutoGroups:    []string{"group_1"},
+			Issued:        types.UserIssuedAPI,
+		},
+		nonDeletableServiceUserID: {
+			Id:            nonDeletableServiceUserID,
+			Role:          "admin",
+			IsServiceUser: true,
+			NonDeletable:  true,
+			Issued:        types.UserIssuedIntegration,
+		},
+	},
+}
+
+func initUsersTestData() *Handler {
+	return &Handler{
+		accountManager: &mock_server.MockAccountManager{
+			GetUserByIDFunc: func(ctx context.Context, id string) (*types.User, error) {
+				return usersTestAccount.Users[id], nil
+			},
+			GetUsersFromAccountFunc: func(_ context.Context, accountID, userID string) (map[string]*types.UserInfo, error) {
+				usersInfos := make(map[string]*types.UserInfo)
+				for _, v := range usersTestAccount.Users {
+					usersInfos[v.Id] = &types.UserInfo{
+						ID:            v.Id,
+						Role:          string(v.Role),
+						Name:          "",
+						Email:         "",
+						IsServiceUser: v.IsServiceUser,
+						NonDeletable:  v.NonDeletable,
+						Issued:        v.Issued,
+					}
+				}
+				return usersInfos, nil
+			},
+			CreateUserFunc: func(_ context.Context, accountID, userID string, key *types.UserInfo) (*types.UserInfo, error) {
+				if userID != existingUserID {
+					return nil, status.Errorf(status.NotFound, "user with ID %s does not exists", userID)
+				}
+				return key, nil
+			},
+			DeleteUserFunc: func(_ context.Context, accountID string, initiatorUserID string, targetUserID string) error {
+				if targetUserID == notFoundUserID {
+					return status.Errorf(status.NotFound, "user with ID %s does not exists", targetUserID)
+				}
+				if !usersTestAccount.Users[targetUserID].IsServiceUser {
+					return status.Errorf(status.PermissionDenied, "user with ID %s is not a service user and can not be deleted", targetUserID)
+				}
+				return nil
+			},
+			SaveUserFunc: func(_ context.Context, accountID, userID string, update *types.User) (*types.UserInfo, error) {
+				if update.Id == notFoundUserID {
+					return nil, status.Errorf(status.NotFound, "user with ID %s does not exists", update.Id)
+				}
+
+				if userID != existingUserID {
+					return nil, status.Errorf(status.NotFound, "user with ID %s does not exists", userID)
+				}
+
+				info, err := update.Copy().ToUserInfo(nil)
+				if err != nil {
+					return nil, err
+				}
+				return info, nil
+			},
+		},
+	}
+}
+
+func TestGetUsers(t *testing.T) {
+	tt := []struct {
+		name            string
+		expectedStatus  int
+		requestType     string
+		requestPath     string
+		expectedUserIDs []string
+	}{
+		{name: "getAllUsers", requestType: http.MethodGet, requestPath: "/users", expectedStatus: http.StatusOK, expectedUserIDs: []string{existingUserID, regularUserID, serviceUserID}},
+		{name: "GetOnlyServiceUsers", requestType: http.MethodGet, requestPath: "/users?service_user=true", expectedStatus: http.StatusOK, expectedUserIDs: []string{serviceUserID}},
+		{name: "GetOnlyRegularUsers", requestType: http.MethodGet, requestPath: "/users?service_user=false", expectedStatus: http.StatusOK, expectedUserIDs: []string{existingUserID, regularUserID}},
+	}
+
+	userHandler := initUsersTestData()
+
+	for _, tc := range tt {
+		t.Run(tc.name, func(t *testing.T) {
+			recorder := httptest.NewRecorder()
+			req := httptest.NewRequest(tc.requestType, tc.requestPath, nil)
+			req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{
+				UserId:    existingUserID,
+				Domain:    testDomain,
+				AccountId: existingAccountID,
+			})
+
+			v1validator, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+			assert.NoError(t, err)
+			router := mux.NewRouter()
+			router.Use(v1validator.Handler)
+
+			router = userHandler.WithEndpointsForRouter(router)
+			router.ServeHTTP(recorder, req)
+
+			res := recorder.Result()
+			defer res.Body.Close()
+
+			content, err := io.ReadAll(res.Body)
+			if err != nil {
+				t.Fatalf("I don't know what I expected; %v", err)
+			}
+
+			if status := recorder.Code; status != tc.expectedStatus {
+				t.Errorf("handler returned wrong status code: got %v want %v, content: %s",
+					status, tc.expectedStatus, string(content))
+				return
+			}
+
+			respBody := []*types.UserInfo{}
+			err = json.Unmarshal(content, &respBody)
+			if err != nil {
+				t.Fatalf("Sent content is not in correct json format; %v", err)
+			}
+
+			assert.Equal(t, len(respBody), len(tc.expectedUserIDs))
+			for _, v := range respBody {
+				assert.Contains(t, tc.expectedUserIDs, v.ID)
+				assert.Equal(t, v.ID, usersTestAccount.Users[v.ID].Id)
+				assert.Equal(t, v.Role, string(usersTestAccount.Users[v.ID].Role))
+				assert.Equal(t, v.IsServiceUser, usersTestAccount.Users[v.ID].IsServiceUser)
+				assert.Equal(t, v.Issued, usersTestAccount.Users[v.ID].Issued)
+			}
+		})
+	}
+}
+
+func TestUpdateUser(t *testing.T) {
+	tt := []struct {
+		name                  string
+		expectedStatusCode    int
+		requestType           string
+		requestPath           string
+		requestBody           io.Reader
+		expectedUserID        string
+		expectedRole          string
+		expectedStatus        string
+		expectedBlocked       bool
+		expectedIsServiceUser bool
+		expectedGroups        []string
+	}{
+		{
+			name:               "Update_Block_User",
+			requestType:        http.MethodPut,
+			requestPath:        "/users/" + regularUserID,
+			expectedStatusCode: http.StatusOK,
+			expectedUserID:     regularUserID,
+			expectedBlocked:    true,
+			expectedRole:       "user",
+			expectedStatus:     "blocked",
+			expectedGroups:     []string{"group_1"},
+			requestBody:        bytes.NewBufferString("{\"role\":\"user\",\"auto_groups\":[\"group_1\"],\"is_service_user\":false, \"is_blocked\": true}"),
+		},
+		{
+			name:               "Update_Change_Role_To_Admin",
+			requestType:        http.MethodPut,
+			requestPath:        "/users/" + regularUserID,
+			expectedStatusCode: http.StatusOK,
+			expectedUserID:     regularUserID,
+			expectedBlocked:    false,
+			expectedRole:       "admin",
+			expectedStatus:     "blocked",
+			expectedGroups:     []string{"group_1"},
+			requestBody:        bytes.NewBufferString("{\"role\":\"admin\",\"auto_groups\":[\"group_1\"],\"is_service_user\":false, \"is_blocked\": false}"),
+		},
+		{
+			name:               "Update_Groups",
+			requestType:        http.MethodPut,
+			requestPath:        "/users/" + regularUserID,
+			expectedStatusCode: http.StatusOK,
+			expectedUserID:     regularUserID,
+			expectedBlocked:    false,
+			expectedRole:       "admin",
+			expectedStatus:     "blocked",
+			expectedGroups:     []string{"group_2", "group_3"},
+			requestBody:        bytes.NewBufferString("{\"role\":\"admin\",\"auto_groups\":[\"group_3\", \"group_2\"],\"is_service_user\":false, \"is_blocked\": false}"),
+		},
+		{
+			name:               "Should_Fail_Because_AutoGroups_Is_Absent",
+			requestType:        http.MethodPut,
+			requestPath:        "/users/" + regularUserID,
+			expectedStatusCode: http.StatusUnprocessableEntity,
+			expectedUserID:     regularUserID,
+			expectedBlocked:    false,
+			expectedRole:       "admin",
+			expectedStatus:     "blocked",
+			expectedGroups:     []string{"group_2", "group_3"},
+			requestBody:        bytes.NewBufferString("{\"role\":\"admin\",\"is_service_user\":false, \"is_blocked\": false}"),
+		},
+	}
+
+	userHandler := initUsersTestData()
+
+	for _, tc := range tt {
+		t.Run(tc.name, func(t *testing.T) {
+			recorder := httptest.NewRecorder()
+			req := httptest.NewRequest(tc.requestType, tc.requestPath, tc.requestBody)
+			req.Header.Set("Content-Type", "application/json")
+			req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{
+				UserId:    existingUserID,
+				Domain:    testDomain,
+				AccountId: existingAccountID,
+			})
+
+			v1validator, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+			assert.NoError(t, err)
+
+			router := mux.NewRouter()
+			router.Use(v1validator.Handler)
+
+			router = userHandler.WithEndpointsForRouter(router)
+			router.ServeHTTP(recorder, req)
+
+			res := recorder.Result()
+			defer res.Body.Close()
+
+			if status := recorder.Code; status != tc.expectedStatusCode {
+				t.Fatalf("handler returned wrong status code: got %v want %v",
+					status, http.StatusOK)
+			}
+
+			if tc.expectedStatusCode == 200 {
+
+				content, err := io.ReadAll(res.Body)
+				if err != nil {
+					t.Fatalf("I don't know what I expected; %v", err)
+				}
+
+				respBody := &apiv1alpha1.User{}
+				err = json.Unmarshal(content, &respBody)
+				if err != nil {
+					t.Fatalf("response content is not in correct json format; %v", err)
+				}
+
+				assert.Equal(t, tc.expectedUserID, respBody.Id)
+				assert.Equal(t, tc.expectedRole, respBody.Role)
+				assert.Equal(t, tc.expectedIsServiceUser, *respBody.IsServiceUser)
+				assert.Equal(t, tc.expectedBlocked, respBody.IsBlocked)
+				assert.Len(t, respBody.AutoGroups, len(tc.expectedGroups))
+
+				for _, expectedGroup := range tc.expectedGroups {
+					exists := false
+					for _, actualGroup := range respBody.AutoGroups {
+						if expectedGroup == actualGroup {
+							exists = true
+						}
+					}
+					assert.True(t, exists, fmt.Sprintf("group %s not found in the response", expectedGroup))
+				}
+			}
+		})
+	}
+}
+
+func TestCreateUser(t *testing.T) {
+	name := "name"
+	email := "email"
+	serviceUserToAdd := apiv1alpha1.UserCreateRequest{
+		AutoGroups:    []string{},
+		Email:         nil,
+		IsServiceUser: true,
+		Name:          &name,
+		Role:          "admin",
+	}
+	serviceUserString, err := json.Marshal(serviceUserToAdd)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	regularUserToAdd := apiv1alpha1.UserCreateRequest{
+		AutoGroups:    []string{},
+		Email:         &email,
+		IsServiceUser: true,
+		Name:          &name,
+		Role:          "admin",
+	}
+	regularUserString, err := json.Marshal(regularUserToAdd)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	tt := []struct {
+		name           string
+		expectedStatus int
+		requestType    string
+		requestPath    string
+		requestBody    io.Reader
+		expectedResult []*types.User
+	}{
+		{name: "CreateServiceUser", requestType: http.MethodPost, requestPath: "/users", expectedStatus: http.StatusOK, requestBody: bytes.NewBuffer(serviceUserString)},
+		// right now creation is blocked in AC middleware, will be refactored in the future
+		{name: "CreateRegularUser", requestType: http.MethodPost, requestPath: "/users", expectedStatus: http.StatusOK, requestBody: bytes.NewBuffer(regularUserString)},
+	}
+
+	userHandler := initUsersTestData()
+
+	for _, tc := range tt {
+		t.Run(tc.name, func(t *testing.T) {
+			req := httptest.NewRequest(tc.requestType, tc.requestPath, tc.requestBody)
+			rr := httptest.NewRecorder()
+			req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{
+				UserId:    existingUserID,
+				Domain:    testDomain,
+				AccountId: existingAccountID,
+			})
+			req.Header.Set("Content-Type", "application/json")
+
+			v1validator, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+			assert.NoError(t, err)
+
+			router := mux.NewRouter()
+			router.Use(v1validator.Handler)
+
+			router = userHandler.WithEndpointsForRouter(router)
+			router.ServeHTTP(rr, req)
+
+			res := rr.Result()
+			defer res.Body.Close()
+
+			if status := rr.Code; status != tc.expectedStatus {
+				t.Fatalf("handler returned wrong status code: got %v want %v",
+					status, tc.expectedStatus)
+			}
+		})
+	}
+}
+
+func TestDeleteUser(t *testing.T) {
+	tt := []struct {
+		name           string
+		expectedStatus int
+		expectedBody   bool
+		requestType    string
+		requestPath    string
+		requestVars    map[string]string
+		requestBody    io.Reader
+	}{
+		{
+			name:           "Delete Regular User",
+			requestType:    http.MethodDelete,
+			requestPath:    "/users/" + regularUserID,
+			requestVars:    map[string]string{"userId": regularUserID},
+			expectedStatus: http.StatusForbidden,
+		},
+		{
+			name:           "Delete Service User",
+			requestType:    http.MethodDelete,
+			requestPath:    "/users/" + serviceUserID,
+			requestVars:    map[string]string{"userId": serviceUserID},
+			expectedStatus: http.StatusOK,
+		},
+		{
+			name:           "Delete Not Existing User",
+			requestType:    http.MethodDelete,
+			requestPath:    "/users/" + notFoundUserID,
+			requestVars:    map[string]string{"userId": notFoundUserID},
+			expectedStatus: http.StatusNotFound,
+		},
+	}
+
+	userHandler := initUsersTestData()
+	for _, tc := range tt {
+		t.Run(tc.name, func(t *testing.T) {
+			req := httptest.NewRequest(tc.requestType, tc.requestPath, nil)
+			req = mux.SetURLVars(req, tc.requestVars)
+			req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{
+				UserId:    existingUserID,
+				Domain:    testDomain,
+				AccountId: existingAccountID,
+			})
+			rr := httptest.NewRecorder()
+
+			v1validator, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+			assert.NoError(t, err)
+
+			router := mux.NewRouter()
+			router.Use(v1validator.Handler)
+			router = userHandler.WithEndpointsForRouter(router)
+			router.ServeHTTP(rr, req)
+
+			res := rr.Result()
+			defer res.Body.Close()
+
+			if status := rr.Code; status != tc.expectedStatus {
+				t.Fatalf("handler returned wrong status code: got %v want %v",
+					status, tc.expectedStatus)
+			}
+		})
+	}
+}
diff --git a/management/server/http/handler.go b/management/server/http/handler.go
index 8ebfd6c64..12aaadbb5 100644
--- a/management/server/http/handler.go
+++ b/management/server/http/handler.go
@@ -7,8 +7,6 @@ import (
 	"net/netip"
 
 	"github.com/gorilla/mux"
-	"github.com/rs/cors"
-	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain/manager"
 
@@ -36,7 +34,6 @@ import (
 
 	"github.com/netbirdio/netbird/management/server/http/handlers/proxy"
 
-	"github.com/netbirdio/netbird/management/server/auth"
 	"github.com/netbirdio/netbird/management/server/geolocation"
 	nbgroups "github.com/netbirdio/netbird/management/server/groups"
 	"github.com/netbirdio/netbird/management/server/http/handlers/accounts"
@@ -51,18 +48,20 @@ import (
 	"github.com/netbirdio/netbird/management/server/http/handlers/routes"
 	"github.com/netbirdio/netbird/management/server/http/handlers/setup_keys"
 	"github.com/netbirdio/netbird/management/server/http/handlers/users"
-	"github.com/netbirdio/netbird/management/server/http/middleware"
 	"github.com/netbirdio/netbird/management/server/http/middleware/bypass"
 	nbinstance "github.com/netbirdio/netbird/management/server/instance"
 	nbnetworks "github.com/netbirdio/netbird/management/server/networks"
 	"github.com/netbirdio/netbird/management/server/networks/resources"
 	"github.com/netbirdio/netbird/management/server/networks/routers"
-	"github.com/netbirdio/netbird/management/server/telemetry"
-	"github.com/netbirdio/netbird/shared/ratelimit"
 )
 
 // NewAPIHandler creates the Management service HTTP API handler registering all the available endpoints.
-func NewAPIHandler(ctx context.Context, router *mux.Router, accountManager account.Manager, networksManager nbnetworks.Manager, resourceManager resources.Manager, routerManager routers.Manager, groupsManager nbgroups.Manager, LocationManager geolocation.Geolocation, authManager auth.Manager, appMetrics telemetry.AppMetrics, permissionsManager permissions.Manager, settingsManager settings.Manager, zManager zones.Manager, rManager records.Manager, networkMapController network_map.Controller, idpManager idpmanager.Manager, serviceManager service.Manager, reverseProxyDomainManager *manager.Manager, reverseProxyAccessLogsManager accesslogs.Manager, proxyGRPCServer *nbgrpc.ProxyServiceServer, trustedHTTPProxies []netip.Prefix, rateLimiter *ratelimit.APIRateLimiter, isValidChildAccount middleware.IsValidChildAccountFunc, agentNetworkManager agentnetwork.Manager, proxyTokenRevocationGuard proxytoken.RevocationGuard) (http.Handler, error) {
+func NewAPIHandler(ctx context.Context, router *mux.Router, accountManager account.Manager, networksManager nbnetworks.Manager,
+	resourceManager resources.Manager, routerManager routers.Manager, groupsManager nbgroups.Manager, LocationManager geolocation.Geolocation,
+	permissionsManager permissions.Manager, settingsManager settings.Manager, zManager zones.Manager, rManager records.Manager,
+	networkMapController network_map.Controller, idpManager idpmanager.Manager, serviceManager service.Manager,
+	reverseProxyDomainManager *manager.Manager, reverseProxyAccessLogsManager accesslogs.Manager, proxyGRPCServer *nbgrpc.ProxyServiceServer,
+	trustedHTTPProxies []netip.Prefix, agentNetworkManager agentnetwork.Manager, proxyTokenRevocationGuard proxytoken.RevocationGuard) (http.Handler, error) {
 
 	// Register bypass paths for unauthenticated endpoints
 	if err := bypass.AddBypassPath("/api/instance"); err != nil {
@@ -83,28 +82,6 @@ func NewAPIHandler(ctx context.Context, router *mux.Router, accountManager accou
 		return nil, fmt.Errorf("failed to add bypass path: %w", err)
 	}
 
-	if rateLimiter == nil {
-		log.Warn("NewAPIHandler: nil rate limiter, rate limiting disabled")
-		rateLimiter = ratelimit.NewAPIRateLimiter(nil)
-		rateLimiter.SetEnabled(false)
-	}
-
-	authMiddleware := middleware.NewAuthMiddleware(
-		authManager,
-		accountManager.GetAccountIDFromUserAuth,
-		accountManager.SyncUserJWTGroups,
-		accountManager.GetUserFromUserAuth,
-		rateLimiter,
-		appMetrics.GetMeter(),
-		isValidChildAccount,
-	)
-
-	corsMiddleware := cors.AllowAll()
-
-	metricsMiddleware := appMetrics.HTTPMiddleware()
-
-	router.Use(metricsMiddleware.Handler, corsMiddleware.Handler, authMiddleware.Handler)
-
 	instanceManager, err := nbinstance.NewManager(ctx, accountManager.GetStore(), idpManager)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create instance manager: %w", err)
diff --git a/management/server/http/middleware/middleware_factory.go b/management/server/http/middleware/middleware_factory.go
new file mode 100644
index 000000000..3ae617774
--- /dev/null
+++ b/management/server/http/middleware/middleware_factory.go
@@ -0,0 +1,35 @@
+package middleware
+
+import (
+	"github.com/gorilla/mux"
+	"github.com/netbirdio/netbird/management/server/account"
+	"github.com/netbirdio/netbird/management/server/auth"
+	"github.com/netbirdio/netbird/management/server/telemetry"
+	"github.com/netbirdio/netbird/shared/ratelimit"
+	"github.com/rs/cors"
+	log "github.com/sirupsen/logrus"
+)
+
+func BuildMiddleware(rateLimiter *ratelimit.APIRateLimiter, authManager auth.Manager, accountManager account.Manager, metrics telemetry.AppMetrics, isValidChildAcctFunc IsValidChildAccountFunc) []mux.MiddlewareFunc {
+	toret := make([]mux.MiddlewareFunc, 0)
+
+	toret = append(toret, metrics.HTTPMiddleware().Handler)
+	toret = append(toret, cors.AllowAll().Handler)
+
+	if rateLimiter == nil {
+		log.Warn("NewAPIHandler: nil rate limiter, rate limiting disabled")
+		rateLimiter = ratelimit.NewAPIRateLimiter(nil)
+		rateLimiter.SetEnabled(false)
+	}
+	toret = append(toret, NewAuthMiddleware(
+		authManager,
+		accountManager.GetAccountIDFromUserAuth,
+		accountManager.SyncUserJWTGroups,
+		accountManager.GetUserFromUserAuth,
+		rateLimiter,
+		metrics.GetMeter(),
+		isValidChildAcctFunc,
+	).Handler)
+
+	return toret
+}
diff --git a/management/server/http/testing/testing_tools/channel/channel.go b/management/server/http/testing/testing_tools/channel/channel.go
index 3f2056c32..1b15ba780 100644
--- a/management/server/http/testing/testing_tools/channel/channel.go
+++ b/management/server/http/testing/testing_tools/channel/channel.go
@@ -39,6 +39,7 @@ import (
 	"github.com/netbirdio/netbird/management/server/geolocation"
 	"github.com/netbirdio/netbird/management/server/groups"
 	http2 "github.com/netbirdio/netbird/management/server/http"
+	"github.com/netbirdio/netbird/management/server/http/middleware"
 	"github.com/netbirdio/netbird/management/server/http/testing/testing_tools"
 	"github.com/netbirdio/netbird/management/server/networks"
 	"github.com/netbirdio/netbird/management/server/networks/resources"
@@ -145,7 +146,10 @@ func BuildApiBlackBoxWithDBState(t testing_tools.TB, sqlFile string, expectedPee
 	zoneRecordsManager := recordsManager.NewManager(store, am, permissionsManager)
 
 	apiRouter := mux.NewRouter().PathPrefix("/api").Subrouter()
-	apiHandler, err := http2.NewAPIHandler(ctx, apiRouter, am, networksManager, resourcesManager, routersManager, groupsManager, geoMock, authManagerMock, metrics, permissionsManager, settingsManager, customZonesManager, zoneRecordsManager, networkMapController, nil, serviceManager, nil, nil, nil, nil, nil, nil, nil, nil)
+	apiRouter.Use(middleware.BuildMiddleware(nil, authManagerMock, am, metrics, nil)...)
+	apiHandler, err := http2.NewAPIHandler(ctx, apiRouter, am, networksManager, resourcesManager, routersManager,
+		groupsManager, geoMock, permissionsManager, settingsManager, customZonesManager, zoneRecordsManager,
+		networkMapController, nil, serviceManager, nil, nil, nil, nil, nil, nil)
 	if err != nil {
 		t.Fatalf("Failed to create API handler: %v", err)
 	}
@@ -284,7 +288,10 @@ func BuildApiBlackBoxWithDBStateAndPeerChannel(t testing_tools.TB, sqlFile strin
 	zoneRecordsManager := recordsManager.NewManager(store, am, permissionsManager)
 
 	apiRouter := mux.NewRouter().PathPrefix("/api").Subrouter()
-	apiHandler, err := http2.NewAPIHandler(ctx, apiRouter, am, networksManager, resourcesManager, routersManager, groupsManager, geoMock, authManagerMock, metrics, permissionsManager, settingsManager, customZonesManager, zoneRecordsManager, networkMapController, nil, serviceManager, nil, nil, nil, nil, nil, nil, nil, nil)
+	apiRouter.Use(middleware.BuildMiddleware(nil, authManagerMock, am, metrics, nil)...)
+	apiHandler, err := http2.NewAPIHandler(ctx, apiRouter, am, networksManager, resourcesManager, routersManager, groupsManager,
+		geoMock, permissionsManager, settingsManager, customZonesManager, zoneRecordsManager,
+		networkMapController, nil, serviceManager, nil, nil, nil, nil, nil, nil)
 	if err != nil {
 		t.Fatalf("Failed to create API handler: %v", err)
 	}
diff --git a/shared/management/http/apiv1alpha1/bundle.yaml b/shared/management/http/apiv1alpha1/bundle.yaml
new file mode 100644
index 000000000..c8245ab49
--- /dev/null
+++ b/shared/management/http/apiv1alpha1/bundle.yaml
@@ -0,0 +1,997 @@
+openapi: 3.1.0
+servers:
+  - url: /api/v1alpha1
+    description: Default server
+info:
+  title: NetBird REST API
+  description: API to manipulate groups, rules, policies and retrieve information about peers and users
+  version: 1.0.0-alpha1
+tags:
+  - name: Users
+    description: Interact with and view information about users.
+  - name: Tokens
+    description: Interact with and view information about tokens.
+  - name: Peers
+    description: Interact with and view information about peers.
+  - name: Setup Keys
+    description: Interact with and view information about setup keys.
+  - name: Groups
+    description: Interact with and view information about groups.
+  - name: Policies
+    description: Interact with and view information about policies.
+  - name: Posture Checks
+    description: Interact with and view information about posture checks.
+  - name: Routes
+    description: Interact with and view information about routes.
+  - name: DNS
+    description: Interact with and view information about DNS configuration.
+  - name: DNS Zones
+    description: Interact with and view information about custom DNS zones.
+  - name: Events
+    description: View information about the account and network events.
+  - name: Accounts
+    description: View information about the accounts.
+  - name: Ingress Ports
+    description: Interact with and view information about the ingress peers and ports.
+    x-cloud-only: true
+  - name: Identity Providers
+    description: Interact with and view information about identity providers.
+  - name: Services
+    description: Interact with and view information about reverse proxy services.
+  - name: Instance
+    description: Instance setup and status endpoints for initial configuration.
+  - name: Jobs
+    description: Interact with and view information about remote jobs.
+    x-experimental: true
+  - name: Usage
+    description: Retrieve current usage statistics for the account.
+    x-cloud-only: true
+  - name: Subscription
+    description: Manage and view information about account subscriptions.
+    x-cloud-only: true
+  - name: Plans
+    description: Retrieve available plans and products.
+    x-cloud-only: true
+  - name: Checkout
+    description: Manage checkout sessions for plan subscriptions.
+    x-cloud-only: true
+  - name: AWS Marketplace
+    description: Manage AWS Marketplace subscriptions.
+    x-cloud-only: true
+  - name: Portal
+    description: Access customer portal for subscription management.
+    x-cloud-only: true
+  - name: Invoice
+    description: Manage and retrieve account invoices.
+    x-cloud-only: true
+  - name: MSP
+    description: MSP portal for Tenant management.
+    x-cloud-only: true
+  - name: IDP SCIM Integrations
+    description: Manage generic SCIM identity provider integrations for user and group sync.
+    x-cloud-only: true
+  - name: IDP Google Integrations
+    description: Manage Google Workspace identity provider integrations for user and group sync.
+    x-cloud-only: true
+  - name: IDP Azure Integrations
+    description: Manage Azure AD identity provider integrations for user and group sync.
+    x-cloud-only: true
+  - name: IDP Okta SCIM Integrations
+    description: Manage Okta SCIM identity provider integrations for user and group sync.
+    x-cloud-only: true
+  - name: EDR Intune Integrations
+    description: Manage Microsoft Intune EDR integrations.
+    x-cloud-only: true
+  - name: EDR SentinelOne Integrations
+    description: Manage SentinelOne EDR integrations.
+    x-cloud-only: true
+  - name: EDR Falcon Integrations
+    description: Manage CrowdStrike Falcon EDR integrations.
+    x-cloud-only: true
+  - name: EDR Huntress Integrations
+    description: Manage Huntress EDR integrations.
+    x-cloud-only: true
+  - name: EDR FleetDM Integrations
+    description: Manage FleetDM EDR integrations.
+    x-cloud-only: true
+  - name: EDR Peers
+    description: Manage EDR compliance bypass for peers.
+    x-cloud-only: true
+  - name: Event Streaming Integrations
+    description: Manage event streaming integrations.
+    x-cloud-only: true
+  - name: Notifications
+    description: Manage notification channels for account event alerts.
+    x-cloud-only: true
+components:
+  schemas:
+    CountryCode:
+      description: 2-letter ISO 3166-1 alpha-2 code that represents the country
+      type: string
+      example: "DE"
+    CityName:
+      description: Commonly used English name of the city
+      type: string
+      example: "Berlin"
+    Country:
+      description: Describe country geographical location information
+      type: object
+      properties:
+        country_name:
+          description: Commonly used English name of the country
+          type: string
+          example: "Germany"
+        country_code:
+          $ref: '#/components/schemas/CountryCode'
+      required:
+        - country_name
+        - country_code
+    City:
+      description: Describe city geographical location information
+      type: object
+      properties:
+        geoname_id:
+          description: Integer ID of the record in GeoNames database
+          type: integer
+          example: 2950158
+        city_name:
+          description: Commonly used English name of the city
+          type: string
+          example: "Berlin"
+      required:
+        - geoname_id
+        - city_name
+    ErrorResponse:
+      type: object
+      description: Standard error response
+      properties:
+        message:
+          type: string
+          description: A human-readable error message.
+          example: "couldn't parse JSON request"
+    PeerBatch:
+      allOf:
+        - $ref: '#/components/schemas/Peer'
+        - type: object
+          properties:
+            created_at:
+              description: Peer creation date (UTC)
+              type: string
+              format: date-time
+              example: "2023-05-05T09:00:35.477782Z"
+            accessible_peers_count:
+              description: Number of accessible peers
+              type: integer
+              example: 5
+          required:
+            - created_at
+            - accessible_peers_count
+    PeerMinimum:
+      type: object
+      properties:
+        id:
+          description: Peer ID
+          type: string
+          example: chacbco6lnnbn6cg5s90
+        name:
+          description: Peer's hostname
+          type: string
+          example: stage-host-1
+      required:
+        - id
+        - name
+    GroupMinimum:
+      type: object
+      properties:
+        id:
+          description: Group ID
+          type: string
+          example: ch8i4ug6lnn4g9hqv7m0
+        name:
+          description: Group Name identifier
+          type: string
+          example: devs
+        peers_count:
+          description: Count of peers associated to the group
+          type: integer
+          example: 2
+        resources_count:
+          description: Count of resources associated to the group
+          type: integer
+          example: 5
+        issued:
+          description: How the group was issued (api, integration, jwt)
+          type: string
+          enum:
+            - "api"
+            - "integration"
+            - "jwt"
+          example: api
+      required:
+        - id
+        - name
+        - peers_count
+        - resources_count
+    PeerLocalFlags:
+      type: object
+      properties:
+        rosenpass_enabled:
+          description: Indicates whether Rosenpass is enabled on this peer
+          type: boolean
+          example: true
+        rosenpass_permissive:
+          description: Indicates whether Rosenpass is in permissive mode or not
+          type: boolean
+          example: false
+        server_ssh_allowed:
+          description: Indicates whether SSH access this peer is allowed or not
+          type: boolean
+          example: true
+        remote_jobs_allowed:
+          description: Indicates whether the peer has opted into management-requested remote jobs (e.g. debug bundles)
+          type: boolean
+          example: true
+        disable_client_routes:
+          description: Indicates whether client routes are disabled on this peer or not
+          type: boolean
+          example: false
+        disable_server_routes:
+          description: Indicates whether server routes are disabled on this peer or not
+          type: boolean
+          example: false
+        disable_dns:
+          description: Indicates whether DNS management is disabled on this peer or not
+          type: boolean
+          example: false
+        disable_firewall:
+          description: Indicates whether firewall management is disabled on this peer or not
+          type: boolean
+          example: false
+        block_lan_access:
+          description: Indicates whether LAN access is blocked on this peer when used as a routing peer
+          type: boolean
+          example: false
+        block_inbound:
+          description: Indicates whether inbound traffic is blocked on this peer
+          type: boolean
+          example: false
+        lazy_connection_enabled:
+          description: Indicates whether lazy connection is enabled on this peer
+          type: boolean
+          example: false
+    Peer:
+      allOf:
+        - $ref: '#/components/schemas/PeerMinimum'
+        - type: object
+          properties:
+            created_at:
+              description: Peer creation date (UTC)
+              type: string
+              format: date-time
+              example: "2023-05-05T09:00:35.477782Z"
+            ip:
+              description: Peer's IP address
+              type: string
+              example: 10.64.0.1
+            ipv6:
+              description: Peer's IPv6 overlay address
+              type: string
+              format: ipv6
+              example: "fd00:4e42:ab12::1"
+            connection_ip:
+              description: Peer's public connection IP address
+              type: string
+              example: 35.64.0.1
+            connected:
+              description: Peer to Management connection status
+              type: boolean
+              example: true
+            last_seen:
+              description: Last time peer connected to Netbird's management service
+              type: string
+              format: date-time
+              example: "2023-05-05T10:05:26.420578Z"
+            os:
+              description: Peer's operating system and version
+              type: string
+              example: Darwin 13.2.1
+            kernel_version:
+              description: Peer's operating system kernel version
+              type: string
+              example: 23.2.0
+            geoname_id:
+              description: Unique identifier from the GeoNames database for a specific geographical location.
+              type: integer
+              example: 2643743
+            version:
+              description: Peer's daemon or cli version
+              type: string
+              example: 0.14.0
+            groups:
+              description: Groups that the peer belongs to
+              type: array
+              items:
+                $ref: '#/components/schemas/GroupMinimum'
+            ssh_enabled:
+              description: Indicates whether SSH server is enabled on this peer
+              type: boolean
+              example: true
+            user_id:
+              description: User ID of the user that enrolled this peer
+              type: string
+              example: google-oauth2|277474792786460067937
+            hostname:
+              description: Hostname of the machine
+              type: string
+              example: stage-host-1
+            ui_version:
+              description: Peer's desktop UI version
+              type: string
+              example: 0.14.0
+            dns_label:
+              description: Peer's DNS label is the parsed peer name for domain resolution. It is used to form an FQDN by appending the account's domain to the peer label. e.g. peer-dns-label.netbird.cloud
+              type: string
+              example: stage-host-1.netbird.cloud
+            login_expiration_enabled:
+              description: Indicates whether peer login expiration has been enabled or not
+              type: boolean
+              example: false
+            login_expired:
+              description: Indicates whether peer's login expired or not
+              type: boolean
+              example: false
+            last_login:
+              description: Last time this peer performed log in (authentication). E.g., user authenticated.
+              type: string
+              format: date-time
+              example: "2023-05-05T09:00:35.477782Z"
+            inactivity_expiration_enabled:
+              description: Indicates whether peer inactivity expiration has been enabled or not
+              type: boolean
+              example: false
+            approval_required:
+              description: (Cloud only) Indicates whether peer needs approval
+              type: boolean
+              example: true
+            disapproval_reason:
+              description: (Cloud only) Reason why the peer requires approval
+              type: string
+            country_code:
+              $ref: '#/components/schemas/CountryCode'
+            city_name:
+              $ref: '#/components/schemas/CityName'
+            serial_number:
+              description: System serial number
+              type: string
+              example: "C02XJ0J0JGH7"
+            extra_dns_labels:
+              description: Extra DNS labels added to the peer
+              type: array
+              items:
+                type: string
+                example: "stage-host-1"
+            ephemeral:
+              description: Indicates whether the peer is ephemeral or not
+              type: boolean
+              example: false
+            local_flags:
+              $ref: '#/components/schemas/PeerLocalFlags'
+          required:
+            - city_name
+            - connected
+            - connection_ip
+            - country_code
+            - created_at
+            - dns_label
+            - geoname_id
+            - groups
+            - hostname
+            - ip
+            - kernel_version
+            - last_login
+            - last_seen
+            - login_expiration_enabled
+            - login_expired
+            - inactivity_expiration_enabled
+            - os
+            - ssh_enabled
+            - user_id
+            - version
+            - ui_version
+            - approval_required
+            - serial_number
+            - extra_dns_labels
+            - ephemeral
+    PeerRequest:
+      type: object
+      properties:
+        name:
+          type: string
+          example: stage-host-1
+        ssh_enabled:
+          type: boolean
+          example: true
+        login_expiration_enabled:
+          type: boolean
+          example: false
+        inactivity_expiration_enabled:
+          type: boolean
+          example: false
+        approval_required:
+          description: (Cloud only) Indicates whether peer needs approval
+          type: boolean
+          example: true
+        ip:
+          description: Peer's IP address
+          type: string
+          format: ipv4
+          example: 100.64.0.15
+        ipv6:
+          description: Peer's IPv6 overlay address. Omitted if IPv6 is not enabled for the account.
+          type: string
+          format: ipv6
+          example: "fd00:4e42:ab12::1"
+      required:
+        - name
+        - ssh_enabled
+        - login_expiration_enabled
+        - inactivity_expiration_enabled
+    User:
+      type: object
+      properties:
+        id:
+          description: User ID
+          type: string
+          example: google-oauth2|277474792786460067937
+        email:
+          description: User's email address
+          type: string
+          example: demo@netbird.io
+        password:
+          description: User's password. Only present when user is created (create user endpoint is called) and only when IdP supports user creation with password.
+          type: string
+          example: super_secure_password
+        name:
+          description: User's name from idp provider
+          type: string
+          example: Tom Schulz
+        role:
+          description: User's NetBird account role
+          type: string
+          example: admin
+        status:
+          description: User's status
+          type: string
+          enum:
+            - "active"
+            - "invited"
+            - "blocked"
+          example: active
+        last_login:
+          description: Last time this user performed a login to the dashboard
+          type: string
+          format: date-time
+          example: "2023-05-05T09:00:35.477782Z"
+        auto_groups:
+          description: Group IDs to auto-assign to peers registered by this user
+          type: array
+          items:
+            type: string
+            example: ch8i4ug6lnn4g9hqv7m0
+        is_current:
+          description: Is true if authenticated user is the same as this user
+          type: boolean
+          readOnly: true
+          example: true
+        is_service_user:
+          description: Is true if this user is a service user
+          type: boolean
+          readOnly: true
+          example: false
+        is_blocked:
+          description: Is true if this user is blocked. Blocked users can't use the system
+          type: boolean
+          example: false
+        pending_approval:
+          description: Is true if this user requires approval before being activated. Only applicable for users joining via domain matching when user_approval_required is enabled.
+          type: boolean
+          example: false
+        issued:
+          description: How user was issued by API or Integration
+          type: string
+          example: api
+        idp_id:
+          description: Identity provider ID (connector ID) that the user authenticated with. Only populated for users with Dex-encoded user IDs.
+          type: string
+          example: okta-abc123
+        permissions:
+          $ref: '#/components/schemas/UserPermissions'
+      required:
+        - id
+        - email
+        - name
+        - role
+        - auto_groups
+        - status
+        - is_blocked
+        - pending_approval
+    UserCreateRequest:
+      type: object
+      properties:
+        email:
+          description: User's Email to send invite to
+          type: string
+          example: demo@netbird.io
+        name:
+          description: User's full name
+          type: string
+          example: Tom Schulz
+        role:
+          description: User's NetBird account role
+          type: string
+          example: admin
+        auto_groups:
+          description: Group IDs to auto-assign to peers registered by this user
+          type: array
+          items:
+            type: string
+            example: ch8i4ug6lnn4g9hqv7m0
+        is_service_user:
+          description: Is true if this user is a service user
+          type: boolean
+          example: false
+      required:
+        - role
+        - auto_groups
+        - is_service_user
+    UserRequest:
+      type: object
+      properties:
+        role:
+          description: User's NetBird account role
+          type: string
+          example: admin
+        auto_groups:
+          description: Group IDs to auto-assign to peers registered by this user
+          type: array
+          items:
+            type: string
+            example: ch8i4ug6lnn4g9hqv7m0
+        is_blocked:
+          description: If set to true then user is blocked and can't use the system
+          type: boolean
+          example: false
+      required:
+        - role
+        - auto_groups
+        - is_blocked
+    UserPermissions:
+      type: object
+      properties:
+        is_restricted:
+          type: boolean
+          description: Indicates whether this User's Peers view is restricted
+        modules:
+          type: object
+          additionalProperties:
+            type: object
+            additionalProperties:
+              type: boolean
+            propertyNames:
+              type: string
+              description: The operation type
+          propertyNames:
+            type: string
+            description: The module name
+          example: {"networks": {"read": true, "create": false, "update": false, "delete": false}, "peers": {"read": false, "create": false, "update": false, "delete": false}}
+      required:
+        - modules
+        - is_restricted
+  responses:
+    not_found:
+      description: Resource not found
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content: {}
+    validation_failed_simple:
+      description: Validation failed
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content: {}
+    bad_request:
+      description: Bad Request
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content: {}
+    unprocessable:
+      description: Unprocessable Entity
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content:
+        application/json:
+          schema:
+            type: object
+            properties:
+              message:
+                type: string
+              code:
+                type: integer
+            required:
+              - message
+              - code
+    internal_error:
+      description: Internal Server Error
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content: {}
+    validation_failed:
+      description: Validation failed
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content: {}
+    forbidden:
+      description: Forbidden
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content: {}
+    requires_authentication:
+      description: Requires authentication
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content: {}
+    conflict:
+      description: Conflict
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/ErrorResponse'
+  headers:
+    X-Request-Id:
+      description: |
+        Unique identifier assigned to the request by the server and set on every
+        response. Useful for correlating client requests with server-side logs.
+      schema:
+        type: string
+        example: cot7r4n3l3vh3qj4qveg
+      example: cot7r4n3l3vh3qj4qveg
+  securitySchemes:
+    BearerAuth:
+      type: http
+      scheme: bearer
+      bearerFormat: JWT
+    TokenAuth:
+      type: apiKey
+      in: header
+      name: Authorization
+      description: >-
+        Enter the token with the `Token` prefix, e.g. "Token nbp_F3f0d.....".
+  pathItems:
+    peers:
+      get:
+        summary: List all Peers
+        description: Returns a list of all peers
+        tags:
+          - Peers
+        parameters:
+          - name: page
+            in: query
+            description: Page number
+            required: false
+            schema:
+              type: integer
+              minimum: 1
+              default: 1
+          - name: page_size
+            in: query
+            description: Number of peers per page
+            required: false
+            schema:
+              type: integer
+              minimum: 1
+              maximum: 250
+              default: 100
+          - name: connected
+            in: query
+            description: Filter by peer connected status
+            required: false
+            schema:
+              type: boolean
+          - name: approval_required
+            in: query
+            description: Filter by approval_required field
+            required: false
+            schema:
+              type: boolean
+          - name: os
+            in: query
+            description: Peer os
+            required: false
+            schema:
+              type: array
+              items:
+                type: string
+                enum:
+                  - linux
+                  - windows
+                  - mac
+                  - android
+                  - ios
+                  - js
+          - name: search
+            in: query
+            description: filter peers by name, dns_label, ip, os, version, serial_number, owner name, owner email, group names, mac
+            required: false
+            schema:
+              type: string
+        security:
+          - BearerAuth: []
+          - TokenAuth: []
+        responses:
+          '200':
+            description: A JSON Array of Peers
+            content:
+              application/json:
+                schema:
+                  type: array
+                  items:
+                    $ref: '#/components/schemas/PeerBatch'
+          '400':
+            "$ref": "#/components/responses/bad_request"
+          '401':
+            "$ref": "#/components/responses/requires_authentication"
+          '403':
+            "$ref": "#/components/responses/forbidden"
+          '422':
+            "$ref": "#/components/responses/unprocessable"
+          '500':
+            "$ref": "#/components/responses/internal_error"
+    peer:
+      get:
+        summary: Retrieve a Peer
+        description: Get information about a peer
+        tags:
+          - Peers
+        security:
+          - BearerAuth: []
+          - TokenAuth: []
+        parameters:
+          - in: path
+            name: peerId
+            required: true
+            schema:
+              type: string
+            description: The unique identifier of a peer
+        responses:
+          '200':
+            description: A Peer object
+            content:
+              application/json:
+                schema:
+                  $ref: '#/components/schemas/Peer'
+          '400':
+            "$ref": '#/components/responses/bad_request'
+          '401':
+            "$ref": '#/components/responses/requires_authentication'
+          '403':
+            "$ref": '#/components/responses/forbidden'
+          '500':
+            "$ref": '#/components/responses/internal_error'
+      put:
+        summary: Update a Peer
+        description: Update information about a peer
+        tags:
+          - Peers
+        security:
+          - BearerAuth: []
+          - TokenAuth: []
+        parameters:
+          - in: path
+            name: peerId
+            required: true
+            schema:
+              type: string
+            description: The unique identifier of a peer
+        requestBody:
+          description: update a peer
+          required: true
+          content:
+            'application/json':
+              schema:
+                $ref: '#/components/schemas/PeerRequest'
+        responses:
+          '200':
+            description: A Peer object
+            content:
+              application/json:
+                schema:
+                  $ref: '#/components/schemas/Peer'
+          '400':
+            "$ref": '#/components/responses/bad_request'
+          '401':
+            "$ref": '#/components/responses/requires_authentication'
+          '403':
+            "$ref": '#/components/responses/forbidden'
+          '422':
+            "$ref": "#/components/responses/unprocessable"
+          '500':
+            "$ref": '#/components/responses/internal_error'
+      delete:
+        summary: Delete a Peer
+        description: Delete a peer
+        tags:
+          - Peers
+        security:
+          - BearerAuth: []
+          - TokenAuth: []
+        parameters:
+          - in: path
+            name: peerId
+            required: true
+            schema:
+              type: string
+            description: The unique identifier of a peer
+        responses:
+          '200':
+            description: Delete status code
+            content: {}
+          '400':
+            "$ref": '#/components/responses/bad_request'
+          '401':
+            "$ref": '#/components/responses/requires_authentication'
+          '403':
+            "$ref": '#/components/responses/forbidden'
+          '500':
+            "$ref": '#/components/responses/internal_error'
+    UsersPath:
+      get:
+        summary: List all Users
+        description: Returns a list of all users
+        tags:
+          - Users
+        security:
+          - BearerAuth: []
+          - TokenAuth: []
+        parameters:
+          - in: query
+            name: service_user
+            schema:
+              type: boolean
+            description: Filters users and returns either regular users or service users
+        responses:
+          '200':
+            description: A JSON array of Users
+            content:
+              application/json:
+                schema:
+                  type: array
+                  items:
+                    $ref: '#/components/schemas/User'
+          '400':
+            "$ref": "#/components/responses/bad_request"
+          '401':
+            "$ref": "#/components/responses/requires_authentication"
+          '403':
+            "$ref": "#/components/responses/forbidden"
+          '422':
+            "$ref": "#/components/responses/unprocessable"
+          '500':
+            "$ref": "#/components/responses/internal_error"
+      post:
+        summary: Create a User
+        description: Creates a new service user or sends an invite to a regular user
+        tags:
+          - Users
+        security:
+          - BearerAuth: []
+          - TokenAuth: []
+        requestBody:
+          description: User invite information
+          required: true
+          content:
+            'application/json':
+              schema:
+                $ref: '#/components/schemas/UserCreateRequest'
+        responses:
+          '200':
+            description: A User object
+            content:
+              application/json:
+                schema:
+                  $ref: '#/components/schemas/User'
+          '400':
+            "$ref": "#/components/responses/bad_request"
+          '401':
+            "$ref": "#/components/responses/requires_authentication"
+          '403':
+            "$ref": "#/components/responses/forbidden"
+          '422':
+            "$ref": "#/components/responses/unprocessable"
+          '500':
+            "$ref": "#/components/responses/internal_error"
+    UserPath:
+      put:
+        summary: Update a User
+        description: Update information about a User
+        tags:
+          - Users
+        security:
+          - BearerAuth: []
+          - TokenAuth: []
+        parameters:
+          - in: path
+            name: userId
+            required: true
+            schema:
+              type: string
+            description: The unique identifier of a user
+        requestBody:
+          description: User update
+          required: true
+          content:
+            'application/json':
+              schema:
+                $ref: '#/components/schemas/UserRequest'
+        responses:
+          '200':
+            description: A User object
+            content:
+              application/json:
+                schema:
+                  $ref: '#/components/schemas/User'
+          '400':
+            "$ref": "#/components/responses/bad_request"
+          '401':
+            "$ref": "#/components/responses/requires_authentication"
+          '403':
+            "$ref": "#/components/responses/forbidden"
+          '422':
+            "$ref": "#/components/responses/unprocessable"
+          '500':
+            "$ref": "#/components/responses/internal_error"
+      delete:
+        summary: Delete a User
+        description: This method removes a user from accessing the system. For this leaves the IDP user intact unless the `--user-delete-from-idp` is passed to management startup.
+        tags:
+          - Users
+        security:
+          - BearerAuth: []
+          - TokenAuth: []
+        parameters:
+          - in: path
+            name: userId
+            required: true
+            schema:
+              type: string
+            description: The unique identifier of a user
+        responses:
+          '200':
+            description: Delete status code
+            content: {}
+          '400':
+            "$ref": "#/components/responses/bad_request"
+          '401':
+            "$ref": "#/components/responses/requires_authentication"
+          '403':
+            "$ref": "#/components/responses/forbidden"
+          '500':
+            "$ref": "#/components/responses/internal_error"
+paths:
+  /peers:
+    $ref: '#/components/pathItems/peers'
+  /peers/{peerId}:
+    $ref: '#/components/pathItems/peer'
+  /users:
+    $ref: '#/components/pathItems/UsersPath'
+  /users/{userId}:
+    $ref: '#/components/pathItems/UserPath'
diff --git a/shared/management/http/apiv1alpha1/group/components.yaml b/shared/management/http/apiv1alpha1/group/components.yaml
new file mode 100644
index 000000000..6817cd8c0
--- /dev/null
+++ b/shared/management/http/apiv1alpha1/group/components.yaml
@@ -0,0 +1,31 @@
+components:
+  schemas:
+    GroupMinimum:
+      type: object
+      properties:
+        id:
+          description: Group ID
+          type: string
+          example: ch8i4ug6lnn4g9hqv7m0
+        name:
+          description: Group Name identifier
+          type: string
+          example: devs
+        peers_count:
+          description: Count of peers associated to the group
+          type: integer
+          example: 2
+        resources_count:
+          description: Count of resources associated to the group
+          type: integer
+          example: 5
+        issued:
+          description: How the group was issued (api, integration, jwt)
+          type: string
+          enum: [ "api", "integration", "jwt" ]
+          example: api
+      required:
+        - id
+        - name
+        - peers_count
+        - resources_count
\ No newline at end of file
diff --git a/shared/management/http/apiv1alpha1/openapi.yaml b/shared/management/http/apiv1alpha1/openapi.yaml
new file mode 100644
index 000000000..2abd1709d
--- /dev/null
+++ b/shared/management/http/apiv1alpha1/openapi.yaml
@@ -0,0 +1,250 @@
+openapi: 3.1.0
+servers:
+  - url: /api/v1alpha1
+    description: Default server
+info:
+  title: NetBird REST API
+  description: API to manipulate groups, rules, policies and retrieve information about peers and users
+  version: 1.0.0-alpha1
+tags:
+  - name: Users
+    description: Interact with and view information about users.
+  - name: Tokens
+    description: Interact with and view information about tokens.
+  - name: Peers
+    description: Interact with and view information about peers.
+  - name: Setup Keys
+    description: Interact with and view information about setup keys.
+  - name: Groups
+    description: Interact with and view information about groups.
+  - name: Policies
+    description: Interact with and view information about policies.
+  - name: Posture Checks
+    description: Interact with and view information about posture checks.
+  - name: Routes
+    description: Interact with and view information about routes.
+  - name: DNS
+    description: Interact with and view information about DNS configuration.
+  - name: DNS Zones
+    description: Interact with and view information about custom DNS zones.
+  - name: Events
+    description: View information about the account and network events.
+  - name: Accounts
+    description: View information about the accounts.
+  - name: Ingress Ports
+    description: Interact with and view information about the ingress peers and ports.
+    x-cloud-only: true
+  - name: Identity Providers
+    description: Interact with and view information about identity providers.
+  - name: Services
+    description: Interact with and view information about reverse proxy services.
+  - name: Instance
+    description: Instance setup and status endpoints for initial configuration.
+  - name: Jobs
+    description: Interact with and view information about remote jobs.
+    x-experimental: true
+
+  - name: Usage
+    description: Retrieve current usage statistics for the account.
+    x-cloud-only: true
+  - name: Subscription
+    description: Manage and view information about account subscriptions.
+    x-cloud-only: true
+  - name: Plans
+    description: Retrieve available plans and products.
+    x-cloud-only: true
+  - name: Checkout
+    description: Manage checkout sessions for plan subscriptions.
+    x-cloud-only: true
+  - name: AWS Marketplace
+    description: Manage AWS Marketplace subscriptions.
+    x-cloud-only: true
+  - name: Portal
+    description: Access customer portal for subscription management.
+    x-cloud-only: true
+  - name: Invoice
+    description: Manage and retrieve account invoices.
+    x-cloud-only: true
+  - name: MSP
+    description: MSP portal for Tenant management.
+    x-cloud-only: true
+  - name: IDP SCIM Integrations
+    description: Manage generic SCIM identity provider integrations for user and group sync.
+    x-cloud-only: true
+  - name: IDP Google Integrations
+    description: Manage Google Workspace identity provider integrations for user and group sync.
+    x-cloud-only: true
+  - name: IDP Azure Integrations
+    description: Manage Azure AD identity provider integrations for user and group sync.
+    x-cloud-only: true
+  - name: IDP Okta SCIM Integrations
+    description: Manage Okta SCIM identity provider integrations for user and group sync.
+    x-cloud-only: true
+  - name: EDR Intune Integrations
+    description: Manage Microsoft Intune EDR integrations.
+    x-cloud-only: true
+  - name: EDR SentinelOne Integrations
+    description: Manage SentinelOne EDR integrations.
+    x-cloud-only: true
+  - name: EDR Falcon Integrations
+    description: Manage CrowdStrike Falcon EDR integrations.
+    x-cloud-only: true
+  - name: EDR Huntress Integrations
+    description: Manage Huntress EDR integrations.
+    x-cloud-only: true
+  - name: EDR FleetDM Integrations
+    description: Manage FleetDM EDR integrations.
+    x-cloud-only: true
+  - name: EDR Peers
+    description: Manage EDR compliance bypass for peers.
+    x-cloud-only: true
+  - name: Event Streaming Integrations
+    description: Manage event streaming integrations.
+    x-cloud-only: true
+  - name: Notifications
+    description: Manage notification channels for account event alerts.
+    x-cloud-only: true
+
+components:
+  schemas:
+    CountryCode:
+      description: 2-letter ISO 3166-1 alpha-2 code that represents the country
+      type: string
+      example: "DE"
+    CityName:
+      description: Commonly used English name of the city
+      type: string
+      example: "Berlin"
+    Country:
+      description: Describe country geographical location information
+      type: object
+      properties:
+        country_name:
+          description: Commonly used English name of the country
+          type: string
+          example: "Germany"
+        country_code:
+          $ref: '#/components/schemas/CountryCode'
+      required:
+        - country_name
+        - country_code
+    City:
+      description: Describe city geographical location information
+      type: object
+      properties:
+        geoname_id:
+          description: Integer ID of the record in GeoNames database
+          type: integer
+          example: 2950158
+        city_name:
+          description: Commonly used English name of the city
+          type: string
+          example: "Berlin"
+      required:
+        - geoname_id
+        - city_name
+    ErrorResponse:
+      type: object
+      description: Standard error response
+      properties:
+        message:
+          type: string
+          description: A human-readable error message.
+          example: "couldn't parse JSON request"
+  responses:
+    not_found:
+      description: Resource not found
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content: { }
+    validation_failed_simple:
+      description: Validation failed
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content: { }
+    bad_request:
+      description: Bad Request
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content: { }
+    unprocessable:
+      description: Unprocessable Entity
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content:
+        application/json:
+          schema:
+            type: object
+            properties:
+              message:
+                type: string
+              code:
+                type: integer
+            required:
+             - message
+             - code
+    internal_error:
+      description: Internal Server Error
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content: { }
+    validation_failed:
+      description: Validation failed
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content: { }
+    forbidden:
+      description: Forbidden
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content: { }
+    requires_authentication:
+      description: Requires authentication
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content: { }
+    conflict:
+      description: Conflict
+      headers:
+        X-Request-Id:
+          $ref: '#/components/headers/X-Request-Id'
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/ErrorResponse'   
+  headers:
+    X-Request-Id:
+      description: |
+        Unique identifier assigned to the request by the server and set on every
+        response. Useful for correlating client requests with server-side logs.
+      schema:
+        type: string
+        example: cot7r4n3l3vh3qj4qveg
+  securitySchemes:
+    BearerAuth:
+      type: http
+      scheme: bearer
+      bearerFormat: JWT
+    TokenAuth:
+      type: apiKey
+      in: header
+      name: Authorization
+      description: >-
+        Enter the token with the `Token` prefix, e.g. "Token nbp_F3f0d.....".
+paths:
+  /peers:
+    $ref: './peer/peers.yaml'
+  /peers/{peerId}:
+    $ref: './peer/peer.yaml'
+  /users:
+    $ref: './user/user_paths.yaml#/UsersPath'
+  /users/{userId}:
+    $ref: './user/user_paths.yaml#/UserPath'
diff --git a/shared/management/http/apiv1alpha1/peer/components.yaml b/shared/management/http/apiv1alpha1/peer/components.yaml
new file mode 100644
index 000000000..e2a7b9240
--- /dev/null
+++ b/shared/management/http/apiv1alpha1/peer/components.yaml
@@ -0,0 +1,257 @@
+components:
+  schemas:
+    PeerRequest:
+      type: object
+      properties:
+        name:
+          type: string
+          example: stage-host-1
+        ssh_enabled:
+          type: boolean
+          example: true
+        login_expiration_enabled:
+          type: boolean
+          example: false
+        inactivity_expiration_enabled:
+          type: boolean
+          example: false
+        approval_required:
+          description: (Cloud only) Indicates whether peer needs approval
+          type: boolean
+          example: true
+        ip:
+          description: Peer's IP address
+          type: string
+          format: ipv4
+          example: 100.64.0.15
+        ipv6:
+          description: Peer's IPv6 overlay address. Omitted if IPv6 is not enabled for the account.
+          type: string
+          format: ipv6
+          example: "fd00:4e42:ab12::1"
+      required:
+        - name
+        - ssh_enabled
+        - login_expiration_enabled
+        - inactivity_expiration_enabled
+    PeerMinimum:
+      type: object
+      properties:
+        id:
+          description: Peer ID
+          type: string
+          example: chacbco6lnnbn6cg5s90
+        name:
+          description: Peer's hostname
+          type: string
+          example: stage-host-1
+      required:
+        - id
+        - name
+    Peer:
+      allOf:
+        - $ref: '#/components/schemas/PeerMinimum'
+        - type: object
+          properties:
+            created_at:
+              description: Peer creation date (UTC)
+              type: string
+              format: date-time
+              example: "2023-05-05T09:00:35.477782Z"
+            ip:
+              description: Peer's IP address
+              type: string
+              example: 10.64.0.1
+            ipv6:
+              description: Peer's IPv6 overlay address
+              type: string
+              format: ipv6
+              example: "fd00:4e42:ab12::1"
+            connection_ip:
+              description: Peer's public connection IP address
+              type: string
+              example: 35.64.0.1
+            connected:
+              description: Peer to Management connection status
+              type: boolean
+              example: true
+            last_seen:
+              description: Last time peer connected to Netbird's management service
+              type: string
+              format: date-time
+              example: "2023-05-05T10:05:26.420578Z"
+            os:
+              description: Peer's operating system and version
+              type: string
+              example: Darwin 13.2.1
+            kernel_version:
+              description: Peer's operating system kernel version
+              type: string
+              example: 23.2.0
+            geoname_id:
+              description: Unique identifier from the GeoNames database for a specific geographical location.
+              type: integer
+              example: 2643743
+            version:
+              description: Peer's daemon or cli version
+              type: string
+              example: 0.14.0
+            groups:
+              description: Groups that the peer belongs to
+              type: array
+              items:
+                $ref: '../group/components.yaml#/components/schemas/GroupMinimum'
+            ssh_enabled:
+              description: Indicates whether SSH server is enabled on this peer
+              type: boolean
+              example: true
+            user_id:
+              description: User ID of the user that enrolled this peer
+              type: string
+              example: google-oauth2|277474792786460067937
+            hostname:
+              description: Hostname of the machine
+              type: string
+              example: stage-host-1
+            ui_version:
+              description: Peer's desktop UI version
+              type: string
+              example: 0.14.0
+            dns_label:
+              description: Peer's DNS label is the parsed peer name for domain resolution. It is used to form an FQDN by appending the account's domain to the peer label. e.g. peer-dns-label.netbird.cloud
+              type: string
+              example: stage-host-1.netbird.cloud
+            login_expiration_enabled:
+              description: Indicates whether peer login expiration has been enabled or not
+              type: boolean
+              example: false
+            login_expired:
+              description: Indicates whether peer's login expired or not
+              type: boolean
+              example: false
+            last_login:
+              description: Last time this peer performed log in (authentication). E.g., user authenticated.
+              type: string
+              format: date-time
+              example: "2023-05-05T09:00:35.477782Z"
+            inactivity_expiration_enabled:
+              description: Indicates whether peer inactivity expiration has been enabled or not
+              type: boolean
+              example: false
+            approval_required:
+              description: (Cloud only) Indicates whether peer needs approval
+              type: boolean
+              example: true
+            disapproval_reason:
+              description: (Cloud only) Reason why the peer requires approval
+              type: string
+            country_code:
+              $ref: '../openapi.yaml#/components/schemas/CountryCode'
+            city_name:
+              $ref: '../openapi.yaml#/components/schemas/CityName'
+            serial_number:
+              description: System serial number
+              type: string
+              example: "C02XJ0J0JGH7"
+            extra_dns_labels:
+              description: Extra DNS labels added to the peer
+              type: array
+              items:
+                type: string
+                example: "stage-host-1"
+            ephemeral:
+              description: Indicates whether the peer is ephemeral or not
+              type: boolean
+              example: false
+            local_flags:
+              $ref: '#/components/schemas/PeerLocalFlags'
+          required:
+            - city_name
+            - connected
+            - connection_ip
+            - country_code
+            - created_at
+            - dns_label
+            - geoname_id
+            - groups
+            - hostname
+            - ip
+            - kernel_version
+            - last_login
+            - last_seen
+            - login_expiration_enabled
+            - login_expired
+            - inactivity_expiration_enabled
+            - os
+            - ssh_enabled
+            - user_id
+            - version
+            - ui_version
+            - approval_required
+            - serial_number
+            - extra_dns_labels
+            - ephemeral
+    PeerLocalFlags:
+      type: object
+      properties:
+        rosenpass_enabled:
+          description: Indicates whether Rosenpass is enabled on this peer
+          type: boolean
+          example: true
+        rosenpass_permissive:
+          description: Indicates whether Rosenpass is in permissive mode or not
+          type: boolean
+          example: false
+        server_ssh_allowed:
+          description: Indicates whether SSH access this peer is allowed or not
+          type: boolean
+          example: true
+        remote_jobs_allowed:
+          description: Indicates whether the peer has opted into management-requested remote jobs (e.g. debug bundles)
+          type: boolean
+          example: true
+        disable_client_routes:
+          description: Indicates whether client routes are disabled on this peer or not
+          type: boolean
+          example: false
+        disable_server_routes:
+          description: Indicates whether server routes are disabled on this peer or not
+          type: boolean
+          example: false
+        disable_dns:
+          description: Indicates whether DNS management is disabled on this peer or not
+          type: boolean
+          example: false
+        disable_firewall:
+          description: Indicates whether firewall management is disabled on this peer or not
+          type: boolean
+          example: false
+        block_lan_access:
+          description: Indicates whether LAN access is blocked on this peer when used as a routing peer
+          type: boolean
+          example: false
+        block_inbound:
+          description: Indicates whether inbound traffic is blocked on this peer
+          type: boolean
+          example: false
+        lazy_connection_enabled:
+          description: Indicates whether lazy connection is enabled on this peer
+          type: boolean
+          example: false
+    PeerBatch:
+      allOf:
+        - $ref: '#/components/schemas/Peer'
+        - type: object
+          properties:
+            created_at:
+              description: Peer creation date (UTC)
+              type: string
+              format: date-time
+              example: "2023-05-05T09:00:35.477782Z"
+            accessible_peers_count:
+              description: Number of accessible peers
+              type: integer
+              example: 5
+          required:
+            - created_at
+            - accessible_peers_count
\ No newline at end of file
diff --git a/shared/management/http/apiv1alpha1/peer/peer.yaml b/shared/management/http/apiv1alpha1/peer/peer.yaml
new file mode 100644
index 000000000..7c7c1a85d
--- /dev/null
+++ b/shared/management/http/apiv1alpha1/peer/peer.yaml
@@ -0,0 +1,93 @@
+get:
+  summary: Retrieve a Peer
+  description: Get information about a peer
+  tags: [ Peers ]
+  security:
+    - BearerAuth: [ ]
+    - TokenAuth: [ ]
+  parameters:
+    - in: path
+      name: peerId
+      required: true
+      schema:
+        type: string
+      description: The unique identifier of a peer
+  responses:
+    '200':
+      description: A Peer object
+      content:
+        application/json:
+          schema:
+            $ref: './components.yaml#/components/schemas/Peer'
+    '400':
+      "$ref": '../openapi.yaml#/components/responses/bad_request'
+    '401':
+      "$ref": '../openapi.yaml#/components/responses/requires_authentication'
+    '403':
+      "$ref": '../openapi.yaml#/components/responses/forbidden'
+    '500':
+      "$ref": '../openapi.yaml#/components/responses/internal_error'
+put:
+  summary: Update a Peer
+  description: Update information about a peer
+  tags: [ Peers ]
+  security:
+    - BearerAuth: [ ]
+    - TokenAuth: [ ]
+  parameters:
+    - in: path
+      name: peerId
+      required: true
+      schema:
+        type: string
+      description: The unique identifier of a peer
+  requestBody:
+    description: update a peer
+    required: true
+    content:
+      'application/json':
+        schema:
+          $ref: './components.yaml#/components/schemas/PeerRequest'
+  responses:
+    '200':
+      description: A Peer object
+      content:
+        application/json:
+          schema:
+            $ref: './components.yaml#/components/schemas/Peer'
+    '400':
+      "$ref": '../openapi.yaml#/components/responses/bad_request'
+    '401':
+      "$ref": '../openapi.yaml#/components/responses/requires_authentication'
+    '403':
+      "$ref": '../openapi.yaml#/components/responses/forbidden'
+    '422':
+      "$ref": "../openapi.yaml#/components/responses/unprocessable"
+    '500':
+      "$ref": '../openapi.yaml#/components/responses/internal_error'
+delete:
+  summary: Delete a Peer
+  description: Delete a peer
+  tags: [ Peers ]
+  security:
+    - BearerAuth: [ ]
+    - TokenAuth: [ ]
+  parameters:
+    - in: path
+      name: peerId
+      required: true
+      schema:
+        type: string
+      description: The unique identifier of a peer
+  responses:
+    '200':
+      description: Delete status code
+      content: { }
+    '400':
+      "$ref": '../openapi.yaml#/components/responses/bad_request'
+    '401':
+      "$ref": '../openapi.yaml#/components/responses/requires_authentication'
+    '403':
+      "$ref": '../openapi.yaml#/components/responses/forbidden'
+    '500':
+      "$ref": '../openapi.yaml#/components/responses/internal_error'
diff --git a/shared/management/http/apiv1alpha1/peer/peers.yaml b/shared/management/http/apiv1alpha1/peer/peers.yaml
new file mode 100644
index 000000000..c360018fc
--- /dev/null
+++ b/shared/management/http/apiv1alpha1/peer/peers.yaml
@@ -0,0 +1,77 @@
+get:
+  summary: List all Peers
+  description: Returns a list of all peers
+  tags: [ Peers ]
+  parameters:
+    - name: page
+      in: query
+      description: Page number
+      required: false
+      schema:
+        type: integer
+        minimum: 1
+        default: 1
+    - name: page_size
+      in: query
+      description: Number of peers per page
+      required: false
+      schema:
+        type: integer
+        minimum: 1
+        maximum: 250
+        default: 100
+    - name: connected
+      in: query
+      description: Filter by peer connected status
+      required: false
+      schema:
+        type: boolean
+    - name: approval_required
+      in: query
+      description: Filter by approval_required field
+      required: false
+      schema:
+        type: boolean
+    - name: os
+      in: query
+      description: Peer os
+      required: false
+      schema:
+        type: array
+        items:
+          type: string
+          enum:
+           - linux
+           - windows
+           - mac
+           - android
+           - ios
+           - js
+    - name: search
+      in: query
+      description: filter peers by name, dns_label, ip, os, version, serial_number, owner name, owner email, group names, mac
+      required: false
+      schema:
+        type: string
+  security:
+    - BearerAuth: [ ]
+    - TokenAuth: [ ]
+  responses:
+    '200':
+      description: A JSON Array of Peers
+      content:
+        application/json:
+          schema:
+            type: array
+            items:
+              $ref: './components.yaml#/components/schemas/PeerBatch'
+    '400':
+      "$ref": "../openapi.yaml#/components/responses/bad_request"
+    '401':
+      "$ref": "../openapi.yaml#/components/responses/requires_authentication"
+    '403':
+      "$ref": "../openapi.yaml#/components/responses/forbidden"
+    '422':
+      "$ref": "../openapi.yaml#/components/responses/unprocessable"
+    '500':
+      "$ref": "../openapi.yaml#/components/responses/internal_error"
diff --git a/shared/management/http/apiv1alpha1/runtime_tooling.go b/shared/management/http/apiv1alpha1/runtime_tooling.go
new file mode 100644
index 000000000..6460e2e2f
--- /dev/null
+++ b/shared/management/http/apiv1alpha1/runtime_tooling.go
@@ -0,0 +1,93 @@
+package apiv1alpha1
+
+import (
+	_ "embed"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"os"
+	"strings"
+
+	"github.com/netbirdio/netbird/shared/management/http/util"
+	"github.com/netbirdio/netbird/shared/management/status"
+	"github.com/pb33f/libopenapi"
+	validator "github.com/pb33f/libopenapi-validator"
+	"github.com/pb33f/libopenapi-validator/config"
+	"github.com/pb33f/libopenapi-validator/errors"
+	"github.com/pb33f/libopenapi/datamodel"
+	log "github.com/sirupsen/logrus"
+)
+
+// TODO (dmitri) this needs to be extracted, as it will grow to 500Kb
+//
+//go:embed bundle.yaml
+var bundle []byte
+
+func CreateV1ApiValidatingMiddleware() (*V1ValidatorMiddleware, error) {
+	doc, err := libopenapi.NewDocumentWithConfiguration(bundle, &datamodel.DocumentConfiguration{
+		Logger: slog.New(slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{
+			Level: slog.LevelInfo,
+		})),
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	model, err := doc.BuildV3Model()
+	if err != nil {
+		return nil, err
+	}
+
+	// TODO figure out document validation: rn it's possible to have a spec
+	// that's not entirely correct -- parts of it fail to parse, but silently
+	v := validator.NewValidatorFromV3Model(&model.Model,
+		config.WithoutSecurityValidation(),
+		config.WithStandardBodyDecoders(),
+		config.WithRejectUnsupportedBodyContent(),
+		config.WithRequestDefaults())
+	// v.SetDocument(doc)
+	// v.ValidatePathParams()
+	// if valid, errs := v.ValidateDocument(); !valid {
+	// 	return nil, fmt.Errorf("error validating OpenAPI doc, %s", errs)
+	// }
+
+	return &V1ValidatorMiddleware{Validator: v}, nil
+}
+
+type V1ValidatorMiddleware struct {
+	Validator validator.Validator
+}
+
+func (v *V1ValidatorMiddleware) Handler(h http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		valid, errs := v.Validator.ValidateHttpRequestSync(r)
+		if !valid {
+			validationErrs := make([]string, 0, len(errs))
+			for _, err := range errs {
+				validationErrs = append(validationErrs, validationError(err))
+			}
+
+			log.WithContext(r.Context()).Debugf("error validating request: %s", strings.Join(validationErrs, ", "))
+			util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "invalid request: %s", strings.Join(validationErrs, ", ")), w)
+
+			return
+		}
+		h.ServeHTTP(w, r)
+	})
+}
+
+func validationError(err *errors.ValidationError) string {
+	if err.SchemaValidationErrors != nil {
+		errs := make([]string, 0, len(err.SchemaValidationErrors))
+		for _, e := range err.SchemaValidationErrors {
+			errs = append(errs, fmt.Sprintf("field %s: %s", e.FieldPath, e.Reason))
+		}
+		return fmt.Sprintf("%s: %s", err.Message, strings.Join(errs, ", "))
+	} else {
+		if err.SpecLine > 0 && err.SpecCol > 0 {
+			return fmt.Sprintf("%s, Line: %d, Column: %d", err.Message, err.SpecLine, err.SpecCol)
+		} else {
+			return fmt.Sprint(err.Message)
+		}
+	}
+}
diff --git a/shared/management/http/apiv1alpha1/tooling.go b/shared/management/http/apiv1alpha1/tooling.go
new file mode 100644
index 000000000..8594348fc
--- /dev/null
+++ b/shared/management/http/apiv1alpha1/tooling.go
@@ -0,0 +1,152 @@
+package apiv1alpha1
+
+import (
+	"log/slog"
+	"os"
+	"path/filepath"
+	"strings"
+	"unicode"
+
+	"github.com/pb33f/libopenapi"
+	"github.com/pb33f/libopenapi/bundler"
+	"github.com/pb33f/libopenapi/datamodel"
+	v3 "github.com/pb33f/libopenapi/datamodel/high/v3"
+	"github.com/pb33f/libopenapi/generator/golang"
+)
+
+var ApiPath = filepath.Join("shared", "management", "http", "apiv1alpha1", "openapi.yaml")
+
+func GenerateV1ApiBindings(openapipath string) ([]byte, *v3.Document, error) {
+	specFile, err := os.ReadFile(openapipath)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	multiFileDoc, err := libopenapi.NewDocumentWithConfiguration(specFile, &datamodel.DocumentConfiguration{
+		AllowFileReferences:     true,
+		BasePath:                filepath.Dir(openapipath),
+		SpecFilePath:            openapipath,
+		ExtractRefsSequentially: true,
+		Logger: slog.New(slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{
+			Level: slog.LevelError,
+		})),
+		TransformSiblingRefs:      true,                    // enable openapi 3.1 compliance by default
+		MergeReferencedProperties: true,                    // enable enhanced resolution by default
+		PropertyMergeStrategy:     datamodel.PreserveLocal, // local properties take precedence
+	})
+	if err != nil {
+		return nil, nil, err
+	}
+	multiFileModel, err := multiFileDoc.BuildV3Model()
+	if err != nil {
+		return nil, nil, err
+	}
+
+	bundle, err := bundler.BundleDocumentComposed(&multiFileModel.Model, &bundler.BundleCompositionConfig{
+		StrictValidation: true,
+	})
+	if err != nil {
+		return nil, nil, err
+	}
+
+	doc, err := libopenapi.NewDocumentWithConfiguration(bundle, &datamodel.DocumentConfiguration{
+		Logger: slog.New(slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{
+			Level: slog.LevelInfo,
+		})),
+	})
+	if err != nil {
+		return nil, nil, err
+	}
+
+	model, err := doc.BuildV3Model()
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return bundle, &model.Model, nil
+}
+
+func GenerateV1Schema(model *v3.Document) (*golang.GeneratedFile, error) {
+	// render every schema in components.schemas into one file
+	gen := golang.NewGenerator(
+		golang.WithGeneratedComment(true),
+		golang.WithFormatMapping("date-time", "time.Time", "time"),
+		golang.WithOptionalFieldsAsPointers(true),
+		golang.WithEnumConstants(true),
+		golang.WithNestedTypeNameDelimiter(""),
+		golang.WithPackageName("apiv1alpha1"),
+		golang.WithFieldNameResolver(toPublicName))
+
+	return gen.RenderSchemas(model.Components.Schemas)
+}
+
+// this is to keep existing naming of fields like "id", "url", etc
+// libopenapi by default converts them to all-uppercase, like "ID", "URL", etc
+func toPublicName(name string) string {
+	parts := splitIdentifier(name)
+	if len(parts) == 0 {
+		return "Value"
+	}
+	var b strings.Builder
+	for _, p := range parts {
+		rs := []rune(strings.ToLower(p))
+		rs[0] = unicode.ToUpper(rs[0])
+		b.WriteString(string(rs))
+	}
+	out := b.String()
+	first := []rune(out)[0]
+	if unicode.IsDigit(first) {
+		return "Value" + out
+	}
+	return out
+}
+
+func splitIdentifier(name string) []string {
+	var raw []string
+	var b strings.Builder
+	flush := func() {
+		if b.Len() > 0 {
+			raw = append(raw, b.String())
+			b.Reset()
+		}
+	}
+	for _, r := range name {
+		switch {
+		case unicode.IsLetter(r) || unicode.IsDigit(r):
+			b.WriteRune(r)
+		default:
+			flush()
+		}
+	}
+	flush()
+	var parts []string
+	for _, part := range raw {
+		parts = append(parts, splitCamel(part)...)
+	}
+	return parts
+}
+
+func splitCamel(value string) []string {
+	rs := []rune(value)
+	if len(rs) == 0 {
+		return nil
+	}
+	var parts []string
+	start := 0
+	for i := 1; i < len(rs); i++ {
+		prev := rs[i-1]
+		cur := rs[i]
+		var next rune
+		if i+1 < len(rs) {
+			next = rs[i+1]
+		}
+		lowerToUpper := unicode.IsLower(prev) && unicode.IsUpper(cur)
+		acronymToWord := unicode.IsUpper(prev) && unicode.IsUpper(cur) && next != 0 && unicode.IsLower(next)
+		if lowerToUpper || acronymToWord {
+			parts = append(parts, string(rs[start:i]))
+			start = i
+		}
+	}
+	parts = append(parts, string(rs[start:]))
+	return parts
+}
diff --git a/shared/management/http/apiv1alpha1/types.gen.go b/shared/management/http/apiv1alpha1/types.gen.go
new file mode 100644
index 000000000..3e9ede3e4
--- /dev/null
+++ b/shared/management/http/apiv1alpha1/types.gen.go
@@ -0,0 +1,414 @@
+// Code generated by libopenapi generator/golang. DO NOT EDIT.
+
+package apiv1alpha1
+
+import (
+	"encoding/json"
+	"time"
+)
+
+// CountryCode 2-letter ISO 3166-1 alpha-2 code that represents the country.
+// CountryCode example value is defined in the OpenAPI schema.
+type CountryCode string
+
+// CityName Commonly used English name of the city.
+// CityName example value is defined in the OpenAPI schema.
+type CityName string
+
+// Country Describe country geographical location information.
+type Country struct {
+	// CountryName Commonly used English name of the country.
+	// CountryName example value is defined in the OpenAPI schema.
+	CountryName string      `json:"country_name"`
+	CountryCode CountryCode `json:"country_code"`
+}
+
+// City Describe city geographical location information.
+type City struct {
+	// GeonameId Integer ID of the record in GeoNames database.
+	// GeonameId example value is defined in the OpenAPI schema.
+	GeonameId int `json:"geoname_id"`
+	// CityName Commonly used English name of the city.
+	// CityName example value is defined in the OpenAPI schema.
+	CityName string `json:"city_name"`
+}
+
+// ErrorResponse Standard error response.
+type ErrorResponse struct {
+	// Message A human-readable error message.
+	// Message example value is defined in the OpenAPI schema.
+	Message *string `json:"message,omitempty"`
+}
+
+type PeerBatch struct {
+	Peer
+	// CreatedAt Peer creation date (UTC).
+	// CreatedAt example value is defined in the OpenAPI schema.
+	CreatedAt time.Time `json:"created_at"`
+	// AccessiblePeersCount Number of accessible peers.
+	// AccessiblePeersCount example value is defined in the OpenAPI schema.
+	AccessiblePeersCount int `json:"accessible_peers_count"`
+}
+
+type PeerMinimum struct {
+	// Id Peer ID.
+	// Id example value is defined in the OpenAPI schema.
+	Id string `json:"id"`
+	// Name Peer's hostname.
+	// Name example value is defined in the OpenAPI schema.
+	Name string `json:"name"`
+}
+
+// GroupMinimumIssued How the group was issued (api, integration, jwt).
+// GroupMinimumIssued example value is defined in the OpenAPI schema.
+type GroupMinimumIssued string
+
+const (
+	GroupMinimumIssuedAPI         GroupMinimumIssued = "api"
+	GroupMinimumIssuedIntegration GroupMinimumIssued = "integration"
+	GroupMinimumIssuedJWT         GroupMinimumIssued = "jwt"
+)
+
+type GroupMinimum struct {
+	// Id Group ID.
+	// Id example value is defined in the OpenAPI schema.
+	Id string `json:"id"`
+	// Name Group Name identifier.
+	// Name example value is defined in the OpenAPI schema.
+	Name string `json:"name"`
+	// PeersCount Count of peers associated to the group.
+	// PeersCount example value is defined in the OpenAPI schema.
+	PeersCount int `json:"peers_count"`
+	// ResourcesCount Count of resources associated to the group.
+	// ResourcesCount example value is defined in the OpenAPI schema.
+	ResourcesCount int `json:"resources_count"`
+	// Issued How the group was issued (api, integration, jwt).
+	// Issued example value is defined in the OpenAPI schema.
+	Issued *GroupMinimumIssued `json:"issued,omitempty"`
+}
+
+type PeerLocalFlags struct {
+	// RosenpassEnabled Indicates whether Rosenpass is enabled on this peer.
+	// RosenpassEnabled example value is defined in the OpenAPI schema.
+	RosenpassEnabled *bool `json:"rosenpass_enabled,omitempty"`
+	// RosenpassPermissive Indicates whether Rosenpass is in permissive mode or not.
+	// RosenpassPermissive example value is defined in the OpenAPI schema.
+	RosenpassPermissive *bool `json:"rosenpass_permissive,omitempty"`
+	// ServerSshAllowed Indicates whether SSH access this peer is allowed or not.
+	// ServerSshAllowed example value is defined in the OpenAPI schema.
+	ServerSshAllowed *bool `json:"server_ssh_allowed,omitempty"`
+	// RemoteJobsAllowed Indicates whether the peer has opted into management-requested remote jobs (e.g. debug bundles).
+	// RemoteJobsAllowed example value is defined in the OpenAPI schema.
+	RemoteJobsAllowed *bool `json:"remote_jobs_allowed,omitempty"`
+	// DisableClientRoutes Indicates whether client routes are disabled on this peer or not.
+	// DisableClientRoutes example value is defined in the OpenAPI schema.
+	DisableClientRoutes *bool `json:"disable_client_routes,omitempty"`
+	// DisableServerRoutes Indicates whether server routes are disabled on this peer or not.
+	// DisableServerRoutes example value is defined in the OpenAPI schema.
+	DisableServerRoutes *bool `json:"disable_server_routes,omitempty"`
+	// DisableDns Indicates whether DNS management is disabled on this peer or not.
+	// DisableDns example value is defined in the OpenAPI schema.
+	DisableDns *bool `json:"disable_dns,omitempty"`
+	// DisableFirewall Indicates whether firewall management is disabled on this peer or not.
+	// DisableFirewall example value is defined in the OpenAPI schema.
+	DisableFirewall *bool `json:"disable_firewall,omitempty"`
+	// BlockLanAccess Indicates whether LAN access is blocked on this peer when used as a routing peer.
+	// BlockLanAccess example value is defined in the OpenAPI schema.
+	BlockLanAccess *bool `json:"block_lan_access,omitempty"`
+	// BlockInbound Indicates whether inbound traffic is blocked on this peer.
+	// BlockInbound example value is defined in the OpenAPI schema.
+	BlockInbound *bool `json:"block_inbound,omitempty"`
+	// LazyConnectionEnabled Indicates whether lazy connection is enabled on this peer.
+	// LazyConnectionEnabled example value is defined in the OpenAPI schema.
+	LazyConnectionEnabled *bool `json:"lazy_connection_enabled,omitempty"`
+}
+
+type Peer struct {
+	PeerMinimum
+	// CreatedAt Peer creation date (UTC).
+	// CreatedAt example value is defined in the OpenAPI schema.
+	CreatedAt time.Time `json:"created_at"`
+	// Ip Peer's IP address.
+	// Ip example value is defined in the OpenAPI schema.
+	Ip string `json:"ip"`
+	// Ipv6 Peer's IPv6 overlay address.
+	// Ipv6 example value is defined in the OpenAPI schema.
+	Ipv6 *string `json:"ipv6,omitempty"`
+	// ConnectionIp Peer's public connection IP address.
+	// ConnectionIp example value is defined in the OpenAPI schema.
+	ConnectionIp string `json:"connection_ip"`
+	// Connected Peer to Management connection status.
+	// Connected example value is defined in the OpenAPI schema.
+	Connected bool `json:"connected"`
+	// LastSeen Last time peer connected to Netbird's management service.
+	// LastSeen example value is defined in the OpenAPI schema.
+	LastSeen time.Time `json:"last_seen"`
+	// Os Peer's operating system and version.
+	// Os example value is defined in the OpenAPI schema.
+	Os string `json:"os"`
+	// KernelVersion Peer's operating system kernel version.
+	// KernelVersion example value is defined in the OpenAPI schema.
+	KernelVersion string `json:"kernel_version"`
+	// GeonameId Unique identifier from the GeoNames database for a specific geographical location.
+	// GeonameId example value is defined in the OpenAPI schema.
+	GeonameId int `json:"geoname_id"`
+	// Version Peer's daemon or cli version.
+	// Version example value is defined in the OpenAPI schema.
+	Version string `json:"version"`
+	// Groups Groups that the peer belongs to.
+	Groups []GroupMinimum `json:"groups"`
+	// SshEnabled Indicates whether SSH server is enabled on this peer.
+	// SshEnabled example value is defined in the OpenAPI schema.
+	SshEnabled bool `json:"ssh_enabled"`
+	// UserId User ID of the user that enrolled this peer.
+	// UserId example value is defined in the OpenAPI schema.
+	UserId string `json:"user_id"`
+	// Hostname Hostname of the machine.
+	// Hostname example value is defined in the OpenAPI schema.
+	Hostname string `json:"hostname"`
+	// UiVersion Peer's desktop UI version.
+	// UiVersion example value is defined in the OpenAPI schema.
+	UiVersion string `json:"ui_version"`
+	// DnsLabel Peer's DNS label is the parsed peer name for domain resolution. It is used to form an FQDN by appending the account's domain to the peer label. e.g. peer-dns-label.netbird.cloud.
+	// DnsLabel example value is defined in the OpenAPI schema.
+	DnsLabel string `json:"dns_label"`
+	// LoginExpirationEnabled Indicates whether peer login expiration has been enabled or not.
+	// LoginExpirationEnabled example value is defined in the OpenAPI schema.
+	LoginExpirationEnabled bool `json:"login_expiration_enabled"`
+	// LoginExpired Indicates whether peer's login expired or not.
+	// LoginExpired example value is defined in the OpenAPI schema.
+	LoginExpired bool `json:"login_expired"`
+	// LastLogin Last time this peer performed log in (authentication). E.g., user authenticated.
+	// LastLogin example value is defined in the OpenAPI schema.
+	LastLogin time.Time `json:"last_login"`
+	// InactivityExpirationEnabled Indicates whether peer inactivity expiration has been enabled or not.
+	// InactivityExpirationEnabled example value is defined in the OpenAPI schema.
+	InactivityExpirationEnabled bool `json:"inactivity_expiration_enabled"`
+	// ApprovalRequired (Cloud only) Indicates whether peer needs approval.
+	// ApprovalRequired example value is defined in the OpenAPI schema.
+	ApprovalRequired bool `json:"approval_required"`
+	// DisapprovalReason (Cloud only) Reason why the peer requires approval.
+	DisapprovalReason *string     `json:"disapproval_reason,omitempty"`
+	CountryCode       CountryCode `json:"country_code"`
+	CityName          CityName    `json:"city_name"`
+	// SerialNumber System serial number.
+	// SerialNumber example value is defined in the OpenAPI schema.
+	SerialNumber string `json:"serial_number"`
+	// ExtraDnsLabels Extra DNS labels added to the peer.
+	ExtraDnsLabels []string `json:"extra_dns_labels"`
+	// Ephemeral Indicates whether the peer is ephemeral or not.
+	// Ephemeral example value is defined in the OpenAPI schema.
+	Ephemeral  bool            `json:"ephemeral"`
+	LocalFlags *PeerLocalFlags `json:"local_flags,omitempty"`
+}
+
+type PeerRequest struct {
+	// Name example value is defined in the OpenAPI schema.
+	Name string `json:"name"`
+	// SshEnabled example value is defined in the OpenAPI schema.
+	SshEnabled bool `json:"ssh_enabled"`
+	// LoginExpirationEnabled example value is defined in the OpenAPI schema.
+	LoginExpirationEnabled bool `json:"login_expiration_enabled"`
+	// InactivityExpirationEnabled example value is defined in the OpenAPI schema.
+	InactivityExpirationEnabled bool `json:"inactivity_expiration_enabled"`
+	// ApprovalRequired (Cloud only) Indicates whether peer needs approval.
+	// ApprovalRequired example value is defined in the OpenAPI schema.
+	ApprovalRequired *bool `json:"approval_required,omitempty"`
+	// Ip Peer's IP address.
+	// Ip example value is defined in the OpenAPI schema.
+	Ip *string `json:"ip,omitempty"`
+	// Ipv6 Peer's IPv6 overlay address. Omitted if IPv6 is not enabled for the account.
+	// Ipv6 example value is defined in the OpenAPI schema.
+	Ipv6 *string `json:"ipv6,omitempty"`
+}
+
+// UserStatus User's status.
+// UserStatus example value is defined in the OpenAPI schema.
+type UserStatus string
+
+const (
+	UserStatusActive  UserStatus = "active"
+	UserStatusInvited UserStatus = "invited"
+	UserStatusBlocked UserStatus = "blocked"
+)
+
+type User struct {
+	// Id User ID.
+	// Id example value is defined in the OpenAPI schema.
+	Id string `json:"id"`
+	// Email User's email address.
+	// Email example value is defined in the OpenAPI schema.
+	Email string `json:"email"`
+	// Password User's password. Only present when user is created (create user endpoint is called) and only when IdP supports user creation with password.
+	// Password example value is defined in the OpenAPI schema.
+	Password *string `json:"password,omitempty"`
+	// Name User's name from idp provider.
+	// Name example value is defined in the OpenAPI schema.
+	Name string `json:"name"`
+	// Role User's NetBird account role.
+	// Role example value is defined in the OpenAPI schema.
+	Role string `json:"role"`
+	// Status User's status.
+	// Status example value is defined in the OpenAPI schema.
+	Status UserStatus `json:"status"`
+	// LastLogin Last time this user performed a login to the dashboard.
+	// LastLogin example value is defined in the OpenAPI schema.
+	LastLogin *time.Time `json:"last_login,omitempty"`
+	// AutoGroups Group IDs to auto-assign to peers registered by this user.
+	AutoGroups []string `json:"auto_groups"`
+	// IsCurrent Is true if authenticated user is the same as this user.
+	// IsCurrent readOnly.
+	// IsCurrent example value is defined in the OpenAPI schema.
+	IsCurrent *bool `json:"is_current,omitempty"`
+	// IsServiceUser Is true if this user is a service user.
+	// IsServiceUser readOnly.
+	// IsServiceUser example value is defined in the OpenAPI schema.
+	IsServiceUser *bool `json:"is_service_user,omitempty"`
+	// IsBlocked Is true if this user is blocked. Blocked users can't use the system.
+	// IsBlocked example value is defined in the OpenAPI schema.
+	IsBlocked bool `json:"is_blocked"`
+	// PendingApproval Is true if this user requires approval before being activated. Only applicable for users joining via domain matching when user_approval_required is enabled.
+	// PendingApproval example value is defined in the OpenAPI schema.
+	PendingApproval bool `json:"pending_approval"`
+	// Issued How user was issued by API or Integration.
+	// Issued example value is defined in the OpenAPI schema.
+	Issued *string `json:"issued,omitempty"`
+	// IdpId Identity provider ID (connector ID) that the user authenticated with. Only populated for users with Dex-encoded user IDs.
+	// IdpId example value is defined in the OpenAPI schema.
+	IdpId       *string          `json:"idp_id,omitempty"`
+	Permissions *UserPermissions `json:"permissions,omitempty"`
+}
+
+type UserCreateRequest struct {
+	// Email User's Email to send invite to.
+	// Email example value is defined in the OpenAPI schema.
+	Email *string `json:"email,omitempty"`
+	// Name User's full name.
+	// Name example value is defined in the OpenAPI schema.
+	Name *string `json:"name,omitempty"`
+	// Role User's NetBird account role.
+	// Role example value is defined in the OpenAPI schema.
+	Role string `json:"role"`
+	// AutoGroups Group IDs to auto-assign to peers registered by this user.
+	AutoGroups []string `json:"auto_groups"`
+	// IsServiceUser Is true if this user is a service user.
+	// IsServiceUser example value is defined in the OpenAPI schema.
+	IsServiceUser bool `json:"is_service_user"`
+}
+
+type UserRequest struct {
+	// Role User's NetBird account role.
+	// Role example value is defined in the OpenAPI schema.
+	Role string `json:"role"`
+	// AutoGroups Group IDs to auto-assign to peers registered by this user.
+	AutoGroups []string `json:"auto_groups"`
+	// IsBlocked If set to true then user is blocked and can't use the system.
+	// IsBlocked example value is defined in the OpenAPI schema.
+	IsBlocked bool `json:"is_blocked"`
+}
+
+type UserPermissionsModulesAdditionalProperty struct {
+	AdditionalProperties map[string]bool `json:"-"`
+}
+
+func (m *UserPermissionsModulesAdditionalProperty) UnmarshalJSON(data []byte) error {
+	type Alias UserPermissionsModulesAdditionalProperty
+	var known Alias
+	if err := json.Unmarshal(data, &known); err != nil {
+		return err
+	}
+	*m = UserPermissionsModulesAdditionalProperty(known)
+	var raw map[string]json.RawMessage
+	if err := json.Unmarshal(data, &raw); err != nil {
+		return err
+	}
+	if len(raw) == 0 {
+		return nil
+	}
+	m.AdditionalProperties = make(map[string]bool, len(raw))
+	for key, value := range raw {
+		var decoded bool
+		if err := json.Unmarshal(value, &decoded); err != nil {
+			return err
+		}
+		m.AdditionalProperties[key] = decoded
+	}
+	return nil
+}
+
+func (m UserPermissionsModulesAdditionalProperty) MarshalJSON() ([]byte, error) {
+	type Alias UserPermissionsModulesAdditionalProperty
+	encoded, err := json.Marshal(Alias(m))
+	if err != nil {
+		return nil, err
+	}
+	var object map[string]json.RawMessage
+	if err := json.Unmarshal(encoded, &object); err != nil {
+		return nil, err
+	}
+	for key, value := range m.AdditionalProperties {
+		encodedValue, err := json.Marshal(value)
+		if err != nil {
+			return nil, err
+		}
+		object[key] = encodedValue
+	}
+	return json.Marshal(object)
+}
+
+// UserPermissionsModules example value is defined in the OpenAPI schema.
+type UserPermissionsModules struct {
+	AdditionalProperties map[string]map[string]bool `json:"-"`
+}
+
+func (m *UserPermissionsModules) UnmarshalJSON(data []byte) error {
+	type Alias UserPermissionsModules
+	var known Alias
+	if err := json.Unmarshal(data, &known); err != nil {
+		return err
+	}
+	*m = UserPermissionsModules(known)
+	var raw map[string]json.RawMessage
+	if err := json.Unmarshal(data, &raw); err != nil {
+		return err
+	}
+	if len(raw) == 0 {
+		return nil
+	}
+	m.AdditionalProperties = make(map[string]map[string]bool, len(raw))
+	for key, value := range raw {
+		var decoded map[string]bool
+		if err := json.Unmarshal(value, &decoded); err != nil {
+			return err
+		}
+		m.AdditionalProperties[key] = decoded
+	}
+	return nil
+}
+
+func (m UserPermissionsModules) MarshalJSON() ([]byte, error) {
+	type Alias UserPermissionsModules
+	encoded, err := json.Marshal(Alias(m))
+	if err != nil {
+		return nil, err
+	}
+	var object map[string]json.RawMessage
+	if err := json.Unmarshal(encoded, &object); err != nil {
+		return nil, err
+	}
+	for key, value := range m.AdditionalProperties {
+		encodedValue, err := json.Marshal(value)
+		if err != nil {
+			return nil, err
+		}
+		object[key] = encodedValue
+	}
+	return json.Marshal(object)
+}
+
+type UserPermissions struct {
+	// IsRestricted Indicates whether this User's Peers view is restricted.
+	IsRestricted bool `json:"is_restricted"`
+	// Modules example value is defined in the OpenAPI schema.
+	Modules map[string]map[string]bool `json:"modules"`
+}
diff --git a/shared/management/http/apiv1alpha1/user/user_components.yaml b/shared/management/http/apiv1alpha1/user/user_components.yaml
new file mode 100644
index 000000000..d3cac52e8
--- /dev/null
+++ b/shared/management/http/apiv1alpha1/user/user_components.yaml
@@ -0,0 +1,150 @@
+components:
+  schemas:
+    User:
+      type: object
+      properties:
+        id:
+          description: User ID
+          type: string
+          example: google-oauth2|277474792786460067937
+        email:
+          description: User's email address
+          type: string
+          example: demo@netbird.io
+        password:
+          description: User's password. Only present when user is created (create user endpoint is called) and only when IdP supports user creation with password.
+          type: string
+          example: super_secure_password
+        name:
+          description: User's name from idp provider
+          type: string
+          example: Tom Schulz
+        role:
+          description: User's NetBird account role
+          type: string
+          example: admin
+        status:
+          description: User's status
+          type: string
+          enum: [ "active", "invited", "blocked" ]
+          example: active
+        last_login:
+          description: Last time this user performed a login to the dashboard
+          type: string
+          format: date-time
+          example: "2023-05-05T09:00:35.477782Z"
+        auto_groups:
+          description: Group IDs to auto-assign to peers registered by this user
+          type: array
+          items:
+            type: string
+            example: ch8i4ug6lnn4g9hqv7m0
+        is_current:
+          description: Is true if authenticated user is the same as this user
+          type: boolean
+          readOnly: true
+          example: true
+        is_service_user:
+          description: Is true if this user is a service user
+          type: boolean
+          readOnly: true
+          example: false
+        is_blocked:
+          description: Is true if this user is blocked. Blocked users can't use the system
+          type: boolean
+          example: false
+        pending_approval:
+          description: Is true if this user requires approval before being activated. Only applicable for users joining via domain matching when user_approval_required is enabled.
+          type: boolean
+          example: false
+        issued:
+          description: How user was issued by API or Integration
+          type: string
+          example: api
+        idp_id:
+          description: Identity provider ID (connector ID) that the user authenticated with. Only populated for users with Dex-encoded user IDs.
+          type: string
+          example: okta-abc123
+        permissions:
+          $ref: '#/components/schemas/UserPermissions'
+      required:
+        - id
+        - email
+        - name
+        - role
+        - auto_groups
+        - status
+        - is_blocked
+        - pending_approval
+    UserPermissions:
+      type: object
+      properties:
+        is_restricted:
+          type: boolean
+          description: Indicates whether this User's Peers view is restricted
+        modules:
+          type: object
+          additionalProperties:
+            type: object
+            additionalProperties:
+              type: boolean
+            propertyNames:
+              type: string
+              description: The operation type
+          propertyNames:
+            type: string
+            description: The module name
+          example: { "networks": { "read": true, "create": false, "update": false, "delete": false }, "peers": { "read": false, "create": false, "update": false, "delete": false } }
+      required:
+        - modules
+        - is_restricted
+    UserRequest:
+      type: object
+      properties:
+        role:
+          description: User's NetBird account role
+          type: string
+          example: admin
+        auto_groups:
+          description: Group IDs to auto-assign to peers registered by this user
+          type: array
+          items:
+            type: string
+            example: ch8i4ug6lnn4g9hqv7m0
+        is_blocked:
+          description: If set to true then user is blocked and can't use the system
+          type: boolean
+          example: false
+      required:
+        - role
+        - auto_groups
+        - is_blocked
+    UserCreateRequest:
+      type: object
+      properties:
+        email:
+          description: User's Email to send invite to
+          type: string
+          example: demo@netbird.io
+        name:
+          description: User's full name
+          type: string
+          example: Tom Schulz
+        role:
+          description: User's NetBird account role
+          type: string
+          example: admin
+        auto_groups:
+          description: Group IDs to auto-assign to peers registered by this user
+          type: array
+          items:
+            type: string
+            example: ch8i4ug6lnn4g9hqv7m0
+        is_service_user:
+          description: Is true if this user is a service user
+          type: boolean
+          example: false
+      required:
+        - role
+        - auto_groups
+        - is_service_user
\ No newline at end of file
diff --git a/shared/management/http/apiv1alpha1/user/user_paths.yaml b/shared/management/http/apiv1alpha1/user/user_paths.yaml
new file mode 100644
index 000000000..be5b836c4
--- /dev/null
+++ b/shared/management/http/apiv1alpha1/user/user_paths.yaml
@@ -0,0 +1,129 @@
+UsersPath:
+  get:
+    summary: List all Users
+    description: Returns a list of all users
+    tags: [ Users ]
+    security:
+      - BearerAuth: [ ]
+      - TokenAuth: [ ]
+    parameters:
+      - in: query
+        name: service_user
+        schema:
+          type: boolean
+        description: Filters users and returns either regular users or service users
+    responses:
+      '200':
+        description: A JSON array of Users
+        content:
+          application/json:
+            schema:
+              type: array
+              items:
+                $ref: './user_components.yaml#/components/schemas/User'
+      '400':
+        "$ref": "../openapi.yaml#/components/responses/bad_request"
+      '401':
+        "$ref": "../openapi.yaml#/components/responses/requires_authentication"
+      '403':
+        "$ref": "../openapi.yaml#/components/responses/forbidden"
+      '422':
+        "$ref": "../openapi.yaml#/components/responses/unprocessable"
+      '500':
+        "$ref": "../openapi.yaml#/components/responses/internal_error"
+  post:
+    summary: Create a User
+    description: Creates a new service user or sends an invite to a regular user
+    tags: [ Users ]
+    security:
+      - BearerAuth: [ ]
+      - TokenAuth: [ ]
+    requestBody:
+      description: User invite information
+      required: true
+      content:
+        'application/json':
+          schema:
+            $ref: './user_components.yaml#/components/schemas/UserCreateRequest'
+    responses:
+      '200':
+        description: A User object
+        content:
+          application/json:
+            schema:
+              $ref: './user_components.yaml#/components/schemas/User'
+      '400':
+        "$ref": "../openapi.yaml#/components/responses/bad_request"
+      '401':
+        "$ref": "../openapi.yaml#/components/responses/requires_authentication"
+      '403':
+        "$ref": "../openapi.yaml#/components/responses/forbidden"
+      '422':
+        "$ref": "../openapi.yaml#/components/responses/unprocessable"
+      '500':
+        "$ref": "../openapi.yaml#/components/responses/internal_error"
+UserPath:
+  put:
+    summary: Update a User
+    description: Update information about a User
+    tags: [ Users ]
+    security:
+      - BearerAuth: [ ]
+      - TokenAuth: [ ]
+    parameters:
+      - in: path
+        name: userId
+        required: true
+        schema:
+          type: string
+        description: The unique identifier of a user
+    requestBody:
+      description: User update
+      required: true
+      content:
+        'application/json':
+          schema:
+            $ref: './user_components.yaml#/components/schemas/UserRequest'
+    responses:
+      '200':
+        description: A User object
+        content:
+          application/json:
+            schema:
+              $ref: './user_components.yaml#/components/schemas/User'
+      '400':
+        "$ref": "../openapi.yaml#/components/responses/bad_request"
+      '401':
+        "$ref": "../openapi.yaml#/components/responses/requires_authentication"
+      '403':
+        "$ref": "../openapi.yaml#/components/responses/forbidden"
+      '422':
+        "$ref": "../openapi.yaml#/components/responses/unprocessable"
+      '500':
+        "$ref": "../openapi.yaml#/components/responses/internal_error"
+  delete:
+    summary: Delete a User
+    description: This method removes a user from accessing the system. For this leaves the IDP user intact unless the `--user-delete-from-idp` is passed to management startup.
+    tags: [ Users ]
+    security:
+      - BearerAuth: [ ]
+      - TokenAuth: [ ]
+    parameters:
+      - in: path
+        name: userId
+        required: true
+        schema:
+          type: string
+        description: The unique identifier of a user
+    responses:
+      '200':
+        description: Delete status code
+        content: { }
+      '400':
+        "$ref": "../openapi.yaml#/components/responses/bad_request"
+      '401':
+        "$ref": "../openapi.yaml#/components/responses/requires_authentication"
+      '403':
+        "$ref": "../openapi.yaml#/components/responses/forbidden"
+      '500':
+        "$ref": "../openapi.yaml#/components/responses/internal_error"

From e392c5899e6bdae6d9de7925d13a4199a7417ffa Mon Sep 17 00:00:00 2001
From: Zoltan Papp <zoltan.pmail@gmail.com>
Date: Thu, 8 Oct 2026 11:36:37 +0200
Subject: [PATCH 22/70] [relay] Fix race in Relay server shutdown (#7607)

* [relay] Bind listeners before serving to fix the shutdown race

A shutdown signal that arrives while the relay is still starting races
the listener goroutines. Server.Shutdown read the listener's server
field while Listen was writing it, which the race detector reported,
and when Shutdown won it saw a nil server, returned as if nothing was
running, and the listener then bound and served with nothing left to
stop it. Server.Listen never returned and the process hung on exit.

The listener lifecycle is now split into Bind and Serve. Server.Listen
binds every listener under its mutex before spawning the accept loops,
so the fields Shutdown reads are written before the goroutines exist.
A closed flag on the server makes a Listen that runs after Shutdown
return without binding. A bind failure on one listener shuts down the
ones already bound and surfaces the error at once instead of holding
it in a channel until the surviving listener exits.

* [relay] Mark the server closed before shutting down the relay

Shutdown set the closed flag only after the relay had finished closing
peers, so a Listen that started during that window could bind sockets
and start serving on a server that was already going down. The flag is
now set under listenerMux before the relay shutdown, and Accept closes
connections it receives once the relay is closed instead of leaving
them to the client's timeout.

The tests now cover the public Listen bind failure and a QUIC listener
shut down while blocked in Accept, and they pick ports that are free
for both TCP and UDP, reporting a bind error instead of a timeout.

* Fix tests

* [relay] Test the Listen and Shutdown race and the QUIC bind rollback

The existing tests order Listen and Shutdown deterministically, so the
race the fix targets was never exercised. A new test fires both from a
shared start channel across repeated rounds so either side can take the
lock first, and fails on the hang the old code produced.

The rollback test now drives Server.Listen with the real ws and quic
listeners and a UDP blocker, so the ws socket is bound and released when
the quic bind fails. Both tests pass a real TLS config because a nil one
only yields a quic listener in the devcert build.

* [relay] Bound the Shutdown wait in the concurrent Listen and Shutdown test

* [relay] Keep the default WS port for an empty listen address

net.Listen picks a random port for an empty address, while ListenAndServe
used :http or :https. Apply the same default in Bind so an empty address
keeps listening where it did before.

* [relay] Release the WS socket when Serve fails

ServeTLS can return before it takes ownership of the listener, for example
when no certificate is configured, leaving the socket opened in Bind bound
until Shutdown. Close it in Serve on any error other than a server close.

* [relay] Drain the relay outside the listener lock

Shutdown held listenerMux while the relay closed its peers gracefully, so
ListenerProtocols, and with it the healthcheck, blocked for the whole drain.
Mark the server closed and take the listeners under the lock, then drain and
stop them after releasing it. The closed flag still keeps Listen from
registering new listeners.
---
 relay/server/listener/quic/listener.go      |  13 +-
 relay/server/listener/quic/listener_test.go | 130 +++++++++++
 relay/server/listener/ws/listener.go        |  42 +++-
 relay/server/listener/ws/listener_test.go   | 104 +++++++++
 relay/server/relay.go                       |   6 +-
 relay/server/relay_test.go                  |  55 +++++
 relay/server/server.go                      | 100 ++++++---
 relay/server/server_test.go                 | 230 ++++++++++++++++++++
 8 files changed, 636 insertions(+), 44 deletions(-)
 create mode 100644 relay/server/listener/quic/listener_test.go
 create mode 100644 relay/server/listener/ws/listener_test.go
 create mode 100644 relay/server/relay_test.go
 create mode 100644 relay/server/server_test.go

diff --git a/relay/server/listener/quic/listener.go b/relay/server/listener/quic/listener.go
index 4c3b07571..115a2d0c2 100644
--- a/relay/server/listener/quic/listener.go
+++ b/relay/server/listener/quic/listener.go
@@ -25,21 +25,28 @@ type Listener struct {
 	listener *quic.Listener
 }
 
-func (l *Listener) Listen(acceptFn func(conn relaylistener.Conn)) error {
+func (l *Listener) Bind() error {
 	quicCfg := &quic.Config{
 		EnableDatagrams:   true,
 		InitialPacketSize: nbRelay.QUICInitialPacketSize,
 	}
 	listener, err := quic.ListenAddr(l.Address, l.TLSConfig, quicCfg)
 	if err != nil {
-		return fmt.Errorf("failed to create QUIC listener: %v", err)
+		return err
 	}
 
 	l.listener = listener
 	log.Infof("QUIC server listening on address: %s", l.Address)
+	return nil
+}
+
+func (l *Listener) Serve(acceptFn func(conn relaylistener.Conn)) error {
+	if l.listener == nil {
+		return errors.New("listener is not bound")
+	}
 
 	for {
-		session, err := listener.Accept(context.Background())
+		session, err := l.listener.Accept(context.Background())
 		if err != nil {
 			if errors.Is(err, quic.ErrServerClosed) {
 				return nil
diff --git a/relay/server/listener/quic/listener_test.go b/relay/server/listener/quic/listener_test.go
new file mode 100644
index 000000000..6a2e9ce75
--- /dev/null
+++ b/relay/server/listener/quic/listener_test.go
@@ -0,0 +1,130 @@
+package quic
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"math/big"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	relaylistener "github.com/netbirdio/netbird/relay/server/listener"
+	quictls "github.com/netbirdio/netbird/shared/relay/tls"
+)
+
+func TestListener_ShutdownBeforeServe(t *testing.T) {
+	l := &Listener{Address: "127.0.0.1:0", TLSConfig: testTLSConfig(t)}
+	require.NoError(t, l.Bind())
+	addr := l.listener.Addr().String()
+	require.NoError(t, l.Shutdown(context.Background()))
+
+	errChan := make(chan error, 1)
+	go func() {
+		errChan <- l.Serve(func(relaylistener.Conn) {})
+	}()
+
+	assert.NoError(t, waitForServeToReturn(t, errChan))
+	requireUDPAddressFree(t, addr)
+}
+
+func TestListener_ShutdownStopsServe(t *testing.T) {
+	l := &Listener{Address: "127.0.0.1:0", TLSConfig: testTLSConfig(t)}
+	require.NoError(t, l.Bind())
+	addr := l.listener.Addr().String()
+
+	accepted := make(chan relaylistener.Conn, 1)
+	errChan := make(chan error, 1)
+	go func() {
+		errChan <- l.Serve(func(conn relaylistener.Conn) { accepted <- conn })
+	}()
+
+	// quic-go completes handshakes on a bound socket before Accept is called, so
+	// only a session handed to acceptFn proves Serve is blocked in Accept when
+	// Shutdown arrives.
+	dialTestSession(t, addr)
+	var conn relaylistener.Conn
+	select {
+	case conn = <-accepted:
+	case <-time.After(5 * time.Second):
+		t.Fatal("listener did not accept the test session")
+	}
+
+	require.NoError(t, l.Shutdown(context.Background()))
+	assert.NoError(t, waitForServeToReturn(t, errChan))
+
+	// Shutdown leaves accepted sessions alive, as the relay closes its peers itself,
+	// and quic-go keeps the UDP socket bound until the last session is gone.
+	require.NoError(t, conn.Close())
+	requireUDPAddressFree(t, addr)
+}
+
+func TestListener_Unbound(t *testing.T) {
+	l := &Listener{Address: "127.0.0.1:0", TLSConfig: testTLSConfig(t)}
+	assert.Error(t, l.Serve(func(relaylistener.Conn) {}), "Serve must refuse an unbound listener")
+	assert.NoError(t, l.Shutdown(context.Background()), "Shutdown of an unbound listener is a no-op")
+}
+
+func testTLSConfig(t *testing.T) *tls.Config {
+	t.Helper()
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+
+	template := &x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     time.Now().Add(time.Hour),
+		IPAddresses:  []net.IP{net.ParseIP("127.0.0.1")},
+	}
+	certDER, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
+	require.NoError(t, err)
+
+	return &tls.Config{
+		Certificates: []tls.Certificate{{Certificate: [][]byte{certDER}, PrivateKey: key}},
+		NextProtos:   []string{quictls.NBalpn},
+	}
+}
+
+func dialTestSession(t *testing.T, addr string) {
+	t.Helper()
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	tlsCfg := &tls.Config{InsecureSkipVerify: true, NextProtos: []string{quictls.NBalpn}}
+	session, err := quic.DialAddr(ctx, addr, tlsCfg, &quic.Config{EnableDatagrams: true})
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = session.CloseWithError(0, "") })
+}
+
+func waitForServeToReturn(t *testing.T, errChan <-chan error) error {
+	t.Helper()
+	select {
+	case err := <-errChan:
+		return err
+	case <-time.After(5 * time.Second):
+		t.Fatal("Serve did not return")
+		return nil
+	}
+}
+
+// quic-go retires a closed session's connection IDs on a timer and closes the UDP
+// socket from its read loop once the last one is gone, so the address is polled
+// rather than checked once.
+func requireUDPAddressFree(t *testing.T, addr string) {
+	t.Helper()
+	require.Eventually(t, func() bool {
+		conn, err := net.ListenPacket("udp", addr)
+		if err != nil {
+			return false
+		}
+		_ = conn.Close()
+		return true
+	}, 5*time.Second, 10*time.Millisecond, "udp address %s must be released", addr)
+}
diff --git a/relay/server/listener/ws/listener.go b/relay/server/listener/ws/listener.go
index 208b9186e..a1a26668a 100644
--- a/relay/server/listener/ws/listener.go
+++ b/relay/server/listener/ws/listener.go
@@ -32,32 +32,57 @@ type Listener struct {
 	// headers are trusted. Headers from any other immediate peer are ignored.
 	TrustedProxies *trustedproxy.List
 
+	listener net.Listener
 	server   *http.Server
 	acceptFn func(conn relaylistener.Conn)
 }
 
-func (l *Listener) Listen(acceptFn func(conn relaylistener.Conn)) error {
-	l.acceptFn = acceptFn
+func (l *Listener) Bind() error {
+	addr := l.Address
+	if addr == "" {
+		addr = ":http"
+		if l.TLSConfig != nil {
+			addr = ":https"
+		}
+	}
+
+	listener, err := net.Listen("tcp", addr)
+	if err != nil {
+		return err
+	}
+
 	mux := http.NewServeMux()
 	mux.HandleFunc(URLPath, l.onAccept)
 
+	l.listener = listener
 	l.server = &http.Server{
-		Addr:              l.Address,
 		Handler:           mux,
 		TLSConfig:         l.TLSConfig,
 		ReadHeaderTimeout: 5 * time.Second,
 	}
 
-	log.Infof("WS server listening address: %s", l.Address)
+	log.Infof("WS server listening address: %s", addr)
+	return nil
+}
+
+func (l *Listener) Serve(acceptFn func(conn relaylistener.Conn)) error {
+	if l.listener == nil {
+		return errors.New("listener is not bound")
+	}
+
+	l.acceptFn = acceptFn
 	var err error
 	if l.TLSConfig != nil {
-		err = l.server.ListenAndServeTLS("", "")
+		err = l.server.ServeTLS(l.listener, "", "")
 	} else {
-		err = l.server.ListenAndServe()
+		err = l.server.Serve(l.listener)
 	}
 	if errors.Is(err, http.ErrServerClosed) {
 		return nil
 	}
+	if closeErr := l.listener.Close(); closeErr != nil && !errors.Is(closeErr, net.ErrClosed) {
+		log.Debugf("failed to close WS listener: %v", closeErr)
+	}
 	return err
 }
 
@@ -66,7 +91,7 @@ func (l *Listener) Protocol() protocol.Protocol {
 }
 
 func (l *Listener) Shutdown(ctx context.Context) error {
-	if l.server == nil {
+	if l.listener == nil {
 		return nil
 	}
 
@@ -74,6 +99,9 @@ func (l *Listener) Shutdown(ctx context.Context) error {
 	if err := l.server.Shutdown(ctx); err != nil {
 		return fmt.Errorf("server shutdown failed: %v", err)
 	}
+	if err := l.listener.Close(); err != nil && !errors.Is(err, net.ErrClosed) {
+		return fmt.Errorf("close listener: %w", err)
+	}
 	log.Infof("WS listener stopped")
 	return nil
 }
diff --git a/relay/server/listener/ws/listener_test.go b/relay/server/listener/ws/listener_test.go
new file mode 100644
index 000000000..2373fb5ed
--- /dev/null
+++ b/relay/server/listener/ws/listener_test.go
@@ -0,0 +1,104 @@
+package ws
+
+import (
+	"context"
+	"crypto/tls"
+	"net"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	relaylistener "github.com/netbirdio/netbird/relay/server/listener"
+)
+
+func TestListener_ShutdownBeforeServe(t *testing.T) {
+	l := &Listener{Address: "127.0.0.1:0"}
+	require.NoError(t, l.Bind())
+	addr := l.listener.Addr().String()
+	require.NoError(t, l.Shutdown(context.Background()))
+
+	errChan := make(chan error, 1)
+	go func() {
+		errChan <- l.Serve(func(relaylistener.Conn) {})
+	}()
+
+	assert.NoError(t, waitForServeToReturn(t, errChan))
+	requireTCPAddressFree(t, addr)
+}
+
+func TestListener_ShutdownStopsServe(t *testing.T) {
+	l := &Listener{Address: "127.0.0.1:0"}
+	require.NoError(t, l.Bind())
+	addr := l.listener.Addr().String()
+
+	errChan := make(chan error, 1)
+	go func() {
+		errChan <- l.Serve(func(relaylistener.Conn) {})
+	}()
+
+	// A bound socket accepts TCP connections before Serve runs, so only a served
+	// HTTP response proves the accept loop is running.
+	require.Eventually(t, func() bool {
+		return httpGetSucceeds("http://" + addr + "/")
+	}, 5*time.Second, 10*time.Millisecond, "listener did not start serving")
+
+	require.NoError(t, l.Shutdown(context.Background()))
+	assert.NoError(t, waitForServeToReturn(t, errChan))
+	requireTCPAddressFree(t, addr)
+}
+
+func TestListener_ServeErrorReleasesSocket(t *testing.T) {
+	// A TLS config without certificates makes ServeTLS fail before it takes
+	// ownership of the listener, so only Serve itself can close the socket.
+	l := &Listener{Address: "127.0.0.1:0", TLSConfig: &tls.Config{}}
+	require.NoError(t, l.Bind())
+	addr := l.listener.Addr().String()
+
+	assert.Error(t, l.Serve(func(relaylistener.Conn) {}), "ServeTLS must fail without a certificate")
+	requireTCPAddressFree(t, addr)
+	assert.NoError(t, l.Shutdown(context.Background()), "Shutdown after a failed Serve must succeed")
+}
+
+func TestListener_Unbound(t *testing.T) {
+	l := &Listener{Address: "127.0.0.1:0"}
+	assert.Error(t, l.Serve(func(relaylistener.Conn) {}), "Serve must refuse an unbound listener")
+	assert.NoError(t, l.Shutdown(context.Background()), "Shutdown of an unbound listener is a no-op")
+}
+
+func waitForServeToReturn(t *testing.T, errChan <-chan error) error {
+	t.Helper()
+	select {
+	case err := <-errChan:
+		return err
+	case <-time.After(5 * time.Second):
+		t.Fatal("Serve did not return")
+		return nil
+	}
+}
+
+func httpGetSucceeds(url string) bool {
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, http.NoBody)
+	if err != nil {
+		return false
+	}
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return false
+	}
+	_ = resp.Body.Close()
+	return true
+}
+
+func requireTCPAddressFree(t *testing.T, addr string) {
+	t.Helper()
+	ln, err := net.Listen("tcp", addr)
+	require.NoError(t, err, "tcp address %s must be released", addr)
+	require.NoError(t, ln.Close())
+}
diff --git a/relay/server/relay.go b/relay/server/relay.go
index 84c424b8e..58f9db840 100644
--- a/relay/server/relay.go
+++ b/relay/server/relay.go
@@ -21,7 +21,8 @@ import (
 )
 
 type Listener interface {
-	Listen(func(conn listener.Conn)) error
+	Bind() error
+	Serve(func(conn listener.Conn)) error
 	Shutdown(ctx context.Context) error
 	Protocol() protocol.Protocol
 }
@@ -122,6 +123,9 @@ func (r *Relay) Accept(conn listener.Conn) {
 	r.closeMu.RLock()
 	defer r.closeMu.RUnlock()
 	if r.closed {
+		if err := conn.Close(); err != nil {
+			log.Debugf("failed to close connection after shutdown, %s: %s", conn.RemoteAddr(), err)
+		}
 		return
 	}
 
diff --git a/relay/server/relay_test.go b/relay/server/relay_test.go
new file mode 100644
index 000000000..aea0f2a62
--- /dev/null
+++ b/relay/server/relay_test.go
@@ -0,0 +1,55 @@
+package server
+
+import (
+	"context"
+	"net"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/relay/auth/allow"
+)
+
+type closeRecorderConn struct {
+	reads  int
+	closed bool
+}
+
+func (c *closeRecorderConn) Read(context.Context, []byte) (int, error) {
+	c.reads++
+	return 0, net.ErrClosed
+}
+
+func (c *closeRecorderConn) Write(context.Context, []byte) (int, error) {
+	return 0, net.ErrClosed
+}
+
+func (c *closeRecorderConn) RemoteAddr() net.Addr {
+	return &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 1}
+}
+
+func (c *closeRecorderConn) Close() error {
+	c.closed = true
+	return nil
+}
+
+func (c *closeRecorderConn) Protocol() string {
+	return "test"
+}
+
+func TestRelay_AcceptAfterShutdownClosesConn(t *testing.T) {
+	relay, err := NewRelay(Config{
+		ExposedAddress: "rel://127.0.0.1:1234",
+		AuthValidator:  &allow.Auth{},
+	})
+	require.NoError(t, err)
+	relay.Shutdown(context.Background())
+
+	conn := &closeRecorderConn{}
+	relay.Accept(conn)
+	assert.True(t, conn.closed, "a connection accepted after shutdown must be closed")
+	// The handshake error path closes the connection too, so only an untouched Read
+	// proves the closed guard rejected it before any handshake.
+	assert.Zero(t, conn.reads, "a connection accepted after shutdown must not be read")
+}
diff --git a/relay/server/server.go b/relay/server/server.go
index 8d303e9e4..4636eed65 100644
--- a/relay/server/server.go
+++ b/relay/server/server.go
@@ -3,6 +3,7 @@ package server
 import (
 	"context"
 	"crypto/tls"
+	"fmt"
 	"net/url"
 	"sync"
 
@@ -35,6 +36,7 @@ type Server struct {
 	relay       *Relay
 	listeners   []Listener
 	listenerMux sync.Mutex
+	closed      bool
 }
 
 // NewServer creates and returns a new relay server instance.
@@ -62,39 +64,30 @@ func NewServer(config Config) (*Server, error) {
 	}, nil
 }
 
-// Listen starts the relay server.
+// Listen binds the relay listeners and serves them until Shutdown is called.
 func (r *Server) Listen(cfg ListenerConfig) error {
-	wSListener := &ws.Listener{
-		Address:        cfg.Address,
-		TLSConfig:      cfg.TLSConfig,
-		TrustedProxies: cfg.TrustedProxies,
-	}
-
 	r.listenerMux.Lock()
-	r.listeners = append(r.listeners, wSListener)
-
-	tlsConfigQUIC, err := quictls.ServerQUICTLSConfig(cfg.TLSConfig)
-	if err != nil {
-		log.Warnf("Not starting QUIC listener: %v", err)
-	} else {
-		quicListener := &quic.Listener{
-			Address:   cfg.Address,
-			TLSConfig: tlsConfigQUIC,
-		}
-
-		r.listeners = append(r.listeners, quicListener)
+	if r.closed {
+		r.listenerMux.Unlock()
+		return nil
 	}
 
-	errChan := make(chan error, len(r.listeners))
+	listeners, err := bindListeners(newListeners(cfg))
+	if err != nil {
+		r.listenerMux.Unlock()
+		return err
+	}
+	r.listeners = append(r.listeners, listeners...)
+
+	errChan := make(chan error, len(listeners))
 	wg := sync.WaitGroup{}
-	for _, l := range r.listeners {
+	for _, l := range listeners {
 		wg.Add(1)
 		go func(listener Listener) {
 			defer wg.Done()
-			errChan <- listener.Listen(r.relay.Accept)
+			errChan <- listener.Serve(r.relay.Accept)
 		}(l)
 	}
-
 	r.listenerMux.Unlock()
 
 	wg.Wait()
@@ -110,18 +103,14 @@ func (r *Server) Listen(cfg ListenerConfig) error {
 // Shutdown stops the relay server. If there are active connections, they will be closed gracefully. In case of a context,
 // the connections will be forcefully closed.
 func (r *Server) Shutdown(ctx context.Context) error {
-	r.relay.Shutdown(ctx)
-
 	r.listenerMux.Lock()
-	var multiErr *multierror.Error
-	for _, l := range r.listeners {
-		if err := l.Shutdown(ctx); err != nil {
-			multiErr = multierror.Append(multiErr, err)
-		}
-	}
-	r.listeners = r.listeners[:0]
+	r.closed = true
+	listeners := r.listeners
+	r.listeners = nil
 	r.listenerMux.Unlock()
-	return nberrors.FormatErrorOrNil(multiErr)
+
+	r.relay.Shutdown(ctx)
+	return shutdownListeners(ctx, listeners)
 }
 
 func (r *Server) ListenerProtocols() []protocol.Protocol {
@@ -145,3 +134,48 @@ func (r *Server) InstanceURL() url.URL {
 func (r *Server) RelayAccept() func(conn listener.Conn) {
 	return r.relay.Accept
 }
+
+func newListeners(cfg ListenerConfig) []Listener {
+	listeners := []Listener{
+		&ws.Listener{
+			Address:        cfg.Address,
+			TLSConfig:      cfg.TLSConfig,
+			TrustedProxies: cfg.TrustedProxies,
+		},
+	}
+
+	tlsConfigQUIC, err := quictls.ServerQUICTLSConfig(cfg.TLSConfig)
+	if err != nil {
+		log.Warnf("Not starting QUIC listener: %v", err)
+		return listeners
+	}
+
+	return append(listeners, &quic.Listener{
+		Address:   cfg.Address,
+		TLSConfig: tlsConfigQUIC,
+	})
+}
+
+func bindListeners(listeners []Listener) ([]Listener, error) {
+	bound := make([]Listener, 0, len(listeners))
+	for _, l := range listeners {
+		if err := l.Bind(); err != nil {
+			if shutdownErr := shutdownListeners(context.Background(), bound); shutdownErr != nil {
+				log.Warnf("failed to close listeners after bind error: %v", shutdownErr)
+			}
+			return nil, fmt.Errorf("%s listener: %w", l.Protocol(), err)
+		}
+		bound = append(bound, l)
+	}
+	return bound, nil
+}
+
+func shutdownListeners(ctx context.Context, listeners []Listener) error {
+	var multiErr *multierror.Error
+	for _, l := range listeners {
+		if err := l.Shutdown(ctx); err != nil {
+			multiErr = multierror.Append(multiErr, err)
+		}
+	}
+	return nberrors.FormatErrorOrNil(multiErr)
+}
diff --git a/relay/server/server_test.go b/relay/server/server_test.go
new file mode 100644
index 000000000..6ec802b94
--- /dev/null
+++ b/relay/server/server_test.go
@@ -0,0 +1,230 @@
+package server
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"fmt"
+	"math/big"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/relay/server/listener/quic"
+	"github.com/netbirdio/netbird/shared/relay/auth/allow"
+)
+
+func TestServer_ShutdownBeforeListen(t *testing.T) {
+	addr := freeAddress(t)
+	srv := newTestServer(t, addr)
+	require.NoError(t, srv.Shutdown(context.Background()))
+
+	errChan := make(chan error, 1)
+	go func() {
+		errChan <- srv.Listen(ListenerConfig{Address: addr})
+	}()
+
+	assert.NoError(t, waitForReturn(t, "Listen", errChan))
+	assert.Empty(t, srv.ListenerProtocols(), "a shut down server must not register listeners")
+	requireAddressFree(t, addr)
+}
+
+func TestServer_ShutdownStopsListen(t *testing.T) {
+	addr := freeAddress(t)
+	srv := newTestServer(t, addr)
+
+	errChan := make(chan error, 1)
+	go func() {
+		errChan <- srv.Listen(ListenerConfig{Address: addr})
+	}()
+
+	waitForListeners(t, srv, errChan)
+
+	require.NoError(t, srv.Shutdown(context.Background()))
+	assert.NoError(t, waitForReturn(t, "Listen", errChan))
+	requireAddressFree(t, addr)
+}
+
+func TestServer_ConcurrentListenAndShutdown(t *testing.T) {
+	tlsCfg := testTLSConfig(t)
+	for round := 0; round < 20; round++ {
+		t.Run(fmt.Sprintf("round-%d", round), func(t *testing.T) {
+			addr := freeAddress(t)
+			srv := newTestServer(t, addr)
+
+			start := make(chan struct{})
+			listenErr := make(chan error, 1)
+			shutdownErr := make(chan error, 1)
+			go func() {
+				<-start
+				listenErr <- srv.Listen(ListenerConfig{Address: addr, TLSConfig: tlsCfg})
+			}()
+			go func() {
+				<-start
+				shutdownErr <- srv.Shutdown(context.Background())
+			}()
+			close(start)
+
+			// Either side may take the lock first: Listen then returns without binding,
+			// or Shutdown stops its accept loops. Listen must return in both cases.
+			assert.NoError(t, waitForReturn(t, "Listen", listenErr))
+			assert.NoError(t, waitForReturn(t, "Shutdown", shutdownErr))
+			assert.Empty(t, srv.ListenerProtocols(), "no listener may stay registered after shutdown")
+			requireAddressFree(t, addr)
+		})
+	}
+}
+
+func TestServer_ListenReturnsBindError(t *testing.T) {
+	blocker, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = blocker.Close() })
+	addr := blocker.Addr().String()
+	srv := newTestServer(t, addr)
+
+	errChan := make(chan error, 1)
+	go func() {
+		errChan <- srv.Listen(ListenerConfig{Address: addr})
+	}()
+
+	assert.Error(t, waitForReturn(t, "Listen", errChan), "Listen must return the bind error instead of serving")
+	assert.Empty(t, srv.ListenerProtocols(), "a failed Listen must not register listeners")
+
+	require.NoError(t, blocker.Close())
+	requireAddressFree(t, addr)
+}
+
+func TestServer_ListenRollsBackOnBindError(t *testing.T) {
+	addr := freeAddress(t)
+	blocker, err := net.ListenPacket("udp", addr)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = blocker.Close() })
+	srv := newTestServer(t, addr)
+	tlsCfg := testTLSConfig(t)
+
+	errChan := make(chan error, 1)
+	go func() {
+		errChan <- srv.Listen(ListenerConfig{Address: addr, TLSConfig: tlsCfg})
+	}()
+
+	err = waitForReturn(t, "Listen", errChan)
+	require.Error(t, err, "Listen must fail when the QUIC port is taken")
+	assert.ErrorContains(t, err, string(quic.Proto)+" listener", "the QUIC listener must be the one that failed to bind")
+	assert.Empty(t, srv.ListenerProtocols(), "a failed Listen must not register listeners")
+
+	// The WS listener binds first, so a free TCP port proves the rollback closed it.
+	ln, err := net.Listen("tcp", addr)
+	require.NoError(t, err, "the WS socket must be released after the QUIC bind failure")
+	require.NoError(t, ln.Close())
+}
+
+func newTestServer(t *testing.T, addr string) *Server {
+	t.Helper()
+	srv, err := NewServer(Config{
+		ExposedAddress: "rel://" + addr,
+		AuthValidator:  &allow.Auth{},
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		assert.NoError(t, srv.Shutdown(context.Background()))
+	})
+	return srv
+}
+
+// The server binds TCP and UDP on the same port, so a port is only picked when
+// both are free. The probes are closed before Listen binds, which leaves a small
+// window for another process to take the port; waitForListeners then reports the
+// bind error instead of a timeout.
+func freeAddress(t *testing.T) string {
+	t.Helper()
+	for attempt := 0; attempt < 10; attempt++ {
+		ln, err := net.Listen("tcp", "127.0.0.1:0")
+		require.NoError(t, err)
+		addr := ln.Addr().String()
+		require.NoError(t, ln.Close())
+
+		conn, err := net.ListenPacket("udp", addr)
+		if err != nil {
+			continue
+		}
+		require.NoError(t, conn.Close())
+		return addr
+	}
+	t.Fatal("no address with both tcp and udp ports free")
+	return ""
+}
+
+// Listen registers its listeners under the same lock that starts serving, so a
+// non-empty ListenerProtocols means the sockets are bound. A Listen that returns
+// before that has failed to bind, and its error is reported instead of a timeout.
+func waitForListeners(t *testing.T, srv *Server, errChan <-chan error) {
+	t.Helper()
+	deadline := time.After(5 * time.Second)
+	for len(srv.ListenerProtocols()) == 0 {
+		select {
+		case err := <-errChan:
+			t.Fatalf("Listen returned before binding: %v", err)
+		case <-deadline:
+			t.Fatal("listeners were not bound")
+		case <-time.After(10 * time.Millisecond):
+		}
+	}
+}
+
+func waitForReturn(t *testing.T, op string, errChan <-chan error) error {
+	t.Helper()
+	select {
+	case err := <-errChan:
+		return err
+	case <-time.After(5 * time.Second):
+		t.Fatalf("%s did not return", op)
+		return nil
+	}
+}
+
+// The QUIC listener releases its UDP socket from the read loop after Close returns,
+// so both sockets are polled instead of checked once.
+func requireAddressFree(t *testing.T, addr string) {
+	t.Helper()
+	require.Eventually(t, func() bool {
+		ln, err := net.Listen("tcp", addr)
+		if err != nil {
+			return false
+		}
+		_ = ln.Close()
+
+		conn, err := net.ListenPacket("udp", addr)
+		if err != nil {
+			return false
+		}
+		_ = conn.Close()
+		return true
+	}, 5*time.Second, 10*time.Millisecond, "address %s must be released", addr)
+}
+
+// A nil TLS config only yields a QUIC listener in the devcert build, so the tests
+// that need both listeners pass a real one and bind them regardless of build tags.
+func testTLSConfig(t *testing.T) *tls.Config {
+	t.Helper()
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+
+	template := &x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     time.Now().Add(time.Hour),
+		IPAddresses:  []net.IP{net.ParseIP("127.0.0.1")},
+	}
+	certDER, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
+	require.NoError(t, err)
+
+	return &tls.Config{
+		Certificates: []tls.Certificate{{Certificate: [][]byte{certDER}, PrivateKey: key}},
+	}
+}

From a8a67f5cf1b2d10c314967c8c4185b510187dbc2 Mon Sep 17 00:00:00 2001
From: Zoltan Papp <zoltan.pmail@gmail.com>
Date: Thu, 8 Oct 2026 12:46:15 +0200
Subject: [PATCH 23/70] [client] Keep the updater silent until management
 decides the mode (#7455)

* [client] Keep the updater silent until management decides the mode

The update manager started in download-only mode and every engine stop
reset it there again, kicking the update loop with the cached latest
version. On a managed peer this published a "New version available"
notification on each disconnect, session expiry or logout, and once more
in the window between daemon start and the first network map. Users under
enforced updates then installed the release by hand.

Replace the boolean with a three-state mode. The manager starts undecided
and publishes nothing, from the fetcher or from NotifyUI, until the network
map picks download-only or managed. A new connection lifecycle resets to
undecided; disconnects leave the last decision untouched. A missing
AutoUpdateSettings now means download-only instead of a no-op, and on
platforms without an installer SetVersion falls back to download-only so
they keep notifying.

* [client] Address review findings on the updater mode split

Route every mode transition through one locked helper so the staged
managed version cannot outlive the decision that created it. Both
download-only transitions kept pendingVersion, letting Install put on
the old enforced release after management disabled updates or the
platform fell back to download-only.

The helper also bumps a generation counter. handleUpdate and NotifyUI
copy the mode under the mutex but publish and install after releasing
it, so a reset landing in that window could still emit an enforced
notification. Both now recheck the generation right before the side
effect and drop the stale work.

Reset on every connection attempt instead of once per run: the backoff
loop reconnects without re-entering run, and since disconnects no longer
force download-only, a fetch in the disconnected gap republished the
enforced notification before the new network map arrived.

A missing AutoUpdateSettings now logs that it defaults to download-only
rather than claiming auto-update is disabled, which contradicted the
notifications that mode still emits.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* [client] Reset the updater mode on engine stop

Removing SetDownloadOnly from the engine teardown also dropped the reset of
the forced-update flag. After netbird down the manager kept the last
management directive, so a release published while the client was stopped
could still trigger a forced install that management no longer asked for.
The same window existed between an engine teardown and the next reconnect
attempt, where ResetMode only ran at the start of the attempt.

Reset the mode in stopLocked instead, so the updater stays silent from the
moment the engine goes down until the first network map of the next
connection decides the mode again.

* [client] Name the force-reset test for the behavior it proves

The silence after ResetMode follows from the undecided mode alone, and the
closing SetVersion overwrites forceUpdate from its argument, so the test
cannot observe whether the flag itself was cleared. Name it for the stale
directive staying silent, which is what it asserts.

* [client] Fall back to download-only on a malformed expected version

* [client] Compare the full auto-update directive before skipping it

* [client] Set the mock latest version under its lock in the updater tests

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 client/internal/connect.go                    |   4 +
 client/internal/engine.go                     |   6 +-
 client/internal/updater/manager.go            | 123 +++++++---
 client/internal/updater/manager_linux_test.go |  20 +-
 client/internal/updater/manager_mode_test.go  | 217 ++++++++++++++++++
 client/internal/updater/manager_test.go       |   2 +-
 .../updater/manager_test_helpers_test.go      |  36 ++-
 7 files changed, 360 insertions(+), 48 deletions(-)
 create mode 100644 client/internal/updater/manager_mode_test.go

diff --git a/client/internal/connect.go b/client/internal/connect.go
index 88d829d2f..b42ef9818 100644
--- a/client/internal/connect.go
+++ b/client/internal/connect.go
@@ -292,6 +292,10 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 			return nil
 		}
 
+		if c.updateManager != nil {
+			c.updateManager.ResetMode()
+		}
+
 		// suspend connection attempts while the OS reports no usable network
 		if waited, err := c.netMgr.Wait(c.ctx); err != nil {
 			return nil
diff --git a/client/internal/engine.go b/client/internal/engine.go
index 4d731cbd7..e167f7589 100644
--- a/client/internal/engine.go
+++ b/client/internal/engine.go
@@ -455,7 +455,7 @@ func (e *Engine) stopLocked() {
 	}
 
 	if e.updateManager != nil {
-		e.updateManager.SetDownloadOnly()
+		e.updateManager.ResetMode()
 	}
 
 	log.Info("cleaning up status recorder states")
@@ -951,11 +951,13 @@ func (e *Engine) handleAutoUpdateVersion(autoUpdateSettings *mgmProto.AutoUpdate
 	}
 
 	if autoUpdateSettings == nil {
+		log.Infof("no auto-update settings received, defaulting to download-only")
+		e.updateManager.SetDownloadOnly()
 		return
 	}
 
 	if autoUpdateSettings.Version == disableAutoUpdate {
-		log.Infof("auto-update is disabled")
+		log.Infof("auto-update is disabled, switching to download-only")
 		e.updateManager.SetDownloadOnly()
 		return
 	}
diff --git a/client/internal/updater/manager.go b/client/internal/updater/manager.go
index 1b69368d0..c730713d3 100644
--- a/client/internal/updater/manager.go
+++ b/client/internal/updater/manager.go
@@ -21,8 +21,16 @@ const (
 	latestVersion = "latest"
 )
 
+const (
+	modeUndecided updateMode = iota
+	modeDownloadOnly
+	modeManaged
+)
+
 var errNoUpdateState = errors.New("no update state found")
 
+type updateMode int
+
 type UpdateState struct {
 	PreUpdateVersion string
 	TargetVersion    string
@@ -36,8 +44,9 @@ type Manager struct {
 	statusRecorder *peer.Status
 	stateManager   *statemanager.Manager
 
-	downloadOnly bool // true when no enforcement from management; notifies UI to download latest
-	forceUpdate  bool // true when management sets AlwaysUpdate; skips UI interaction and installs directly
+	mode        updateMode
+	modeGen     uint64
+	forceUpdate bool // true when management sets AlwaysUpdate; skips UI interaction and installs directly
 
 	lastTrigger    time.Time
 	mgmUpdateChan  chan struct{}
@@ -54,7 +63,7 @@ type Manager struct {
 	pendingVersion *v.Version
 
 	// updateMutex protects update, expectedVersion, updateToLatestVersion,
-	// downloadOnly, forceUpdate, pendingVersion, and lastTrigger fields
+	// mode, modeGen, forceUpdate, pendingVersion, and lastTrigger fields
 	updateMutex sync.Mutex
 
 	// installMutex and installing guard against concurrent installation attempts
@@ -76,7 +85,6 @@ func NewManager(statusRecorder *peer.Status, stateManager *statemanager.Manager)
 		updateChannel:       make(chan struct{}, 1),
 		currentVersion:      version.NetbirdVersion(),
 		update:              version.NewUpdate("nb/client"),
-		downloadOnly:        true,
 		autoUpdateSupported: isAutoUpdateSupported,
 	}
 
@@ -151,11 +159,7 @@ func (m *Manager) Start(ctx context.Context) {
 
 func (m *Manager) SetDownloadOnly() {
 	m.updateMutex.Lock()
-	m.downloadOnly = true
-	m.forceUpdate = false
-	m.expectedVersion = nil
-	m.updateToLatestVersion = false
-	m.lastTrigger = time.Time{}
+	m.setModeLocked(modeDownloadOnly)
 	m.updateMutex.Unlock()
 
 	select {
@@ -169,6 +173,7 @@ func (m *Manager) SetVersion(expectedVersion string, forceUpdate bool) {
 
 	if !m.autoUpdateSupported() {
 		log.Warnf("auto-update not supported on this platform")
+		m.SetDownloadOnly()
 		return
 	}
 
@@ -177,30 +182,32 @@ func (m *Manager) SetVersion(expectedVersion string, forceUpdate bool) {
 
 	if expectedVersion == "" {
 		log.Errorf("empty expected version provided")
-		m.expectedVersion = nil
-		m.updateToLatestVersion = false
-		m.downloadOnly = true
+		m.setModeLocked(modeDownloadOnly)
 		return
 	}
 
-	if expectedVersion == latestVersion {
-		m.updateToLatestVersion = true
-		m.expectedVersion = nil
-	} else {
-		expectedSemVer, err := v.NewVersion(expectedVersion)
+	var expectedSemVer *v.Version
+	if expectedVersion != latestVersion {
+		parsed, err := v.NewVersion(expectedVersion)
 		if err != nil {
-			log.Errorf("error parsing version: %v", err)
+			log.Errorf("error parsing version, switching to download-only: %v", err)
+			m.setModeLocked(modeDownloadOnly)
+			select {
+			case m.mgmUpdateChan <- struct{}{}:
+			default:
+			}
 			return
 		}
-		if m.expectedVersion != nil && m.expectedVersion.Equal(expectedSemVer) {
-			return
-		}
-		m.expectedVersion = expectedSemVer
-		m.updateToLatestVersion = false
+		expectedSemVer = parsed
 	}
 
-	m.lastTrigger = time.Time{}
-	m.downloadOnly = false
+	if m.sameDirectiveLocked(expectedSemVer, forceUpdate) {
+		return
+	}
+
+	m.setModeLocked(modeManaged)
+	m.expectedVersion = expectedSemVer
+	m.updateToLatestVersion = expectedSemVer == nil
 	m.forceUpdate = forceUpdate
 
 	select {
@@ -209,6 +216,13 @@ func (m *Manager) SetVersion(expectedVersion string, forceUpdate bool) {
 	}
 }
 
+func (m *Manager) ResetMode() {
+	m.updateMutex.Lock()
+	defer m.updateMutex.Unlock()
+
+	m.setModeLocked(modeUndecided)
+}
+
 // Install triggers the installation of the pending version. It is called when the user clicks the install button in the UI.
 func (m *Manager) Install(ctx context.Context) error {
 	if !m.autoUpdateSupported() {
@@ -255,12 +269,17 @@ func (m *Manager) NotifyUI() {
 		m.updateMutex.Unlock()
 		return
 	}
-	downloadOnly := m.downloadOnly
+	mode := m.mode
+	gen := m.modeGen
 	pendingVersion := m.pendingVersion
 	latestVersion := m.update.LatestVersion()
 	m.updateMutex.Unlock()
 
-	if downloadOnly {
+	if mode == modeUndecided {
+		return
+	}
+
+	if mode == modeDownloadOnly {
 		if latestVersion == nil {
 			return
 		}
@@ -268,6 +287,9 @@ func (m *Manager) NotifyUI() {
 		if err != nil || currentVersion.GreaterThanOrEqual(latestVersion) {
 			return
 		}
+		if m.modeChanged(gen) {
+			return
+		}
 		m.statusRecorder.PublishEvent(
 			cProto.SystemEvent_INFO,
 			cProto.SystemEvent_SYSTEM,
@@ -278,7 +300,7 @@ func (m *Manager) NotifyUI() {
 		return
 	}
 
-	if pendingVersion != nil {
+	if pendingVersion != nil && !m.modeChanged(gen) {
 		m.statusRecorder.PublishEvent(
 			cProto.SystemEvent_INFO,
 			cProto.SystemEvent_SYSTEM,
@@ -343,13 +365,18 @@ func (m *Manager) handleUpdate(ctx context.Context) {
 		return
 	}
 
-	downloadOnly := m.downloadOnly
+	mode := m.mode
+	gen := m.modeGen
 	forceUpdate := m.forceUpdate
 	curLatestVersion := m.update.LatestVersion()
 
 	switch {
+	case mode == modeUndecided:
+		log.Tracef("auto-update mode not decided yet")
+		m.updateMutex.Unlock()
+		return
 	// Download-only mode or resolve "latest" to actual version
-	case downloadOnly, m.updateToLatestVersion:
+	case mode == modeDownloadOnly, m.updateToLatestVersion:
 		if curLatestVersion == nil {
 			log.Tracef("latest version not fetched yet")
 			m.updateMutex.Unlock()
@@ -374,12 +401,17 @@ func (m *Manager) handleUpdate(ctx context.Context) {
 	m.lastTrigger = time.Now()
 	log.Infof("new version available: %s", updateVersion)
 
-	if !downloadOnly && !forceUpdate {
+	if mode == modeManaged && !forceUpdate {
 		m.pendingVersion = updateVersion
 	}
 	m.updateMutex.Unlock()
 
-	if downloadOnly {
+	if m.modeChanged(gen) {
+		log.Debugf("auto-update mode changed while checking %s, discarding", updateVersion)
+		return
+	}
+
+	if mode == modeDownloadOnly {
 		m.statusRecorder.PublishEvent(
 			cProto.SystemEvent_INFO,
 			cProto.SystemEvent_SYSTEM,
@@ -406,6 +438,33 @@ func (m *Manager) handleUpdate(ctx context.Context) {
 	)
 }
 
+func (m *Manager) modeChanged(gen uint64) bool {
+	m.updateMutex.Lock()
+	defer m.updateMutex.Unlock()
+
+	return m.modeGen != gen
+}
+
+func (m *Manager) sameDirectiveLocked(expectedVersion *v.Version, forceUpdate bool) bool {
+	if m.mode != modeManaged || m.forceUpdate != forceUpdate {
+		return false
+	}
+	if expectedVersion == nil {
+		return m.updateToLatestVersion
+	}
+	return m.expectedVersion != nil && m.expectedVersion.Equal(expectedVersion)
+}
+
+func (m *Manager) setModeLocked(mode updateMode) {
+	m.mode = mode
+	m.modeGen++
+	m.forceUpdate = false
+	m.expectedVersion = nil
+	m.updateToLatestVersion = false
+	m.pendingVersion = nil
+	m.lastTrigger = time.Time{}
+}
+
 func (m *Manager) install(ctx context.Context, pendingVersion *v.Version) error {
 	m.statusRecorder.PublishEvent(
 		cProto.SystemEvent_CRITICAL,
diff --git a/client/internal/updater/manager_linux_test.go b/client/internal/updater/manager_linux_test.go
index b05dd7e7d..4501ddde7 100644
--- a/client/internal/updater/manager_linux_test.go
+++ b/client/internal/updater/manager_linux_test.go
@@ -16,7 +16,7 @@ import (
 )
 
 // On Linux, only Mode 1 (downloadOnly) is supported.
-// SetVersion is a no-op because auto-update installation is not supported.
+// SetVersion falls back to download-only because auto-update installation is not supported.
 
 func Test_LatestVersion_Linux(t *testing.T) {
 	testMatrix := []struct {
@@ -70,7 +70,7 @@ func Test_LatestVersion_Linux(t *testing.T) {
 			t.Errorf("%s: Initial version mismatch, expected %v, got %v", c.name, c.initialLatestVersion.String(), ver)
 		}
 
-		mockUpdate.latestVersion = c.latestVersion
+		mockUpdate.setLatestVersion(c.latestVersion)
 		mockUpdate.onUpdate()
 
 		ver, enforced = waitForUpdateEvent(sub, 500*time.Millisecond)
@@ -89,22 +89,24 @@ func Test_LatestVersion_Linux(t *testing.T) {
 	}
 }
 
-func Test_SetVersion_NoOp_Linux(t *testing.T) {
-	// On Linux, SetVersion should be a no-op — no events fired
-	tmpFile := path.Join(t.TempDir(), "update-test-noop.json")
+func Test_SetVersion_FallsBackToDownloadOnly_Linux(t *testing.T) {
+	tmpFile := path.Join(t.TempDir(), "update-test-fallback.json")
 	recorder := peer.NewRecorder("")
 	sub := recorder.SubscribeToEvents()
 	defer recorder.UnsubscribeFromEvents(sub)
 
 	m := NewManager(recorder, statemanager.New(tmpFile))
-	m.update = &versionUpdateMock{latestVersion: v.Must(v.NewSemver("1.0.1"))}
+	m.update = &versionUpdateMock{latestVersion: v.Must(v.NewSemver("1.0.5"))}
 	m.currentVersion = "1.0.0"
 	m.Start(context.Background())
 	m.SetVersion("1.0.1", false)
 
-	ver, _ := waitForUpdateEvent(sub, 500*time.Millisecond)
-	if ver != "" {
-		t.Errorf("SetVersion should be a no-op on Linux, but got event with version %s", ver)
+	ver, enforced := waitForUpdateEvent(sub, 500*time.Millisecond)
+	if ver != "1.0.5" {
+		t.Fatalf("expected download-only event for fetched 1.0.5, got %q", ver)
+	}
+	if enforced {
+		t.Error("Linux fallback must never have enforced metadata")
 	}
 
 	m.Stop()
diff --git a/client/internal/updater/manager_mode_test.go b/client/internal/updater/manager_mode_test.go
new file mode 100644
index 000000000..aa238f94c
--- /dev/null
+++ b/client/internal/updater/manager_mode_test.go
@@ -0,0 +1,217 @@
+package updater
+
+import (
+	"context"
+	"path"
+	"testing"
+	"time"
+
+	v "github.com/hashicorp/go-version"
+
+	"github.com/netbirdio/netbird/client/internal/peer"
+	"github.com/netbirdio/netbird/client/internal/statemanager"
+)
+
+func Test_UndecidedMode_SuppressesNotification(t *testing.T) {
+	tmpFile := path.Join(t.TempDir(), "update-test-undecided.json")
+	recorder := peer.NewRecorder("")
+	sub := recorder.SubscribeToEvents()
+	defer recorder.UnsubscribeFromEvents(sub)
+
+	mockUpdate := &versionUpdateMock{latestVersion: v.Must(v.NewSemver("1.0.1"))}
+	m := NewManager(recorder, statemanager.New(tmpFile))
+	m.update = mockUpdate
+	m.currentVersion = "1.0.0"
+	m.Start(context.Background())
+	defer m.Stop()
+
+	mockUpdate.onUpdate()
+	if ver, _ := waitForUpdateEvent(sub, 300*time.Millisecond); ver != "" {
+		t.Fatalf("undecided mode must not publish, got %q", ver)
+	}
+
+	m.NotifyUI()
+	if ver, _ := waitForUpdateEvent(sub, 300*time.Millisecond); ver != "" {
+		t.Fatalf("NotifyUI in undecided mode must not publish, got %q", ver)
+	}
+
+	m.SetDownloadOnly()
+	ver, enforced := waitForUpdateEvent(sub, 500*time.Millisecond)
+	if ver != "1.0.1" {
+		t.Fatalf("expected download-only event for 1.0.1, got %q", ver)
+	}
+	if enforced {
+		t.Error("download-only event must not carry enforced metadata")
+	}
+}
+
+func Test_ResetMode_ReturnsToUndecided(t *testing.T) {
+	tmpFile := path.Join(t.TempDir(), "update-test-reset.json")
+	recorder := peer.NewRecorder("")
+	sub := recorder.SubscribeToEvents()
+	defer recorder.UnsubscribeFromEvents(sub)
+
+	mockUpdate := &versionUpdateMock{latestVersion: v.Must(v.NewSemver("1.0.1"))}
+	m := NewManager(recorder, statemanager.New(tmpFile))
+	m.update = mockUpdate
+	m.currentVersion = "1.0.0"
+	m.autoUpdateSupported = func() bool { return true }
+	m.Start(context.Background())
+	defer m.Stop()
+
+	m.SetVersion("1.0.1", false)
+	ver, enforced := waitForUpdateEvent(sub, 500*time.Millisecond)
+	if ver != "1.0.1" || !enforced {
+		t.Fatalf("expected enforced event for 1.0.1, got %q enforced=%v", ver, enforced)
+	}
+
+	m.ResetMode()
+
+	mockUpdate.onUpdate()
+	if ver, _ := waitForUpdateEvent(sub, 300*time.Millisecond); ver != "" {
+		t.Fatalf("reset mode must not publish on fetch, got %q", ver)
+	}
+
+	m.NotifyUI()
+	if ver, _ := waitForUpdateEvent(sub, 300*time.Millisecond); ver != "" {
+		t.Fatalf("NotifyUI after reset must not publish, got %q", ver)
+	}
+
+	if err := m.Install(context.Background()); err == nil {
+		t.Fatal("Install after reset must fail without a pending version")
+	}
+
+	m.SetVersion("1.0.1", false)
+	ver, enforced = waitForUpdateEvent(sub, 500*time.Millisecond)
+	if ver != "1.0.1" || !enforced {
+		t.Fatalf("expected enforced event again after reset, got %q enforced=%v", ver, enforced)
+	}
+}
+
+func Test_SetDownloadOnly_ClearsPendingVersion(t *testing.T) {
+	tmpFile := path.Join(t.TempDir(), "update-test-pending.json")
+	recorder := peer.NewRecorder("")
+	sub := recorder.SubscribeToEvents()
+	defer recorder.UnsubscribeFromEvents(sub)
+
+	m := NewManager(recorder, statemanager.New(tmpFile))
+	m.update = &versionUpdateMock{latestVersion: v.Must(v.NewSemver("1.0.1"))}
+	m.currentVersion = "1.0.0"
+	m.autoUpdateSupported = func() bool { return true }
+	m.Start(context.Background())
+	defer m.Stop()
+
+	m.SetVersion("1.0.1", false)
+	if ver, enforced := waitForUpdateEvent(sub, 500*time.Millisecond); ver != "1.0.1" || !enforced {
+		t.Fatalf("expected enforced event for 1.0.1, got %q enforced=%v", ver, enforced)
+	}
+
+	m.SetDownloadOnly()
+	if ver, enforced := waitForUpdateEvent(sub, 500*time.Millisecond); ver != "1.0.1" || enforced {
+		t.Fatalf("expected download-only event for 1.0.1, got %q enforced=%v", ver, enforced)
+	}
+
+	if err := m.Install(context.Background()); err == nil {
+		t.Fatal("Install in download-only mode must not install the staged managed version")
+	}
+}
+
+func Test_ResetMode_SilencesStaleForceDirective(t *testing.T) {
+	tmpFile := path.Join(t.TempDir(), "update-test-force-reset.json")
+	recorder := peer.NewRecorder("")
+	sub := recorder.SubscribeToEvents()
+	defer recorder.UnsubscribeFromEvents(sub)
+
+	mockUpdate := &versionUpdateMock{}
+	m := NewManager(recorder, statemanager.New(tmpFile))
+	m.update = mockUpdate
+	m.currentVersion = "1.0.0"
+	m.autoUpdateSupported = func() bool { return true }
+	m.Start(context.Background())
+	defer m.Stop()
+
+	// Management enforces "latest" before the fetcher has reported any version,
+	// so nothing can be installed while the engine is still up.
+	m.SetVersion(latestVersion, true)
+	if event := waitForAnyEvent(sub, 300*time.Millisecond); event != nil {
+		t.Fatalf("no event expected before the latest version is known, got %v", event)
+	}
+
+	// The engine stop resets the mode. A release published afterwards must not
+	// trigger the stale forced install or any notification.
+	m.ResetMode()
+	mockUpdate.setLatestVersion(v.Must(v.NewSemver("1.0.1")))
+	mockUpdate.onUpdate()
+	if event := waitForAnyEvent(sub, 300*time.Millisecond); event != nil {
+		t.Fatalf("stale force directive must stay silent after reset, got %v", event)
+	}
+
+	m.SetVersion("1.0.1", false)
+	ver, enforced := waitForUpdateEvent(sub, 500*time.Millisecond)
+	if ver != "1.0.1" || !enforced {
+		t.Fatalf("expected enforced event after a fresh directive, got %q enforced=%v", ver, enforced)
+	}
+}
+
+func Test_SetVersion_MalformedFallsBackToDownloadOnly(t *testing.T) {
+	tmpFile := path.Join(t.TempDir(), "update-test-malformed.json")
+	recorder := peer.NewRecorder("")
+	sub := recorder.SubscribeToEvents()
+	defer recorder.UnsubscribeFromEvents(sub)
+
+	m := NewManager(recorder, statemanager.New(tmpFile))
+	m.update = &versionUpdateMock{latestVersion: v.Must(v.NewSemver("1.0.1"))}
+	m.currentVersion = "1.0.0"
+	m.autoUpdateSupported = func() bool { return true }
+	m.Start(context.Background())
+	defer m.Stop()
+
+	m.SetVersion("not-a-version", false)
+	ver, enforced := waitForUpdateEvent(sub, 500*time.Millisecond)
+	if ver != "1.0.1" {
+		t.Fatalf("expected download-only event for 1.0.1 after malformed version, got %q", ver)
+	}
+	if enforced {
+		t.Error("malformed version fallback must not carry enforced metadata")
+	}
+}
+
+func Test_SetVersion_ForceChangeAppliesWithSameVersion(t *testing.T) {
+	m := NewManager(peer.NewRecorder(""), statemanager.New(path.Join(t.TempDir(), "update-test-force-change.json")))
+	m.update = &versionUpdateMock{}
+	m.autoUpdateSupported = func() bool { return true }
+
+	m.SetVersion("1.0.1", false)
+	m.SetVersion("1.0.1", true)
+
+	m.updateMutex.Lock()
+	defer m.updateMutex.Unlock()
+	if !m.forceUpdate {
+		t.Fatal("enabling force update without a version change must take effect")
+	}
+	if m.expectedVersion == nil || m.expectedVersion.String() != "1.0.1" {
+		t.Fatalf("expected version 1.0.1 to stay set, got %v", m.expectedVersion)
+	}
+}
+
+func Test_SetVersion_RepeatedDirectiveKeepsMode(t *testing.T) {
+	m := NewManager(peer.NewRecorder(""), statemanager.New(path.Join(t.TempDir(), "update-test-repeat.json")))
+	m.update = &versionUpdateMock{}
+	m.autoUpdateSupported = func() bool { return true }
+
+	for _, expected := range []string{"1.0.1", latestVersion} {
+		m.SetVersion(expected, false)
+		m.updateMutex.Lock()
+		gen := m.modeGen
+		m.updateMutex.Unlock()
+
+		m.SetVersion(expected, false)
+		m.updateMutex.Lock()
+		repeatedGen := m.modeGen
+		m.updateMutex.Unlock()
+
+		if repeatedGen != gen {
+			t.Errorf("repeating the %q directive must not reset the mode", expected)
+		}
+	}
+}
diff --git a/client/internal/updater/manager_test.go b/client/internal/updater/manager_test.go
index 107dca2b3..939c09814 100644
--- a/client/internal/updater/manager_test.go
+++ b/client/internal/updater/manager_test.go
@@ -66,7 +66,7 @@ func Test_LatestVersion(t *testing.T) {
 			t.Errorf("%s: Initial update version mismatch, expected %v, got %v", c.name, c.initialLatestVersion.String(), ver)
 		}
 
-		mockUpdate.latestVersion = c.latestVersion
+		mockUpdate.setLatestVersion(c.latestVersion)
 		mockUpdate.onUpdate()
 
 		ver, _ = waitForUpdateEvent(sub, 500*time.Millisecond)
diff --git a/client/internal/updater/manager_test_helpers_test.go b/client/internal/updater/manager_test_helpers_test.go
index c7faee1f4..430b31ec1 100644
--- a/client/internal/updater/manager_test_helpers_test.go
+++ b/client/internal/updater/manager_test_helpers_test.go
@@ -2,21 +2,24 @@ package updater
 
 import (
 	"strconv"
+	"sync"
 	"time"
 
 	v "github.com/hashicorp/go-version"
 
 	"github.com/netbirdio/netbird/client/internal/peer"
+	cProto "github.com/netbirdio/netbird/client/proto"
 )
 
 type versionUpdateMock struct {
 	latestVersion *v.Version
 	onUpdate      func()
+	mu            sync.Mutex
 }
 
-func (m versionUpdateMock) StopWatch() {}
+func (m *versionUpdateMock) StopWatch() {}
 
-func (m versionUpdateMock) SetDaemonVersion(newVersion string) bool {
+func (m *versionUpdateMock) SetDaemonVersion(newVersion string) bool {
 	return false
 }
 
@@ -24,11 +27,19 @@ func (m *versionUpdateMock) SetOnUpdateListener(updateFn func()) {
 	m.onUpdate = updateFn
 }
 
-func (m versionUpdateMock) LatestVersion() *v.Version {
+func (m *versionUpdateMock) LatestVersion() *v.Version {
+	m.mu.Lock()
+	defer m.mu.Unlock()
 	return m.latestVersion
 }
 
-func (m versionUpdateMock) StartFetcher() {}
+func (m *versionUpdateMock) StartFetcher() {}
+
+func (m *versionUpdateMock) setLatestVersion(version *v.Version) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.latestVersion = version
+}
 
 // waitForUpdateEvent waits for a new_version_available event, returns the version string or "" on timeout.
 func waitForUpdateEvent(sub *peer.EventSubscription, timeout time.Duration) (version string, enforced bool) {
@@ -54,3 +65,20 @@ func waitForUpdateEvent(sub *peer.EventSubscription, timeout time.Duration) (ver
 		}
 	}
 }
+
+// waitForAnyEvent returns the first published event of any kind, or nil on timeout.
+// Unlike waitForUpdateEvent it also catches the install-progress events, so a test
+// can assert that a forced install never started.
+func waitForAnyEvent(sub *peer.EventSubscription, timeout time.Duration) *cProto.SystemEvent {
+	timer := time.NewTimer(timeout)
+	defer timer.Stop()
+	select {
+	case event, ok := <-sub.Events():
+		if !ok {
+			return nil
+		}
+		return event
+	case <-timer.C:
+		return nil
+	}
+}

From cc51a3e16aa2fdcbdfe7ac81cd7f89700fbfb6ff Mon Sep 17 00:00:00 2001
From: Bethuel Mmbaga <bethuelmbaga12@gmail.com>
Date: Thu, 8 Oct 2026 13:55:09 +0300
Subject: [PATCH 24/70] [misc] Skip mysql-migrate container tests on Windows
 (#8121)

---
 .github/workflows/golang-test-windows.yml | 2 +-
 tools/mysql-migrate/main_test.go          | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/golang-test-windows.yml b/.github/workflows/golang-test-windows.yml
index ca300f7df..49be3af58 100644
--- a/.github/workflows/golang-test-windows.yml
+++ b/.github/workflows/golang-test-windows.yml
@@ -76,7 +76,7 @@ jobs:
         # resolve; the Where-Object pipeline then drops the broken package by
         # path. Without -e, go list aborts with empty stdout.
         run: |
-          $packages = go list -e ./... | Where-Object { $_ -notmatch '/management' } | Where-Object { $_ -notmatch '/relay' } | Where-Object { $_ -notmatch '/signal' } | Where-Object { $_ -notmatch '/proxy' } | Where-Object { $_ -notmatch '/combined' } | Where-Object { $_ -notmatch '/client/ui$' }
+          $packages = go list -e ./... | Where-Object { $_ -notmatch '/management' } | Where-Object { $_ -notmatch '/relay' } | Where-Object { $_ -notmatch '/signal' } | Where-Object { $_ -notmatch '/proxy' } | Where-Object { $_ -notmatch '/combined' } | Where-Object { $_ -notmatch '/client/ui$' } | Where-Object { $_ -notmatch '/tools/mysql-migrate' }
           $goExe = "C:\hostedtoolcache\windows\go\${{ steps.go.outputs.go-version }}\x64\bin\go.exe"
           $cmd = "$goExe test -tags `"devcert privileged`" -timeout 10m -p 1 $($packages -join ' ') > test-out.txt 2>&1"
           Set-Content -Path "${{ github.workspace }}\run-tests.cmd" -Value $cmd
diff --git a/tools/mysql-migrate/main_test.go b/tools/mysql-migrate/main_test.go
index c80fc6e4c..59d444440 100644
--- a/tools/mysql-migrate/main_test.go
+++ b/tools/mysql-migrate/main_test.go
@@ -32,8 +32,8 @@ import (
 const testAccountID = "bf1c8084-ba50-4ce7-9439-34653001fc3b"
 
 func TestRun(t *testing.T) {
-	if os.Getenv("CI") == "true" && runtime.GOOS != "linux" {
-		t.Skip("needs Docker for the MySQL and Postgres containers")
+	if runtime.GOOS == "windows" || (os.Getenv("CI") == "true" && runtime.GOOS != "linux") {
+		t.Skip("needs Docker with Linux containers for MySQL and Postgres")
 	}
 	// Seed in UTC to match the --mysql-timezone default.
 	time.Local = time.UTC
@@ -153,8 +153,8 @@ func accountJSON(t *testing.T, ctx context.Context, s store.Store) string {
 }
 
 func TestMySQLTimezone(t *testing.T) {
-	if os.Getenv("CI") == "true" && runtime.GOOS != "linux" {
-		t.Skip("needs Docker for the MySQL and Postgres containers")
+	if runtime.GOOS == "windows" || (os.Getenv("CI") == "true" && runtime.GOOS != "linux") {
+		t.Skip("needs Docker with Linux containers for MySQL and Postgres")
 	}
 	ctx := context.Background()
 	mysqlDSN := newMySQLDatabase(t, "tz_src")

From 834b0f699c8d2fd941dc5a3a73ab975388e5cc48 Mon Sep 17 00:00:00 2001
From: Maycon Santos <mlsmaycon@gmail.com>
Date: Thu, 8 Oct 2026 15:04:12 +0200
Subject: [PATCH 25/70] [misc] Exclude tools/mysql-migrate from docker tests
 (#8128)

---
 .github/workflows/golang-test-linux.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/golang-test-linux.yml b/.github/workflows/golang-test-linux.yml
index 449eb14fa..dd6b9fe68 100644
--- a/.github/workflows/golang-test-linux.yml
+++ b/.github/workflows/golang-test-linux.yml
@@ -270,7 +270,7 @@ jobs:
             sh -c ' \
               apk update; apk add --no-cache \
                 ca-certificates iptables ip6tables dbus dbus-dev libpcap-dev build-base; \
-              go test -buildvcs=false -tags "devcert privileged" -v -timeout 10m -p 1 $(go list -e -buildvcs=false ./... | grep -v -e /management -e /signal -e /relay -e /proxy -e /combined -e /client/ui -e /upload-server -e /client/testutil/privileged)
+              go test -buildvcs=false -tags "devcert privileged" -v -timeout 10m -p 1 $(go list -e -buildvcs=false ./... | grep -v -e /management -e /signal -e /relay -e /proxy -e /combined -e /client/ui -e /upload-server -e /client/testutil/privileged -e tools/mysql-migrate)
             '
 
   test_relay:

From 515a01dd11797a20374dc70d3c686fb2a35df00d Mon Sep 17 00:00:00 2001
From: Zoltan Papp <zoltan.pmail@gmail.com>
Date: Thu, 8 Oct 2026 15:40:39 +0200
Subject: [PATCH 26/70] [client] Force interactive login when extending the
 auth session (#7216)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* [client] Force interactive login when extending the auth session

A session extend must be answered from the account the peer is registered
under. With a silent PKCE flow (DisablePromptLogin or max_age=0) the IdP
answers from whatever session it already holds, which need not be the
peer's account when several are signed in; the token then fails the
user match in ExtendAuthSession with no way to pick another account.

Mark the PKCE flow request as a session extend so the management server
can force prompt=login for it, overriding the configured silent flow.

* [client] Reduce cognitive complexity of Server.Login

Login sat at cognitive complexity 27, over the 25 the linter allows.

Extract the interactive SSO branch into startSSOLogin, and split the
nested in-flight-flow reuse check out of it into reuseOAuthFlow, which
flattens the original if/else into early returns: it returns the cached
auth info when the previous flow targets the same client and still has
more than 90s left, otherwise cancels the stale wait and returns nil so
the caller requests a fresh flow.

The helpers take the contextState through a small statusSetter
interface, since internal.contextState is unexported and re-deriving it
with CtxGetState inside the helper would resolve against callerCtx
rather than rootCtx.

No behavior change: same ordering of state transitions, same mutex scope
around the oauthAuthFlow write, same error paths. Login is now at 21.

* [client] Respect DisablePromptLogin when extending the auth session

Forcing prompt=login on a session extend overrode DisablePromptLogin, which
is set for IdPs that break on it: Authentik triggers a double authentication
and social logins fail outright. Overriding it there trades a recoverable
extend for a login that cannot complete at all.

Keep the LoginFlag override, which only replaces max_age=0 or none with
prompt=login so the IdP honours login_hint, and leave DisablePromptLogin as
configured. Those deployments keep the silent flow, and with several accounts
signed in an extend answered from the wrong one still fails the user match.

* [client] Guard the shared OAuth flow state with the server mutex

reuseOAuthFlow read flow, expiresAt, waitCancel and info without holding
s.mutex, while startSSOLogin and WaitSSOLogin write them under it. Reading the
fields one at a time could also answer with auth info from a flow that was
already replaced, or cancel a wait that no longer belongs to the flow just
judged stale. Take one snapshot under the lock and decide from it.

WaitSSOLogin read oauthAuthFlow.flow twice outside the lock; both now use a
value snapshotted in the critical section that already installs actCancel.

Its stale waitCancel was read and called in a separate section from the one
installing the new one, so two racing calls could read the same predecessor and
leave one wait uncancelled. Swap the two in a single critical section. Both
cancels run after unlocking: the displaced wait takes s.mutex as it unwinds.

* [client] Verify the SSO login came back for the hinted account

login_hint is a suggestion the IdP may ignore: with a silent flow configured
(DisablePromptLogin or max_age=0) and a live IdP session for another account,
the login completes with that account's token. On a registered peer the
management server rejects it as a user mismatch, but on a fresh profile the
peer silently registers under the wrong account and the profile is then bound
to it — every later login follows the stored hint straight back.

After the token exchange, compare the ID token's email against the hint the
flow was sent with. On a mismatch, do not log in to management with the token;
run one more round asking the IdP to re-decide the account (prompt=login, via
ForceAccountPrompt — DisablePromptLogin still wins there). If the prompted
round also comes back different, proceed with a warning: the address may
legitimately have changed, and refusing forever would lock the user out of the
profile while the management server still rejects a token that does not own
the peer. A token or profile with no email to compare is not judged.

The retry differs per platform because of who opens the browser:

- CLI (netbird login foreground) and Android run the whole flow in one
  process, so the mismatch retries automatically: the browser reopens with
  the account prompt within the same login attempt.
- On desktop the login is split between the daemon and the GUI: Login hands
  the authorize URL to the GUI, WaitSSOLogin blocks for the token, and only
  the GUI can open a browser. A new URL cannot be handed out from inside
  WaitSSOLogin (its response has no field for one, kept that way to avoid a
  proto change), so the daemon arms forceAccountPrompt, fails the round with
  "connect again to choose the account", and builds the next Login's flow
  with the prompt — the user's next connect is the retry.

The flag and the flow annotations live in daemon memory only; SwitchProfile
drops them so the previous profile's hint cannot judge the next profile's
token. The device code flow has no prompt parameter (RFC 8628), so a prompted
round there runs as-is and a repeated mismatch is let through with the
warning rather than looping.

* [client] Address review comments on PKCE session extend flow

Fail the PKCE authorization flow test on request error instead of
continuing into a nil dereference, and make the godoc comments on the
touched exported symbols identifier-leading full sentences.

* [client] Match accounts only on the email claim of the ID token

The name-claim fallback in the ID token parsing is kept for the login
hint and display, but account matching now only considers a value that
came from the email claim, so a token without one no longer produces a
false account mismatch.

* [client] Drop the pending session extend on a profile switch

The profile-switch cleanup dropped the pending login flow and the
account-prompt flag, but left extendAuthSessionFlow untouched. Its device
code was issued by the previous profile's IdP client, so a
WaitExtendAuthSession still parked on the browser leg would submit the
resulting token against the new profile's engine.

* [client] Judge the SSO account against the flow that produced the token

WaitSSOLogin snapshotted the flow on entry but re-read the info, hint and
accountPrompted from the live s.oauthAuthFlow afterwards, in separate
critical sections. WaitToken blocks for the whole browser leg, so a
concurrent Login or RequestJWTAuth could replace the flow meanwhile and
the mismatch check would compare this wait's token against another flow's
account: either arming the prompt spuriously or letting a wrong-account
token through against an unrelated profile's hint. Take all of it in the
entry snapshot.

* [client] Keep the forced account prompt from being lost to flow reuse

startSSOLogin consumed forceAccountPrompt and applied the prompt to the
freshly built flow, but reuseOAuthFlow could then answer from a cached
flow for the same client — one built without prompt=login, e.g. by
RequestJWTAuth. The user got the same silent authorization URL that
produced the mismatch, with the flag already spent, so no later round
asked either. Rule reuse out when the prompt is forced, while still
cancelling the predecessor's wait.

RequestJWTAuth also wrote the flow fields one by one, leaving the previous
login's hint and accountPrompted behind for WaitSSOLogin to judge a later
token against. Both sites now replace the whole record.

* [client] Consume the forced account prompt after the retry

forceAccountPrompt was never cleared, so a flow that outlived the retry it
was armed for kept sending prompt=login on every later authorization
request and re-authenticated the user each time. RequestAuthInfo now takes
the flag as it builds the request.

* [client] Cancel the caller context in the SSO login tests

WaitSSOLogin parks a goroutine on the caller's context for the whole
browser leg. The tests passed context.Background(), which never cancels,
so each left one goroutine behind for the lifetime of the test binary.

* [client] Cancel the wait displaced by an OAuth flow replacement

Replacing the shared record with a whole struct value dropped the previous
flow's waitCancel, so an SSO browser wait still parked on it lost its
cancel: nothing could preempt it, and it could go on to run attemptLogin
or mutate the record behind the new flow. Both replacement sites now take
the displaced cancel over in the same critical section, via a shared
replaceOAuthFlow, and invoke it after the unlock.

* [client] Guard OAuth flow mutations by the flow that owns the wait

* [client] Arm the account prompt only from the wait that owns the flow

* [client] Adopt the three-value parseEmailFromIDToken in the device flow

The main merge brought in the device flow's email extraction from #7193,
which still used the two-value signature this branch replaced when account
matching was narrowed to the email claim. Git merged the files without a
textual conflict, so the branch stopped compiling.

Take the fromEmailClaim result and fill EmailClaim from it, the same way the
PKCE path does, so device-flow clients get the same account matching.

* [client] Populate the pending extend flow in the test server helper

SwitchProfile cancels and clears the pending session extend flow
unconditionally, the same way it clears the SSH JWT cache. New always
populates the field, but the hand-assembled test server did not, so
TestSwitchProfile_ClearsJWTCache panicked on a nil PendingFlow.
---
 client/android/login.go                       |   41 +-
 client/android/session.go                     |   10 +-
 client/android/ssh_client.go                  |    2 +-
 client/cmd/login.go                           |   35 +-
 client/internal/auth/account_match_test.go    |  113 ++
 client/internal/auth/auth.go                  |   18 +-
 client/internal/auth/device_flow.go           |    5 +-
 client/internal/auth/oauth.go                 |   61 +-
 client/internal/auth/pkce_flow.go             |   73 +-
 client/internal/auth/pkce_flow_test.go        |   26 +
 client/ios/NetBirdSDK/client.go               |    2 +-
 client/ios/NetBirdSDK/login.go                |    2 +-
 client/server/login_account_test.go           |  211 +++
 client/server/server.go                       |  240 ++-
 client/server/server_connect_test.go          |    4 +-
 .../internals/shared/grpc/pkce_flow_test.go   |   87 ++
 management/internals/shared/grpc/server.go    |   38 +-
 shared/management/client/client.go            |    6 +-
 shared/management/client/client_test.go       |   13 +-
 shared/management/client/grpc.go              |   10 +-
 shared/management/client/mock.go              |    7 +-
 shared/management/proto/management.pb.go      | 1375 +++++++++--------
 shared/management/proto/management.proto      |   14 +-
 23 files changed, 1591 insertions(+), 802 deletions(-)
 create mode 100644 client/internal/auth/account_match_test.go
 create mode 100644 client/server/login_account_test.go
 create mode 100644 management/internals/shared/grpc/pkce_flow_test.go

diff --git a/client/android/login.go b/client/android/login.go
index 155c6eadd..b9ec21b39 100644
--- a/client/android/login.go
+++ b/client/android/login.go
@@ -194,12 +194,49 @@ func (a *Auth) login(urlOpener URLOpener, isAndroidTV bool) error {
 }
 
 func (a *Auth) foregroundGetTokenInfo(authClient *auth.Auth, urlOpener URLOpener, isAndroidTV bool) (*auth.TokenInfo, error) {
-	oAuthFlow, err := authClient.GetOAuthFlow(a.ctx, isAndroidTV, profileLoginHint(a.cfgPath))
+	return a.foregroundGetTokenInfoFlow(authClient, urlOpener, isAndroidTV, false)
+}
+
+// foregroundGetTokenInfoFlow runs the interactive flow. sessionExtend tells the
+// server the token will renew this peer's session rather than log a peer in, so
+// it can rule out a silent authorization the IdP could answer from an unrelated
+// account. See PKCEAuthorizationFlowRequest.
+func (a *Auth) foregroundGetTokenInfoFlow(authClient *auth.Auth, urlOpener URLOpener, isAndroidTV bool, sessionExtend bool) (*auth.TokenInfo, error) {
+	hint := profileLoginHint(a.cfgPath)
+
+	oAuthFlow, err := authClient.GetOAuthFlow(a.ctx, isAndroidTV, sessionExtend, hint)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get OAuth flow: %v", err)
 	}
 
-	return runOAuthFlow(a.ctx, oAuthFlow, urlOpener, nil)
+	tokenInfo, err := runOAuthFlow(a.ctx, oAuthFlow, urlOpener, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	if tokenInfo.MatchesAccount(hint) {
+		return tokenInfo, nil
+	}
+
+	// The IdP answered from a session belonging to another account. Retrying is
+	// what makes this recoverable: on a peer already registered the server would
+	// reject the token, and on a fresh one it would silently register the peer
+	// under the wrong account and bind the profile to it.
+	log.Infof("login returned an account other than the one this profile is bound to, retrying with an account prompt")
+	retryFlow := auth.RetryFlowForAccount(oAuthFlow)
+	if retryFlow == nil {
+		return tokenInfo, nil
+	}
+
+	retryToken, err := runOAuthFlow(a.ctx, retryFlow, urlOpener, nil)
+	if err != nil {
+		return nil, err
+	}
+	if !retryToken.MatchesAccount(hint) {
+		log.Warnf("login still returned a different account after the prompt, continuing with it")
+	}
+
+	return retryToken, nil
 }
 
 // profileLoginHint returns the stored account email for the profile at cfgPath.
diff --git a/client/android/session.go b/client/android/session.go
index 1ce97f074..b2de8dadb 100644
--- a/client/android/session.go
+++ b/client/android/session.go
@@ -222,11 +222,13 @@ func (c *Client) extendAuthSession(ctx context.Context, urlOpener URLOpener, isA
 	}
 	defer authClient.Close()
 
-	// Passing the config path makes the flow pick up the login_hint: an extend
-	// renews the session of the account already signed in, so it must not stop to
-	// offer a choice.
+	// Passing the config path makes the flow pick up the login_hint. That alone
+	// cannot keep the IdP on this profile's account though — a hint is only a
+	// suggestion, and a silent authorization is answered from whatever session the
+	// IdP already has, which need not be this peer's when several accounts are
+	// signed in. Marking the flow as an extend lets the server rule that out.
 	a := NewAuthWithConfig(ctx, cfg, cfgPath)
-	tokenInfo, err := a.foregroundGetTokenInfo(authClient, urlOpener, isAndroidTV)
+	tokenInfo, err := a.foregroundGetTokenInfoFlow(authClient, urlOpener, isAndroidTV, true)
 	if err != nil {
 		return fmt.Errorf("interactive sso login failed: %v", err)
 	}
diff --git a/client/android/ssh_client.go b/client/android/ssh_client.go
index 9a11044ba..e05249e98 100644
--- a/client/android/ssh_client.go
+++ b/client/android/ssh_client.go
@@ -469,7 +469,7 @@ func (s *SSHClient) requestJWTToken(cfg *profilemanager.Config, cfgPath string)
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
 	defer cancel()
 
-	flow, err := auth.NewOAuthFlow(ctx, cfg, false, true, profileLoginHint(cfgPath))
+	flow, err := auth.NewOAuthFlow(ctx, cfg, false, true, profileLoginHint(cfgPath), false)
 	if err != nil {
 		return "", fmt.Errorf("create oauth flow: %w", err)
 	}
diff --git a/client/cmd/login.go b/client/cmd/login.go
index 1dc2d0d09..764fdd5b1 100644
--- a/client/cmd/login.go
+++ b/client/cmd/login.go
@@ -425,11 +425,44 @@ func foregroundGetTokenInfo(ctx context.Context, cmd *cobra.Command, config *pro
 		hint = profileState.Email
 	}
 
-	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, util.HasGraphicalSession(), false, hint)
+	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, util.HasGraphicalSession(), false, hint, false)
 	if err != nil {
 		return nil, err
 	}
 
+	tokenInfo, err := runInteractiveFlow(cmd, oAuthFlow)
+	if err != nil {
+		return nil, err
+	}
+
+	if tokenInfo.MatchesAccount(hint) {
+		return tokenInfo, nil
+	}
+
+	// The IdP answered from a session belonging to another account. Retrying is
+	// what makes this recoverable: on a peer already registered the server would
+	// reject the token, and on a fresh one it would silently register the peer
+	// under the wrong account and bind the profile to it.
+	cmd.Println("The login returned a different account than this profile uses. Asking to sign in again.")
+	retryFlow := auth.RetryFlowForAccount(oAuthFlow)
+	if retryFlow == nil {
+		return tokenInfo, nil
+	}
+
+	retryToken, err := runInteractiveFlow(cmd, retryFlow)
+	if err != nil {
+		return nil, err
+	}
+	if !retryToken.MatchesAccount(hint) {
+		log.Warnf("login still returned a different account after the prompt, continuing with it")
+	}
+
+	return retryToken, nil
+}
+
+// runInteractiveFlow requests the authorization info, shows the URL to the user
+// and blocks until the token comes back.
+func runInteractiveFlow(cmd *cobra.Command, oAuthFlow auth.OAuthFlow) (*auth.TokenInfo, error) {
 	flowInfo, err := oAuthFlow.RequestAuthInfo(context.TODO())
 	if err != nil {
 		return nil, fmt.Errorf("getting a request OAuth flow info failed: %v", err)
diff --git a/client/internal/auth/account_match_test.go b/client/internal/auth/account_match_test.go
new file mode 100644
index 000000000..b879cf9ab
--- /dev/null
+++ b/client/internal/auth/account_match_test.go
@@ -0,0 +1,113 @@
+package auth
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestTokenInfoMatchesAccount(t *testing.T) {
+	tests := []struct {
+		name  string
+		token TokenInfo
+		hint  string
+		match bool
+	}{
+		{
+			name:  "same account",
+			token: TokenInfo{EmailClaim: "user@example.com"},
+			hint:  "user@example.com",
+			match: true,
+		},
+		{
+			name:  "different account",
+			token: TokenInfo{EmailClaim: "other@example.com"},
+			hint:  "user@example.com",
+			match: false,
+		},
+		{
+			name:  "case differences are the same account",
+			token: TokenInfo{EmailClaim: "User@Example.com"},
+			hint:  "user@example.com",
+			match: true,
+		},
+		{
+			name:  "no hint leaves the choice to the IdP",
+			token: TokenInfo{EmailClaim: "other@example.com"},
+			hint:  "",
+			match: true,
+		},
+		{
+			name:  "token without an email claim is not judged",
+			token: TokenInfo{EmailClaim: ""},
+			hint:  "user@example.com",
+			match: true,
+		},
+		{
+			name:  "name fallback does not trigger matching",
+			token: TokenInfo{Email: "Some One"},
+			hint:  "user@example.com",
+			match: true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.match, tc.token.MatchesAccount(tc.hint))
+		})
+	}
+}
+
+func TestParseEmailFromIDToken(t *testing.T) {
+	tests := []struct {
+		name          string
+		claims        map[string]interface{}
+		wantValue     string
+		wantFromEmail bool
+		wantErr       bool
+	}{
+		{
+			name:          "email claim",
+			claims:        map[string]interface{}{"email": "user@example.com", "name": "Some One"},
+			wantValue:     "user@example.com",
+			wantFromEmail: true,
+		},
+		{
+			name:      "name fallback",
+			claims:    map[string]interface{}{"name": "Some One"},
+			wantValue: "Some One",
+		},
+		{
+			name:    "neither claim present",
+			claims:  map[string]interface{}{"sub": "abc"},
+			wantErr: true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			value, fromEmailClaim, err := parseEmailFromIDToken(idTokenWithClaims(t, tc.claims))
+			if tc.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tc.wantValue, value)
+			assert.Equal(t, tc.wantFromEmail, fromEmailClaim)
+		})
+	}
+}
+
+func TestRetryFlowForAccountUnsupportedFlow(t *testing.T) {
+	assert.Nil(t, RetryFlowForAccount(&DeviceAuthorizationFlow{}))
+}
+
+func idTokenWithClaims(t *testing.T, claims map[string]interface{}) string {
+	t.Helper()
+	payload, err := json.Marshal(claims)
+	require.NoError(t, err)
+	return "header." + base64.RawURLEncoding.EncodeToString(payload) + ".signature"
+}
diff --git a/client/internal/auth/auth.go b/client/internal/auth/auth.go
index 939df3a21..7c156b5fd 100644
--- a/client/internal/auth/auth.go
+++ b/client/internal/auth/auth.go
@@ -103,7 +103,7 @@ func (a *Auth) IsSSOSupported(ctx context.Context) (bool, error) {
 
 	err := a.withRetry(ctx, func(client *mgm.GrpcClient) error {
 		// Try PKCE flow first
-		_, err := a.getPKCEFlow(client)
+		_, err := a.getPKCEFlow(client, false)
 		if err == nil {
 			supportsSSO = true
 			return nil
@@ -136,9 +136,13 @@ func (a *Auth) IsSSOSupported(ctx context.Context) (bool, error) {
 	return supportsSSO, err
 }
 
-// GetOAuthFlow returns an OAuth flow (PKCE or Device) using the existing management connection
-// This avoids creating a new connection to the management server
-func (a *Auth) GetOAuthFlow(ctx context.Context, forceDeviceAuth bool, hint string) (OAuthFlow, error) {
+// GetOAuthFlow returns an OAuth flow (PKCE or Device) using the existing management connection.
+// This avoids creating a new connection to the management server.
+//
+// sessionExtend marks the flow as renewing an existing peer's session rather than
+// logging one in; the server needs it to rule out a silent authorization that the
+// IdP could answer from another account. See PKCEAuthorizationFlowRequest.
+func (a *Auth) GetOAuthFlow(ctx context.Context, forceDeviceAuth bool, sessionExtend bool, hint string) (OAuthFlow, error) {
 	var flow OAuthFlow
 
 	err := a.withRetry(ctx, func(client *mgm.GrpcClient) error {
@@ -153,7 +157,7 @@ func (a *Auth) GetOAuthFlow(ctx context.Context, forceDeviceAuth bool, hint stri
 		}
 
 		// Try PKCE flow first
-		pkceFlow, err := a.getPKCEFlow(client)
+		pkceFlow, err := a.getPKCEFlow(client, sessionExtend)
 		if err != nil {
 			// If PKCE not supported, try Device flow
 			if s, ok := status.FromError(err); ok && (s.Code() == codes.NotFound || s.Code() == codes.Unimplemented) {
@@ -240,8 +244,8 @@ func (a *Auth) Login(ctx context.Context, setupKey string, jwtToken string) (err
 }
 
 // getPKCEFlow retrieves PKCE authorization flow configuration and creates a flow instance
-func (a *Auth) getPKCEFlow(client *mgm.GrpcClient) (*PKCEAuthorizationFlow, error) {
-	protoFlow, err := client.GetPKCEAuthorizationFlow()
+func (a *Auth) getPKCEFlow(client *mgm.GrpcClient, sessionExtend bool) (*PKCEAuthorizationFlow, error) {
+	protoFlow, err := client.GetPKCEAuthorizationFlow(sessionExtend)
 	if err != nil {
 		if s, ok := status.FromError(err); ok && s.Code() == codes.NotFound {
 			log.Warnf("server couldn't find pkce flow, contact admin: %v", err)
diff --git a/client/internal/auth/device_flow.go b/client/internal/auth/device_flow.go
index 3592e589d..c2b8d34b8 100644
--- a/client/internal/auth/device_flow.go
+++ b/client/internal/auth/device_flow.go
@@ -308,10 +308,13 @@ func (d *DeviceAuthorizationFlow) WaitToken(ctx context.Context, info AuthFlowIn
 			// callers store to send back as the login_hint. Without it a client
 			// driven through the device flow — Android TV and tvOS — never binds
 			// an account to its profile and every later login goes out blind.
-			if email, err := parseEmailFromIDToken(tokenInfo.IDToken); err != nil {
+			if email, fromEmailClaim, err := parseEmailFromIDToken(tokenInfo.IDToken); err != nil {
 				log.Warnf("failed to parse email from ID token: %v", err)
 			} else {
 				tokenInfo.Email = email
+				if fromEmailClaim {
+					tokenInfo.EmailClaim = email
+				}
 			}
 
 			log.Infof("device flow: user authorization confirmed after %d polls in %s", polls, time.Since(start).Round(time.Second))
diff --git a/client/internal/auth/oauth.go b/client/internal/auth/oauth.go
index 91329c98b..54ecb5d86 100644
--- a/client/internal/auth/oauth.go
+++ b/client/internal/auth/oauth.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"net/http"
 	"runtime"
+	"strings"
 
 	log "github.com/sirupsen/logrus"
 	"google.golang.org/grpc/codes"
@@ -25,6 +26,14 @@ type HTTPClient interface {
 	Do(req *http.Request) (*http.Response, error)
 }
 
+// accountPromptForcer is implemented by the PKCE flow only. The device code
+// flow has no equivalent: RFC 8628 defines no prompt parameter, and the user
+// confirms the code on a page that shows which account signs in, so a silent
+// wrong-account answer is not the failure mode there.
+type accountPromptForcer interface {
+	ForceAccountPrompt()
+}
+
 // AuthFlowInfo holds information for the OAuth 2.0  authorization flow
 type AuthFlowInfo struct { //nolint:revive
 	DeviceCode              string `json:"device_code"`
@@ -49,6 +58,23 @@ type TokenInfo struct {
 	ExpiresIn    int    `json:"expires_in"`
 	UseIDToken   bool   `json:"-"`
 	Email        string `json:"-"`
+	EmailClaim   string `json:"-"`
+}
+
+// MatchesAccount reports whether the token belongs to the account a profile is
+// bound to. A hint the IdP could not have acted on — no hint stored, or a token
+// that carried no email claim — is reported as a match: the check exists to catch a
+// login answered from the wrong account, not to block one it cannot judge.
+//
+// The comparison is case-insensitive. Local-parts are case-sensitive per RFC
+// 5321, but no IdP in practice issues two accounts differing only in case, and
+// an IdP that echoes a differently-cased address would otherwise fail every
+// login.
+func (t TokenInfo) MatchesAccount(hint string) bool {
+	if hint == "" || t.EmailClaim == "" {
+		return true
+	}
+	return strings.EqualFold(t.EmailClaim, hint)
 }
 
 // GetTokenToUse returns either the access or id token based on UseIDToken field
@@ -63,19 +89,22 @@ func shouldUseDeviceFlow(force bool, isUnixDesktopClient bool) bool {
 	return force || (runtime.GOOS == "linux" || runtime.GOOS == "freebsd") && !isUnixDesktopClient
 }
 
-// NewOAuthFlow initializes and returns the appropriate OAuth flow based on the management configuration
+// NewOAuthFlow initializes and returns the appropriate OAuth flow based on the management configuration.
 //
 // It starts by initializing the PKCE.If this process fails, it resorts to the Device Code Flow,
 // and if that also fails, the authentication process is deemed unsuccessful
 //
-// On Linux distros without desktop environment support, it only tries to initialize the Device Code Flow
-// forceDeviceCodeFlow can be used to skip PKCE and go directly to Device Code Flow (e.g., for Android TV)
-func NewOAuthFlow(ctx context.Context, config *profilemanager.Config, isUnixDesktopClient bool, forceDeviceCodeFlow bool, hint string) (OAuthFlow, error) {
+// On Linux distros without desktop environment support, it only tries to initialize the Device Code Flow.
+// forceDeviceCodeFlow can be used to skip PKCE and go directly to Device Code Flow (e.g., for Android TV).
+//
+// sessionExtend marks the flow as renewing an existing peer's session rather than
+// logging one in. See PKCEAuthorizationFlowRequest for what the server makes of it.
+func NewOAuthFlow(ctx context.Context, config *profilemanager.Config, isUnixDesktopClient bool, forceDeviceCodeFlow bool, hint string, sessionExtend bool) (OAuthFlow, error) {
 	if shouldUseDeviceFlow(forceDeviceCodeFlow, isUnixDesktopClient) {
 		return authenticateWithDeviceCodeFlow(ctx, config, hint)
 	}
 
-	pkceFlow, err := authenticateWithPKCEFlow(ctx, config, hint)
+	pkceFlow, err := authenticateWithPKCEFlow(ctx, config, hint, sessionExtend)
 	if err != nil {
 		log.Debugf("failed to initialize pkce authentication with error: %v\n", err)
 		log.Debug("falling back to device code flow")
@@ -85,14 +114,14 @@ func NewOAuthFlow(ctx context.Context, config *profilemanager.Config, isUnixDesk
 }
 
 // authenticateWithPKCEFlow initializes the Proof Key for Code Exchange flow auth flow
-func authenticateWithPKCEFlow(ctx context.Context, config *profilemanager.Config, hint string) (OAuthFlow, error) {
+func authenticateWithPKCEFlow(ctx context.Context, config *profilemanager.Config, hint string, sessionExtend bool) (OAuthFlow, error) {
 	authClient, err := NewAuth(ctx, config.PrivateKey, config.ManagementURL, config)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create auth client: %v", err)
 	}
 	defer authClient.Close()
 
-	pkceFlowInfo, err := authClient.getPKCEFlow(authClient.client)
+	pkceFlowInfo, err := authClient.getPKCEFlow(authClient.client, sessionExtend)
 	if err != nil {
 		return nil, fmt.Errorf("getting pkce authorization flow info failed with error: %v", err)
 	}
@@ -129,3 +158,21 @@ func authenticateWithDeviceCodeFlow(ctx context.Context, config *profilemanager.
 
 	return deviceFlowInfo, nil
 }
+
+// RetryFlowForAccount returns a flow that asks the IdP to re-authenticate, for
+// a login answered with an account other than the one hinted. Returns nil when
+// the flow cannot ask — the caller then proceeds with the token it has.
+//
+// Proceeding rather than failing is deliberate. The hint is an email that may
+// simply have changed since it was stored, and refusing the login would lock a
+// user out of their own profile over a rename. The retry gives the account a
+// chance to be corrected; the server still rejects a token that does not own
+// the peer.
+func RetryFlowForAccount(flow OAuthFlow) OAuthFlow {
+	forcer, ok := flow.(accountPromptForcer)
+	if !ok {
+		return nil
+	}
+	forcer.ForceAccountPrompt()
+	return flow
+}
diff --git a/client/internal/auth/pkce_flow.go b/client/internal/auth/pkce_flow.go
index be64cc6a8..ebb0d4f1f 100644
--- a/client/internal/auth/pkce_flow.go
+++ b/client/internal/auth/pkce_flow.go
@@ -87,10 +87,11 @@ func validatePKCEConfig(config *PKCEAuthProviderConfig) error {
 // PKCEAuthorizationFlow implements the OAuthFlow interface for
 // the Authorization Code Flow with PKCE.
 type PKCEAuthorizationFlow struct {
-	providerConfig PKCEAuthProviderConfig
-	state          string
-	codeVerifier   string
-	oAuthConfig    *oauth2.Config
+	providerConfig     PKCEAuthProviderConfig
+	state              string
+	codeVerifier       string
+	oAuthConfig        *oauth2.Config
+	forceAccountPrompt bool
 }
 
 // NewPKCEAuthorizationFlow returns new PKCE authorization code flow.
@@ -153,11 +154,16 @@ func (p *PKCEAuthorizationFlow) RequestAuthInfo(ctx context.Context) (AuthFlowIn
 		oauth2.SetAuthURLParam("code_challenge", codeChallenge),
 		oauth2.SetAuthURLParam("audience", p.providerConfig.Audience),
 	}
+	forceAccountPrompt := p.forceAccountPrompt
+	p.forceAccountPrompt = false
+
 	if !p.providerConfig.DisablePromptLogin {
-		switch p.providerConfig.LoginFlag {
-		case common.LoginFlagPromptLogin:
+		switch {
+		case forceAccountPrompt:
 			params = append(params, oauth2.SetAuthURLParam("prompt", "login"))
-		case common.LoginFlagMaxAge0:
+		case p.providerConfig.LoginFlag == common.LoginFlagPromptLogin:
+			params = append(params, oauth2.SetAuthURLParam("prompt", "login"))
+		case p.providerConfig.LoginFlag == common.LoginFlagMaxAge0:
 			params = append(params, oauth2.SetAuthURLParam("max_age", "0"))
 		}
 	}
@@ -178,6 +184,20 @@ func (p *PKCEAuthorizationFlow) SetLoginHint(hint string) {
 	p.providerConfig.LoginHint = hint
 }
 
+// ForceAccountPrompt makes the next authorization request ask the IdP to
+// re-authenticate instead of answering from the session it already holds. Used
+// to retry a login that came back for an account other than the one hinted.
+//
+// The next RequestAuthInfo consumes the flag, so a flow that outlives its retry
+// goes back to the configured behaviour instead of re-authenticating forever.
+//
+// DisablePromptLogin still wins: it is set for IdPs that break on prompt=login,
+// where retrying with it would replace a wrong-account login with one that
+// cannot complete at all.
+func (p *PKCEAuthorizationFlow) ForceAccountPrompt() {
+	p.forceAccountPrompt = true
+}
+
 // WaitToken waits for the OAuth token in the PKCE Authorization Flow.
 // It starts an HTTP server to receive the OAuth token callback and waits for the token or an error.
 // Once the token is received, it is converted to TokenInfo and validated before returning.
@@ -310,49 +330,48 @@ func (p *PKCEAuthorizationFlow) parseOAuthToken(token *oauth2.Token) (TokenInfo,
 		return TokenInfo{}, fmt.Errorf("authentication failed: invalid access token - %w", err)
 	}
 
-	email, err := parseEmailFromIDToken(tokenInfo.IDToken)
+	email, fromEmailClaim, err := parseEmailFromIDToken(tokenInfo.IDToken)
 	if err != nil {
 		log.Warnf("failed to parse email from ID token: %v", err)
 	} else {
 		tokenInfo.Email = email
+		if fromEmailClaim {
+			tokenInfo.EmailClaim = email
+		}
 	}
 
 	return tokenInfo, nil
 }
 
 // parseEmailFromIDToken extracts the email (or name) claim from an ID token
-// without verifying its signature. The value is best-effort and used only as a
-// UX convenience (login hint prefill and display); it never drives an
-// authorization decision. The authoritative identity is established server-side
-// from the signature-verified token.
-func parseEmailFromIDToken(token string) (string, error) {
+// without verifying its signature. The value is best-effort: it prefills the
+// login hint and is displayed. Account matching (see MatchesAccount) only uses
+// it when it came from the email claim, which fromEmailClaim reports. It never
+// grants anything — the authoritative identity is established server-side from
+// the signature-verified token.
+func parseEmailFromIDToken(token string) (value string, fromEmailClaim bool, err error) {
 	parts := strings.Split(token, ".")
 	if len(parts) < 2 {
-		return "", fmt.Errorf("invalid token format")
+		return "", false, fmt.Errorf("invalid token format")
 	}
 
 	data, err := base64.RawURLEncoding.DecodeString(parts[1])
 	if err != nil {
-		return "", fmt.Errorf("failed to decode payload: %w", err)
+		return "", false, fmt.Errorf("failed to decode payload: %w", err)
 	}
 	var claims map[string]interface{}
 	if err := json.Unmarshal(data, &claims); err != nil {
-		return "", fmt.Errorf("json unmarshal error: %w", err)
+		return "", false, fmt.Errorf("json unmarshal error: %w", err)
 	}
 
-	var email string
-	if emailValue, ok := claims["email"].(string); ok {
-		email = emailValue
-	} else {
-		val, ok := claims["name"].(string)
-		if ok {
-			email = val
-		} else {
-			return "", fmt.Errorf("email or name field not found in token payload")
-		}
+	if email, ok := claims["email"].(string); ok {
+		return email, true, nil
+	}
+	if name, ok := claims["name"].(string); ok {
+		return name, false, nil
 	}
 
-	return email, nil
+	return "", false, fmt.Errorf("email or name field not found in token payload")
 }
 
 func createCodeChallenge(codeVerifier string) string {
diff --git a/client/internal/auth/pkce_flow_test.go b/client/internal/auth/pkce_flow_test.go
index c487c13df..ccbca10e9 100644
--- a/client/internal/auth/pkce_flow_test.go
+++ b/client/internal/auth/pkce_flow_test.go
@@ -76,6 +76,32 @@ func TestPromptLogin(t *testing.T) {
 	}
 }
 
+func TestForceAccountPromptAppliesOnlyToTheRetry(t *testing.T) {
+	config := PKCEAuthProviderConfig{
+		ClientID:              "test-client-id",
+		Audience:              "test-audience",
+		TokenEndpoint:         "https://test-token-endpoint.com/token",
+		Scope:                 "openid email profile",
+		AuthorizationEndpoint: "https://test-auth-endpoint.com/authorize",
+		RedirectURLs:          []string{"http://127.0.0.1:33992/"},
+		UseIDToken:            true,
+		LoginFlag:             mgm.LoginFlagNone,
+	}
+	pkce, err := NewPKCEAuthorizationFlow(config)
+	require.NoError(t, err)
+
+	pkce.ForceAccountPrompt()
+
+	retry, err := pkce.RequestAuthInfo(context.Background())
+	require.NoError(t, err)
+	require.Contains(t, retry.VerificationURIComplete, "prompt=login")
+
+	next, err := pkce.RequestAuthInfo(context.Background())
+	require.NoError(t, err)
+	require.NotContains(t, next.VerificationURIComplete, "prompt=login",
+		"the forced prompt outlived the retry it was armed for")
+}
+
 func TestIsPortInExcludedRange(t *testing.T) {
 	tests := []struct {
 		name            string
diff --git a/client/ios/NetBirdSDK/client.go b/client/ios/NetBirdSDK/client.go
index a6315a4ab..457ae3a7d 100644
--- a/client/ios/NetBirdSDK/client.go
+++ b/client/ios/NetBirdSDK/client.go
@@ -479,7 +479,7 @@ func (c *Client) LoginForMobile() string {
 	}
 	c.applyMDMOverlay(cfg)
 
-	oAuthFlow, err := auth.NewOAuthFlow(ctx, cfg, false, false, "")
+	oAuthFlow, err := auth.NewOAuthFlow(ctx, cfg, false, false, "", false)
 	if err != nil {
 		return err.Error()
 	}
diff --git a/client/ios/NetBirdSDK/login.go b/client/ios/NetBirdSDK/login.go
index 6a9a6d3d0..b182e82b6 100644
--- a/client/ios/NetBirdSDK/login.go
+++ b/client/ios/NetBirdSDK/login.go
@@ -330,7 +330,7 @@ func profileLoginHint(cfgPath string) string {
 const authInfoRequestTimeout = 30 * time.Second
 
 func (a *Auth) foregroundGetTokenInfo(authClient *auth.Auth, urlOpener URLOpener, forceDeviceAuth bool) (*auth.TokenInfo, error) {
-	oAuthFlow, err := authClient.GetOAuthFlow(a.ctx, forceDeviceAuth, profileLoginHint(a.cfgPath))
+	oAuthFlow, err := authClient.GetOAuthFlow(a.ctx, forceDeviceAuth, false, profileLoginHint(a.cfgPath))
 	if err != nil {
 		return nil, fmt.Errorf("failed to get OAuth flow: %v", err)
 	}
diff --git a/client/server/login_account_test.go b/client/server/login_account_test.go
new file mode 100644
index 000000000..c113c8bfe
--- /dev/null
+++ b/client/server/login_account_test.go
@@ -0,0 +1,211 @@
+package server
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal"
+	"github.com/netbirdio/netbird/client/internal/auth"
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+type stubOAuthFlow struct {
+	token  auth.TokenInfo
+	onWait func()
+}
+
+func (f *stubOAuthFlow) RequestAuthInfo(context.Context) (auth.AuthFlowInfo, error) {
+	return auth.AuthFlowInfo{}, nil
+}
+
+func (f *stubOAuthFlow) WaitToken(context.Context, auth.AuthFlowInfo) (auth.TokenInfo, error) {
+	if f.onWait != nil {
+		f.onWait()
+	}
+	return f.token, nil
+}
+
+func (f *stubOAuthFlow) GetClientID(context.Context) string {
+	return "stub-client"
+}
+
+func TestWaitSSOLogin_WrongAccountArmsPromptAndFails(t *testing.T) {
+	s := newSSOTestServer(t, "user@example.com", false, "other@example.com")
+	attempts := 0
+	s.loginAttemptFn = func(context.Context, string, string) (internal.StatusType, error) {
+		attempts++
+		return "", nil
+	}
+
+	resp, err := s.WaitSSOLogin(callerCtx(t), &proto.WaitSSOLoginRequest{UserCode: "code"})
+	require.Error(t, err)
+	require.Nil(t, resp)
+	require.Equal(t, 0, attempts, "the wrong account's token reached the management login")
+	require.True(t, s.forceAccountPrompt, "the next login was not armed to ask for the account")
+	require.Nil(t, s.oauthAuthFlow.flow, "the mismatched flow stayed cached for reuse")
+
+	status, stateErr := internal.CtxGetState(s.rootCtx).Status()
+	require.NoError(t, stateErr)
+	require.Equal(t, internal.StatusNeedsLogin, status, "the mismatch must stay retryable")
+}
+
+func TestWaitSSOLogin_WrongAccountAfterPromptProceeds(t *testing.T) {
+	s := newSSOTestServer(t, "user@example.com", true, "other@example.com")
+	attempts := 0
+	s.loginAttemptFn = func(context.Context, string, string) (internal.StatusType, error) {
+		attempts++
+		return "", nil
+	}
+
+	resp, err := s.WaitSSOLogin(callerCtx(t), &proto.WaitSSOLoginRequest{UserCode: "code"})
+	require.NoError(t, err, "a prompted round must not error again on a mismatch")
+	require.NotNil(t, resp)
+	require.Equal(t, "other@example.com", resp.Email)
+	require.Equal(t, 1, attempts)
+	require.False(t, s.forceAccountPrompt)
+}
+
+func TestWaitSSOLogin_MatchingAccountProceeds(t *testing.T) {
+	s := newSSOTestServer(t, "user@example.com", false, "User@Example.com")
+	attempts := 0
+	s.loginAttemptFn = func(context.Context, string, string) (internal.StatusType, error) {
+		attempts++
+		return "", nil
+	}
+
+	resp, err := s.WaitSSOLogin(callerCtx(t), &proto.WaitSSOLoginRequest{UserCode: "code"})
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	require.Equal(t, 1, attempts)
+	require.False(t, s.forceAccountPrompt)
+}
+
+func TestWaitSSOLogin_NoHintIsNotJudged(t *testing.T) {
+	s := newSSOTestServer(t, "", false, "whoever@example.com")
+	attempts := 0
+	s.loginAttemptFn = func(context.Context, string, string) (internal.StatusType, error) {
+		attempts++
+		return "", nil
+	}
+
+	_, err := s.WaitSSOLogin(callerCtx(t), &proto.WaitSSOLoginRequest{UserCode: "code"})
+	require.NoError(t, err)
+	require.Equal(t, 1, attempts)
+	require.False(t, s.forceAccountPrompt)
+}
+
+func TestSwitchProfile_DropsAccountPromptAndPendingFlow(t *testing.T) {
+	s, ctx, _, _, _ := setupServerWithProfile(t)
+	s.forceAccountPrompt = true
+	cancelled := false
+	s.oauthAuthFlow = oauthAuthFlow{
+		flow:       &stubOAuthFlow{},
+		hint:       "user@example.com",
+		waitCancel: func() { cancelled = true },
+	}
+
+	extendCancelled := false
+	s.extendAuthSessionFlow.Set(&stubOAuthFlow{}, auth.AuthFlowInfo{DeviceCode: "device"})
+	s.extendAuthSessionFlow.SetWaitCancel(func() { extendCancelled = true })
+
+	_, err := s.SwitchProfile(ctx, nil)
+	require.NoError(t, err)
+	require.False(t, s.forceAccountPrompt, "the prompt flag leaked across a profile switch")
+	require.Nil(t, s.oauthAuthFlow.flow, "the previous profile's flow leaked across a profile switch")
+	require.Empty(t, s.oauthAuthFlow.hint)
+	require.True(t, cancelled, "the pending wait was not cancelled")
+
+	require.True(t, extendCancelled, "the pending extend wait was not cancelled")
+	_, _, pending := s.extendAuthSessionFlow.Get()
+	require.False(t, pending, "the previous profile's extend flow leaked across a profile switch")
+}
+
+func TestWaitSSOLogin_JudgesTheFlowThatProducedTheToken(t *testing.T) {
+	s := newSSOTestServer(t, "user@example.com", false, "user@example.com")
+	attempts := 0
+	s.loginAttemptFn = func(context.Context, string, string) (internal.StatusType, error) {
+		attempts++
+		return "", nil
+	}
+
+	flow := s.oauthAuthFlow.flow.(*stubOAuthFlow)
+	flow.onWait = func() {
+		s.mutex.Lock()
+		defer s.mutex.Unlock()
+		s.oauthAuthFlow.hint = "someone-else@example.com"
+	}
+
+	resp, err := s.WaitSSOLogin(callerCtx(t), &proto.WaitSSOLoginRequest{UserCode: "code"})
+	require.NoError(t, err, "a flow replaced mid-wait must not decide this wait's verdict")
+	require.NotNil(t, resp)
+	require.Equal(t, 1, attempts)
+	require.False(t, s.forceAccountPrompt, "the prompt was armed off another flow's hint")
+}
+
+func TestReuseOAuthFlow_ForcedPromptRefusesTheCachedFlow(t *testing.T) {
+	s := New(internal.CtxInitState(context.Background()), "console", "", false, false, false, false)
+	cancelled := false
+	s.oauthAuthFlow = oauthAuthFlow{
+		flow:       &stubOAuthFlow{},
+		info:       auth.AuthFlowInfo{UserCode: "code"},
+		expiresAt:  time.Now().Add(time.Hour),
+		waitCancel: func() { cancelled = true },
+	}
+
+	state := internal.CtxGetState(s.rootCtx)
+	resp := s.reuseOAuthFlow(context.Background(), &stubOAuthFlow{}, state, true)
+	require.Nil(t, resp, "a forced account prompt reused the flow that skipped it")
+	require.True(t, cancelled, "the predecessor wait was orphaned")
+
+	resp = s.reuseOAuthFlow(context.Background(), &stubOAuthFlow{}, state, false)
+	require.NotNil(t, resp, "an unforced login stopped reusing a live flow")
+	require.Equal(t, "code", resp.UserCode)
+}
+
+func TestReplaceOAuthFlow_CancelsTheDisplacedWait(t *testing.T) {
+	s := New(internal.CtxInitState(context.Background()), "console", "", false, false, false, false)
+	cancelled := false
+	s.oauthAuthFlow = oauthAuthFlow{
+		flow:            &stubOAuthFlow{},
+		info:            auth.AuthFlowInfo{UserCode: "code"},
+		expiresAt:       time.Now().Add(time.Hour),
+		hint:            "user@example.com",
+		accountPrompted: true,
+		waitCancel:      func() { cancelled = true },
+	}
+
+	next := &stubOAuthFlow{}
+	s.replaceOAuthFlow(oauthAuthFlow{flow: next, info: auth.AuthFlowInfo{UserCode: "next"}})
+
+	require.True(t, cancelled, "the displaced wait was left without an owner")
+	require.Equal(t, next, s.oauthAuthFlow.flow)
+	require.Equal(t, "next", s.oauthAuthFlow.info.UserCode)
+	require.Empty(t, s.oauthAuthFlow.hint, "the previous flow's hint survived the replacement")
+	require.False(t, s.oauthAuthFlow.accountPrompted)
+	require.Nil(t, s.oauthAuthFlow.waitCancel, "the consumed cancel stayed on the record")
+}
+
+func newSSOTestServer(t *testing.T, hint string, accountPrompted bool, tokenEmail string) *Server {
+	t.Helper()
+	s := New(internal.CtxInitState(context.Background()), "console", "", false, false, false, false)
+	s.oauthAuthFlow = oauthAuthFlow{
+		flow:            &stubOAuthFlow{token: auth.TokenInfo{Email: tokenEmail, EmailClaim: tokenEmail}},
+		info:            auth.AuthFlowInfo{UserCode: "code"},
+		expiresAt:       time.Now().Add(time.Minute),
+		hint:            hint,
+		accountPrompted: accountPrompted,
+	}
+	return s
+}
+
+// callerCtx is the gRPC caller's context. WaitSSOLogin parks a goroutine on it
+// for the whole browser leg, so a test that never cancels leaks one.
+func callerCtx(t *testing.T) context.Context {
+	t.Helper()
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+	return ctx
+}
diff --git a/client/server/server.go b/client/server/server.go
index f7f81b688..916d7041b 100644
--- a/client/server/server.go
+++ b/client/server/server.go
@@ -71,6 +71,10 @@ const (
 
 var ErrServiceNotUp = errors.New("service is not up")
 
+type statusSetter interface {
+	Set(update internal.StatusType)
+}
+
 // Server for service control.
 type Server struct {
 	rootCtx   context.Context
@@ -88,6 +92,12 @@ type Server struct {
 	uiLogPath string
 
 	oauthAuthFlow oauthAuthFlow
+	// forceAccountPrompt makes the next startSSOLogin build its flow with a
+	// forced account prompt. Armed when a login came back for an account other
+	// than the hinted one: that flow's browser is gone, so the correction has to
+	// ride on the user's next connect. Guarded by mutex; deliberately not
+	// persisted — a lost flag only costs one more mismatch round.
+	forceAccountPrompt bool
 	// extendAuthSessionFlow holds the pending PKCE flow created by
 	// RequestExtendAuthSession until WaitExtendAuthSession resolves it.
 	// Kept separate from oauthAuthFlow (which is reserved for the SSH
@@ -177,6 +187,14 @@ type oauthAuthFlow struct {
 	cacheGeneration uint64
 
 	waitCancel context.CancelFunc
+	// hint is the account the flow was asked to sign in (login_hint). The token
+	// that comes back is compared against it; empty means nothing to compare.
+	hint string
+	// accountPrompted records that this flow already asked the IdP to re-decide
+	// the account (or could not ask — the device flow has no way to). A token
+	// for the wrong account is then let through with a warning instead of
+	// erroring again, so the flow cannot loop.
+	accountPrompted bool
 }
 
 // New server instance constructor.
@@ -756,7 +774,7 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 	}
 
 	if msg.SetupKey == "" {
-		return s.beginSSOLogin(ctx, config, msg)
+		return s.startSSOLogin(ctx, msg, config, state)
 	}
 
 	// Setup-key path: we are about to dial Management with the key, so the
@@ -772,23 +790,31 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 	return &proto.LoginResponse{}, nil
 }
 
-// beginSSOLogin starts the browser leg of a login that carries no setup key and
-// returns the response that parks the caller on it.
-func (s *Server) beginSSOLogin(ctx context.Context, config *profilemanager.Config, msg *proto.LoginRequest) (*proto.LoginResponse, error) {
-	state := internal.CtxGetState(s.rootCtx)
-
+// startSSOLogin opens the interactive leg of a login: it reuses the in-flight
+// OAuth flow when one is still valid for the same client, and otherwise
+// requests fresh auth info and parks the daemon on StatusNeedsLogin.
+func (s *Server) startSSOLogin(ctx context.Context, msg *proto.LoginRequest, config *profilemanager.Config, state statusSetter) (*proto.LoginResponse, error) {
 	hint := ""
 	if msg.Hint != nil {
 		hint = *msg.Hint
 	}
-	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, msg.IsUnixDesktopClient, false, hint)
+	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, msg.IsUnixDesktopClient, false, hint, false)
 	if err != nil {
 		state.Set(internal.StatusLoginFailed)
 		return nil, err
 	}
 
-	if resp := s.pendingOAuthFlowResponse(ctx, oAuthFlow); resp != nil {
-		state.Set(internal.StatusNeedsLogin)
+	s.mutex.Lock()
+	promptForAccount := s.forceAccountPrompt
+	s.forceAccountPrompt = false
+	s.mutex.Unlock()
+	if promptForAccount && auth.RetryFlowForAccount(oAuthFlow) == nil {
+		// The device flow cannot ask; run it as-is. accountPrompted still goes
+		// true below so a second mismatch is let through instead of looping.
+		log.Warnf("the previous login returned a different account, but this flow cannot ask the IdP to choose one")
+	}
+
+	if resp := s.reuseOAuthFlow(ctx, oAuthFlow, state, promptForAccount); resp != nil {
 		return resp, nil
 	}
 
@@ -798,11 +824,13 @@ func (s *Server) beginSSOLogin(ctx context.Context, config *profilemanager.Confi
 		return nil, err
 	}
 
-	s.mutex.Lock()
-	s.oauthAuthFlow.flow = oAuthFlow
-	s.oauthAuthFlow.info = authInfo
-	s.oauthAuthFlow.expiresAt = time.Now().Add(time.Duration(authInfo.ExpiresIn) * time.Second)
-	s.mutex.Unlock()
+	s.replaceOAuthFlow(oauthAuthFlow{
+		flow:            oAuthFlow,
+		info:            authInfo,
+		expiresAt:       time.Now().Add(time.Duration(authInfo.ExpiresIn) * time.Second),
+		hint:            hint,
+		accountPrompted: promptForAccount,
+	})
 
 	state.Set(internal.StatusNeedsLogin)
 
@@ -814,32 +842,74 @@ func (s *Server) beginSSOLogin(ctx context.Context, config *profilemanager.Confi
 	}, nil
 }
 
-// pendingOAuthFlowResponse returns the in-flight flow's response when it
-// targets the same IdP client and has enough time left for the user to finish
-// the browser leg, so a second login joins the pending flow instead of opening
-// a competing one. A flow too close to expiry has its waiter cancelled and nil
-// returned, leaving the caller to start a fresh flow.
-func (s *Server) pendingOAuthFlowResponse(ctx context.Context, oAuthFlow auth.OAuthFlow) *proto.LoginResponse {
-	if s.oauthAuthFlow.flow == nil || s.oauthAuthFlow.flow.GetClientID(ctx) != oAuthFlow.GetClientID(ctx) {
+// replaceOAuthFlow installs next as the shared OAuth flow record and takes over
+// the wait it displaces, so a WaitSSOLogin still parked on the old flow is not
+// left without an owner: nothing would preempt it, and it could go on to run
+// attemptLogin or mutate the record behind the new flow.
+//
+// The displaced cancel is read in the same critical section that replaces the
+// record, so two callers racing here cannot both take the same predecessor. The
+// cancel runs after the unlock — the displaced wait takes s.mutex as it unwinds.
+func (s *Server) replaceOAuthFlow(next oauthAuthFlow) {
+	s.mutex.Lock()
+	staleCancel := s.oauthAuthFlow.waitCancel
+	s.oauthAuthFlow = next
+	s.mutex.Unlock()
+
+	if staleCancel != nil {
+		staleCancel()
+	}
+}
+
+func (s *Server) expireOAuthFlow(flow auth.OAuthFlow) {
+	s.mutex.Lock()
+	if s.oauthAuthFlow.flow == flow {
+		s.oauthAuthFlow.expiresAt = time.Now()
+	}
+	s.mutex.Unlock()
+}
+
+// reuseOAuthFlow returns the cached auth info when the previous flow targets
+// the same client and still has enough life left, and otherwise cancels the
+// stale wait and returns nil so the caller requests a fresh flow.
+//
+// promptForAccount rules reuse out: the cached flow was built without the
+// account prompt, so handing its URL back would repeat the silent
+// authorization that returned the wrong account — and with the flag already
+// consumed, no later round would ask either. The predecessor's wait is still
+// cancelled on the way out, so it is not orphaned on its device-code window.
+//
+// The whole decision runs off one snapshot taken under s.mutex: a concurrent
+// WaitSSOLogin replaces waitCancel and expires the flow, so reading the fields
+// one at a time could cancel a wait that no longer belongs to the flow just
+// judged stale, or answer with auth info from a flow that was already replaced.
+// The cancel itself is called after unlocking — it runs arbitrary teardown, and
+// WaitSSOLogin takes s.mutex on the way out.
+func (s *Server) reuseOAuthFlow(ctx context.Context, oAuthFlow auth.OAuthFlow, state statusSetter, promptForAccount bool) *proto.LoginResponse {
+	s.mutex.Lock()
+	current := s.oauthAuthFlow
+	s.mutex.Unlock()
+
+	if current.flow == nil || current.flow.GetClientID(ctx) != oAuthFlow.GetClientID(ctx) {
 		return nil
 	}
 
-	if s.oauthAuthFlow.expiresAt.After(time.Now().Add(90 * time.Second)) {
-		log.Debugf("using previous oauth flow info")
-		return &proto.LoginResponse{
-			NeedsSSOLogin:           true,
-			VerificationURI:         s.oauthAuthFlow.info.VerificationURI,
-			VerificationURIComplete: s.oauthAuthFlow.info.VerificationURIComplete,
-			UserCode:                s.oauthAuthFlow.info.UserCode,
+	if promptForAccount || !current.expiresAt.After(time.Now().Add(90*time.Second)) {
+		log.Warnf("canceling previous waiting execution")
+		if current.waitCancel != nil {
+			current.waitCancel()
 		}
+		return nil
 	}
 
-	log.Warnf("canceling previous waiting execution")
-	if s.oauthAuthFlow.waitCancel != nil {
-		s.oauthAuthFlow.waitCancel()
+	log.Debugf("using previous oauth flow info")
+	state.Set(internal.StatusNeedsLogin)
+	return &proto.LoginResponse{
+		NeedsSSOLogin:           true,
+		VerificationURI:         current.info.VerificationURI,
+		VerificationURIComplete: current.info.VerificationURIComplete,
+		UserCode:                current.info.UserCode,
 	}
-
-	return nil
 }
 
 // WaitSSOLogin validates the supplied userCode against the in-flight OAuth
@@ -912,9 +982,16 @@ func (s *Server) WaitSSOLogin(callerCtx context.Context, msg *proto.WaitSSOLogin
 	}
 
 	s.actCancel = cancel
+	// One snapshot of the flow this wait belongs to. hint and accountPrompted
+	// are judged against the token that comes back below, and WaitToken blocks
+	// for the whole browser leg: a concurrent Login or RequestJWTAuth replaces
+	// s.oauthAuthFlow meanwhile, so re-reading them after the wait would judge
+	// this flow's token against another flow's account.
+	pending := s.oauthAuthFlow
+	flow := pending.flow
 	s.mutex.Unlock()
 
-	if s.oauthAuthFlow.flow == nil {
+	if flow == nil {
 		return nil, gstatus.Errorf(codes.Internal, "oauth flow is not initialized")
 	}
 
@@ -932,31 +1009,36 @@ func (s *Server) WaitSSOLogin(callerCtx context.Context, msg *proto.WaitSSOLogin
 	// the affordance instead of a Connecting that never resolves.
 	state.Set(internal.StatusNeedsLogin)
 
-	s.mutex.Lock()
-	flowInfo := s.oauthAuthFlow.info
-	s.mutex.Unlock()
+	flowInfo := pending.info
 
 	if flowInfo.UserCode != msg.UserCode {
 		state.Set(internal.StatusLoginFailed)
 		return nil, gstatus.Errorf(codes.InvalidArgument, "sso user code is invalid")
 	}
 
-	if s.oauthAuthFlow.waitCancel != nil {
-		s.oauthAuthFlow.waitCancel()
-	}
-
 	waitCTX, cancel := context.WithCancel(ctx)
 	defer cancel()
 
+	// Swap in this wait's cancel and take over the one it displaces in a single
+	// critical section, so two WaitSSOLogin calls racing here cannot both read
+	// the same predecessor and leave one wait uncancelled. Cancelling happens
+	// after the unlock: the displaced wait takes s.mutex as it unwinds.
 	s.mutex.Lock()
+	if s.oauthAuthFlow.flow != flow {
+		s.mutex.Unlock()
+		return nil, gstatus.Errorf(codes.Canceled, "sso login was replaced by a newer login")
+	}
+	staleCancel := s.oauthAuthFlow.waitCancel
 	s.oauthAuthFlow.waitCancel = cancel
 	s.mutex.Unlock()
 
-	tokenInfo, err := s.oauthAuthFlow.flow.WaitToken(waitCTX, flowInfo)
+	if staleCancel != nil {
+		staleCancel()
+	}
+
+	tokenInfo, err := flow.WaitToken(waitCTX, flowInfo)
 	if err != nil {
-		s.mutex.Lock()
-		s.oauthAuthFlow.expiresAt = time.Now()
-		s.mutex.Unlock()
+		s.expireOAuthFlow(flow)
 		switch {
 		case errors.Is(err, context.Canceled):
 			// External abort. If our caller cancelled (the client closed
@@ -969,7 +1051,9 @@ func (s *Server) WaitSSOLogin(callerCtx context.Context, msg *proto.WaitSSOLogin
 			// the new owner — don't clobber it.
 			if callerCtx.Err() != nil {
 				s.mutex.Lock()
-				s.oauthAuthFlow = oauthAuthFlow{}
+				if s.oauthAuthFlow.flow == flow {
+					s.oauthAuthFlow = oauthAuthFlow{}
+				}
 				s.mutex.Unlock()
 			}
 		case errors.Is(err, context.DeadlineExceeded):
@@ -985,9 +1069,32 @@ func (s *Server) WaitSSOLogin(callerCtx context.Context, msg *proto.WaitSSOLogin
 		return nil, err
 	}
 
-	s.mutex.Lock()
-	s.oauthAuthFlow.expiresAt = time.Now()
-	s.mutex.Unlock()
+	s.expireOAuthFlow(flow)
+
+	if !tokenInfo.MatchesAccount(pending.hint) {
+		if !pending.accountPrompted {
+			// The IdP answered from a session belonging to another account. The
+			// browser for this flow is gone, so a new URL cannot be handed out
+			// here — arm the prompt for the user's next connect and fail this
+			// round. Never log in with the token: on a registered peer the
+			// server would reject it, and on a fresh one it would silently
+			// register the peer under the wrong account.
+			log.Warnf("login returned an account other than the one this profile is bound to; the next connect will ask the IdP to choose")
+			s.mutex.Lock()
+			if s.oauthAuthFlow.flow == flow {
+				s.oauthAuthFlow = oauthAuthFlow{}
+				s.forceAccountPrompt = true
+			}
+			s.mutex.Unlock()
+			state.Set(internal.StatusNeedsLogin)
+			return nil, gstatus.Errorf(codes.FailedPrecondition, "the login used a different account than this profile; connect again to choose the account")
+		}
+		// Already asked once; the account may legitimately differ (a changed
+		// email address). Refusing again would lock the user out of the profile,
+		// and the management server still rejects a token that does not own the
+		// peer.
+		log.Warnf("login still returned a different account after the prompt, continuing with it")
+	}
 
 	if loginStatus, err := s.attemptLogin(ctx, "", tokenInfo.GetTokenToUse()); err != nil {
 		state.Set(loginStatus)
@@ -1297,6 +1404,22 @@ func (s *Server) SwitchProfile(callerCtx context.Context, msg *proto.SwitchProfi
 
 	s.jwtCache.clear()
 
+	// A pending login flow and the account-prompt flag describe the previous
+	// profile's login; carried across a switch they would judge the new
+	// profile's token against the old profile's account. CancelFunc is
+	// non-blocking, so calling it under the mutex is safe.
+	if cancel := s.oauthAuthFlow.waitCancel; cancel != nil {
+		cancel()
+	}
+	s.oauthAuthFlow = oauthAuthFlow{}
+	s.forceAccountPrompt = false
+
+	// A pending session extend belongs to the previous profile too: its device
+	// code was issued by that profile's IdP client, and WaitExtendAuthSession
+	// would submit the resulting token against the new profile's engine.
+	s.extendAuthSessionFlow.CancelWait()
+	s.extendAuthSessionFlow.Clear()
+
 	if msg != nil && msg.ProfileName != nil {
 		s.publishProfileListChanged(*msg.ProfileName)
 	}
@@ -1940,7 +2063,7 @@ func (s *Server) RequestJWTAuth(
 	}
 
 	// the daemon has no graphical session of its own, only the caller can answer this
-	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, msg.GetHasGraphicalSession(), false, hint)
+	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, msg.GetHasGraphicalSession(), false, hint, false)
 	if err != nil {
 		return nil, gstatus.Errorf(codes.Internal, "failed to create OAuth flow: %v", err)
 	}
@@ -1950,12 +2073,15 @@ func (s *Server) RequestJWTAuth(
 		return nil, gstatus.Errorf(codes.Internal, "failed to request auth info: %v", err)
 	}
 
-	s.mutex.Lock()
-	s.oauthAuthFlow.flow = oAuthFlow
-	s.oauthAuthFlow.info = authInfo
-	s.oauthAuthFlow.expiresAt = time.Now().Add(time.Duration(authInfo.ExpiresIn) * time.Second)
-	s.oauthAuthFlow.cacheGeneration = cacheGeneration
-	s.mutex.Unlock()
+	// This flow carries no profile hint: leaving the previous login's hint and
+	// accountPrompted in place would have WaitSSOLogin judge a later token
+	// against them.
+	s.replaceOAuthFlow(oauthAuthFlow{
+		flow:            oAuthFlow,
+		info:            authInfo,
+		expiresAt:       time.Now().Add(time.Duration(authInfo.ExpiresIn) * time.Second),
+		cacheGeneration: cacheGeneration,
+	})
 
 	return &proto.RequestJWTAuthResponse{
 		VerificationURI:         authInfo.VerificationURI,
@@ -2055,7 +2181,7 @@ func (s *Server) RequestExtendAuthSession(
 	}
 
 	// the daemon has no graphical session of its own, only the caller can answer this
-	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, msg.GetHasGraphicalSession(), false, hint)
+	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, msg.GetHasGraphicalSession(), false, hint, true)
 	if err != nil {
 		return nil, gstatus.Errorf(codes.Internal, "failed to create OAuth flow: %v", err)
 	}
diff --git a/client/server/server_connect_test.go b/client/server/server_connect_test.go
index dc191a44f..28bbfccde 100644
--- a/client/server/server_connect_test.go
+++ b/client/server/server_connect_test.go
@@ -10,6 +10,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/client/internal"
+	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/proto"
 )
@@ -21,7 +22,8 @@ func newTestServer() *Server {
 		// New always populates the SSH JWT cache and the logout and
 		// profile-switch paths call into it unconditionally, so a Server
 		// assembled field by field has to populate it too.
-		jwtCache: newJWTCache(),
+		jwtCache:              newJWTCache(),
+		extendAuthSessionFlow: auth.NewPendingFlow(),
 	}
 }
 
diff --git a/management/internals/shared/grpc/pkce_flow_test.go b/management/internals/shared/grpc/pkce_flow_test.go
new file mode 100644
index 000000000..8724bacd8
--- /dev/null
+++ b/management/internals/shared/grpc/pkce_flow_test.go
@@ -0,0 +1,87 @@
+package grpc
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/netbirdio/netbird/shared/management/client/common"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+func TestApplySessionExtendFlowPolicy(t *testing.T) {
+	tests := []struct {
+		name               string
+		flow               *proto.PKCEAuthorizationFlow
+		sessionExtend      bool
+		disablePromptLogin bool
+		loginFlag          uint32
+	}{
+		{
+			name: "extend replaces max_age=0 so login_hint is honoured",
+			flow: &proto.PKCEAuthorizationFlow{
+				ProviderConfig: &proto.ProviderConfig{
+					DisablePromptLogin: false,
+					LoginFlag:          uint32(common.LoginFlagMaxAge0),
+				},
+			},
+			sessionExtend:      true,
+			disablePromptLogin: false,
+			loginFlag:          uint32(common.LoginFlagPromptLogin),
+		},
+		{
+			name: "extend replaces the none flag so the extend is not silent",
+			flow: &proto.PKCEAuthorizationFlow{
+				ProviderConfig: &proto.ProviderConfig{
+					DisablePromptLogin: false,
+					LoginFlag:          uint32(common.LoginFlagNone),
+				},
+			},
+			sessionExtend:      true,
+			disablePromptLogin: false,
+			loginFlag:          uint32(common.LoginFlagPromptLogin),
+		},
+		{
+			name: "extend respects DisablePromptLogin",
+			flow: &proto.PKCEAuthorizationFlow{
+				ProviderConfig: &proto.ProviderConfig{
+					DisablePromptLogin: true,
+					LoginFlag:          uint32(common.LoginFlagMaxAge0),
+				},
+			},
+			sessionExtend:      true,
+			disablePromptLogin: true,
+			loginFlag:          uint32(common.LoginFlagMaxAge0),
+		},
+		{
+			name: "login keeps the configured flow untouched",
+			flow: &proto.PKCEAuthorizationFlow{
+				ProviderConfig: &proto.ProviderConfig{
+					DisablePromptLogin: false,
+					LoginFlag:          uint32(common.LoginFlagMaxAge0),
+				},
+			},
+			sessionExtend:      false,
+			disablePromptLogin: false,
+			loginFlag:          uint32(common.LoginFlagMaxAge0),
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			applySessionExtendFlowPolicy(tc.flow, tc.sessionExtend)
+			cfg := tc.flow.GetProviderConfig()
+			assert.Equal(t, tc.disablePromptLogin, cfg.GetDisablePromptLogin())
+			assert.Equal(t, tc.loginFlag, cfg.GetLoginFlag())
+		})
+	}
+}
+
+// A provider config is not guaranteed to be present on the response; clearing
+// the flag must not panic when the validator returned an empty flow.
+func TestApplySessionExtendFlowPolicyWithoutProviderConfig(t *testing.T) {
+	assert.NotPanics(t, func() {
+		applySessionExtendFlowPolicy(&proto.PKCEAuthorizationFlow{}, true)
+		applySessionExtendFlowPolicy(nil, true)
+	})
+}
diff --git a/management/internals/shared/grpc/server.go b/management/internals/shared/grpc/server.go
index 6e95a8998..079a16a70 100644
--- a/management/internals/shared/grpc/server.go
+++ b/management/internals/shared/grpc/server.go
@@ -1088,7 +1088,8 @@ func (s *Server) GetPKCEAuthorizationFlow(ctx context.Context, req *proto.Encryp
 		return nil, status.Errorf(codes.Internal, "failed to get server key")
 	}
 
-	err = encryption.DecryptMessage(peerKey, key, req.Body, &proto.PKCEAuthorizationFlowRequest{})
+	flowReq := &proto.PKCEAuthorizationFlowRequest{}
+	err = encryption.DecryptMessage(peerKey, key, req.Body, flowReq)
 	if err != nil {
 		errMSG := fmt.Sprintf("error while decrypting peer's message with Wireguard public key %s.", req.WgPubKey)
 		log.WithContext(ctx).Warn(errMSG)
@@ -1132,6 +1133,7 @@ func (s *Server) GetPKCEAuthorizationFlow(ctx context.Context, req *proto.Encryp
 	}
 
 	flowInfoResp := s.integratedPeerValidator.ValidateFlowResponse(ctx, peerKey.String(), initInfoFlow)
+	applySessionExtendFlowPolicy(flowInfoResp, flowReq.GetSessionExtend())
 
 	encryptedResp, err := encryption.EncryptMessage(peerKey, key, flowInfoResp)
 	if err != nil {
@@ -1144,6 +1146,40 @@ func (s *Server) GetPKCEAuthorizationFlow(ctx context.Context, req *proto.Encryp
 	}, nil
 }
 
+// applySessionExtendFlowPolicy forces a prompt=login flow for a session extend.
+//
+// An extend renews the session of one specific peer, so its token has to come
+// from the account that peer is registered under. A flow that does not prompt
+// leaves the choice to the IdP, which answers a silent authorization from any
+// session it already holds — not necessarily this peer's account when several
+// are signed in, and login_hint is a suggestion the IdP may ignore. The token
+// then fails the jwt.UserID == peer.UserID check in ExtendAuthSession, and the
+// user is given no opportunity to pick a different account.
+//
+// LoginFlagPromptLogin rather than max_age=0: both re-authenticate, but with
+// prompt=login the IdP honours login_hint and offers the peer's own account,
+// whereas max_age=0 leaves the user to find it among every account signed in.
+//
+// DisablePromptLogin is left alone. It is set for IdPs that break on
+// prompt=login — Authentik triggers a double authentication, and social logins
+// fail outright — so overriding it would trade a recoverable session extend for
+// a login that cannot complete at all. Those deployments keep the silent flow
+// and, with several accounts signed in, an extend answered from the wrong one
+// still fails the user match.
+//
+// Called after ValidateFlowResponse so that a per-peer override cannot reinstate
+// the silent flow for an extend.
+func applySessionExtendFlowPolicy(flow *proto.PKCEAuthorizationFlow, sessionExtend bool) {
+	if !sessionExtend {
+		return
+	}
+	cfg := flow.GetProviderConfig()
+	if cfg == nil || cfg.GetDisablePromptLogin() {
+		return
+	}
+	cfg.LoginFlag = uint32(common.LoginFlagPromptLogin)
+}
+
 // SyncMeta endpoint is used to synchronize peer's system metadata and notifies the connected,
 // peer's under the same account of any updates.
 func (s *Server) SyncMeta(ctx context.Context, req *proto.EncryptedMessage) (*proto.Empty, error) {
diff --git a/shared/management/client/client.go b/shared/management/client/client.go
index 13beabee6..64a54f45a 100644
--- a/shared/management/client/client.go
+++ b/shared/management/client/client.go
@@ -21,7 +21,11 @@ type Client interface {
 	// is not eligible for session extension.
 	ExtendAuthSession(sysInfo *system.Info, jwtToken string) (*proto.ExtendAuthSessionResponse, error)
 	GetDeviceAuthorizationFlow() (*proto.DeviceAuthorizationFlow, error)
-	GetPKCEAuthorizationFlow() (*proto.PKCEAuthorizationFlow, error)
+	// GetPKCEAuthorizationFlow returns the PKCE authorization flow information.
+	//
+	// sessionExtend marks the flow as renewing an existing peer's session rather
+	// than logging one in. See PKCEAuthorizationFlowRequest.
+	GetPKCEAuthorizationFlow(sessionExtend bool) (*proto.PKCEAuthorizationFlow, error)
 	GetServerURL() string
 	// IsHealthy returns the current connection status without blocking.
 	// Used by the engine to monitor connectivity in the background.
diff --git a/shared/management/client/client_test.go b/shared/management/client/client_test.go
index c1d394e7e..d8992d0f0 100644
--- a/shared/management/client/client_test.go
+++ b/shared/management/client/client_test.go
@@ -665,7 +665,12 @@ func Test_GetPKCEAuthorizationFlow(t *testing.T) {
 		},
 	}
 
+	var gotRequest mgmtProto.PKCEAuthorizationFlowRequest
 	mgmtMockServer.GetPKCEAuthorizationFlowFunc = func(ctx context.Context, req *mgmtProto.EncryptedMessage) (*mgmtProto.EncryptedMessage, error) {
+		if err := encryption.DecryptMessage(client.key.PublicKey(), serverKey, req.Body, &gotRequest); err != nil {
+			return nil, err
+		}
+
 		encryptedResp, err := encryption.EncryptMessage(client.key.PublicKey(), serverKey, expectedFlowInfo)
 		if err != nil {
 			return nil, err
@@ -678,10 +683,10 @@ func Test_GetPKCEAuthorizationFlow(t *testing.T) {
 		}, nil
 	}
 
-	flowInfo, err := client.GetPKCEAuthorizationFlow()
-	if err != nil {
-		t.Error("error while retrieving pkce auth flow information")
-	}
+	flowInfo, err := client.GetPKCEAuthorizationFlow(true)
+	require.NoError(t, err)
+
+	assert.True(t, gotRequest.GetSessionExtend(), "session extend should reach the server")
 
 	assert.Equal(t, expectedFlowInfo.ProviderConfig.ClientID, flowInfo.ProviderConfig.ClientID, "provider configured client ID should match")
 	assert.Equal(t, expectedFlowInfo.ProviderConfig.ClientSecret, flowInfo.ProviderConfig.ClientSecret, "provider configured client secret should match") //nolint:staticcheck
diff --git a/shared/management/client/grpc.go b/shared/management/client/grpc.go
index ce2d07429..f7c7f2dc3 100644
--- a/shared/management/client/grpc.go
+++ b/shared/management/client/grpc.go
@@ -738,9 +738,13 @@ func (c *GrpcClient) GetDeviceAuthorizationFlow() (*proto.DeviceAuthorizationFlo
 	return flowInfoResp, nil
 }
 
-// GetPKCEAuthorizationFlow returns a pkce authorization flow information.
+// GetPKCEAuthorizationFlow returns the PKCE authorization flow information.
 // It also takes care of encrypting and decrypting messages.
-func (c *GrpcClient) GetPKCEAuthorizationFlow() (*proto.PKCEAuthorizationFlow, error) {
+//
+// sessionExtend tells the server the flow will renew an existing peer's session
+// rather than log one in, so it can rule out a configuration that would let the
+// IdP answer from an unrelated account. See PKCEAuthorizationFlowRequest.
+func (c *GrpcClient) GetPKCEAuthorizationFlow(sessionExtend bool) (*proto.PKCEAuthorizationFlow, error) {
 	if !c.ready() {
 		return nil, fmt.Errorf("no connection to management in order to get pkce authorization flow")
 	}
@@ -753,7 +757,7 @@ func (c *GrpcClient) GetPKCEAuthorizationFlow() (*proto.PKCEAuthorizationFlow, e
 	mgmCtx, cancel := context.WithTimeout(c.ctx, time.Second*2)
 	defer cancel()
 
-	message := &proto.PKCEAuthorizationFlowRequest{}
+	message := &proto.PKCEAuthorizationFlowRequest{SessionExtend: sessionExtend}
 	encryptedMSG, err := encryption.EncryptMessage(*serverKey, c.key, message)
 	if err != nil {
 		return nil, err
diff --git a/shared/management/client/mock.go b/shared/management/client/mock.go
index 28278dcab..330bf9ece 100644
--- a/shared/management/client/mock.go
+++ b/shared/management/client/mock.go
@@ -16,7 +16,7 @@ type MockClient struct {
 	LoginFunc                      func(info *system.Info, sshKey []byte, dnsLabels domain.List) (*proto.LoginResponse, error)
 	ExtendAuthSessionFunc          func(info *system.Info, jwtToken string) (*proto.ExtendAuthSessionResponse, error)
 	GetDeviceAuthorizationFlowFunc func() (*proto.DeviceAuthorizationFlow, error)
-	GetPKCEAuthorizationFlowFunc   func() (*proto.PKCEAuthorizationFlow, error)
+	GetPKCEAuthorizationFlowFunc   func(sessionExtend bool) (*proto.PKCEAuthorizationFlow, error)
 	GetServerURLFunc               func() string
 	HealthCheckFunc                func() error
 	SyncMetaFunc                   func(sysInfo *system.Info) error
@@ -80,11 +80,12 @@ func (m *MockClient) GetDeviceAuthorizationFlow() (*proto.DeviceAuthorizationFlo
 	return m.GetDeviceAuthorizationFlowFunc()
 }
 
-func (m *MockClient) GetPKCEAuthorizationFlow() (*proto.PKCEAuthorizationFlow, error) {
+// GetPKCEAuthorizationFlow returns the PKCE authorization flow information.
+func (m *MockClient) GetPKCEAuthorizationFlow(sessionExtend bool) (*proto.PKCEAuthorizationFlow, error) {
 	if m.GetPKCEAuthorizationFlowFunc == nil {
 		return nil, nil
 	}
-	return m.GetPKCEAuthorizationFlowFunc()
+	return m.GetPKCEAuthorizationFlowFunc(sessionExtend)
 }
 
 func (m *MockClient) HealthCheck() error {
diff --git a/shared/management/proto/management.pb.go b/shared/management/proto/management.pb.go
index de0fdd84d..13e3552f5 100644
--- a/shared/management/proto/management.pb.go
+++ b/shared/management/proto/management.pb.go
@@ -3247,11 +3247,21 @@ func (x *DeviceAuthorizationFlow) GetProviderConfig() *ProviderConfig {
 	return nil
 }
 
-// PKCEAuthorizationFlowRequest empty struct for future expansion
+// PKCEAuthorizationFlowRequest asks for the PKCE flow configuration to use for
+// an upcoming authorization request.
 type PKCEAuthorizationFlowRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
+
+	// SessionExtend indicates the flow will renew the SSO session of a peer that
+	// is already registered, rather than log in or register one. An extend is
+	// bound to the account that peer belongs to, so the server must not answer it
+	// with a configuration that lets the IdP reply from whatever session is
+	// already active: with several accounts signed in at the IdP that need not be
+	// the peer's own, and the resulting token is rejected as a peer/user mismatch
+	// with no way for the user to correct it.
+	SessionExtend bool `protobuf:"varint,1,opt,name=SessionExtend,proto3" json:"SessionExtend,omitempty"`
 }
 
 func (x *PKCEAuthorizationFlowRequest) Reset() {
@@ -3286,6 +3296,13 @@ func (*PKCEAuthorizationFlowRequest) Descriptor() ([]byte, []int) {
 	return file_management_proto_rawDescGZIP(), []int{35}
 }
 
+func (x *PKCEAuthorizationFlowRequest) GetSessionExtend() bool {
+	if x != nil {
+		return x.SessionExtend
+	}
+	return false
+}
+
 // PKCEAuthorizationFlow represents Authorization Code Flow information
 // that can be used by the client to login initiate a Oauth 2.0 authorization code grant flow
 // with Proof Key for Code Exchange (PKCE). See https://datatracker.ietf.org/doc/html/rfc7636
@@ -7288,700 +7305,702 @@ var file_management_proto_rawDesc = []byte{
 	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f,
 	0x6e, 0x66, 0x69, 0x67, 0x52, 0x0e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f,
 	0x6e, 0x66, 0x69, 0x67, 0x22, 0x16, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72,
-	0x12, 0x0a, 0x0a, 0x06, 0x48, 0x4f, 0x53, 0x54, 0x45, 0x44, 0x10, 0x00, 0x22, 0x1e, 0x0a, 0x1c,
+	0x12, 0x0a, 0x0a, 0x06, 0x48, 0x4f, 0x53, 0x54, 0x45, 0x44, 0x10, 0x00, 0x22, 0x44, 0x0a, 0x1c,
 	0x50, 0x4b, 0x43, 0x45, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f,
-	0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x5b, 0x0a, 0x15,
-	0x50, 0x4b, 0x43, 0x45, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f,
-	0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x12, 0x42, 0x0a, 0x0e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65,
-	0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x76, 0x69,
-	0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0e, 0x50, 0x72, 0x6f, 0x76, 0x69,
-	0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0xbc, 0x03, 0x0a, 0x0e, 0x50, 0x72,
-	0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x1a, 0x0a, 0x08,
-	0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49, 0x44, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
-	0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49, 0x44, 0x12, 0x26, 0x0a, 0x0c, 0x43, 0x6c, 0x69, 0x65,
-	0x6e, 0x74, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x02,
-	0x18, 0x01, 0x52, 0x0c, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74,
-	0x12, 0x16, 0x0a, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x41, 0x75, 0x64, 0x69,
-	0x65, 0x6e, 0x63, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x41, 0x75, 0x64, 0x69,
-	0x65, 0x6e, 0x63, 0x65, 0x12, 0x2e, 0x0a, 0x12, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75,
-	0x74, 0x68, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x12, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x45, 0x6e, 0x64, 0x70,
-	0x6f, 0x69, 0x6e, 0x74, 0x12, 0x24, 0x0a, 0x0d, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x45, 0x6e, 0x64,
-	0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x54, 0x6f, 0x6b,
-	0x65, 0x6e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x53, 0x63,
-	0x6f, 0x70, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x53, 0x63, 0x6f, 0x70, 0x65,
-	0x12, 0x1e, 0x0a, 0x0a, 0x55, 0x73, 0x65, 0x49, 0x44, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x08,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x55, 0x73, 0x65, 0x49, 0x44, 0x54, 0x6f, 0x6b, 0x65, 0x6e,
-	0x12, 0x34, 0x0a, 0x15, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f,
-	0x6e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x15, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e,
-	0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x22, 0x0a, 0x0c, 0x52, 0x65, 0x64, 0x69, 0x72, 0x65,
-	0x63, 0x74, 0x55, 0x52, 0x4c, 0x73, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x52, 0x65,
-	0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x55, 0x52, 0x4c, 0x73, 0x12, 0x2e, 0x0a, 0x12, 0x44, 0x69,
+	0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x24, 0x0a, 0x0d,
+	0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x08, 0x52, 0x0d, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x45, 0x78, 0x74, 0x65,
+	0x6e, 0x64, 0x22, 0x5b, 0x0a, 0x15, 0x50, 0x4b, 0x43, 0x45, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72,
+	0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x12, 0x42, 0x0a, 0x0e, 0x50,
+	0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+	0x2e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52,
+	0x0e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22,
+	0xbc, 0x03, 0x0a, 0x0e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x12, 0x1a, 0x0a, 0x08, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49, 0x44, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49, 0x44, 0x12, 0x26,
+	0x0a, 0x0c, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x42, 0x02, 0x18, 0x01, 0x52, 0x0c, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74,
+	0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x1a,
+	0x0a, 0x08, 0x41, 0x75, 0x64, 0x69, 0x65, 0x6e, 0x63, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x08, 0x41, 0x75, 0x64, 0x69, 0x65, 0x6e, 0x63, 0x65, 0x12, 0x2e, 0x0a, 0x12, 0x44, 0x65,
+	0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74,
+	0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75,
+	0x74, 0x68, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x24, 0x0a, 0x0d, 0x54, 0x6f,
+	0x6b, 0x65, 0x6e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0d, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74,
+	0x12, 0x14, 0x0a, 0x05, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x05, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x12, 0x1e, 0x0a, 0x0a, 0x55, 0x73, 0x65, 0x49, 0x44, 0x54,
+	0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x55, 0x73, 0x65, 0x49,
+	0x44, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x34, 0x0a, 0x15, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72,
+	0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18,
+	0x09, 0x20, 0x01, 0x28, 0x09, 0x52, 0x15, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x22, 0x0a, 0x0c,
+	0x52, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x55, 0x52, 0x4c, 0x73, 0x18, 0x0a, 0x20, 0x03,
+	0x28, 0x09, 0x52, 0x0c, 0x52, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x55, 0x52, 0x4c, 0x73,
+	0x12, 0x2e, 0x0a, 0x12, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x6d, 0x70,
+	0x74, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12, 0x44, 0x69,
 	0x73, 0x61, 0x62, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x4c, 0x6f, 0x67, 0x69, 0x6e,
-	0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x50,
-	0x72, 0x6f, 0x6d, 0x70, 0x74, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x1c, 0x0a, 0x09, 0x4c, 0x6f,
-	0x67, 0x69, 0x6e, 0x46, 0x6c, 0x61, 0x67, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x09, 0x4c,
-	0x6f, 0x67, 0x69, 0x6e, 0x46, 0x6c, 0x61, 0x67, 0x22, 0x93, 0x02, 0x0a, 0x05, 0x52, 0x6f, 0x75,
-	0x74, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x49, 0x44, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02,
-	0x49, 0x44, 0x12, 0x18, 0x0a, 0x07, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x07, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x12, 0x20, 0x0a, 0x0b,
-	0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x54, 0x79, 0x70, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x03, 0x52, 0x0b, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x54, 0x79, 0x70, 0x65, 0x12, 0x12,
-	0x0a, 0x04, 0x50, 0x65, 0x65, 0x72, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x50, 0x65,
-	0x65, 0x72, 0x12, 0x16, 0x0a, 0x06, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x18, 0x05, 0x20, 0x01,
-	0x28, 0x03, 0x52, 0x06, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x12, 0x1e, 0x0a, 0x0a, 0x4d, 0x61,
-	0x73, 0x71, 0x75, 0x65, 0x72, 0x61, 0x64, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a,
-	0x4d, 0x61, 0x73, 0x71, 0x75, 0x65, 0x72, 0x61, 0x64, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x4e, 0x65,
-	0x74, 0x49, 0x44, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x4e, 0x65, 0x74, 0x49, 0x44,
-	0x12, 0x18, 0x0a, 0x07, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28,
-	0x09, 0x52, 0x07, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x1c, 0x0a, 0x09, 0x6b, 0x65,
-	0x65, 0x70, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x18, 0x09, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x6b,
-	0x65, 0x65, 0x70, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x12, 0x24, 0x0a, 0x0d, 0x73, 0x6b, 0x69, 0x70,
-	0x41, 0x75, 0x74, 0x6f, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x0d, 0x73, 0x6b, 0x69, 0x70, 0x41, 0x75, 0x74, 0x6f, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x22, 0xde,
-	0x01, 0x0a, 0x09, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x24, 0x0a, 0x0d,
-	0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x08, 0x52, 0x0d, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x45, 0x6e, 0x61, 0x62,
-	0x6c, 0x65, 0x12, 0x47, 0x0a, 0x10, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72,
-	0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65,
-	0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x52, 0x10, 0x4e, 0x61, 0x6d, 0x65, 0x53,
-	0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x38, 0x0a, 0x0b, 0x43,
-	0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b,
-	0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x75,
-	0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x52, 0x0b, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d,
-	0x5a, 0x6f, 0x6e, 0x65, 0x73, 0x12, 0x28, 0x0a, 0x0d, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64,
-	0x65, 0x72, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x42, 0x02, 0x18, 0x01,
-	0x52, 0x0d, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x50, 0x6f, 0x72, 0x74, 0x22,
-	0xb8, 0x01, 0x0a, 0x0a, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x12, 0x16,
-	0x0a, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06,
-	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x32, 0x0a, 0x07, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64,
-	0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x69, 0x6d, 0x70, 0x6c, 0x65, 0x52, 0x65, 0x63, 0x6f, 0x72,
-	0x64, 0x52, 0x07, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x12, 0x32, 0x0a, 0x14, 0x53, 0x65,
-	0x61, 0x72, 0x63, 0x68, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c,
-	0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x14, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68,
-	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x2a,
-	0x0a, 0x10, 0x4e, 0x6f, 0x6e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x61, 0x74, 0x69,
-	0x76, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x4e, 0x6f, 0x6e, 0x41, 0x75, 0x74,
-	0x68, 0x6f, 0x72, 0x69, 0x74, 0x61, 0x74, 0x69, 0x76, 0x65, 0x22, 0x74, 0x0a, 0x0c, 0x53, 0x69,
-	0x6d, 0x70, 0x6c, 0x65, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x4e, 0x61,
-	0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x12,
-	0x0a, 0x04, 0x54, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x04, 0x54, 0x79,
-	0x70, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x05, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x12, 0x10, 0x0a, 0x03, 0x54, 0x54, 0x4c, 0x18,
-	0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x03, 0x54, 0x54, 0x4c, 0x12, 0x14, 0x0a, 0x05, 0x52, 0x44,
-	0x61, 0x74, 0x61, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x52, 0x44, 0x61, 0x74, 0x61,
-	0x22, 0xb3, 0x01, 0x0a, 0x0f, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47,
-	0x72, 0x6f, 0x75, 0x70, 0x12, 0x38, 0x0a, 0x0b, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76,
-	0x65, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65,
-	0x72, 0x52, 0x0b, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x18,
-	0x0a, 0x07, 0x50, 0x72, 0x69, 0x6d, 0x61, 0x72, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x07, 0x50, 0x72, 0x69, 0x6d, 0x61, 0x72, 0x79, 0x12, 0x18, 0x0a, 0x07, 0x44, 0x6f, 0x6d, 0x61,
-	0x69, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x44, 0x6f, 0x6d, 0x61, 0x69,
-	0x6e, 0x73, 0x12, 0x32, 0x0a, 0x14, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x44, 0x6f, 0x6d, 0x61,
-	0x69, 0x6e, 0x73, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08,
-	0x52, 0x14, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x45,
-	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x22, 0x48, 0x0a, 0x0a, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65,
-	0x72, 0x76, 0x65, 0x72, 0x12, 0x0e, 0x0a, 0x02, 0x49, 0x50, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x02, 0x49, 0x50, 0x12, 0x16, 0x0a, 0x06, 0x4e, 0x53, 0x54, 0x79, 0x70, 0x65, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x03, 0x52, 0x06, 0x4e, 0x53, 0x54, 0x79, 0x70, 0x65, 0x12, 0x12, 0x0a, 0x04,
-	0x50, 0x6f, 0x72, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52, 0x04, 0x50, 0x6f, 0x72, 0x74,
-	0x22, 0xfb, 0x02, 0x0a, 0x0c, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c,
-	0x65, 0x12, 0x1a, 0x0a, 0x06, 0x50, 0x65, 0x65, 0x72, 0x49, 0x50, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x42, 0x02, 0x18, 0x01, 0x52, 0x06, 0x50, 0x65, 0x65, 0x72, 0x49, 0x50, 0x12, 0x37, 0x0a,
-	0x09, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e,
-	0x32, 0x19, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75,
-	0x6c, 0x65, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x09, 0x44, 0x69, 0x72,
-	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x2e, 0x0a, 0x06, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06,
-	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x34, 0x0a, 0x08, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63,
-	0x6f, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63,
-	0x6f, 0x6c, 0x52, 0x08, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x12, 0x0a, 0x04,
-	0x50, 0x6f, 0x72, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x50, 0x6f, 0x72, 0x74,
-	0x12, 0x30, 0x0a, 0x08, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x18, 0x06, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x08, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e,
-	0x66, 0x6f, 0x12, 0x1a, 0x0a, 0x08, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x44, 0x18, 0x07,
-	0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x44, 0x12, 0x26,
-	0x0a, 0x0e, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c,
-	0x18, 0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0e, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x50, 0x72,
-	0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x26, 0x0a, 0x0e, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x65, 0x73, 0x18, 0x09, 0x20, 0x03, 0x28, 0x0c, 0x52, 0x0e,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x65, 0x73, 0x22, 0x38,
-	0x0a, 0x0e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73,
-	0x12, 0x14, 0x0a, 0x05, 0x6e, 0x65, 0x74, 0x49, 0x50, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x05, 0x6e, 0x65, 0x74, 0x49, 0x50, 0x12, 0x10, 0x0a, 0x03, 0x6d, 0x61, 0x63, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x03, 0x6d, 0x61, 0x63, 0x22, 0x1e, 0x0a, 0x06, 0x43, 0x68, 0x65, 0x63,
-	0x6b, 0x73, 0x12, 0x14, 0x0a, 0x05, 0x46, 0x69, 0x6c, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28,
-	0x09, 0x52, 0x05, 0x46, 0x69, 0x6c, 0x65, 0x73, 0x22, 0x96, 0x01, 0x0a, 0x08, 0x50, 0x6f, 0x72,
-	0x74, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x14, 0x0a, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x0d, 0x48, 0x00, 0x52, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x32, 0x0a, 0x05, 0x72,
-	0x61, 0x6e, 0x67, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f,
-	0x2e, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x48, 0x00, 0x52, 0x05, 0x72, 0x61, 0x6e, 0x67, 0x65, 0x1a,
-	0x2f, 0x0a, 0x05, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x72,
-	0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x05, 0x73, 0x74, 0x61, 0x72, 0x74, 0x12, 0x10,
-	0x0a, 0x03, 0x65, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x03, 0x65, 0x6e, 0x64,
-	0x42, 0x0f, 0x0a, 0x0d, 0x70, 0x6f, 0x72, 0x74, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x22, 0x87, 0x03, 0x0a, 0x11, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x46, 0x69, 0x72, 0x65, 0x77,
-	0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x12, 0x22, 0x0a, 0x0c, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x12, 0x2e, 0x0a, 0x06, 0x61,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x16, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x41, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x20, 0x0a, 0x0b, 0x64,
-	0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x0b, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x34, 0x0a,
-	0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32,
-	0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c,
-	0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x63, 0x6f, 0x6c, 0x12, 0x30, 0x0a, 0x08, 0x70, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x18,
-	0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x08, 0x70, 0x6f, 0x72,
-	0x74, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x1c, 0x0a, 0x09, 0x69, 0x73, 0x44, 0x79, 0x6e, 0x61, 0x6d,
-	0x69, 0x63, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x69, 0x73, 0x44, 0x79, 0x6e, 0x61,
-	0x6d, 0x69, 0x63, 0x12, 0x18, 0x0a, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x07,
-	0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x26, 0x0a,
-	0x0e, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18,
-	0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0e, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x50, 0x72, 0x6f,
-	0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x1a, 0x0a, 0x08, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49,
-	0x44, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49,
-	0x44, 0x12, 0x18, 0x0a, 0x07, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x49, 0x44, 0x18, 0x0a, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x07, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x49, 0x44, 0x22, 0xf6, 0x01, 0x0a, 0x0e,
-	0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x12, 0x34,
-	0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e,
-	0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75,
-	0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x3e, 0x0a, 0x0f, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74,
-	0x69, 0x6f, 0x6e, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49,
-	0x6e, 0x66, 0x6f, 0x52, 0x0f, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x50, 0x6f, 0x72, 0x74, 0x12, 0x2c, 0x0a, 0x11, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x6c, 0x61, 0x74,
-	0x65, 0x64, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52,
-	0x11, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x41, 0x64, 0x64, 0x72, 0x65,
-	0x73, 0x73, 0x12, 0x3c, 0x0a, 0x0e, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x6c, 0x61, 0x74, 0x65, 0x64,
-	0x50, 0x6f, 0x72, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f,
-	0x52, 0x0e, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x50, 0x6f, 0x72, 0x74,
-	0x3a, 0x02, 0x18, 0x01, 0x22, 0x8b, 0x02, 0x0a, 0x14, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x53,
-	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x12, 0x0a,
-	0x04, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x04, 0x70, 0x6f, 0x72,
-	0x74, 0x12, 0x36, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x0e, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x2e, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52,
-	0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x10, 0x0a, 0x03, 0x70, 0x69, 0x6e,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x70, 0x69, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x70,
-	0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70,
-	0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x1f, 0x0a, 0x0b, 0x75, 0x73, 0x65, 0x72, 0x5f,
-	0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0a, 0x75, 0x73,
-	0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61,
-	0x69, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
-	0x12, 0x1f, 0x0a, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x18,
-	0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6e, 0x61, 0x6d, 0x65, 0x50, 0x72, 0x65, 0x66, 0x69,
-	0x78, 0x12, 0x1f, 0x0a, 0x0b, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x5f, 0x70, 0x6f, 0x72, 0x74,
-	0x18, 0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0a, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x50, 0x6f,
-	0x72, 0x74, 0x22, 0xa1, 0x01, 0x0a, 0x15, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x53, 0x65, 0x72,
-	0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x21, 0x0a, 0x0c,
-	0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12,
-	0x1f, 0x0a, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x55, 0x72, 0x6c,
-	0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x2c, 0x0a, 0x12, 0x70, 0x6f, 0x72, 0x74,
-	0x5f, 0x61, 0x75, 0x74, 0x6f, 0x5f, 0x61, 0x73, 0x73, 0x69, 0x67, 0x6e, 0x65, 0x64, 0x18, 0x04,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x70, 0x6f, 0x72, 0x74, 0x41, 0x75, 0x74, 0x6f, 0x41, 0x73,
-	0x73, 0x69, 0x67, 0x6e, 0x65, 0x64, 0x22, 0x2c, 0x0a, 0x12, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x45,
-	0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x16, 0x0a, 0x06,
-	0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f,
-	0x6d, 0x61, 0x69, 0x6e, 0x22, 0x15, 0x0a, 0x13, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x45, 0x78, 0x70,
-	0x6f, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x2b, 0x0a, 0x11, 0x53,
-	0x74, 0x6f, 0x70, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x22, 0x14, 0x0a, 0x12, 0x53, 0x74, 0x6f, 0x70,
-	0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x9a,
-	0x01, 0x0a, 0x12, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x76,
-	0x65, 0x6c, 0x6f, 0x70, 0x65, 0x12, 0x3a, 0x0a, 0x04, 0x66, 0x75, 0x6c, 0x6c, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f,
-	0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x48, 0x00, 0x52, 0x04, 0x66, 0x75, 0x6c,
-	0x6c, 0x12, 0x3d, 0x0a, 0x05, 0x64, 0x65, 0x6c, 0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x25, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65,
-	0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e,
-	0x74, 0x73, 0x44, 0x65, 0x6c, 0x74, 0x61, 0x48, 0x00, 0x52, 0x05, 0x64, 0x65, 0x6c, 0x74, 0x61,
-	0x42, 0x09, 0x0a, 0x07, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x22, 0x96, 0x0f, 0x0a, 0x18,
-	0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e,
-	0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x65, 0x72, 0x69,
-	0x61, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x06, 0x73, 0x65, 0x72, 0x69, 0x61, 0x6c,
-	0x12, 0x37, 0x0a, 0x0b, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0a, 0x70,
-	0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x34, 0x0a, 0x07, 0x6e, 0x65, 0x74,
-	0x77, 0x6f, 0x72, 0x6b, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x4e,
-	0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x12,
-	0x4d, 0x0a, 0x10, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x74, 0x69,
-	0x6e, 0x67, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x53, 0x65,
-	0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x0f, 0x61,
-	0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x41,
-	0x0a, 0x0c, 0x64, 0x6e, 0x73, 0x5f, 0x73, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x05,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
-	0x74, 0x2e, 0x44, 0x4e, 0x53, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x43, 0x6f, 0x6d,
-	0x70, 0x61, 0x63, 0x74, 0x52, 0x0b, 0x64, 0x6e, 0x73, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67,
-	0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x64, 0x6e, 0x73, 0x5f, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18,
-	0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x64, 0x6e, 0x73, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
-	0x12, 0x2c, 0x0a, 0x12, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5f, 0x7a, 0x6f, 0x6e, 0x65, 0x5f,
-	0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x63, 0x75,
-	0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x25,
-	0x0a, 0x0e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x73,
-	0x18, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0d, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72,
-	0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x2d, 0x0a, 0x05, 0x70, 0x65, 0x65, 0x72, 0x73, 0x18, 0x09,
-	0x20, 0x03, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
-	0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x05, 0x70,
-	0x65, 0x65, 0x72, 0x73, 0x12, 0x2e, 0x0a, 0x13, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x5f, 0x70,
-	0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x18, 0x0a, 0x20, 0x03, 0x28,
-	0x0d, 0x52, 0x11, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x50, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64,
-	0x65, 0x78, 0x65, 0x73, 0x12, 0x35, 0x0a, 0x08, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73,
-	0x18, 0x0b, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63,
-	0x74, 0x52, 0x08, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x12, 0x30, 0x0a, 0x06, 0x67,
-	0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x0c, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x43, 0x6f,
-	0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x06, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x2c, 0x0a,
-	0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x0d, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65,
-	0x52, 0x61, 0x77, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x4b, 0x0a, 0x11, 0x6e,
-	0x61, 0x6d, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73,
-	0x18, 0x0e, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72,
-	0x6f, 0x75, 0x70, 0x52, 0x61, 0x77, 0x52, 0x10, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x65, 0x72, 0x76,
-	0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x40, 0x0a, 0x0f, 0x61, 0x6c, 0x6c, 0x5f,
-	0x64, 0x6e, 0x73, 0x5f, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x18, 0x0f, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53,
-	0x69, 0x6d, 0x70, 0x6c, 0x65, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x52, 0x0d, 0x61, 0x6c, 0x6c,
-	0x44, 0x6e, 0x73, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x12, 0x3b, 0x0a, 0x0d, 0x61, 0x63,
-	0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x7a, 0x6f, 0x6e, 0x65, 0x73, 0x18, 0x10, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43,
-	0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x52, 0x0c, 0x61, 0x63, 0x63, 0x6f, 0x75,
-	0x6e, 0x74, 0x5a, 0x6f, 0x6e, 0x65, 0x73, 0x12, 0x4b, 0x0a, 0x11, 0x6e, 0x65, 0x74, 0x77, 0x6f,
-	0x72, 0x6b, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x11, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52,
-	0x61, 0x77, 0x52, 0x10, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x73, 0x12, 0x55, 0x0a, 0x0b, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x73, 0x5f,
-	0x6d, 0x61, 0x70, 0x18, 0x12, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x34, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x12, 0x1c, 0x0a, 0x09, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x46, 0x6c, 0x61, 0x67, 0x18, 0x0c, 0x20,
+	0x01, 0x28, 0x0d, 0x52, 0x09, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x46, 0x6c, 0x61, 0x67, 0x22, 0x93,
+	0x02, 0x0a, 0x05, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x49, 0x44, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x49, 0x44, 0x12, 0x18, 0x0a, 0x07, 0x4e, 0x65, 0x74, 0x77,
+	0x6f, 0x72, 0x6b, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x4e, 0x65, 0x74, 0x77, 0x6f,
+	0x72, 0x6b, 0x12, 0x20, 0x0a, 0x0b, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x54, 0x79, 0x70,
+	0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0b, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
+	0x54, 0x79, 0x70, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x50, 0x65, 0x65, 0x72, 0x18, 0x04, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x04, 0x50, 0x65, 0x65, 0x72, 0x12, 0x16, 0x0a, 0x06, 0x4d, 0x65, 0x74, 0x72,
+	0x69, 0x63, 0x18, 0x05, 0x20, 0x01, 0x28, 0x03, 0x52, 0x06, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63,
+	0x12, 0x1e, 0x0a, 0x0a, 0x4d, 0x61, 0x73, 0x71, 0x75, 0x65, 0x72, 0x61, 0x64, 0x65, 0x18, 0x06,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x4d, 0x61, 0x73, 0x71, 0x75, 0x65, 0x72, 0x61, 0x64, 0x65,
+	0x12, 0x14, 0x0a, 0x05, 0x4e, 0x65, 0x74, 0x49, 0x44, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x05, 0x4e, 0x65, 0x74, 0x49, 0x44, 0x12, 0x18, 0x0a, 0x07, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
+	0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73,
+	0x12, 0x1c, 0x0a, 0x09, 0x6b, 0x65, 0x65, 0x70, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x18, 0x09, 0x20,
+	0x01, 0x28, 0x08, 0x52, 0x09, 0x6b, 0x65, 0x65, 0x70, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x12, 0x24,
+	0x0a, 0x0d, 0x73, 0x6b, 0x69, 0x70, 0x41, 0x75, 0x74, 0x6f, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x18,
+	0x0a, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x73, 0x6b, 0x69, 0x70, 0x41, 0x75, 0x74, 0x6f, 0x41,
+	0x70, 0x70, 0x6c, 0x79, 0x22, 0xde, 0x01, 0x0a, 0x09, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x12, 0x24, 0x0a, 0x0d, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x45, 0x6e, 0x61,
+	0x62, 0x6c, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x53, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x12, 0x47, 0x0a, 0x10, 0x4e, 0x61, 0x6d, 0x65,
+	0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x02, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x52,
+	0x10, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70,
+	0x73, 0x12, 0x38, 0x0a, 0x0b, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x73,
+	0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x52, 0x0b,
+	0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x73, 0x12, 0x28, 0x0a, 0x0d, 0x46,
+	0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x04, 0x20, 0x01,
+	0x28, 0x03, 0x42, 0x02, 0x18, 0x01, 0x52, 0x0d, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65,
+	0x72, 0x50, 0x6f, 0x72, 0x74, 0x22, 0xb8, 0x01, 0x0a, 0x0a, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d,
+	0x5a, 0x6f, 0x6e, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x32, 0x0a, 0x07,
+	0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x69, 0x6d, 0x70, 0x6c,
+	0x65, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x52, 0x07, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73,
+	0x12, 0x32, 0x0a, 0x14, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
+	0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x14,
+	0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x44, 0x69, 0x73, 0x61,
+	0x62, 0x6c, 0x65, 0x64, 0x12, 0x2a, 0x0a, 0x10, 0x4e, 0x6f, 0x6e, 0x41, 0x75, 0x74, 0x68, 0x6f,
+	0x72, 0x69, 0x74, 0x61, 0x74, 0x69, 0x76, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10,
+	0x4e, 0x6f, 0x6e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x61, 0x74, 0x69, 0x76, 0x65,
+	0x22, 0x74, 0x0a, 0x0c, 0x53, 0x69, 0x6d, 0x70, 0x6c, 0x65, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64,
+	0x12, 0x12, 0x0a, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
+	0x4e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x54, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x03, 0x52, 0x04, 0x54, 0x79, 0x70, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x43, 0x6c, 0x61, 0x73,
+	0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x12, 0x10,
+	0x0a, 0x03, 0x54, 0x54, 0x4c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x03, 0x54, 0x54, 0x4c,
+	0x12, 0x14, 0x0a, 0x05, 0x52, 0x44, 0x61, 0x74, 0x61, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x05, 0x52, 0x44, 0x61, 0x74, 0x61, 0x22, 0xb3, 0x01, 0x0a, 0x0f, 0x4e, 0x61, 0x6d, 0x65, 0x53,
+	0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x38, 0x0a, 0x0b, 0x4e, 0x61,
+	0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x61, 0x6d,
+	0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x0b, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72,
+	0x76, 0x65, 0x72, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x50, 0x72, 0x69, 0x6d, 0x61, 0x72, 0x79, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x50, 0x72, 0x69, 0x6d, 0x61, 0x72, 0x79, 0x12, 0x18,
+	0x0a, 0x07, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52,
+	0x07, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x32, 0x0a, 0x14, 0x53, 0x65, 0x61, 0x72,
+	0x63, 0x68, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x14, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x44, 0x6f,
+	0x6d, 0x61, 0x69, 0x6e, 0x73, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x22, 0x48, 0x0a, 0x0a,
+	0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x12, 0x0e, 0x0a, 0x02, 0x49, 0x50,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x49, 0x50, 0x12, 0x16, 0x0a, 0x06, 0x4e, 0x53,
+	0x54, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x06, 0x4e, 0x53, 0x54, 0x79,
+	0x70, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03,
+	0x52, 0x04, 0x50, 0x6f, 0x72, 0x74, 0x22, 0xfb, 0x02, 0x0a, 0x0c, 0x46, 0x69, 0x72, 0x65, 0x77,
+	0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x12, 0x1a, 0x0a, 0x06, 0x50, 0x65, 0x65, 0x72, 0x49,
+	0x50, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x02, 0x18, 0x01, 0x52, 0x06, 0x50, 0x65, 0x65,
+	0x72, 0x49, 0x50, 0x12, 0x37, 0x0a, 0x09, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x19, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x52, 0x09, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x2e, 0x0a, 0x06,
+	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x16, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x41, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x34, 0x0a, 0x08,
+	0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x18,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65,
+	0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63,
+	0x6f, 0x6c, 0x12, 0x12, 0x0a, 0x04, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x04, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x30, 0x0a, 0x08, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e,
+	0x66, 0x6f, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x08,
+	0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x1a, 0x0a, 0x08, 0x50, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x49, 0x44, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x50, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x49, 0x44, 0x12, 0x26, 0x0a, 0x0e, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x50, 0x72,
+	0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0e, 0x63, 0x75,
+	0x73, 0x74, 0x6f, 0x6d, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x26, 0x0a, 0x0e,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x65, 0x73, 0x18, 0x09,
+	0x20, 0x03, 0x28, 0x0c, 0x52, 0x0e, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x72, 0x65, 0x66,
+	0x69, 0x78, 0x65, 0x73, 0x22, 0x38, 0x0a, 0x0e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x41,
+	0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x14, 0x0a, 0x05, 0x6e, 0x65, 0x74, 0x49, 0x50, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6e, 0x65, 0x74, 0x49, 0x50, 0x12, 0x10, 0x0a, 0x03,
+	0x6d, 0x61, 0x63, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6d, 0x61, 0x63, 0x22, 0x1e,
+	0x0a, 0x06, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x73, 0x12, 0x14, 0x0a, 0x05, 0x46, 0x69, 0x6c, 0x65,
+	0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x05, 0x46, 0x69, 0x6c, 0x65, 0x73, 0x22, 0x96,
+	0x01, 0x0a, 0x08, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x14, 0x0a, 0x04, 0x70,
+	0x6f, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x48, 0x00, 0x52, 0x04, 0x70, 0x6f, 0x72,
+	0x74, 0x12, 0x32, 0x0a, 0x05, 0x72, 0x61, 0x6e, 0x67, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f,
+	0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x2e, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x48, 0x00, 0x52, 0x05,
+	0x72, 0x61, 0x6e, 0x67, 0x65, 0x1a, 0x2f, 0x0a, 0x05, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x14,
+	0x0a, 0x05, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x05, 0x73,
+	0x74, 0x61, 0x72, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x0d, 0x52, 0x03, 0x65, 0x6e, 0x64, 0x42, 0x0f, 0x0a, 0x0d, 0x70, 0x6f, 0x72, 0x74, 0x53, 0x65,
+	0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x87, 0x03, 0x0a, 0x11, 0x52, 0x6f, 0x75, 0x74,
+	0x65, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x12, 0x22, 0x0a,
+	0x0c, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x18, 0x01, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x61, 0x6e, 0x67, 0x65,
+	0x73, 0x12, 0x2e, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x0e, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52,
+	0x75, 0x6c, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x12, 0x34, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52,
+	0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x30, 0x0a, 0x08, 0x70, 0x6f, 0x72,
+	0x74, 0x49, 0x6e, 0x66, 0x6f, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66,
+	0x6f, 0x52, 0x08, 0x70, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x1c, 0x0a, 0x09, 0x69,
+	0x73, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09,
+	0x69, 0x73, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x12, 0x18, 0x0a, 0x07, 0x64, 0x6f, 0x6d,
+	0x61, 0x69, 0x6e, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x64, 0x6f, 0x6d, 0x61,
+	0x69, 0x6e, 0x73, 0x12, 0x26, 0x0a, 0x0e, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x50, 0x72, 0x6f,
+	0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0e, 0x63, 0x75, 0x73,
+	0x74, 0x6f, 0x6d, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x1a, 0x0a, 0x08, 0x50,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x44, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x50,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x44, 0x12, 0x18, 0x0a, 0x07, 0x52, 0x6f, 0x75, 0x74, 0x65,
+	0x49, 0x44, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x49,
+	0x44, 0x22, 0xf6, 0x01, 0x0a, 0x0e, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67,
+	0x52, 0x75, 0x6c, 0x65, 0x12, 0x34, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c,
+	0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x3e, 0x0a, 0x0f, 0x64, 0x65,
+	0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+	0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x0f, 0x64, 0x65, 0x73, 0x74, 0x69,
+	0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x2c, 0x0a, 0x11, 0x74, 0x72,
+	0x61, 0x6e, 0x73, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x11, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x6c, 0x61, 0x74, 0x65,
+	0x64, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x3c, 0x0a, 0x0e, 0x74, 0x72, 0x61, 0x6e,
+	0x73, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f,
+	0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x0e, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x6c, 0x61, 0x74,
+	0x65, 0x64, 0x50, 0x6f, 0x72, 0x74, 0x3a, 0x02, 0x18, 0x01, 0x22, 0x8b, 0x02, 0x0a, 0x14, 0x45,
+	0x78, 0x70, 0x6f, 0x73, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0d, 0x52, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x36, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x63, 0x6f, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x50, 0x72, 0x6f,
+	0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12,
+	0x10, 0x0a, 0x03, 0x70, 0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x70, 0x69,
+	0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x1f, 0x0a,
+	0x0b, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x05, 0x20, 0x03,
+	0x28, 0x09, 0x52, 0x0a, 0x75, 0x73, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x16,
+	0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06,
+	0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x1f, 0x0a, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x70,
+	0x72, 0x65, 0x66, 0x69, 0x78, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6e, 0x61, 0x6d,
+	0x65, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x12, 0x1f, 0x0a, 0x0b, 0x6c, 0x69, 0x73, 0x74, 0x65,
+	0x6e, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0a, 0x6c, 0x69,
+	0x73, 0x74, 0x65, 0x6e, 0x50, 0x6f, 0x72, 0x74, 0x22, 0xa1, 0x01, 0x0a, 0x15, 0x45, 0x78, 0x70,
+	0x6f, 0x73, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x6e, 0x61,
+	0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x5f, 0x75, 0x72, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x73, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x55, 0x72, 0x6c, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x2c,
+	0x0a, 0x12, 0x70, 0x6f, 0x72, 0x74, 0x5f, 0x61, 0x75, 0x74, 0x6f, 0x5f, 0x61, 0x73, 0x73, 0x69,
+	0x67, 0x6e, 0x65, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x70, 0x6f, 0x72, 0x74,
+	0x41, 0x75, 0x74, 0x6f, 0x41, 0x73, 0x73, 0x69, 0x67, 0x6e, 0x65, 0x64, 0x22, 0x2c, 0x0a, 0x12,
+	0x52, 0x65, 0x6e, 0x65, 0x77, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x22, 0x15, 0x0a, 0x13, 0x52, 0x65,
+	0x6e, 0x65, 0x77, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x22, 0x2b, 0x0a, 0x11, 0x53, 0x74, 0x6f, 0x70, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x22, 0x14,
+	0x0a, 0x12, 0x53, 0x74, 0x6f, 0x70, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x9a, 0x01, 0x0a, 0x12, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
+	0x4d, 0x61, 0x70, 0x45, 0x6e, 0x76, 0x65, 0x6c, 0x6f, 0x70, 0x65, 0x12, 0x3a, 0x0a, 0x04, 0x66,
+	0x75, 0x6c, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
 	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61,
-	0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x2e,
-	0x52, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x73, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52,
-	0x0a, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x73, 0x4d, 0x61, 0x70, 0x12, 0x71, 0x0a, 0x15, 0x72,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73,
-	0x5f, 0x6d, 0x61, 0x70, 0x18, 0x13, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x3d, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d,
-	0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c,
-	0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65,
-	0x73, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x13, 0x72, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x4d, 0x61, 0x70, 0x12, 0x6a,
-	0x0a, 0x14, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x5f, 0x74, 0x6f, 0x5f, 0x75, 0x73,
-	0x65, 0x72, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x14, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x3a, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72,
-	0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46, 0x75,
-	0x6c, 0x6c, 0x2e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x54, 0x6f, 0x55, 0x73, 0x65, 0x72,
-	0x49, 0x64, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x10, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x49,
-	0x64, 0x54, 0x6f, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x73, 0x12, 0x28, 0x0a, 0x10, 0x61, 0x6c,
-	0x6c, 0x6f, 0x77, 0x65, 0x64, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x15,
-	0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x55, 0x73, 0x65,
-	0x72, 0x49, 0x64, 0x73, 0x12, 0x6e, 0x0a, 0x14, 0x70, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x5f,
-	0x66, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x5f, 0x70, 0x65, 0x65, 0x72, 0x73, 0x18, 0x16, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x3c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x48,
+	0x00, 0x52, 0x04, 0x66, 0x75, 0x6c, 0x6c, 0x12, 0x3d, 0x0a, 0x05, 0x64, 0x65, 0x6c, 0x74, 0x61,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f,
+	0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x44, 0x65, 0x6c, 0x74, 0x61, 0x48, 0x00, 0x52,
+	0x05, 0x64, 0x65, 0x6c, 0x74, 0x61, 0x42, 0x09, 0x0a, 0x07, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61,
+	0x64, 0x22, 0x96, 0x0f, 0x0a, 0x18, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70,
+	0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x12, 0x16,
+	0x0a, 0x06, 0x73, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x06,
+	0x73, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x12, 0x37, 0x0a, 0x0b, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x63,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x52, 0x0a, 0x70, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12,
+	0x34, 0x0a, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63,
+	0x63, 0x6f, 0x75, 0x6e, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x07, 0x6e, 0x65,
+	0x74, 0x77, 0x6f, 0x72, 0x6b, 0x12, 0x4d, 0x0a, 0x10, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74,
+	0x5f, 0x73, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63,
+	0x6f, 0x75, 0x6e, 0x74, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x43, 0x6f, 0x6d, 0x70,
+	0x61, 0x63, 0x74, 0x52, 0x0f, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x53, 0x65, 0x74, 0x74,
+	0x69, 0x6e, 0x67, 0x73, 0x12, 0x41, 0x0a, 0x0c, 0x64, 0x6e, 0x73, 0x5f, 0x73, 0x65, 0x74, 0x74,
+	0x69, 0x6e, 0x67, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x44, 0x4e, 0x53, 0x53, 0x65, 0x74, 0x74, 0x69,
+	0x6e, 0x67, 0x73, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x0b, 0x64, 0x6e, 0x73, 0x53,
+	0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x64, 0x6e, 0x73, 0x5f, 0x64,
+	0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x64, 0x6e, 0x73,
+	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x2c, 0x0a, 0x12, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d,
+	0x5f, 0x7a, 0x6f, 0x6e, 0x65, 0x5f, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x07, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x10, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x44, 0x6f,
+	0x6d, 0x61, 0x69, 0x6e, 0x12, 0x25, 0x0a, 0x0e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x5f, 0x76, 0x65,
+	0x72, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0d, 0x61, 0x67,
+	0x65, 0x6e, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x2d, 0x0a, 0x05, 0x70,
+	0x65, 0x65, 0x72, 0x73, 0x18, 0x09, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6d, 0x70,
+	0x61, 0x63, 0x74, 0x52, 0x05, 0x70, 0x65, 0x65, 0x72, 0x73, 0x12, 0x2e, 0x0a, 0x13, 0x72, 0x6f,
+	0x75, 0x74, 0x65, 0x72, 0x5f, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x65,
+	0x73, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x0d, 0x52, 0x11, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x50,
+	0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x12, 0x35, 0x0a, 0x08, 0x70, 0x6f,
+	0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x18, 0x0b, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x08, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65,
+	0x73, 0x12, 0x30, 0x0a, 0x06, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x0c, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x47,
+	0x72, 0x6f, 0x75, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x06, 0x67, 0x72, 0x6f,
+	0x75, 0x70, 0x73, 0x12, 0x2c, 0x0a, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x0d, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+	0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x61, 0x77, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65,
+	0x73, 0x12, 0x4b, 0x0a, 0x11, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f,
+	0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x0e, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x52, 0x61, 0x77, 0x52, 0x10, 0x6e, 0x61,
+	0x6d, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x40,
+	0x0a, 0x0f, 0x61, 0x6c, 0x6c, 0x5f, 0x64, 0x6e, 0x73, 0x5f, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64,
+	0x73, 0x18, 0x0f, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x69, 0x6d, 0x70, 0x6c, 0x65, 0x52, 0x65, 0x63, 0x6f, 0x72,
+	0x64, 0x52, 0x0d, 0x61, 0x6c, 0x6c, 0x44, 0x6e, 0x73, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73,
+	0x12, 0x3b, 0x0a, 0x0d, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x7a, 0x6f, 0x6e, 0x65,
+	0x73, 0x18, 0x10, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x52,
+	0x0c, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5a, 0x6f, 0x6e, 0x65, 0x73, 0x12, 0x4b, 0x0a,
+	0x11, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x73, 0x18, 0x11, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x61, 0x77, 0x52, 0x10, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72,
+	0x6b, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x55, 0x0a, 0x0b, 0x72, 0x6f,
+	0x75, 0x74, 0x65, 0x72, 0x73, 0x5f, 0x6d, 0x61, 0x70, 0x18, 0x12, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x34, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74,
+	0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74,
+	0x73, 0x46, 0x75, 0x6c, 0x6c, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x73, 0x4d, 0x61, 0x70,
+	0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0a, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x73, 0x4d, 0x61,
+	0x70, 0x12, 0x71, 0x0a, 0x15, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x70, 0x6f,
+	0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x5f, 0x6d, 0x61, 0x70, 0x18, 0x13, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x3d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65,
+	0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e,
+	0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50,
+	0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52,
+	0x13, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65,
+	0x73, 0x4d, 0x61, 0x70, 0x12, 0x6a, 0x0a, 0x14, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64,
+	0x5f, 0x74, 0x6f, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x14, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x3a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
 	0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e,
-	0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x2e, 0x50, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65,
-	0x46, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79,
-	0x52, 0x12, 0x70, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x46, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x50,
-	0x65, 0x65, 0x72, 0x73, 0x12, 0x2c, 0x0a, 0x12, 0x64, 0x6e, 0x73, 0x5f, 0x66, 0x6f, 0x72, 0x77,
-	0x61, 0x72, 0x64, 0x65, 0x72, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x17, 0x20, 0x01, 0x28, 0x03,
-	0x52, 0x10, 0x64, 0x6e, 0x73, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x50, 0x6f,
-	0x72, 0x74, 0x12, 0x3b, 0x0a, 0x0b, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x5f, 0x70, 0x61, 0x74, 0x63,
-	0x68, 0x18, 0x18, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x61, 0x74, 0x63, 0x68, 0x42,
-	0x02, 0x18, 0x01, 0x52, 0x0a, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x61, 0x74, 0x63, 0x68, 0x12,
-	0x22, 0x0a, 0x0d, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x5f, 0x63, 0x6c, 0x61, 0x69, 0x6d,
-	0x18, 0x19, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x43, 0x6c,
-	0x61, 0x69, 0x6d, 0x1a, 0x5c, 0x0a, 0x0f, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x73, 0x4d, 0x61,
-	0x70, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x33, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75,
-	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x6f, 0x75, 0x74,
-	0x65, 0x72, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38,
-	0x01, 0x1a, 0x5d, 0x0a, 0x18, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x6f, 0x6c,
-	0x69, 0x63, 0x69, 0x65, 0x73, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a,
+	0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x2e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64,
+	0x54, 0x6f, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x10,
+	0x67, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x54, 0x6f, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x73,
+	0x12, 0x28, 0x0a, 0x10, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x5f, 0x75, 0x73, 0x65, 0x72,
+	0x5f, 0x69, 0x64, 0x73, 0x18, 0x15, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x61, 0x6c, 0x6c, 0x6f,
+	0x77, 0x65, 0x64, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x73, 0x12, 0x6e, 0x0a, 0x14, 0x70, 0x6f,
+	0x73, 0x74, 0x75, 0x72, 0x65, 0x5f, 0x66, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x5f, 0x70, 0x65, 0x65,
+	0x72, 0x73, 0x18, 0x16, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x3c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70,
+	0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x2e, 0x50,
+	0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x46, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72,
+	0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x12, 0x70, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x46,
+	0x61, 0x69, 0x6c, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x73, 0x12, 0x2c, 0x0a, 0x12, 0x64, 0x6e,
+	0x73, 0x5f, 0x66, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x5f, 0x70, 0x6f, 0x72, 0x74,
+	0x18, 0x17, 0x20, 0x01, 0x28, 0x03, 0x52, 0x10, 0x64, 0x6e, 0x73, 0x46, 0x6f, 0x72, 0x77, 0x61,
+	0x72, 0x64, 0x65, 0x72, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x3b, 0x0a, 0x0b, 0x70, 0x72, 0x6f, 0x78,
+	0x79, 0x5f, 0x70, 0x61, 0x74, 0x63, 0x68, 0x18, 0x18, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79,
+	0x50, 0x61, 0x74, 0x63, 0x68, 0x42, 0x02, 0x18, 0x01, 0x52, 0x0a, 0x70, 0x72, 0x6f, 0x78, 0x79,
+	0x50, 0x61, 0x74, 0x63, 0x68, 0x12, 0x22, 0x0a, 0x0d, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64,
+	0x5f, 0x63, 0x6c, 0x61, 0x69, 0x6d, 0x18, 0x19, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x75, 0x73,
+	0x65, 0x72, 0x49, 0x64, 0x43, 0x6c, 0x61, 0x69, 0x6d, 0x1a, 0x5c, 0x0a, 0x0f, 0x52, 0x6f, 0x75,
+	0x74, 0x65, 0x72, 0x73, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03,
+	0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x33,
+	0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f,
+	0x72, 0x6b, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x05, 0x76, 0x61,
+	0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x5d, 0x0a, 0x18, 0x52, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x4d, 0x61, 0x70, 0x45, 0x6e,
+	0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x2b, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x64, 0x73, 0x52, 0x05, 0x76, 0x61, 0x6c,
+	0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x5b, 0x0a, 0x15, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49,
+	0x64, 0x54, 0x6f, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12,
+	0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65,
+	0x79, 0x12, 0x2c, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x55, 0x73,
+	0x65, 0x72, 0x49, 0x44, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a,
+	0x02, 0x38, 0x01, 0x1a, 0x5f, 0x0a, 0x17, 0x50, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x46, 0x61,
+	0x69, 0x6c, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10,
+	0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79,
+	0x12, 0x2e, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65,
+	0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x53, 0x65, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
+	0x3a, 0x02, 0x38, 0x01, 0x4a, 0x04, 0x08, 0x1a, 0x10, 0x33, 0x22, 0x8b, 0x03, 0x0a, 0x0a, 0x50,
+	0x72, 0x6f, 0x78, 0x79, 0x50, 0x61, 0x74, 0x63, 0x68, 0x12, 0x32, 0x0a, 0x05, 0x70, 0x65, 0x65,
+	0x72, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72,
+	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x05, 0x70, 0x65, 0x65, 0x72, 0x73, 0x12, 0x41, 0x0a,
+	0x0d, 0x6f, 0x66, 0x66, 0x6c, 0x69, 0x6e, 0x65, 0x5f, 0x70, 0x65, 0x65, 0x72, 0x73, 0x18, 0x02,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x52, 0x0c, 0x6f, 0x66, 0x66, 0x6c, 0x69, 0x6e, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73,
+	0x12, 0x3f, 0x0a, 0x0e, 0x66, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x5f, 0x72, 0x75, 0x6c,
+	0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75,
+	0x6c, 0x65, 0x52, 0x0d, 0x66, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65,
+	0x73, 0x12, 0x29, 0x0a, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52,
+	0x6f, 0x75, 0x74, 0x65, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x4f, 0x0a, 0x14,
+	0x72, 0x6f, 0x75, 0x74, 0x65, 0x5f, 0x66, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x5f, 0x72,
+	0x75, 0x6c, 0x65, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x46, 0x69, 0x72,
+	0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x52, 0x12, 0x72, 0x6f, 0x75, 0x74, 0x65,
+	0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x12, 0x45, 0x0a,
+	0x10, 0x66, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x5f, 0x72, 0x75, 0x6c, 0x65,
+	0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52,
+	0x75, 0x6c, 0x65, 0x52, 0x0f, 0x66, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52,
+	0x75, 0x6c, 0x65, 0x73, 0x3a, 0x02, 0x18, 0x01, 0x22, 0x94, 0x01, 0x0a, 0x16, 0x41, 0x63, 0x63,
+	0x6f, 0x75, 0x6e, 0x74, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x43, 0x6f, 0x6d, 0x70,
+	0x61, 0x63, 0x74, 0x12, 0x41, 0x0a, 0x1d, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x6c, 0x6f, 0x67, 0x69,
+	0x6e, 0x5f, 0x65, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x6e, 0x61,
+	0x62, 0x6c, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x1a, 0x70, 0x65, 0x65, 0x72,
+	0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45,
+	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x37, 0x0a, 0x18, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x6c,
+	0x6f, 0x67, 0x69, 0x6e, 0x5f, 0x65, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f,
+	0x6e, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x15, 0x70, 0x65, 0x65, 0x72, 0x4c, 0x6f,
+	0x67, 0x69, 0x6e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4e, 0x73, 0x22,
+	0x95, 0x01, 0x0a, 0x0e, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f,
+	0x72, 0x6b, 0x12, 0x1e, 0x0a, 0x0a, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69,
+	0x65, 0x72, 0x12, 0x19, 0x0a, 0x08, 0x6e, 0x65, 0x74, 0x5f, 0x63, 0x69, 0x64, 0x72, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6e, 0x65, 0x74, 0x43, 0x69, 0x64, 0x72, 0x12, 0x1e, 0x0a,
+	0x0b, 0x6e, 0x65, 0x74, 0x5f, 0x76, 0x36, 0x5f, 0x63, 0x69, 0x64, 0x72, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x09, 0x6e, 0x65, 0x74, 0x56, 0x36, 0x43, 0x69, 0x64, 0x72, 0x12, 0x10, 0x0a,
+	0x03, 0x64, 0x6e, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x64, 0x6e, 0x73, 0x12,
+	0x16, 0x0a, 0x06, 0x73, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x04, 0x52,
+	0x06, 0x73, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x22, 0x21, 0x0a, 0x19, 0x4e, 0x65, 0x74, 0x77, 0x6f,
+	0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x44,
+	0x65, 0x6c, 0x74, 0x61, 0x4a, 0x04, 0x08, 0x01, 0x10, 0x65, 0x22, 0xa2, 0x04, 0x0a, 0x0b, 0x50,
+	0x65, 0x65, 0x72, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x12, 0x1c, 0x0a, 0x0a, 0x77, 0x67,
+	0x5f, 0x70, 0x75, 0x62, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08,
+	0x77, 0x67, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x70, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0c, 0x52, 0x02, 0x69, 0x70, 0x12, 0x12, 0x0a, 0x04, 0x69, 0x70, 0x76, 0x36,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x69, 0x70, 0x76, 0x36, 0x12, 0x1e, 0x0a, 0x0b,
+	0x73, 0x73, 0x68, 0x5f, 0x70, 0x75, 0x62, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x0c, 0x52, 0x09, 0x73, 0x73, 0x68, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x12, 0x1b, 0x0a, 0x09,
+	0x64, 0x6e, 0x73, 0x5f, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x08, 0x64, 0x6e, 0x73, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x12, 0x23, 0x0a, 0x0d, 0x61, 0x67, 0x65,
+	0x6e, 0x74, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x0c, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x2f,
+	0x0a, 0x14, 0x61, 0x64, 0x64, 0x65, 0x64, 0x5f, 0x77, 0x69, 0x74, 0x68, 0x5f, 0x73, 0x73, 0x6f,
+	0x5f, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x11, 0x61, 0x64,
+	0x64, 0x65, 0x64, 0x57, 0x69, 0x74, 0x68, 0x53, 0x73, 0x6f, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x12,
+	0x38, 0x0a, 0x18, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x5f, 0x65, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x08, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x16, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x2f, 0x0a, 0x14, 0x6c, 0x61, 0x73,
+	0x74, 0x5f, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x5f, 0x75, 0x6e, 0x69, 0x78, 0x5f, 0x6e, 0x61, 0x6e,
+	0x6f, 0x18, 0x09, 0x20, 0x01, 0x28, 0x03, 0x52, 0x11, 0x6c, 0x61, 0x73, 0x74, 0x4c, 0x6f, 0x67,
+	0x69, 0x6e, 0x55, 0x6e, 0x69, 0x78, 0x4e, 0x61, 0x6e, 0x6f, 0x12, 0x1f, 0x0a, 0x0b, 0x73, 0x73,
+	0x68, 0x5f, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x0a, 0x73, 0x73, 0x68, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x23, 0x0a, 0x0d, 0x73,
+	0x75, 0x70, 0x70, 0x6f, 0x72, 0x74, 0x73, 0x5f, 0x69, 0x70, 0x76, 0x36, 0x18, 0x0b, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x0c, 0x73, 0x75, 0x70, 0x70, 0x6f, 0x72, 0x74, 0x73, 0x49, 0x70, 0x76, 0x36,
+	0x12, 0x38, 0x0a, 0x18, 0x73, 0x75, 0x70, 0x70, 0x6f, 0x72, 0x74, 0x73, 0x5f, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x5f, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x65, 0x73, 0x18, 0x0c, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x16, 0x73, 0x75, 0x70, 0x70, 0x6f, 0x72, 0x74, 0x73, 0x53, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x65, 0x73, 0x12, 0x2c, 0x0a, 0x12, 0x73, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x5f, 0x73, 0x73, 0x68, 0x5f, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64,
+	0x18, 0x0d, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x53, 0x73,
+	0x68, 0x41, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x12, 0x25, 0x0a, 0x0e, 0x70, 0x72, 0x6f, 0x78,
+	0x79, 0x5f, 0x65, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x65, 0x64, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x0d, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x45, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x65, 0x64, 0x22,
+	0x91, 0x06, 0x0a, 0x0d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63,
+	0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69,
+	0x64, 0x12, 0x2e, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x0e, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52,
+	0x75, 0x6c, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x12, 0x34, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x0e, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+	0x2e, 0x52, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x24, 0x0a, 0x0d, 0x62, 0x69, 0x64, 0x69, 0x72,
+	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d,
+	0x62, 0x69, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x12, 0x14, 0x0a,
+	0x05, 0x70, 0x6f, 0x72, 0x74, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0d, 0x52, 0x05, 0x70, 0x6f,
+	0x72, 0x74, 0x73, 0x12, 0x3b, 0x0a, 0x0b, 0x70, 0x6f, 0x72, 0x74, 0x5f, 0x72, 0x61, 0x6e, 0x67,
+	0x65, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x2e, 0x52,
+	0x61, 0x6e, 0x67, 0x65, 0x52, 0x0a, 0x70, 0x6f, 0x72, 0x74, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73,
+	0x12, 0x28, 0x0a, 0x10, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70,
+	0x5f, 0x69, 0x64, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x32, 0x0a, 0x15, 0x64, 0x65,
+	0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f,
+	0x69, 0x64, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x13, 0x64, 0x65, 0x73, 0x74, 0x69,
+	0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x5c,
+	0x0a, 0x11, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x5f, 0x67, 0x72, 0x6f,
+	0x75, 0x70, 0x73, 0x18, 0x09, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x43, 0x6f, 0x6d,
+	0x70, 0x61, 0x63, 0x74, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x47,
+	0x72, 0x6f, 0x75, 0x70, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x10, 0x61, 0x75, 0x74, 0x68,
+	0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x27, 0x0a, 0x0f,
+	0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x18,
+	0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65,
+	0x64, 0x55, 0x73, 0x65, 0x72, 0x12, 0x44, 0x0a, 0x0f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f,
+	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x0e, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x4e, 0x0a, 0x14, 0x64,
+	0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43,
+	0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x13, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x37, 0x0a, 0x18, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x70, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x5f, 0x63, 0x68,
+	0x65, 0x63, 0x6b, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x0d, 0x20, 0x03, 0x28, 0x09, 0x52, 0x15, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x43, 0x68, 0x65, 0x63,
+	0x6b, 0x49, 0x64, 0x73, 0x1a, 0x5d, 0x0a, 0x15, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a,
+	0x65, 0x64, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a,
 	0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12,
-	0x2b, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x6c, 0x69,
-	0x63, 0x79, 0x49, 0x64, 0x73, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01,
-	0x1a, 0x5b, 0x0a, 0x15, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x54, 0x6f, 0x55, 0x73, 0x65,
-	0x72, 0x49, 0x64, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x2c, 0x0a, 0x05, 0x76,
-	0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x49, 0x44, 0x4c, 0x69,
-	0x73, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x5f, 0x0a,
-	0x17, 0x50, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x46, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x50, 0x65,
-	0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x2e, 0x0a, 0x05, 0x76, 0x61,
-	0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78,
-	0x53, 0x65, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x4a, 0x04,
-	0x08, 0x1a, 0x10, 0x33, 0x22, 0x8b, 0x03, 0x0a, 0x0a, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x61,
-	0x74, 0x63, 0x68, 0x12, 0x32, 0x0a, 0x05, 0x70, 0x65, 0x65, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x52, 0x05, 0x70, 0x65, 0x65, 0x72, 0x73, 0x12, 0x41, 0x0a, 0x0d, 0x6f, 0x66, 0x66, 0x6c, 0x69,
-	0x6e, 0x65, 0x5f, 0x70, 0x65, 0x65, 0x72, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x6d, 0x6f,
-	0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0c, 0x6f, 0x66,
-	0x66, 0x6c, 0x69, 0x6e, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73, 0x12, 0x3f, 0x0a, 0x0e, 0x66, 0x69,
-	0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x5f, 0x72, 0x75, 0x6c, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x52, 0x0d, 0x66, 0x69,
-	0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x12, 0x29, 0x0a, 0x06, 0x72,
-	0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x06,
-	0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x4f, 0x0a, 0x14, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x5f,
-	0x66, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x5f, 0x72, 0x75, 0x6c, 0x65, 0x73, 0x18, 0x05,
-	0x20, 0x03, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
-	0x74, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52,
-	0x75, 0x6c, 0x65, 0x52, 0x12, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61,
-	0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x12, 0x45, 0x0a, 0x10, 0x66, 0x6f, 0x72, 0x77, 0x61,
-	0x72, 0x64, 0x69, 0x6e, 0x67, 0x5f, 0x72, 0x75, 0x6c, 0x65, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x46,
-	0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x52, 0x0f, 0x66,
-	0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x3a, 0x02,
-	0x18, 0x01, 0x22, 0x94, 0x01, 0x0a, 0x16, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x53, 0x65,
-	0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x12, 0x41, 0x0a,
-	0x1d, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x5f, 0x65, 0x78, 0x70, 0x69,
-	0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x1a, 0x70, 0x65, 0x65, 0x72, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x45,
-	0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64,
-	0x12, 0x37, 0x0a, 0x18, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x5f, 0x65,
-	0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x73, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x03, 0x52, 0x15, 0x70, 0x65, 0x65, 0x72, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x45, 0x78, 0x70,
-	0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4e, 0x73, 0x22, 0x95, 0x01, 0x0a, 0x0e, 0x41, 0x63,
-	0x63, 0x6f, 0x75, 0x6e, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x12, 0x1e, 0x0a, 0x0a,
-	0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x0a, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x12, 0x19, 0x0a, 0x08,
-	0x6e, 0x65, 0x74, 0x5f, 0x63, 0x69, 0x64, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07,
-	0x6e, 0x65, 0x74, 0x43, 0x69, 0x64, 0x72, 0x12, 0x1e, 0x0a, 0x0b, 0x6e, 0x65, 0x74, 0x5f, 0x76,
-	0x36, 0x5f, 0x63, 0x69, 0x64, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6e, 0x65,
-	0x74, 0x56, 0x36, 0x43, 0x69, 0x64, 0x72, 0x12, 0x10, 0x0a, 0x03, 0x64, 0x6e, 0x73, 0x18, 0x04,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x64, 0x6e, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x65, 0x72,
-	0x69, 0x61, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x04, 0x52, 0x06, 0x73, 0x65, 0x72, 0x69, 0x61,
-	0x6c, 0x22, 0x21, 0x0a, 0x19, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43,
-	0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x44, 0x65, 0x6c, 0x74, 0x61, 0x4a, 0x04,
-	0x08, 0x01, 0x10, 0x65, 0x22, 0xa2, 0x04, 0x0a, 0x0b, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6d,
-	0x70, 0x61, 0x63, 0x74, 0x12, 0x1c, 0x0a, 0x0a, 0x77, 0x67, 0x5f, 0x70, 0x75, 0x62, 0x5f, 0x6b,
-	0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x77, 0x67, 0x50, 0x75, 0x62, 0x4b,
-	0x65, 0x79, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x70, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x02,
-	0x69, 0x70, 0x12, 0x12, 0x0a, 0x04, 0x69, 0x70, 0x76, 0x36, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c,
-	0x52, 0x04, 0x69, 0x70, 0x76, 0x36, 0x12, 0x1e, 0x0a, 0x0b, 0x73, 0x73, 0x68, 0x5f, 0x70, 0x75,
-	0x62, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x73, 0x73, 0x68,
-	0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x12, 0x1b, 0x0a, 0x09, 0x64, 0x6e, 0x73, 0x5f, 0x6c, 0x61,
-	0x62, 0x65, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x64, 0x6e, 0x73, 0x4c, 0x61,
-	0x62, 0x65, 0x6c, 0x12, 0x23, 0x0a, 0x0d, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x5f, 0x76, 0x65, 0x72,
-	0x73, 0x69, 0x6f, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x61, 0x67, 0x65, 0x6e,
-	0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x2f, 0x0a, 0x14, 0x61, 0x64, 0x64, 0x65,
-	0x64, 0x5f, 0x77, 0x69, 0x74, 0x68, 0x5f, 0x73, 0x73, 0x6f, 0x5f, 0x6c, 0x6f, 0x67, 0x69, 0x6e,
-	0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x11, 0x61, 0x64, 0x64, 0x65, 0x64, 0x57, 0x69, 0x74,
-	0x68, 0x53, 0x73, 0x6f, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x38, 0x0a, 0x18, 0x6c, 0x6f, 0x67,
-	0x69, 0x6e, 0x5f, 0x65, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x6e,
-	0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x16, 0x6c, 0x6f, 0x67,
-	0x69, 0x6e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x61, 0x62,
-	0x6c, 0x65, 0x64, 0x12, 0x2f, 0x0a, 0x14, 0x6c, 0x61, 0x73, 0x74, 0x5f, 0x6c, 0x6f, 0x67, 0x69,
-	0x6e, 0x5f, 0x75, 0x6e, 0x69, 0x78, 0x5f, 0x6e, 0x61, 0x6e, 0x6f, 0x18, 0x09, 0x20, 0x01, 0x28,
-	0x03, 0x52, 0x11, 0x6c, 0x61, 0x73, 0x74, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x55, 0x6e, 0x69, 0x78,
-	0x4e, 0x61, 0x6e, 0x6f, 0x12, 0x1f, 0x0a, 0x0b, 0x73, 0x73, 0x68, 0x5f, 0x65, 0x6e, 0x61, 0x62,
-	0x6c, 0x65, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x73, 0x73, 0x68, 0x45, 0x6e,
-	0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x23, 0x0a, 0x0d, 0x73, 0x75, 0x70, 0x70, 0x6f, 0x72, 0x74,
-	0x73, 0x5f, 0x69, 0x70, 0x76, 0x36, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0c, 0x73, 0x75,
-	0x70, 0x70, 0x6f, 0x72, 0x74, 0x73, 0x49, 0x70, 0x76, 0x36, 0x12, 0x38, 0x0a, 0x18, 0x73, 0x75,
-	0x70, 0x70, 0x6f, 0x72, 0x74, 0x73, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x70, 0x72,
-	0x65, 0x66, 0x69, 0x78, 0x65, 0x73, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x08, 0x52, 0x16, 0x73, 0x75,
-	0x70, 0x70, 0x6f, 0x72, 0x74, 0x73, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x72, 0x65, 0x66,
-	0x69, 0x78, 0x65, 0x73, 0x12, 0x2c, 0x0a, 0x12, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x73,
-	0x73, 0x68, 0x5f, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x08,
-	0x52, 0x10, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x53, 0x73, 0x68, 0x41, 0x6c, 0x6c, 0x6f, 0x77,
-	0x65, 0x64, 0x12, 0x25, 0x0a, 0x0e, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x5f, 0x65, 0x6d, 0x62, 0x65,
-	0x64, 0x64, 0x65, 0x64, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x70, 0x72, 0x6f, 0x78,
-	0x79, 0x45, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x65, 0x64, 0x22, 0x91, 0x06, 0x0a, 0x0d, 0x50, 0x6f,
-	0x6c, 0x69, 0x63, 0x79, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69,
-	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x2e, 0x0a, 0x06, 0x61,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x16, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x41, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x34, 0x0a, 0x08, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x18, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x50,
-	0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f,
-	0x6c, 0x12, 0x24, 0x0a, 0x0d, 0x62, 0x69, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x61, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x62, 0x69, 0x64, 0x69, 0x72, 0x65,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x12, 0x14, 0x0a, 0x05, 0x70, 0x6f, 0x72, 0x74, 0x73,
-	0x18, 0x05, 0x20, 0x03, 0x28, 0x0d, 0x52, 0x05, 0x70, 0x6f, 0x72, 0x74, 0x73, 0x12, 0x3b, 0x0a,
-	0x0b, 0x70, 0x6f, 0x72, 0x74, 0x5f, 0x72, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x18, 0x06, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x2e, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x52, 0x0a,
-	0x70, 0x6f, 0x72, 0x74, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x12, 0x28, 0x0a, 0x10, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x07,
-	0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x47, 0x72, 0x6f, 0x75,
-	0x70, 0x49, 0x64, 0x73, 0x12, 0x32, 0x0a, 0x15, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74,
-	0x69, 0x6f, 0x6e, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x08, 0x20,
-	0x03, 0x28, 0x09, 0x52, 0x13, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x5c, 0x0a, 0x11, 0x61, 0x75, 0x74, 0x68,
-	0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x09, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x2e, 0x41,
-	0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x45,
-	0x6e, 0x74, 0x72, 0x79, 0x52, 0x10, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64,
-	0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x27, 0x0a, 0x0f, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72,
-	0x69, 0x7a, 0x65, 0x64, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x0e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x55, 0x73, 0x65, 0x72, 0x12,
-	0x44, 0x0a, 0x0f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f,
-	0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x0e, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x4e, 0x0a, 0x14, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61,
-	0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x0c, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74,
-	0x52, 0x13, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x37, 0x0a, 0x18, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f,
-	0x70, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x5f, 0x63, 0x68, 0x65, 0x63, 0x6b, 0x5f, 0x69, 0x64,
-	0x73, 0x18, 0x0d, 0x20, 0x03, 0x28, 0x09, 0x52, 0x15, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50,
-	0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x49, 0x64, 0x73, 0x1a, 0x5d,
-	0x0a, 0x15, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x47, 0x72, 0x6f, 0x75,
-	0x70, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x2e, 0x0a, 0x05, 0x76, 0x61, 0x6c,
-	0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x4c, 0x69,
-	0x73, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x80, 0x01,
-	0x0a, 0x0f, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63,
-	0x74, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x24, 0x0a, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e,
-	0x64, 0x65, 0x78, 0x5f, 0x73, 0x65, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0c, 0x70,
-	0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x53, 0x65, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x70,
-	0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x52,
-	0x09, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64,
-	0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x4a, 0x04, 0x08, 0x04, 0x10, 0x05,
-	0x22, 0x24, 0x0a, 0x0c, 0x55, 0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x4c, 0x69, 0x73, 0x74,
-	0x12, 0x14, 0x0a, 0x05, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52,
-	0x05, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x22, 0x93, 0x01, 0x0a, 0x0c, 0x47, 0x72, 0x6f, 0x75, 0x70,
-	0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x21, 0x0a, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x5f,
-	0x69, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0d, 0x52, 0x0b, 0x70,
-	0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x12, 0x15, 0x0a, 0x06, 0x69, 0x73,
-	0x5f, 0x61, 0x6c, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x05, 0x69, 0x73, 0x41, 0x6c,
-	0x6c, 0x12, 0x39, 0x0a, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x04,
-	0x20, 0x03, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
-	0x74, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63,
-	0x74, 0x52, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x22, 0x57, 0x0a, 0x12,
-	0x44, 0x4e, 0x53, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x43, 0x6f, 0x6d, 0x70, 0x61,
-	0x63, 0x74, 0x12, 0x41, 0x0a, 0x1d, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x5f, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f,
-	0x69, 0x64, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x1a, 0x64, 0x69, 0x73, 0x61, 0x62,
-	0x6c, 0x65, 0x64, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x47, 0x72, 0x6f,
-	0x75, 0x70, 0x49, 0x64, 0x73, 0x22, 0x8d, 0x04, 0x0a, 0x08, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52,
+	0x2e, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x18,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x55, 0x73, 0x65, 0x72,
+	0x4e, 0x61, 0x6d, 0x65, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a,
+	0x02, 0x38, 0x01, 0x22, 0x80, 0x01, 0x0a, 0x0f, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x24, 0x0a, 0x0e, 0x70,
+	0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x5f, 0x73, 0x65, 0x74, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x08, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x53, 0x65,
+	0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x09, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78,
+	0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64,
+	0x4a, 0x04, 0x08, 0x04, 0x10, 0x05, 0x22, 0x24, 0x0a, 0x0c, 0x55, 0x73, 0x65, 0x72, 0x4e, 0x61,
+	0x6d, 0x65, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x18,
+	0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x05, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x22, 0x93, 0x01, 0x0a,
+	0x0c, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x12, 0x0e, 0x0a,
+	0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x21, 0x0a,
+	0x0c, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x18, 0x02, 0x20,
+	0x03, 0x28, 0x0d, 0x52, 0x0b, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73,
+	0x12, 0x15, 0x0a, 0x06, 0x69, 0x73, 0x5f, 0x61, 0x6c, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x05, 0x69, 0x73, 0x41, 0x6c, 0x6c, 0x12, 0x39, 0x0a, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x73, 0x22, 0x57, 0x0a, 0x12, 0x44, 0x4e, 0x53, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67,
+	0x73, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x12, 0x41, 0x0a, 0x1d, 0x64, 0x69, 0x73, 0x61,
+	0x62, 0x6c, 0x65, 0x64, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x5f,
+	0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52,
+	0x1a, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x22, 0x8d, 0x04, 0x0a, 0x08,
+	0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x61, 0x77, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x15, 0x0a, 0x06, 0x6e, 0x65, 0x74, 0x5f,
+	0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6e, 0x65, 0x74, 0x49, 0x64, 0x12,
+	0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f,
+	0x6e, 0x12, 0x21, 0x0a, 0x0c, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x5f, 0x63, 0x69, 0x64,
+	0x72, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
+	0x43, 0x69, 0x64, 0x72, 0x12, 0x18, 0x0a, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18,
+	0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x1d,
+	0x0a, 0x0a, 0x6b, 0x65, 0x65, 0x70, 0x5f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x18, 0x06, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x09, 0x6b, 0x65, 0x65, 0x70, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x12, 0x24, 0x0a,
+	0x0e, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x5f, 0x73, 0x65, 0x74, 0x18,
+	0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78,
+	0x53, 0x65, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65,
+	0x78, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x09, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64,
+	0x65, 0x78, 0x12, 0x24, 0x0a, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70,
+	0x5f, 0x69, 0x64, 0x73, 0x18, 0x09, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72,
+	0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x6e, 0x65, 0x74, 0x77,
+	0x6f, 0x72, 0x6b, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0b,
+	0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x54, 0x79, 0x70, 0x65, 0x12, 0x1e, 0x0a, 0x0a, 0x6d,
+	0x61, 0x73, 0x71, 0x75, 0x65, 0x72, 0x61, 0x64, 0x65, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x0a, 0x6d, 0x61, 0x73, 0x71, 0x75, 0x65, 0x72, 0x61, 0x64, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x6d,
+	0x65, 0x74, 0x72, 0x69, 0x63, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x05, 0x52, 0x06, 0x6d, 0x65, 0x74,
+	0x72, 0x69, 0x63, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x0d,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x1b, 0x0a,
+	0x09, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x0e, 0x20, 0x03, 0x28, 0x09,
+	0x52, 0x08, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x37, 0x0a, 0x18, 0x61, 0x63,
+	0x63, 0x65, 0x73, 0x73, 0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x5f, 0x67, 0x72, 0x6f,
+	0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x0f, 0x20, 0x03, 0x28, 0x09, 0x52, 0x15, 0x61, 0x63,
+	0x63, 0x65, 0x73, 0x73, 0x43, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x47, 0x72, 0x6f, 0x75, 0x70,
+	0x49, 0x64, 0x73, 0x12, 0x26, 0x0a, 0x0f, 0x73, 0x6b, 0x69, 0x70, 0x5f, 0x61, 0x75, 0x74, 0x6f,
+	0x5f, 0x61, 0x70, 0x70, 0x6c, 0x79, 0x18, 0x10, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x73, 0x6b,
+	0x69, 0x70, 0x41, 0x75, 0x74, 0x6f, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x22, 0xff, 0x01, 0x0a, 0x12,
+	0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x52,
 	0x61, 0x77, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02,
-	0x69, 0x64, 0x12, 0x15, 0x0a, 0x06, 0x6e, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x05, 0x6e, 0x65, 0x74, 0x49, 0x64, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73,
-	0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b,
-	0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x21, 0x0a, 0x0c, 0x6e,
-	0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x5f, 0x63, 0x69, 0x64, 0x72, 0x18, 0x04, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x0b, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x43, 0x69, 0x64, 0x72, 0x12, 0x18,
-	0x0a, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52,
-	0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x6b, 0x65, 0x65, 0x70,
-	0x5f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x6b, 0x65,
-	0x65, 0x70, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x12, 0x24, 0x0a, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x5f,
-	0x69, 0x6e, 0x64, 0x65, 0x78, 0x5f, 0x73, 0x65, 0x74, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x0c, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x53, 0x65, 0x74, 0x12, 0x1d, 0x0a,
-	0x0a, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x18, 0x08, 0x20, 0x01, 0x28,
+	0x69, 0x64, 0x12, 0x38, 0x0a, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72,
+	0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52,
+	0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x1b, 0x0a, 0x09,
+	0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52,
+	0x08, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x70, 0x72, 0x69,
+	0x6d, 0x61, 0x72, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x70, 0x72, 0x69, 0x6d,
+	0x61, 0x72, 0x79, 0x12, 0x18, 0x0a, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x05,
+	0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x18, 0x0a,
+	0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07,
+	0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x34, 0x0a, 0x16, 0x73, 0x65, 0x61, 0x72, 0x63,
+	0x68, 0x5f, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x5f, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65,
+	0x64, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x14, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x44,
+	0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x22, 0x87, 0x02,
+	0x0a, 0x12, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x52, 0x61, 0x77, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x02, 0x69, 0x64, 0x12, 0x1f, 0x0a, 0x0b, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x5f,
+	0x73, 0x65, 0x71, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6e, 0x65, 0x74, 0x77, 0x6f,
+	0x72, 0x6b, 0x53, 0x65, 0x71, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73,
+	0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b,
+	0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x74,
+	0x79, 0x70, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12,
+	0x18, 0x0a, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x64, 0x6f, 0x6d,
+	0x61, 0x69, 0x6e, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x0b, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x1f, 0x0a, 0x0b,
+	0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x5f, 0x63, 0x69, 0x64, 0x72, 0x18, 0x08, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0a, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x43, 0x69, 0x64, 0x72, 0x12, 0x18, 0x0a,
+	0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x09, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07,
+	0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x22, 0x4d, 0x0a, 0x11, 0x4e, 0x65, 0x74, 0x77, 0x6f,
+	0x72, 0x6b, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x38, 0x0a, 0x07,
+	0x65, 0x6e, 0x74, 0x72, 0x69, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f,
+	0x72, 0x6b, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x07, 0x65,
+	0x6e, 0x74, 0x72, 0x69, 0x65, 0x73, 0x22, 0xe1, 0x01, 0x0a, 0x12, 0x4e, 0x65, 0x74, 0x77, 0x6f,
+	0x72, 0x6b, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x0e, 0x0a,
+	0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x1d, 0x0a,
+	0x0a, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x18, 0x02, 0x20, 0x01, 0x28,
 	0x0d, 0x52, 0x09, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x12, 0x24, 0x0a, 0x0e,
-	0x70, 0x65, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x09,
-	0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49,
-	0x64, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x5f, 0x74, 0x79,
-	0x70, 0x65, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0b, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72,
-	0x6b, 0x54, 0x79, 0x70, 0x65, 0x12, 0x1e, 0x0a, 0x0a, 0x6d, 0x61, 0x73, 0x71, 0x75, 0x65, 0x72,
-	0x61, 0x64, 0x65, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x6d, 0x61, 0x73, 0x71, 0x75,
-	0x65, 0x72, 0x61, 0x64, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x6d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x18,
-	0x0c, 0x20, 0x01, 0x28, 0x05, 0x52, 0x06, 0x6d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x12, 0x18, 0x0a,
-	0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07,
-	0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x67, 0x72, 0x6f, 0x75, 0x70,
-	0x5f, 0x69, 0x64, 0x73, 0x18, 0x0e, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x67, 0x72, 0x6f, 0x75,
-	0x70, 0x49, 0x64, 0x73, 0x12, 0x37, 0x0a, 0x18, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x63,
-	0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73,
-	0x18, 0x0f, 0x20, 0x03, 0x28, 0x09, 0x52, 0x15, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x43, 0x6f,
-	0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x26, 0x0a,
-	0x0f, 0x73, 0x6b, 0x69, 0x70, 0x5f, 0x61, 0x75, 0x74, 0x6f, 0x5f, 0x61, 0x70, 0x70, 0x6c, 0x79,
-	0x18, 0x10, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x73, 0x6b, 0x69, 0x70, 0x41, 0x75, 0x74, 0x6f,
-	0x41, 0x70, 0x70, 0x6c, 0x79, 0x22, 0xff, 0x01, 0x0a, 0x12, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65,
-	0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x52, 0x61, 0x77, 0x12, 0x0e, 0x0a, 0x02,
-	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x38, 0x0a, 0x0b,
-	0x6e, 0x61, 0x6d, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e,
-	0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x73,
-	0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x1b, 0x0a, 0x09, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f,
-	0x69, 0x64, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x67, 0x72, 0x6f, 0x75, 0x70,
-	0x49, 0x64, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x70, 0x72, 0x69, 0x6d, 0x61, 0x72, 0x79, 0x18, 0x04,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x70, 0x72, 0x69, 0x6d, 0x61, 0x72, 0x79, 0x12, 0x18, 0x0a,
-	0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07,
-	0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c,
-	0x65, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65,
-	0x64, 0x12, 0x34, 0x0a, 0x16, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x5f, 0x64, 0x6f, 0x6d, 0x61,
-	0x69, 0x6e, 0x73, 0x5f, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x07, 0x20, 0x01, 0x28,
-	0x08, 0x52, 0x14, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73,
-	0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x22, 0x87, 0x02, 0x0a, 0x12, 0x4e, 0x65, 0x74, 0x77,
-	0x6f, 0x72, 0x6b, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x61, 0x77, 0x12, 0x0e,
-	0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x1f,
-	0x0a, 0x0b, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x5f, 0x73, 0x65, 0x71, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x0a, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x53, 0x65, 0x71, 0x12,
-	0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e,
-	0x61, 0x6d, 0x65, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69,
-	0x6f, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69,
-	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x05, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x61, 0x64, 0x64,
-	0x72, 0x65, 0x73, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x64, 0x64, 0x72,
-	0x65, 0x73, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x5f, 0x76, 0x61,
-	0x6c, 0x75, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x6f, 0x6d, 0x61, 0x69,
-	0x6e, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78,
-	0x5f, 0x63, 0x69, 0x64, 0x72, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x70, 0x72, 0x65,
-	0x66, 0x69, 0x78, 0x43, 0x69, 0x64, 0x72, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c,
-	0x65, 0x64, 0x18, 0x09, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65,
-	0x64, 0x22, 0x4d, 0x0a, 0x11, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x6f, 0x75, 0x74,
-	0x65, 0x72, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x38, 0x0a, 0x07, 0x65, 0x6e, 0x74, 0x72, 0x69, 0x65,
-	0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x6f, 0x75, 0x74,
-	0x65, 0x72, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x07, 0x65, 0x6e, 0x74, 0x72, 0x69, 0x65, 0x73,
-	0x22, 0xe1, 0x01, 0x0a, 0x12, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x6f, 0x75, 0x74,
-	0x65, 0x72, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x70, 0x65, 0x65, 0x72, 0x5f,
-	0x69, 0x6e, 0x64, 0x65, 0x78, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x09, 0x70, 0x65, 0x65,
-	0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x12, 0x24, 0x0a, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x69,
-	0x6e, 0x64, 0x65, 0x78, 0x5f, 0x73, 0x65, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0c,
-	0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x53, 0x65, 0x74, 0x12, 0x24, 0x0a, 0x0e,
-	0x70, 0x65, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x04,
-	0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49,
-	0x64, 0x73, 0x12, 0x1e, 0x0a, 0x0a, 0x6d, 0x61, 0x73, 0x71, 0x75, 0x65, 0x72, 0x61, 0x64, 0x65,
-	0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x6d, 0x61, 0x73, 0x71, 0x75, 0x65, 0x72, 0x61,
-	0x64, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x6d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x18, 0x06, 0x20, 0x01,
-	0x28, 0x05, 0x52, 0x06, 0x6d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e,
-	0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61,
-	0x62, 0x6c, 0x65, 0x64, 0x22, 0x1d, 0x0a, 0x09, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x64,
-	0x73, 0x12, 0x10, 0x0a, 0x03, 0x69, 0x64, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x03,
-	0x69, 0x64, 0x73, 0x22, 0x27, 0x0a, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x49, 0x44, 0x4c, 0x69, 0x73,
-	0x74, 0x12, 0x19, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x01, 0x20,
-	0x03, 0x28, 0x09, 0x52, 0x07, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x73, 0x22, 0x31, 0x0a, 0x0c,
-	0x50, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x53, 0x65, 0x74, 0x12, 0x21, 0x0a, 0x0c,
-	0x70, 0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03,
-	0x28, 0x0d, 0x52, 0x0b, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x2a,
-	0x3a, 0x0a, 0x09, 0x4a, 0x6f, 0x62, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x12, 0x0a, 0x0e,
-	0x75, 0x6e, 0x6b, 0x6e, 0x6f, 0x77, 0x6e, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x10, 0x00,
-	0x12, 0x0d, 0x0a, 0x09, 0x73, 0x75, 0x63, 0x63, 0x65, 0x65, 0x64, 0x65, 0x64, 0x10, 0x01, 0x12,
-	0x0a, 0x0a, 0x06, 0x66, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x10, 0x02, 0x2a, 0x93, 0x01, 0x0a, 0x0e,
-	0x50, 0x65, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x79, 0x12, 0x19,
-	0x0a, 0x15, 0x50, 0x65, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x79,
-	0x55, 0x6e, 0x6b, 0x6e, 0x6f, 0x77, 0x6e, 0x10, 0x00, 0x12, 0x20, 0x0a, 0x1c, 0x50, 0x65, 0x65,
-	0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x79, 0x53, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x65, 0x73, 0x10, 0x01, 0x12, 0x1d, 0x0a, 0x19, 0x50,
-	0x65, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x79, 0x49, 0x50, 0x76,
-	0x36, 0x4f, 0x76, 0x65, 0x72, 0x6c, 0x61, 0x79, 0x10, 0x02, 0x12, 0x25, 0x0a, 0x21, 0x50, 0x65,
-	0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x79, 0x43, 0x6f, 0x6d, 0x70,
-	0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x10,
-	0x03, 0x2a, 0x48, 0x0a, 0x09, 0x4c, 0x61, 0x7a, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x14,
-	0x0a, 0x10, 0x4c, 0x61, 0x7a, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x44, 0x65, 0x66, 0x61, 0x75,
-	0x6c, 0x74, 0x10, 0x00, 0x12, 0x11, 0x0a, 0x0d, 0x4c, 0x61, 0x7a, 0x79, 0x53, 0x74, 0x61, 0x74,
-	0x65, 0x4c, 0x61, 0x7a, 0x79, 0x10, 0x01, 0x12, 0x12, 0x0a, 0x0e, 0x4c, 0x61, 0x7a, 0x79, 0x53,
-	0x74, 0x61, 0x74, 0x65, 0x45, 0x61, 0x67, 0x65, 0x72, 0x10, 0x02, 0x2a, 0x5d, 0x0a, 0x0c, 0x52,
-	0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x0b, 0x0a, 0x07, 0x55,
-	0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x07, 0x0a, 0x03, 0x41, 0x4c, 0x4c, 0x10,
-	0x01, 0x12, 0x07, 0x0a, 0x03, 0x54, 0x43, 0x50, 0x10, 0x02, 0x12, 0x07, 0x0a, 0x03, 0x55, 0x44,
-	0x50, 0x10, 0x03, 0x12, 0x08, 0x0a, 0x04, 0x49, 0x43, 0x4d, 0x50, 0x10, 0x04, 0x12, 0x0a, 0x0a,
-	0x06, 0x43, 0x55, 0x53, 0x54, 0x4f, 0x4d, 0x10, 0x05, 0x12, 0x0f, 0x0a, 0x0b, 0x4e, 0x45, 0x54,
-	0x42, 0x49, 0x52, 0x44, 0x5f, 0x53, 0x53, 0x48, 0x10, 0x06, 0x2a, 0x20, 0x0a, 0x0d, 0x52, 0x75,
-	0x6c, 0x65, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x06, 0x0a, 0x02, 0x49,
-	0x4e, 0x10, 0x00, 0x12, 0x07, 0x0a, 0x03, 0x4f, 0x55, 0x54, 0x10, 0x01, 0x2a, 0x22, 0x0a, 0x0a,
-	0x52, 0x75, 0x6c, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x0a, 0x0a, 0x06, 0x41, 0x43,
-	0x43, 0x45, 0x50, 0x54, 0x10, 0x00, 0x12, 0x08, 0x0a, 0x04, 0x44, 0x52, 0x4f, 0x50, 0x10, 0x01,
-	0x2a, 0x63, 0x0a, 0x0e, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63,
-	0x6f, 0x6c, 0x12, 0x0f, 0x0a, 0x0b, 0x45, 0x58, 0x50, 0x4f, 0x53, 0x45, 0x5f, 0x48, 0x54, 0x54,
-	0x50, 0x10, 0x00, 0x12, 0x10, 0x0a, 0x0c, 0x45, 0x58, 0x50, 0x4f, 0x53, 0x45, 0x5f, 0x48, 0x54,
-	0x54, 0x50, 0x53, 0x10, 0x01, 0x12, 0x0e, 0x0a, 0x0a, 0x45, 0x58, 0x50, 0x4f, 0x53, 0x45, 0x5f,
-	0x54, 0x43, 0x50, 0x10, 0x02, 0x12, 0x0e, 0x0a, 0x0a, 0x45, 0x58, 0x50, 0x4f, 0x53, 0x45, 0x5f,
-	0x55, 0x44, 0x50, 0x10, 0x03, 0x12, 0x0e, 0x0a, 0x0a, 0x45, 0x58, 0x50, 0x4f, 0x53, 0x45, 0x5f,
-	0x54, 0x4c, 0x53, 0x10, 0x04, 0x32, 0xd0, 0x07, 0x0a, 0x11, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x45, 0x0a, 0x05, 0x4c,
-	0x6f, 0x67, 0x69, 0x6e, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
-	0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61,
-	0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,
-	0x22, 0x00, 0x12, 0x46, 0x0a, 0x04, 0x53, 0x79, 0x6e, 0x63, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e,
+	0x70, 0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x5f, 0x73, 0x65, 0x74, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x53,
+	0x65, 0x74, 0x12, 0x24, 0x0a, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70,
+	0x5f, 0x69, 0x64, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72,
+	0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x1e, 0x0a, 0x0a, 0x6d, 0x61, 0x73, 0x71,
+	0x75, 0x65, 0x72, 0x61, 0x64, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x6d, 0x61,
+	0x73, 0x71, 0x75, 0x65, 0x72, 0x61, 0x64, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x6d, 0x65, 0x74, 0x72,
+	0x69, 0x63, 0x18, 0x06, 0x20, 0x01, 0x28, 0x05, 0x52, 0x06, 0x6d, 0x65, 0x74, 0x72, 0x69, 0x63,
+	0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x07, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x22, 0x1d, 0x0a, 0x09, 0x50, 0x6f,
+	0x6c, 0x69, 0x63, 0x79, 0x49, 0x64, 0x73, 0x12, 0x10, 0x0a, 0x03, 0x69, 0x64, 0x73, 0x18, 0x01,
+	0x20, 0x03, 0x28, 0x09, 0x52, 0x03, 0x69, 0x64, 0x73, 0x22, 0x27, 0x0a, 0x0a, 0x55, 0x73, 0x65,
+	0x72, 0x49, 0x44, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x5f,
+	0x69, 0x64, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x75, 0x73, 0x65, 0x72, 0x49,
+	0x64, 0x73, 0x22, 0x31, 0x0a, 0x0c, 0x50, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x53,
+	0x65, 0x74, 0x12, 0x21, 0x0a, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78,
+	0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0d, 0x52, 0x0b, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e,
+	0x64, 0x65, 0x78, 0x65, 0x73, 0x2a, 0x3a, 0x0a, 0x09, 0x4a, 0x6f, 0x62, 0x53, 0x74, 0x61, 0x74,
+	0x75, 0x73, 0x12, 0x12, 0x0a, 0x0e, 0x75, 0x6e, 0x6b, 0x6e, 0x6f, 0x77, 0x6e, 0x5f, 0x73, 0x74,
+	0x61, 0x74, 0x75, 0x73, 0x10, 0x00, 0x12, 0x0d, 0x0a, 0x09, 0x73, 0x75, 0x63, 0x63, 0x65, 0x65,
+	0x64, 0x65, 0x64, 0x10, 0x01, 0x12, 0x0a, 0x0a, 0x06, 0x66, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x10,
+	0x02, 0x2a, 0x93, 0x01, 0x0a, 0x0e, 0x50, 0x65, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69,
+	0x6c, 0x69, 0x74, 0x79, 0x12, 0x19, 0x0a, 0x15, 0x50, 0x65, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61,
+	0x62, 0x69, 0x6c, 0x69, 0x74, 0x79, 0x55, 0x6e, 0x6b, 0x6e, 0x6f, 0x77, 0x6e, 0x10, 0x00, 0x12,
+	0x20, 0x0a, 0x1c, 0x50, 0x65, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74,
+	0x79, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x65, 0x73, 0x10,
+	0x01, 0x12, 0x1d, 0x0a, 0x19, 0x50, 0x65, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c,
+	0x69, 0x74, 0x79, 0x49, 0x50, 0x76, 0x36, 0x4f, 0x76, 0x65, 0x72, 0x6c, 0x61, 0x79, 0x10, 0x02,
+	0x12, 0x25, 0x0a, 0x21, 0x50, 0x65, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69,
+	0x74, 0x79, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f,
+	0x72, 0x6b, 0x4d, 0x61, 0x70, 0x10, 0x03, 0x2a, 0x48, 0x0a, 0x09, 0x4c, 0x61, 0x7a, 0x79, 0x53,
+	0x74, 0x61, 0x74, 0x65, 0x12, 0x14, 0x0a, 0x10, 0x4c, 0x61, 0x7a, 0x79, 0x53, 0x74, 0x61, 0x74,
+	0x65, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x10, 0x00, 0x12, 0x11, 0x0a, 0x0d, 0x4c, 0x61,
+	0x7a, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x4c, 0x61, 0x7a, 0x79, 0x10, 0x01, 0x12, 0x12, 0x0a,
+	0x0e, 0x4c, 0x61, 0x7a, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x45, 0x61, 0x67, 0x65, 0x72, 0x10,
+	0x02, 0x2a, 0x5d, 0x0a, 0x0c, 0x52, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f,
+	0x6c, 0x12, 0x0b, 0x0a, 0x07, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x07,
+	0x0a, 0x03, 0x41, 0x4c, 0x4c, 0x10, 0x01, 0x12, 0x07, 0x0a, 0x03, 0x54, 0x43, 0x50, 0x10, 0x02,
+	0x12, 0x07, 0x0a, 0x03, 0x55, 0x44, 0x50, 0x10, 0x03, 0x12, 0x08, 0x0a, 0x04, 0x49, 0x43, 0x4d,
+	0x50, 0x10, 0x04, 0x12, 0x0a, 0x0a, 0x06, 0x43, 0x55, 0x53, 0x54, 0x4f, 0x4d, 0x10, 0x05, 0x12,
+	0x0f, 0x0a, 0x0b, 0x4e, 0x45, 0x54, 0x42, 0x49, 0x52, 0x44, 0x5f, 0x53, 0x53, 0x48, 0x10, 0x06,
+	0x2a, 0x20, 0x0a, 0x0d, 0x52, 0x75, 0x6c, 0x65, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x12, 0x06, 0x0a, 0x02, 0x49, 0x4e, 0x10, 0x00, 0x12, 0x07, 0x0a, 0x03, 0x4f, 0x55, 0x54,
+	0x10, 0x01, 0x2a, 0x22, 0x0a, 0x0a, 0x52, 0x75, 0x6c, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x12, 0x0a, 0x0a, 0x06, 0x41, 0x43, 0x43, 0x45, 0x50, 0x54, 0x10, 0x00, 0x12, 0x08, 0x0a, 0x04,
+	0x44, 0x52, 0x4f, 0x50, 0x10, 0x01, 0x2a, 0x63, 0x0a, 0x0e, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65,
+	0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x0f, 0x0a, 0x0b, 0x45, 0x58, 0x50, 0x4f,
+	0x53, 0x45, 0x5f, 0x48, 0x54, 0x54, 0x50, 0x10, 0x00, 0x12, 0x10, 0x0a, 0x0c, 0x45, 0x58, 0x50,
+	0x4f, 0x53, 0x45, 0x5f, 0x48, 0x54, 0x54, 0x50, 0x53, 0x10, 0x01, 0x12, 0x0e, 0x0a, 0x0a, 0x45,
+	0x58, 0x50, 0x4f, 0x53, 0x45, 0x5f, 0x54, 0x43, 0x50, 0x10, 0x02, 0x12, 0x0e, 0x0a, 0x0a, 0x45,
+	0x58, 0x50, 0x4f, 0x53, 0x45, 0x5f, 0x55, 0x44, 0x50, 0x10, 0x03, 0x12, 0x0e, 0x0a, 0x0a, 0x45,
+	0x58, 0x50, 0x4f, 0x53, 0x45, 0x5f, 0x54, 0x4c, 0x53, 0x10, 0x04, 0x32, 0xd0, 0x07, 0x0a, 0x11,
+	0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x12, 0x45, 0x0a, 0x05, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e,
 	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65,
 	0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
 	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d,
-	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x30, 0x01, 0x12, 0x42, 0x0a, 0x0c, 0x47, 0x65,
-	0x74, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x4b, 0x65, 0x79, 0x12, 0x11, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x1d, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x65,
-	0x72, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x33,
-	0x0a, 0x09, 0x69, 0x73, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x79, 0x12, 0x11, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x11,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6d, 0x70, 0x74,
-	0x79, 0x22, 0x00, 0x12, 0x5a, 0x0a, 0x1a, 0x47, 0x65, 0x74, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65,
+	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x46, 0x0a, 0x04, 0x53, 0x79, 0x6e, 0x63,
+	0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e,
+	0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72,
+	0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x30, 0x01,
+	0x12, 0x42, 0x0a, 0x0c, 0x47, 0x65, 0x74, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x4b, 0x65, 0x79,
+	0x12, 0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6d,
+	0x70, 0x74, 0x79, 0x1a, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+	0x2e, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x22, 0x00, 0x12, 0x33, 0x0a, 0x09, 0x69, 0x73, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68,
+	0x79, 0x12, 0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45,
+	0x6d, 0x70, 0x74, 0x79, 0x1a, 0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x00, 0x12, 0x5a, 0x0a, 0x1a, 0x47, 0x65, 0x74,
+	0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65,
+	0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73,
+	0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x18, 0x47, 0x65, 0x74, 0x50, 0x4b, 0x43, 0x45,
 	0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f,
 	0x77, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45,
 	0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a,
 	0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63,
 	0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x12,
-	0x58, 0x0a, 0x18, 0x47, 0x65, 0x74, 0x50, 0x4b, 0x43, 0x45, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72,
-	0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x12, 0x1c, 0x2e, 0x6d, 0x61,
+	0x3d, 0x0a, 0x08, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x65, 0x74, 0x61, 0x12, 0x1c, 0x2e, 0x6d, 0x61,
 	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74,
-	0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64,
-	0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x3d, 0x0a, 0x08, 0x53, 0x79, 0x6e,
-	0x63, 0x4d, 0x65, 0x74, 0x61, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73,
-	0x61, 0x67, 0x65, 0x1a, 0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x00, 0x12, 0x3b, 0x0a, 0x06, 0x4c, 0x6f, 0x67, 0x6f,
-	0x75, 0x74, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,
-	0x1a, 0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6d,
-	0x70, 0x74, 0x79, 0x22, 0x00, 0x12, 0x47, 0x0a, 0x03, 0x4a, 0x6f, 0x62, 0x12, 0x1c, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70,
-	0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65,
-	0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x28, 0x01, 0x30, 0x01, 0x12, 0x51,
-	0x0a, 0x11, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x64, 0x41, 0x75, 0x74, 0x68, 0x53, 0x65, 0x73, 0x73,
-	0x69, 0x6f, 0x6e, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67,
-	0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45,
-	0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22,
-	0x00, 0x12, 0x4c, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x45, 0x78, 0x70, 0x6f, 0x73,
-	0x65, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45,
-	0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a,
-	0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63,
-	0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x12,
-	0x4b, 0x0a, 0x0b, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x12, 0x1c,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72,
-	0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70,
-	0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x4a, 0x0a, 0x0a,
-	0x53, 0x74, 0x6f, 0x70, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65,
-	0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x00, 0x12, 0x3b,
+	0x0a, 0x06, 0x4c, 0x6f, 0x67, 0x6f, 0x75, 0x74, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
 	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d,
-	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x42, 0x08, 0x5a, 0x06, 0x2f, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x00, 0x12, 0x47, 0x0a, 0x03, 0x4a,
+	0x6f, 0x62, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,
+	0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e,
+	0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00,
+	0x28, 0x01, 0x30, 0x01, 0x12, 0x51, 0x0a, 0x11, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x64, 0x41, 0x75,
+	0x74, 0x68, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64,
+	0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65,
+	0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x4c, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65,
+	0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73,
+	0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x4b, 0x0a, 0x0b, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x45, 0x78,
+	0x70, 0x6f, 0x73, 0x65, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61,
+	0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,
+	0x22, 0x00, 0x12, 0x4a, 0x0a, 0x0a, 0x53, 0x74, 0x6f, 0x70, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65,
+	0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e,
+	0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72,
+	0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x42, 0x08,
+	0x5a, 0x06, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/shared/management/proto/management.proto b/shared/management/proto/management.proto
index f7febfe9a..a85d0cd06 100644
--- a/shared/management/proto/management.proto
+++ b/shared/management/proto/management.proto
@@ -555,8 +555,18 @@ message DeviceAuthorizationFlow {
   }
 }
 
-// PKCEAuthorizationFlowRequest empty struct for future expansion
-message PKCEAuthorizationFlowRequest {}
+// PKCEAuthorizationFlowRequest asks for the PKCE flow configuration to use for
+// an upcoming authorization request.
+message PKCEAuthorizationFlowRequest {
+  // SessionExtend indicates the flow will renew the SSO session of a peer that
+  // is already registered, rather than log in or register one. An extend is
+  // bound to the account that peer belongs to, so the server must not answer it
+  // with a configuration that lets the IdP reply from whatever session is
+  // already active: with several accounts signed in at the IdP that need not be
+  // the peer's own, and the resulting token is rejected as a peer/user mismatch
+  // with no way for the user to correct it.
+  bool SessionExtend = 1;
+}
 
 // PKCEAuthorizationFlow represents Authorization Code Flow information
 // that can be used by the client to login initiate a Oauth 2.0 authorization code grant flow

From 06c4c200108b1499dc2b5a085b13f9febf734db6 Mon Sep 17 00:00:00 2001
From: Pascal Fischer <32096965+pascal-fischer@users.noreply.github.com>
Date: Thu, 8 Oct 2026 16:17:23 +0200
Subject: [PATCH 27/70] [management] Tear down only the peer session that owns
 the stream (#8057)

---
 .../network_map/controller/controller.go      | 12 ++-
 .../controller/controller_disconnect_test.go  | 78 +++++++++++++++++++
 .../controllers/network_map/interface.go      |  5 +-
 .../controllers/network_map/interface_mock.go | 10 ++-
 .../controllers/network_map/update_channel.go |  4 +
 .../update_channel/updatechannel.go           | 24 ++++++
 .../update_channel/updatechannel_test.go      | 55 +++++++++++++
 management/internals/shared/grpc/server.go    | 22 ++++--
 .../shared/grpc/server_disconnect_test.go     | 48 ++++++++++++
 management/server/job/manager.go              | 28 +++++--
 management/server/job/manager_test.go         | 78 +++++++++++++++++++
 11 files changed, 340 insertions(+), 24 deletions(-)
 create mode 100644 management/internals/controllers/network_map/controller/controller_disconnect_test.go
 create mode 100644 management/internals/shared/grpc/server_disconnect_test.go
 create mode 100644 management/server/job/manager_test.go

diff --git a/management/internals/controllers/network_map/controller/controller.go b/management/internals/controllers/network_map/controller/controller.go
index b9c27e57e..9b8471c1b 100644
--- a/management/internals/controllers/network_map/controller/controller.go
+++ b/management/internals/controllers/network_map/controller/controller.go
@@ -127,14 +127,20 @@ func (c *Controller) OnPeerConnected(ctx context.Context, accountID string, peer
 	return c.peersUpdateManager.CreateChannel(ctx, peerID), nil
 }
 
-func (c *Controller) OnPeerDisconnected(ctx context.Context, accountID string, peerID string) {
-	c.peersUpdateManager.CloseChannel(ctx, peerID)
+// OnPeerDisconnected closes the session's updates channel and schedules an ephemeral peer for
+// cleanup. It returns false without touching anything when a newer session owns the peer. A nil
+// session closes any registered channel.
+func (c *Controller) OnPeerDisconnected(ctx context.Context, accountID string, peerID string, session chan *network_map.UpdateMessage) bool {
+	if !c.peersUpdateManager.CloseSessionChannel(ctx, peerID, session) {
+		return false
+	}
 	peer, err := c.repo.GetPeerByID(ctx, accountID, peerID)
 	if err != nil {
 		log.WithContext(ctx).Errorf("failed to get peer %s: %v", peerID, err)
-		return
+		return true
 	}
 	c.EphemeralPeersManager.OnPeerDisconnected(ctx, peer)
+	return true
 }
 
 // injectAllProxyPolicies prepares an account for the per-peer network-map
diff --git a/management/internals/controllers/network_map/controller/controller_disconnect_test.go b/management/internals/controllers/network_map/controller/controller_disconnect_test.go
new file mode 100644
index 000000000..ed1a217d9
--- /dev/null
+++ b/management/internals/controllers/network_map/controller/controller_disconnect_test.go
@@ -0,0 +1,78 @@
+package controller
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map/update_channel"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+)
+
+type recordingEphemeralManager struct {
+	disconnected []string
+}
+
+func (r *recordingEphemeralManager) LoadInitialPeers(context.Context)              {}
+func (r *recordingEphemeralManager) Stop()                                         {}
+func (r *recordingEphemeralManager) OnPeerConnected(context.Context, *nbpeer.Peer) {}
+func (r *recordingEphemeralManager) OnPeerDisconnected(_ context.Context, peer *nbpeer.Peer) {
+	r.disconnected = append(r.disconnected, peer.ID)
+}
+
+func TestOnPeerDisconnected_OwnSession(t *testing.T) {
+	ctx := context.Background()
+	repo := NewMockRepository(gomock.NewController(t))
+	ephemeralManager := &recordingEphemeralManager{}
+	updateManager := update_channel.NewPeersUpdateManager(nil)
+	c := Controller{repo: repo, peersUpdateManager: updateManager, EphemeralPeersManager: ephemeralManager}
+
+	session := updateManager.CreateChannel(ctx, "peer-1")
+	repo.EXPECT().GetPeerByID(gomock.Any(), "account-1", "peer-1").Return(&nbpeer.Peer{ID: "peer-1", Ephemeral: true}, nil)
+
+	require.True(t, c.OnPeerDisconnected(ctx, "account-1", "peer-1", session))
+	assert.False(t, updateManager.HasChannel("peer-1"))
+	assert.Equal(t, []string{"peer-1"}, ephemeralManager.disconnected)
+}
+
+func TestOnPeerDisconnected_NilSessionClosesOlderChannel(t *testing.T) {
+	ctx := context.Background()
+	repo := NewMockRepository(gomock.NewController(t))
+	ephemeralManager := &recordingEphemeralManager{}
+	updateManager := update_channel.NewPeersUpdateManager(nil)
+	c := Controller{repo: repo, peersUpdateManager: updateManager, EphemeralPeersManager: ephemeralManager}
+
+	older := updateManager.CreateChannel(ctx, "peer-1")
+	repo.EXPECT().GetPeerByID(gomock.Any(), "account-1", "peer-1").Return(&nbpeer.Peer{ID: "peer-1", Ephemeral: true}, nil)
+
+	require.True(t, c.OnPeerDisconnected(ctx, "account-1", "peer-1", nil))
+	assert.False(t, updateManager.HasChannel("peer-1"))
+	_, open := <-older
+	assert.False(t, open, "older channel must be closed")
+	assert.Equal(t, []string{"peer-1"}, ephemeralManager.disconnected)
+}
+
+func TestOnPeerDisconnected_NewerSessionOwnsPeer(t *testing.T) {
+	ctx := context.Background()
+	ephemeralManager := &recordingEphemeralManager{}
+	updateManager := update_channel.NewPeersUpdateManager(nil)
+	c := Controller{repo: NewMockRepository(gomock.NewController(t)), peersUpdateManager: updateManager, EphemeralPeersManager: ephemeralManager}
+
+	stale := updateManager.CreateChannel(ctx, "peer-1")
+	current := updateManager.CreateChannel(ctx, "peer-1")
+
+	require.False(t, c.OnPeerDisconnected(ctx, "account-1", "peer-1", stale))
+	require.True(t, updateManager.HasChannel("peer-1"))
+	updateManager.SendUpdate(ctx, "peer-1", &network_map.UpdateMessage{})
+	select {
+	case _, open := <-current:
+		assert.True(t, open, "newer session channel must stay open")
+	default:
+		t.Fatal("newer session channel did not receive the update")
+	}
+	assert.Empty(t, ephemeralManager.disconnected, "a live peer must not be scheduled for ephemeral cleanup")
+}
diff --git a/management/internals/controllers/network_map/interface.go b/management/internals/controllers/network_map/interface.go
index f447387b4..89345fd58 100644
--- a/management/internals/controllers/network_map/interface.go
+++ b/management/internals/controllers/network_map/interface.go
@@ -35,7 +35,10 @@ type Controller interface {
 	OnPeersDeleted(ctx context.Context, accountID string, peerIDs []string, affectedPeerIDs []string) error
 	DisconnectPeers(ctx context.Context, accountId string, peerIDs []string)
 	OnPeerConnected(ctx context.Context, accountID string, peerID string) (chan *UpdateMessage, error)
-	OnPeerDisconnected(ctx context.Context, accountID string, peerID string)
+	// OnPeerDisconnected tears down the stream state of the peer's session, identified by its
+	// updates channel. It returns false and leaves everything untouched when a newer session
+	// owns the peer. A nil session is the newest session and tears down any registered channel.
+	OnPeerDisconnected(ctx context.Context, accountID string, peerID string, session chan *UpdateMessage) bool
 
 	TrackEphemeralPeer(ctx context.Context, peer *nbpeer.Peer)
 }
diff --git a/management/internals/controllers/network_map/interface_mock.go b/management/internals/controllers/network_map/interface_mock.go
index 5dcd241e1..f79b93019 100644
--- a/management/internals/controllers/network_map/interface_mock.go
+++ b/management/internals/controllers/network_map/interface_mock.go
@@ -177,15 +177,17 @@ func (mr *MockControllerMockRecorder) OnPeerConnected(ctx, accountID, peerID any
 }
 
 // OnPeerDisconnected mocks base method.
-func (m *MockController) OnPeerDisconnected(ctx context.Context, accountID, peerID string) {
+func (m *MockController) OnPeerDisconnected(ctx context.Context, accountID, peerID string, session chan *UpdateMessage) bool {
 	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "OnPeerDisconnected", ctx, accountID, peerID)
+	ret := m.ctrl.Call(m, "OnPeerDisconnected", ctx, accountID, peerID, session)
+	ret0, _ := ret[0].(bool)
+	return ret0
 }
 
 // OnPeerDisconnected indicates an expected call of OnPeerDisconnected.
-func (mr *MockControllerMockRecorder) OnPeerDisconnected(ctx, accountID, peerID any) *gomock.Call {
+func (mr *MockControllerMockRecorder) OnPeerDisconnected(ctx, accountID, peerID, session any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "OnPeerDisconnected", reflect.TypeOf((*MockController)(nil).OnPeerDisconnected), ctx, accountID, peerID)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "OnPeerDisconnected", reflect.TypeOf((*MockController)(nil).OnPeerDisconnected), ctx, accountID, peerID, session)
 }
 
 // OnPeersAdded mocks base method.
diff --git a/management/internals/controllers/network_map/update_channel.go b/management/internals/controllers/network_map/update_channel.go
index 0b085b85f..e61432069 100644
--- a/management/internals/controllers/network_map/update_channel.go
+++ b/management/internals/controllers/network_map/update_channel.go
@@ -6,6 +6,10 @@ type PeersUpdateManager interface {
 	SendUpdate(ctx context.Context, peerID string, update *UpdateMessage)
 	CreateChannel(ctx context.Context, peerID string) chan *UpdateMessage
 	CloseChannel(ctx context.Context, peerID string)
+	// CloseSessionChannel closes the peer's channel and returns true, unless a channel of
+	// another session is registered, in which case it returns false and closes nothing.
+	// A nil session is the newest session and closes any registered channel.
+	CloseSessionChannel(ctx context.Context, peerID string, session chan *UpdateMessage) bool
 	CountStreams() int
 	HasChannel(peerID string) bool
 	CloseChannels(ctx context.Context, peerIDs []string)
diff --git a/management/internals/controllers/network_map/update_channel/updatechannel.go b/management/internals/controllers/network_map/update_channel/updatechannel.go
index 91627bf15..a8e29afa0 100644
--- a/management/internals/controllers/network_map/update_channel/updatechannel.go
+++ b/management/internals/controllers/network_map/update_channel/updatechannel.go
@@ -133,6 +133,30 @@ func (p *PeersUpdateManager) CloseChannel(ctx context.Context, peerID string) {
 	p.closeChannel(ctx, peerID)
 }
 
+// CloseSessionChannel closes the peer's updates channel only while it is still session's channel.
+// It returns false when a newer stream has registered a different channel, which the stale
+// session must leave to its new owner. A nil session belongs to a stream that failed before
+// registering its own channel; it is the newest session and closes any channel still registered.
+func (p *PeersUpdateManager) CloseSessionChannel(ctx context.Context, peerID string, session chan *network_map.UpdateMessage) bool {
+	start := time.Now()
+
+	p.channelsMux.Lock()
+	defer func() {
+		p.channelsMux.Unlock()
+		if p.metrics != nil {
+			p.metrics.UpdateChannelMetrics().CountCloseChannelDuration(time.Since(start))
+		}
+	}()
+
+	if channel, ok := p.peerChannels[peerID]; ok && session != nil && channel != session {
+		log.WithContext(ctx).Debugf("skipped closing updates channel: peer %s is owned by a newer session", peerID)
+		return false
+	}
+
+	p.closeChannel(ctx, peerID)
+	return true
+}
+
 // GetAllConnectedPeers returns a copy of the connected peers map
 func (p *PeersUpdateManager) GetAllConnectedPeers() map[string]struct{} {
 	start := time.Now()
diff --git a/management/internals/controllers/network_map/update_channel/updatechannel_test.go b/management/internals/controllers/network_map/update_channel/updatechannel_test.go
index c73baf81f..bceefecf3 100644
--- a/management/internals/controllers/network_map/update_channel/updatechannel_test.go
+++ b/management/internals/controllers/network_map/update_channel/updatechannel_test.go
@@ -5,6 +5,9 @@ import (
 	"testing"
 	"time"
 
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
@@ -84,3 +87,55 @@ func TestCloseChannel(t *testing.T) {
 		t.Error("Error closing the channel")
 	}
 }
+
+func TestCloseSessionChannel(t *testing.T) {
+	ctx := context.Background()
+	const peer = "test-close-session"
+
+	t.Run("own channel is closed", func(t *testing.T) {
+		peersUpdater := NewPeersUpdateManager(nil)
+		session := peersUpdater.CreateChannel(ctx, peer)
+
+		require.True(t, peersUpdater.CloseSessionChannel(ctx, peer, session))
+		assert.False(t, peersUpdater.HasChannel(peer))
+		_, open := <-session
+		assert.False(t, open, "own channel must be closed")
+	})
+
+	t.Run("newer session channel is kept", func(t *testing.T) {
+		peersUpdater := NewPeersUpdateManager(nil)
+		stale := peersUpdater.CreateChannel(ctx, peer)
+		current := peersUpdater.CreateChannel(ctx, peer)
+
+		require.False(t, peersUpdater.CloseSessionChannel(ctx, peer, stale))
+		require.True(t, peersUpdater.HasChannel(peer))
+		assert.Equal(t, current, peersUpdater.peerChannels[peer])
+
+		peersUpdater.SendUpdate(ctx, peer, &network_map.UpdateMessage{})
+		select {
+		case _, open := <-current:
+			assert.True(t, open, "newer session channel must stay open")
+		default:
+			t.Fatal("newer session channel did not receive the update")
+		}
+	})
+
+	t.Run("no registered channel", func(t *testing.T) {
+		peersUpdater := NewPeersUpdateManager(nil)
+		session := peersUpdater.CreateChannel(ctx, peer)
+		peersUpdater.CloseChannel(ctx, peer)
+
+		assert.True(t, peersUpdater.CloseSessionChannel(ctx, peer, session))
+		assert.True(t, peersUpdater.CloseSessionChannel(ctx, peer, nil))
+	})
+
+	t.Run("nil session closes the registered channel", func(t *testing.T) {
+		peersUpdater := NewPeersUpdateManager(nil)
+		current := peersUpdater.CreateChannel(ctx, peer)
+
+		require.True(t, peersUpdater.CloseSessionChannel(ctx, peer, nil))
+		assert.False(t, peersUpdater.HasChannel(peer))
+		_, open := <-current
+		assert.False(t, open, "registered channel must be closed")
+	})
+}
diff --git a/management/internals/shared/grpc/server.go b/management/internals/shared/grpc/server.go
index 079a16a70..529e3d379 100644
--- a/management/internals/shared/grpc/server.go
+++ b/management/internals/shared/grpc/server.go
@@ -313,7 +313,7 @@ func (s *Server) Sync(req *proto.EncryptedMessage, srv proto.ManagementService_S
 	if err != nil {
 		log.WithContext(ctx).Debugf("error while sending initial sync for %s: %v", peerKey.String(), err)
 		s.syncSem.Add(-1)
-		s.cancelPeerRoutinesWithoutLock(ctx, accountID, peer, syncStart)
+		s.cancelPeerRoutinesWithoutLock(ctx, accountID, peer, syncStart, nil)
 		return err
 	}
 
@@ -321,7 +321,7 @@ func (s *Server) Sync(req *proto.EncryptedMessage, srv proto.ManagementService_S
 	if err != nil {
 		log.WithContext(ctx).Debugf("error while notify peer connected for %s: %v", peerKey.String(), err)
 		s.syncSem.Add(-1)
-		s.cancelPeerRoutinesWithoutLock(ctx, accountID, peer, syncStart)
+		s.cancelPeerRoutinesWithoutLock(ctx, accountID, peer, syncStart, nil)
 		return err
 	}
 
@@ -337,7 +337,7 @@ func (s *Server) Sync(req *proto.EncryptedMessage, srv proto.ManagementService_S
 
 	s.syncSem.Add(-1)
 
-	return PeerUpdateHandlerFactory(peerKey, updates, s.secretsManager, srv, func() { s.cancelPeerRoutines(ctx, accountID, peer, syncStart) }).
+	return PeerUpdateHandlerFactory(peerKey, updates, s.secretsManager, srv, func() { s.cancelPeerRoutines(ctx, accountID, peer, syncStart, updates) }).
 		WithMetrics(s.appMetrics).HandleUpdates(ctx)
 }
 
@@ -383,7 +383,7 @@ func (s *Server) startResponseReceiver(ctx context.Context, srv proto.Management
 
 func (s *Server) sendJobsLoop(ctx context.Context, accountID string, peerKey wgtypes.Key, peer *nbpeer.Peer, updates *job.Channel, srv proto.ManagementService_JobServer) error {
 	// todo figure out better error handling strategy
-	defer s.jobManager.CloseChannel(ctx, accountID, peer.ID)
+	defer s.jobManager.CloseChannel(ctx, accountID, peer.ID, updates)
 
 	for {
 		event, err := updates.Event(ctx)
@@ -430,20 +430,26 @@ func (s *Server) sendJob(ctx context.Context, peerKey wgtypes.Key, job *job.Even
 	return nil
 }
 
-func (s *Server) cancelPeerRoutines(ctx context.Context, accountID string, peer *nbpeer.Peer, streamStartTime time.Time) {
+func (s *Server) cancelPeerRoutines(ctx context.Context, accountID string, peer *nbpeer.Peer, streamStartTime time.Time, session chan *network_map.UpdateMessage) {
 	uncanceledCTX := context.WithoutCancel(ctx)
 	unlock := s.acquirePeerLockByUID(uncanceledCTX, peer.Key)
 	defer unlock()
 
-	s.cancelPeerRoutinesWithoutLock(uncanceledCTX, accountID, peer, streamStartTime)
+	s.cancelPeerRoutinesWithoutLock(uncanceledCTX, accountID, peer, streamStartTime, session)
 }
 
-func (s *Server) cancelPeerRoutinesWithoutLock(ctx context.Context, accountID string, peer *nbpeer.Peer, streamStartTime time.Time) {
+// cancelPeerRoutinesWithoutLock tears down the stream of the session identified by streamStartTime
+// and its updates channel. A nil session means the stream failed before it registered a channel;
+// the controller then closes any channel still registered.
+func (s *Server) cancelPeerRoutinesWithoutLock(ctx context.Context, accountID string, peer *nbpeer.Peer, streamStartTime time.Time, session chan *network_map.UpdateMessage) {
 	err := s.accountManager.OnPeerDisconnected(ctx, accountID, peer.Key, streamStartTime)
 	if err != nil {
 		log.WithContext(ctx).Errorf("failed to disconnect peer %s properly: %v", peer.Key, err)
 	}
-	s.networkMapController.OnPeerDisconnected(ctx, accountID, peer.ID)
+	if !s.networkMapController.OnPeerDisconnected(ctx, accountID, peer.ID, session) {
+		log.WithContext(ctx).Debugf("skipped peer routines teardown for %s: a newer session owns the peer", peer.Key)
+		return
+	}
 	s.secretsManager.CancelRefresh(peer.ID)
 
 	log.WithContext(ctx).Debugf("peer %s has been disconnected", peer.Key)
diff --git a/management/internals/shared/grpc/server_disconnect_test.go b/management/internals/shared/grpc/server_disconnect_test.go
new file mode 100644
index 000000000..9a19a9b1a
--- /dev/null
+++ b/management/internals/shared/grpc/server_disconnect_test.go
@@ -0,0 +1,48 @@
+package grpc
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"go.uber.org/mock/gomock"
+
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	"github.com/netbirdio/netbird/management/server/account"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+)
+
+func TestCancelPeerRoutines_SessionOwnership(t *testing.T) {
+	peer := &nbpeer.Peer{ID: "peer-1", Key: "peer-key"}
+	streamStart := time.Unix(1700000000, 0)
+	session := make(chan *network_map.UpdateMessage)
+
+	tests := []struct {
+		name          string
+		session       chan *network_map.UpdateMessage
+		ownsPeer      bool
+		cancelRefresh bool
+	}{
+		{name: "owning session tears everything down", session: session, ownsPeer: true, cancelRefresh: true},
+		{name: "stale session keeps the newer session's refresh", session: session, ownsPeer: false, cancelRefresh: false},
+		{name: "failed sync without a channel closes the older session", session: nil, ownsPeer: true, cancelRefresh: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctrl := gomock.NewController(t)
+			accountManager := account.NewMockManager(ctrl)
+			controller := network_map.NewMockController(ctrl)
+			secretsManager := NewMockSecretsManager(ctrl)
+			s := &Server{accountManager: accountManager, networkMapController: controller, secretsManager: secretsManager}
+
+			accountManager.EXPECT().OnPeerDisconnected(gomock.Any(), "account-1", peer.Key, streamStart).Return(nil)
+			controller.EXPECT().OnPeerDisconnected(gomock.Any(), "account-1", peer.ID, tt.session).Return(tt.ownsPeer)
+			if tt.cancelRefresh {
+				secretsManager.EXPECT().CancelRefresh(peer.ID)
+			}
+
+			s.cancelPeerRoutines(context.Background(), "account-1", peer, streamStart, tt.session)
+		})
+	}
+}
diff --git a/management/server/job/manager.go b/management/server/job/manager.go
index 0b183ac39..323d1e639 100644
--- a/management/server/job/manager.go
+++ b/management/server/job/manager.go
@@ -57,6 +57,7 @@ func (jm *Manager) CreateJobChannel(ctx context.Context, accountID, peerID strin
 	if ch, ok := jm.jobChannels[peerID]; ok {
 		ch.Close()
 		delete(jm.jobChannels, peerID)
+		jm.failPendingLocked(ctx, accountID, peerID, "Pending job cleanup: job stream replaced by a newer stream")
 	}
 
 	ch := NewChannel()
@@ -127,24 +128,35 @@ func (jm *Manager) HandleResponse(ctx context.Context, resp *proto.JobResponse,
 	return nil
 }
 
-// CloseChannel closes a peer’s channel and cleans up its jobs
-func (jm *Manager) CloseChannel(ctx context.Context, accountID, peerID string) {
+// CloseChannel closes the peer's job channel session and fails its pending jobs. It does nothing
+// when a newer job stream has registered a different channel for the peer.
+func (jm *Manager) CloseChannel(ctx context.Context, accountID, peerID string, session *Channel) {
 	jm.mu.Lock()
 	defer jm.mu.Unlock()
 
 	if ch, ok := jm.jobChannels[peerID]; ok {
+		if ch != session {
+			log.WithContext(ctx).Debugf("skipped closing job channel: peer %s is owned by a newer job stream", peerID)
+			return
+		}
 		ch.Close()
 		delete(jm.jobChannels, peerID)
 	}
 
+	jm.failPendingLocked(ctx, accountID, peerID, "Time out peer disconnected")
+}
+
+// failPendingLocked marks the peer's pending jobs as failed and drops them from memory. The caller
+// must hold jm.mu.
+func (jm *Manager) failPendingLocked(ctx context.Context, accountID, peerID, reason string) {
 	for jobID, ev := range jm.pending {
-		if ev.PeerID == peerID {
-			// if the client disconnect and there is pending job then mark it as failed
-			if err := jm.Store.MarkPendingJobsAsFailed(ctx, accountID, peerID, jobID, "Time out peer disconnected"); err != nil {
-				log.WithContext(ctx).Errorf("failed to mark pending jobs as failed: %v", err)
-			}
-			delete(jm.pending, jobID)
+		if ev.PeerID != peerID {
+			continue
 		}
+		if err := jm.Store.MarkPendingJobsAsFailed(ctx, accountID, peerID, jobID, reason); err != nil {
+			log.WithContext(ctx).Errorf("failed to mark pending jobs as failed: %v", err)
+		}
+		delete(jm.pending, jobID)
 	}
 }
 
diff --git a/management/server/job/manager_test.go b/management/server/job/manager_test.go
new file mode 100644
index 000000000..4919ae869
--- /dev/null
+++ b/management/server/job/manager_test.go
@@ -0,0 +1,78 @@
+package job
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+
+	"github.com/netbirdio/netbird/management/server/store"
+)
+
+func TestCloseChannel_OwnSession(t *testing.T) {
+	ctx := context.Background()
+	mockStore := store.NewMockStore(gomock.NewController(t))
+	jm := NewJobManager(nil, mockStore, nil)
+
+	session := NewChannel()
+	jm.jobChannels["peer-1"] = session
+	jm.pending["job-1"] = &Event{PeerID: "peer-1"}
+	jm.pending["job-2"] = &Event{PeerID: "peer-2"}
+
+	mockStore.EXPECT().MarkPendingJobsAsFailed(gomock.Any(), "account-1", "peer-1", "job-1", gomock.Any()).Return(nil)
+
+	jm.CloseChannel(ctx, "account-1", "peer-1", session)
+
+	assert.False(t, jm.IsPeerConnected("peer-1"))
+	_, err := session.Event(ctx)
+	assert.ErrorIs(t, err, ErrJobChannelClosed)
+	assert.NotContains(t, jm.pending, "job-1")
+	assert.Contains(t, jm.pending, "job-2", "jobs of other peers must be kept")
+}
+
+func TestCloseChannel_NewerSessionOwnsPeer(t *testing.T) {
+	ctx := context.Background()
+	jm := NewJobManager(nil, store.NewMockStore(gomock.NewController(t)), nil)
+
+	stale := NewChannel()
+	current := NewChannel()
+	jm.jobChannels["peer-1"] = current
+	jm.pending["job-1"] = &Event{PeerID: "peer-1"}
+
+	jm.CloseChannel(ctx, "account-1", "peer-1", stale)
+
+	require.True(t, jm.IsPeerConnected("peer-1"))
+	assert.Contains(t, jm.pending, "job-1", "jobs served by the newer stream must not be failed")
+
+	event := &Event{PeerID: "peer-1"}
+	require.NoError(t, current.AddEvent(ctx, time.Second, event))
+	got, err := current.Event(ctx)
+	require.NoError(t, err, "newer session channel must stay open")
+	assert.Equal(t, event, got)
+}
+
+func TestCreateJobChannel_ReplacesSessionAndDropsItsPendingJobs(t *testing.T) {
+	ctx := context.Background()
+	mockStore := store.NewMockStore(gomock.NewController(t))
+	jm := NewJobManager(nil, mockStore, nil)
+
+	stale := NewChannel()
+	jm.jobChannels["peer-1"] = stale
+	jm.pending["job-1"] = &Event{PeerID: "peer-1"}
+	jm.pending["job-2"] = &Event{PeerID: "peer-2"}
+
+	mockStore.EXPECT().MarkAllPendingJobsAsFailed(gomock.Any(), "account-1", "peer-1", gomock.Any()).Return(nil)
+	mockStore.EXPECT().MarkPendingJobsAsFailed(gomock.Any(), "account-1", "peer-1", "job-1", "Pending job cleanup: job stream replaced by a newer stream").Return(nil)
+
+	current := jm.CreateJobChannel(ctx, "account-1", "peer-1")
+
+	require.NotSame(t, stale, current)
+	_, err := stale.Event(ctx)
+	assert.ErrorIs(t, err, ErrJobChannelClosed, "replaced channel must be closed")
+	assert.True(t, jm.IsPeerConnected("peer-1"))
+	assert.False(t, jm.IsPeerHasPendingJobs("peer-1"), "jobs of the replaced stream must be dropped")
+	assert.Contains(t, jm.pending, "job-2", "jobs of other peers must be kept")
+}

From 01d828d732e37f357c84c301d710068eb57adc3f Mon Sep 17 00:00:00 2001
From: Pascal Fischer <32096965+pascal-fischer@users.noreply.github.com>
Date: Thu, 8 Oct 2026 16:28:56 +0200
Subject: [PATCH 28/70] [management] Fall back to the IdP for the proxy session
 email (#8112)

---
 management/internals/shared/grpc/proxy.go     |  67 ++++++---
 .../shared/grpc/validate_session_test.go      | 130 +++++++++++++++++-
 2 files changed, 178 insertions(+), 19 deletions(-)

diff --git a/management/internals/shared/grpc/proxy.go b/management/internals/shared/grpc/proxy.go
index 00355087d..8e93f77b0 100644
--- a/management/internals/shared/grpc/proxy.go
+++ b/management/internals/shared/grpc/proxy.go
@@ -1723,6 +1723,40 @@ func sameAccount(userAccountID, serviceAccountID string) bool {
 	return userAccountID != "" && serviceAccountID != "" && userAccountID == serviceAccountID
 }
 
+// resolveUserEmail returns the user's stored email, else the email claim of
+// an already validated session token, else the IdP's email. The claim was
+// resolved the same way when the token was signed, so reusing it saves the
+// IdP round-trip on every validation. An IdP failure yields an empty string.
+func (s *ProxyServiceServer) resolveUserEmail(ctx context.Context, accountID string, user *types.User, tokenEmail string) string {
+	if user.Email != "" {
+		return user.Email
+	}
+	if tokenEmail != "" {
+		return tokenEmail
+	}
+	return s.idpEmail(ctx, accountID, user.Id)
+}
+
+// idpEmail looks up a user's email at the IdP, scoped to the given account.
+// It returns an empty string when no IdP is configured, the lookup fails or
+// the IdP knows no email for the user.
+func (s *ProxyServiceServer) idpEmail(ctx context.Context, accountID, userID string) string {
+	if s.idpManager == nil {
+		return ""
+	}
+
+	userData, err := s.idpManager.GetUserDataByID(ctx, userID, idp.AppMetadata{WTAccountID: accountID})
+	if err != nil {
+		log.WithContext(ctx).WithFields(log.Fields{"user_id": userID, "error": err.Error()}).Debug("IdP email lookup failed; using stored identity")
+		return ""
+	}
+	if userData == nil {
+		return ""
+	}
+
+	return userData.Email
+}
+
 // GenerateSessionToken creates a signed session JWT for the given domain and
 // user. The user's group memberships are embedded in the token so policy-aware
 // middlewares on the proxy can authorise without an extra management round-trip.
@@ -1778,7 +1812,7 @@ func (s *ProxyServiceServer) GenerateSessionToken(ctx context.Context, domain, u
 	token, err := sessionkey.SignToken(
 		service.SessionPrivateKey,
 		userID,
-		user.Email,
+		s.resolveUserEmail(ctx, service.AccountID, user, ""),
 		domain,
 		method,
 		groupIDs,
@@ -1903,7 +1937,7 @@ func (s *ProxyServiceServer) ValidateSession(ctx context.Context, req *proto.Val
 		return nil, err
 	}
 
-	userID, reason := sessionTokenSubject(domain, service, sessionToken)
+	userID, tokenEmail, reason := sessionTokenSubject(domain, service, sessionToken)
 	if reason != "" {
 		return deniedSessionResponse(reason), nil
 	}
@@ -1932,12 +1966,13 @@ func (s *ProxyServiceServer) ValidateSession(ctx context.Context, req *proto.Val
 	}
 
 	groupIDs, groupNames := pairGroupIDsAndNames(userGroups)
+	userEmail := s.resolveUserEmail(ctx, service.AccountID, user, tokenEmail)
 
 	if reason := s.accountUserDeniedReason(domain, service, user); reason != "" {
 		return &proto.ValidateSessionResponse{
 			Valid:          false,
 			UserId:         user.Id,
-			UserEmail:      user.Email,
+			UserEmail:      userEmail,
 			DeniedReason:   reason,
 			PeerGroupIds:   groupIDs,
 			PeerGroupNames: groupNames,
@@ -1947,13 +1982,13 @@ func (s *ProxyServiceServer) ValidateSession(ctx context.Context, req *proto.Val
 	log.WithFields(log.Fields{
 		"domain":  domain,
 		"user_id": userID,
-		"email":   user.Email,
+		"email":   userEmail,
 	}).Debug("ValidateSession: access granted")
 
 	return &proto.ValidateSessionResponse{
 		Valid:          true,
 		UserId:         user.Id,
-		UserEmail:      user.Email,
+		UserEmail:      userEmail,
 		PeerGroupIds:   groupIDs,
 		PeerGroupNames: groupNames,
 		SessionToken:   mintedToken,
@@ -1970,28 +2005,28 @@ func deniedSessionResponse(reason string) *proto.ValidateSessionResponse {
 }
 
 // sessionTokenSubject verifies the session token against the service's session
-// key and returns the user it was minted for, or the reason it cannot be
-// trusted.
-func sessionTokenSubject(domain string, service *rpservice.Service, sessionToken string) (userID, deniedReason string) {
+// key and returns the user and email it was minted for, or the reason it
+// cannot be trusted.
+func sessionTokenSubject(domain string, service *rpservice.Service, sessionToken string) (userID, email, deniedReason string) {
 	pubKeyBytes, err := base64.StdEncoding.DecodeString(service.SessionPublicKey)
 	if err != nil {
 		log.WithFields(log.Fields{
 			"domain": domain,
 			"error":  err.Error(),
 		}).Error("ValidateSession: decode public key")
-		return "", "invalid_service_config"
+		return "", "", "invalid_service_config"
 	}
 
-	userID, _, _, _, _, err = proxyauth.ValidateSessionJWT(sessionToken, domain, pubKeyBytes)
+	userID, email, _, _, _, err = proxyauth.ValidateSessionJWT(sessionToken, domain, pubKeyBytes)
 	if err != nil {
 		log.WithFields(log.Fields{
 			"domain": domain,
 			"error":  err.Error(),
 		}).Debug("ValidateSession: invalid session token")
-		return "", "invalid_token"
+		return "", "", "invalid_token"
 	}
 
-	return userID, ""
+	return userID, email, ""
 }
 
 // accountUserDeniedReason gates a user of the service's own account, returning
@@ -2272,12 +2307,8 @@ func (s *ProxyServiceServer) getTunnelPeerInfo(ctx context.Context, domain strin
 	// IdP enrichment wins when available — the stored email column is a
 	// best-effort cache and is frequently empty for OIDC users. Enrichment
 	// failures must never fail the RPC; we simply keep the stored/peer identity.
-	if s.idpManager != nil {
-		if ud, uerr := s.idpManager.GetUserDataByID(ctx, peer.UserID, idp.AppMetadata{WTAccountID: service.AccountID}); uerr == nil && ud != nil && ud.Email != "" {
-			displayIdentity = ud.Email
-		} else if uerr != nil {
-			log.WithFields(log.Fields{"domain": domain, "user_id": peer.UserID, "error": uerr.Error()}).Debug("ValidateTunnelPeer: IdP user enrichment failed; using stored/peer identity")
-		}
+	if email := s.idpEmail(ctx, service.AccountID, peer.UserID); email != "" {
+		displayIdentity = email
 	}
 
 	return principalID, displayIdentity
diff --git a/management/internals/shared/grpc/validate_session_test.go b/management/internals/shared/grpc/validate_session_test.go
index 8b4090dcc..429639be6 100644
--- a/management/internals/shared/grpc/validate_session_test.go
+++ b/management/internals/shared/grpc/validate_session_test.go
@@ -5,6 +5,7 @@ import (
 	"crypto/ed25519"
 	"crypto/rand"
 	"encoding/base64"
+	"errors"
 	"testing"
 	"time"
 
@@ -177,7 +178,12 @@ func generateSessionKeyPair(t *testing.T) (string, string) {
 
 func createSessionToken(t *testing.T, privKeyB64, userID, domain string) string {
 	t.Helper()
-	token, err := sessionkey.SignToken(privKeyB64, userID, "", domain, auth.MethodOIDC, nil, nil, time.Hour)
+	return createSessionTokenWithEmail(t, privKeyB64, userID, "", domain)
+}
+
+func createSessionTokenWithEmail(t *testing.T, privKeyB64, userID, email, domain string) string {
+	t.Helper()
+	token, err := sessionkey.SignToken(privKeyB64, userID, email, domain, auth.MethodOIDC, nil, nil, time.Hour)
 	require.NoError(t, err)
 	return token
 }
@@ -712,3 +718,125 @@ func TestValidateSession_InvalidSessionCode(t *testing.T) {
 	assert.False(t, resp.Valid)
 	assert.Empty(t, resp.GetSessionToken())
 }
+
+// TestGenerateSessionToken_EmailFallsBackToIdP covers users whose stored email
+// column is empty: the token's email claim comes from the IdP so the proxy can
+// still stamp X-NetBird-User.
+func TestGenerateSessionToken_EmailFallsBackToIdP(t *testing.T) {
+	setup := setupValidateSessionTest(t)
+	defer setup.cleanup()
+
+	ctx := context.Background()
+	svc, err := setup.store.GetServiceByID(ctx, store.LockingStrengthNone, "testAccountId", "restrictedProxyId")
+	require.NoError(t, err)
+
+	idpMock := &mockTunnelIdpManager{email: "idp@example.com", hasData: true}
+	setup.proxyService.idpManager = idpMock
+
+	token, err := setup.proxyService.GenerateSessionToken(ctx, "restricted-proxy.example.com", "allowedUserId", auth.MethodOIDC)
+	require.NoError(t, err)
+
+	pubKey, err := base64.StdEncoding.DecodeString(svc.SessionPublicKey)
+	require.NoError(t, err)
+
+	_, email, _, _, _, err := auth.ValidateSessionJWT(token, "restricted-proxy.example.com", pubKey)
+	require.NoError(t, err)
+	assert.Equal(t, "idp@example.com", email)
+	require.Len(t, idpMock.gotMeta, 1)
+	assert.Equal(t, "testAccountId", idpMock.gotMeta[0].WTAccountID, "IdP lookup must be scoped to the service's account")
+}
+
+// TestGenerateSessionToken_IdPFailureStillIssuesToken pins the fail-soft
+// behaviour: an unreachable IdP costs the email claim, not the login.
+func TestGenerateSessionToken_IdPFailureStillIssuesToken(t *testing.T) {
+	setup := setupValidateSessionTest(t)
+	defer setup.cleanup()
+
+	ctx := context.Background()
+	svc, err := setup.store.GetServiceByID(ctx, store.LockingStrengthNone, "testAccountId", "restrictedProxyId")
+	require.NoError(t, err)
+
+	setup.proxyService.idpManager = &mockTunnelIdpManager{err: errors.New("idp down")}
+
+	token, err := setup.proxyService.GenerateSessionToken(ctx, "restricted-proxy.example.com", "allowedUserId", auth.MethodOIDC)
+	require.NoError(t, err)
+
+	pubKey, err := base64.StdEncoding.DecodeString(svc.SessionPublicKey)
+	require.NoError(t, err)
+
+	userID, email, _, _, _, err := auth.ValidateSessionJWT(token, "restricted-proxy.example.com", pubKey)
+	require.NoError(t, err)
+	assert.Equal(t, "allowedUserId", userID)
+	assert.Empty(t, email)
+}
+
+func TestValidateSession_EmailResolution(t *testing.T) {
+	tests := []struct {
+		name        string
+		storedEmail string
+		tokenEmail  string
+		idp         *mockTunnelIdpManager
+		expectEmail string
+		expectCalls int
+	}{
+		{
+			name:        "stored email wins without IdP call",
+			storedEmail: "stored@example.com",
+			tokenEmail:  "claim@example.com",
+			idp:         &mockTunnelIdpManager{email: "idp@example.com", hasData: true},
+			expectEmail: "stored@example.com",
+		},
+		{
+			name:        "token email claim is reused without IdP call",
+			tokenEmail:  "claim@example.com",
+			idp:         &mockTunnelIdpManager{email: "idp@example.com", hasData: true},
+			expectEmail: "claim@example.com",
+		},
+		{
+			name:        "empty stored email and claim fall back to IdP",
+			idp:         &mockTunnelIdpManager{email: "idp@example.com", hasData: true},
+			expectEmail: "idp@example.com",
+			expectCalls: 1,
+		},
+		{
+			name:        "IdP error leaves email empty but session valid",
+			idp:         &mockTunnelIdpManager{err: errors.New("idp down")},
+			expectCalls: 1,
+		},
+		{
+			name:        "IdP without data leaves email empty",
+			idp:         &mockTunnelIdpManager{},
+			expectCalls: 1,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			setup := setupValidateSessionTest(t)
+			defer setup.cleanup()
+
+			ctx := context.Background()
+			user, err := setup.store.GetUserByUserID(ctx, store.LockingStrengthNone, "allowedUserId")
+			require.NoError(t, err)
+			user.Email = tt.storedEmail
+			require.NoError(t, setup.store.SaveUser(ctx, user))
+
+			setup.proxyService.idpManager = tt.idp
+
+			svc, err := setup.store.GetServiceByID(ctx, store.LockingStrengthNone, "testAccountId", "testProxyId")
+			require.NoError(t, err)
+			token := createSessionTokenWithEmail(t, svc.SessionPrivateKey, "allowedUserId", tt.tokenEmail, "test-proxy.example.com")
+			code, ok := setup.proxyService.GenerateSessionCode(token)
+			require.True(t, ok)
+
+			resp, err := setup.proxyService.ValidateSession(ctx, &proto.ValidateSessionRequest{
+				Domain:      "test-proxy.example.com",
+				SessionCode: code,
+			})
+			require.NoError(t, err)
+			assert.True(t, resp.GetValid())
+			assert.Equal(t, tt.expectEmail, resp.GetUserEmail())
+			assert.Equal(t, tt.expectCalls, tt.idp.gotCalls)
+		})
+	}
+}

From 3e85e40be27e9cae8f35c7d163d322ea73f65d3d Mon Sep 17 00:00:00 2001
From: Riccardo Manfrin <3090891+riccardomanfrin@users.noreply.github.com>
Date: Fri, 9 Oct 2026 11:03:34 +0200
Subject: [PATCH 29/70] [client] Cache the WireGuard interface check shared by
 ICE agents (#8001)

* [client] Take a WireGuard detector through the interface filter

The interface filter answers whether an interface is a WireGuard device by opening
a wgctrl client and asking for it, and it does that for every interface it is given.
Nothing about that call is tied to the caller, so it can be answered by a shared
object instead of being repeated, but the filter has no way to receive one.

InterfaceFilter and the constructors that build one now take a detector, and the ICE
config carries it so that every agent can be handed the same one. Nobody supplies a
detector yet: a nil one probes on every call, which is what the filter did before, so
this changes no behaviour.

* [client] Share one WireGuard detector across every ICE agent

Creating an ICE agent builds two interface filters, one for the agent and one for
the transport net it sits on, and each is asked about every host interface. For an
interface the disallow list does not settle, answering means opening a wgctrl client,
which builds a kernel and a userspace client and resolves the netlink family, and
then a round trip that usually just reports the device does not exist. An agent is
created per peer connection attempt, so on a large network that runs constantly:
on a routing peer with ~16000 peers it measured 2.40s of a 66.59s CPU profile, 3.6%,
split evenly between opening the client and the round trip.

The engine now owns a detector and passes it to every agent through the ICE config,
so the answer for an interface is reused instead of being asked again for each agent.
It is kept for a second, short enough that a WireGuard interface appearing is picked
up before ICE settles on candidates over it.

The callers that build one filter and keep it, the relay and the UDP mux, keep
passing nil and so keep probing, which costs them nothing at their rate.

* [client] Recheck the WireGuard cache inside the singleflight group

A caller that saw an expired entry could enter the singleflight group
after another caller had already refreshed the entry and left it, and
probe the interface a second time. Read the cache again inside the group
before probing.

This also makes the concurrent probe test independent of scheduling: a
late caller finds the fresh entry instead of starting a new probe.

* [client] Drop expired WireGuard detector entries

The detector lives as long as the engine and kept an entry for every
interface name it was ever asked about. On hosts that churn interfaces,
such as container veths, the map only grew. Remove expired entries when
a new answer is stored; the map holds a few dozen names at most, so the
sweep is cheap and runs at most once per interface per TTL.

* [client] Skip the disallow-list filter test on iOS

InterfaceFilter does not apply the disallow list on iOS, so the subtest
reaches the probe there and its no-probe assertion cannot hold.
---
 client/iface/iface_test.go                    |  18 +--
 client/iface/udpmux/mux.go                    |   2 +-
 client/internal/dns/server_privileged_test.go |   4 +-
 client/internal/dns/server_test.go            |   2 +-
 client/internal/engine.go                     |   5 +
 client/internal/engine_generic.go             |   1 +
 client/internal/engine_js.go                  |   1 +
 client/internal/engine_stdnet.go              |   2 +-
 client/internal/engine_stdnet_android.go      |   2 +-
 client/internal/engine_test.go                |   4 +-
 client/internal/peer/conn_test.go             |   2 +-
 client/internal/peer/ice/agent.go             |   4 +-
 client/internal/peer/ice/config.go            |   6 +
 client/internal/peer/ice/stdnet.go            |   4 +-
 client/internal/peer/ice/stdnet_android.go    |   4 +-
 client/internal/relay/relay.go                |   4 +-
 client/internal/routemanager/manager_test.go  |   2 +-
 .../systemops/systemops_generic_test.go       |   2 +-
 client/internal/stdnet/filter.go              |  23 +--
 client/internal/stdnet/stdnet.go              |   8 +-
 client/internal/stdnet/stdnet_test.go         |   4 +-
 client/internal/stdnet/wgdetector.go          | 119 ++++++++++++++
 client/internal/stdnet/wgdetector_test.go     | 152 ++++++++++++++++++
 23 files changed, 323 insertions(+), 52 deletions(-)
 create mode 100644 client/internal/stdnet/wgdetector.go
 create mode 100644 client/internal/stdnet/wgdetector_test.go

diff --git a/client/iface/iface_test.go b/client/iface/iface_test.go
index cb50ca4a1..690a0f66f 100644
--- a/client/iface/iface_test.go
+++ b/client/iface/iface_test.go
@@ -51,7 +51,7 @@ func TestWGIface_UpdateAddr(t *testing.T) {
 	ifaceName := fmt.Sprintf("utun%d", WgIntNumber+4)
 	addr := "100.64.0.1/8"
 	wgPort := 33100
-	newNet := stdnet.NewNet(context.Background(), testIFaceBlackList)
+	newNet := stdnet.NewNet(context.Background(), testIFaceBlackList, nil)
 
 	opts := WGIFaceOpts{
 		IFaceName:    ifaceName,
@@ -131,7 +131,7 @@ func getIfaceAddrs(ifaceName string) ([]net.Addr, error) {
 func Test_CreateInterface(t *testing.T) {
 	ifaceName := fmt.Sprintf("utun%d", WgIntNumber+1)
 	wgIP := "10.99.99.1/32"
-	newNet := stdnet.NewNet(context.Background(), testIFaceBlackList)
+	newNet := stdnet.NewNet(context.Background(), testIFaceBlackList, nil)
 	opts := WGIFaceOpts{
 		IFaceName:    ifaceName,
 		Address:      wgaddr.MustParseWGAddress(wgIP),
@@ -171,7 +171,7 @@ func Test_Close(t *testing.T) {
 	ifaceName := fmt.Sprintf("utun%d", WgIntNumber+2)
 	wgIP := "10.99.99.2/32"
 	wgPort := 33100
-	newNet := stdnet.NewNet(context.Background(), testIFaceBlackList)
+	newNet := stdnet.NewNet(context.Background(), testIFaceBlackList, nil)
 
 	opts := WGIFaceOpts{
 		IFaceName:    ifaceName,
@@ -213,7 +213,7 @@ func TestRecreation(t *testing.T) {
 			ifaceName := fmt.Sprintf("utun%d", WgIntNumber+2)
 			wgIP := "10.99.99.2/32"
 			wgPort := 33100
-			newNet := stdnet.NewNet(context.Background(), testIFaceBlackList)
+			newNet := stdnet.NewNet(context.Background(), testIFaceBlackList, nil)
 
 			opts := WGIFaceOpts{
 				IFaceName:    ifaceName,
@@ -283,7 +283,7 @@ func Test_ConfigureInterface(t *testing.T) {
 	ifaceName := fmt.Sprintf("utun%d", WgIntNumber+3)
 	wgIP := "10.99.99.5/30"
 	wgPort := 33100
-	newNet := stdnet.NewNet(context.Background(), testIFaceBlackList)
+	newNet := stdnet.NewNet(context.Background(), testIFaceBlackList, nil)
 	opts := WGIFaceOpts{
 		IFaceName:    ifaceName,
 		Address:      wgaddr.MustParseWGAddress(wgIP),
@@ -335,7 +335,7 @@ func Test_ConfigureInterface(t *testing.T) {
 func Test_UpdatePeer(t *testing.T) {
 	ifaceName := fmt.Sprintf("utun%d", WgIntNumber+4)
 	wgIP := "10.99.99.9/30"
-	newNet := stdnet.NewNet(context.Background(), testIFaceBlackList)
+	newNet := stdnet.NewNet(context.Background(), testIFaceBlackList, nil)
 
 	opts := WGIFaceOpts{
 		IFaceName:    ifaceName,
@@ -402,7 +402,7 @@ func Test_UpdatePeer(t *testing.T) {
 func Test_RemovePeer(t *testing.T) {
 	ifaceName := fmt.Sprintf("utun%d", WgIntNumber+4)
 	wgIP := "10.99.99.13/30"
-	newNet := stdnet.NewNet(context.Background(), testIFaceBlackList)
+	newNet := stdnet.NewNet(context.Background(), testIFaceBlackList, nil)
 
 	opts := WGIFaceOpts{
 		IFaceName:    ifaceName,
@@ -463,7 +463,7 @@ func Test_ConnectPeers(t *testing.T) {
 	peer2wgPort := 33200
 
 	keepAlive := 1 * time.Second
-	newNet := stdnet.NewNet(context.Background(), testIFaceBlackList)
+	newNet := stdnet.NewNet(context.Background(), testIFaceBlackList, nil)
 
 	guid := fmt.Sprintf("{%s}", uuid.New().String())
 	device.CustomWindowsGUIDString = strings.ToLower(guid)
@@ -499,7 +499,7 @@ func Test_ConnectPeers(t *testing.T) {
 	guid = fmt.Sprintf("{%s}", uuid.New().String())
 	device.CustomWindowsGUIDString = strings.ToLower(guid)
 
-	newNet = stdnet.NewNet(context.Background(), testIFaceBlackList)
+	newNet = stdnet.NewNet(context.Background(), testIFaceBlackList, nil)
 
 	optsPeer2 := WGIFaceOpts{
 		IFaceName:    peer2ifaceName,
diff --git a/client/iface/udpmux/mux.go b/client/iface/udpmux/mux.go
index 68cecc953..3aa0b4d88 100644
--- a/client/iface/udpmux/mux.go
+++ b/client/iface/udpmux/mux.go
@@ -200,7 +200,7 @@ func (m *SingleSocketUDPMux) updateLocalAddresses() {
 		}
 		if len(networks) > 0 {
 			if m.params.Net == nil {
-				m.params.Net = stdnet.NewNet(context.Background(), nil)
+				m.params.Net = stdnet.NewNet(context.Background(), nil, nil)
 			}
 
 			ips, err := localInterfaces(m.params.Net, m.params.InterfaceFilter, nil, networks, true)
diff --git a/client/internal/dns/server_privileged_test.go b/client/internal/dns/server_privileged_test.go
index 270e3bf91..b135c3661 100644
--- a/client/internal/dns/server_privileged_test.go
+++ b/client/internal/dns/server_privileged_test.go
@@ -247,7 +247,7 @@ func TestUpdateDNSServer(t *testing.T) {
 	for n, testCase := range testCases {
 		t.Run(testCase.name, func(t *testing.T) {
 			privKey, _ := wgtypes.GenerateKey()
-			newNet := stdnet.NewNet(context.Background(), testIFaceBlackList)
+			newNet := stdnet.NewNet(context.Background(), testIFaceBlackList, nil)
 
 			opts := iface.WGIFaceOpts{
 				IFaceName:    fmt.Sprintf("utun230%d", n),
@@ -349,7 +349,7 @@ func TestDNSFakeResolverHandleUpdates(t *testing.T) {
 	defer t.Setenv("NB_WG_KERNEL_DISABLED", ov)
 
 	t.Setenv("NB_WG_KERNEL_DISABLED", "true")
-	newNet := stdnet.NewNet(context.Background(), []string{"utun2301"})
+	newNet := stdnet.NewNet(context.Background(), []string{"utun2301"}, nil)
 
 	privKey, _ := wgtypes.GeneratePrivateKey()
 	opts := iface.WGIFaceOpts{
diff --git a/client/internal/dns/server_test.go b/client/internal/dns/server_test.go
index 414890158..777594272 100644
--- a/client/internal/dns/server_test.go
+++ b/client/internal/dns/server_test.go
@@ -394,7 +394,7 @@ func createWgInterfaceWithBind(t *testing.T) (*iface.WGIface, error) {
 	defer t.Setenv("NB_WG_KERNEL_DISABLED", ov)
 
 	t.Setenv("NB_WG_KERNEL_DISABLED", "true")
-	newNet := stdnet.NewNet(context.Background(), []string{"utun2301"})
+	newNet := stdnet.NewNet(context.Background(), []string{"utun2301"}, nil)
 
 	privKey, _ := wgtypes.GeneratePrivateKey()
 
diff --git a/client/internal/engine.go b/client/internal/engine.go
index e167f7589..ccff974d8 100644
--- a/client/internal/engine.go
+++ b/client/internal/engine.go
@@ -57,6 +57,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/rosenpass"
 	"github.com/netbirdio/netbird/client/internal/routemanager"
 	"github.com/netbirdio/netbird/client/internal/statemanager"
+	"github.com/netbirdio/netbird/client/internal/stdnet"
 	"github.com/netbirdio/netbird/client/internal/syncstore"
 	"github.com/netbirdio/netbird/client/internal/updater"
 	"github.com/netbirdio/netbird/client/jobexec"
@@ -245,6 +246,9 @@ type Engine struct {
 
 	udpMux *udpmux.UniversalUDPMuxDefault
 
+	// wgDetector is shared by every ICE agent through the ICE config.
+	wgDetector *stdnet.WGDetector
+
 	// networkSerial is the latest CurrentSerial (state ID) of the network sent by the Management service
 	networkSerial uint64
 
@@ -362,6 +366,7 @@ func NewEngine(
 		mgmClient:          services.MgmClient,
 		relayManager:       services.RelayManager,
 		peerStore:          peerstore.NewConnStore(),
+		wgDetector:         stdnet.NewWGDetector(),
 		syncMsgMux:         &sync.Mutex{},
 		config:             config,
 		mobileDep:          mobileDep,
diff --git a/client/internal/engine_generic.go b/client/internal/engine_generic.go
index 34a75e45b..e293f1636 100644
--- a/client/internal/engine_generic.go
+++ b/client/internal/engine_generic.go
@@ -15,5 +15,6 @@ func (e *Engine) createICEConfig() icemaker.Config {
 		UDPMux:               e.udpMux.SingleSocketUDPMux,
 		UDPMuxSrflx:          e.udpMux,
 		NATExternalIPs:       e.parseNATExternalIPMappings(),
+		WGDetector:           e.wgDetector,
 	}
 }
diff --git a/client/internal/engine_js.go b/client/internal/engine_js.go
index dce3c57fb..0243b7b37 100644
--- a/client/internal/engine_js.go
+++ b/client/internal/engine_js.go
@@ -13,6 +13,7 @@ func (e *Engine) createICEConfig() icemaker.Config {
 		InterfaceBlackList:   e.config.IFaceBlackList,
 		DisableIPv6Discovery: e.config.DisableIPv6Discovery,
 		NATExternalIPs:       e.parseNATExternalIPMappings(),
+		WGDetector:           e.wgDetector,
 	}
 	return cfg
 }
diff --git a/client/internal/engine_stdnet.go b/client/internal/engine_stdnet.go
index 86f6d297a..d6e2b1aa4 100644
--- a/client/internal/engine_stdnet.go
+++ b/client/internal/engine_stdnet.go
@@ -7,5 +7,5 @@ import (
 )
 
 func (e *Engine) newStdNet() *stdnet.Net {
-	return stdnet.NewNet(e.clientCtx, e.config.IFaceBlackList)
+	return stdnet.NewNet(e.clientCtx, e.config.IFaceBlackList, e.wgDetector)
 }
diff --git a/client/internal/engine_stdnet_android.go b/client/internal/engine_stdnet_android.go
index b14deeadf..7ef996203 100644
--- a/client/internal/engine_stdnet_android.go
+++ b/client/internal/engine_stdnet_android.go
@@ -3,5 +3,5 @@ package internal
 import "github.com/netbirdio/netbird/client/internal/stdnet"
 
 func (e *Engine) newStdNet() *stdnet.Net {
-	return stdnet.NewNetWithDiscover(e.clientCtx, e.mobileDep.IFaceDiscover, e.config.IFaceBlackList)
+	return stdnet.NewNetWithDiscover(e.clientCtx, e.mobileDep.IFaceDiscover, e.config.IFaceBlackList, e.wgDetector)
 }
diff --git a/client/internal/engine_test.go b/client/internal/engine_test.go
index 14076c051..bfde05c04 100644
--- a/client/internal/engine_test.go
+++ b/client/internal/engine_test.go
@@ -688,7 +688,7 @@ func TestEngine_UpdateNetworkMapWithRoutes(t *testing.T) {
 				StatusRecorder: peer.NewRecorder("https://mgm"),
 			}, MobileDependency{})
 			engine.ctx = ctx
-			newNet := stdnet.NewNet(context.Background(), profilemanager.DefaultInterfaceBlacklist)
+			newNet := stdnet.NewNet(context.Background(), profilemanager.DefaultInterfaceBlacklist, nil)
 
 			opts := iface.WGIFaceOpts{
 				IFaceName:    wgIfaceName,
@@ -893,7 +893,7 @@ func TestEngine_UpdateNetworkMapWithDNSUpdate(t *testing.T) {
 			}, MobileDependency{})
 			engine.ctx = ctx
 
-			newNet := stdnet.NewNet(context.Background(), profilemanager.DefaultInterfaceBlacklist)
+			newNet := stdnet.NewNet(context.Background(), profilemanager.DefaultInterfaceBlacklist, nil)
 			opts := iface.WGIFaceOpts{
 				IFaceName:    wgIfaceName,
 				Address:      wgaddr.MustParseWGAddress(wgAddr),
diff --git a/client/internal/peer/conn_test.go b/client/internal/peer/conn_test.go
index b709d5e40..8f3d6216d 100644
--- a/client/internal/peer/conn_test.go
+++ b/client/internal/peer/conn_test.go
@@ -42,7 +42,7 @@ func TestNewConn_interfaceFilter(t *testing.T) {
 	ignore := []string{iface.WgInterfaceDefault, "tun0", "zt", "ZeroTier", "utun", "wg", "ts",
 		"Tailscale", "tailscale"}
 
-	filter := stdnet.InterfaceFilter(ignore)
+	filter := stdnet.InterfaceFilter(ignore, nil)
 
 	for _, s := range ignore {
 		assert.Equal(t, filter(s), false)
diff --git a/client/internal/peer/ice/agent.go b/client/internal/peer/ice/agent.go
index 6cd8c48de..a919cded5 100644
--- a/client/internal/peer/ice/agent.go
+++ b/client/internal/peer/ice/agent.go
@@ -39,7 +39,7 @@ func NewAgent(ctx context.Context, iFaceDiscover stdnet.ExternalIFaceDiscover, c
 	iceFailedTimeout := iceFailedTimeout()
 	iceRelayAcceptanceMinWait := iceRelayAcceptanceMinWait()
 
-	transportNet := newStdNet(ctx, iFaceDiscover, config.InterfaceBlackList)
+	transportNet := newStdNet(ctx, iFaceDiscover, config.InterfaceBlackList, config.WGDetector)
 
 	fac := logging.NewDefaultLoggerFactory()
 
@@ -50,7 +50,7 @@ func NewAgent(ctx context.Context, iFaceDiscover stdnet.ExternalIFaceDiscover, c
 		NetworkTypes:           []ice.NetworkType{ice.NetworkTypeUDP4, ice.NetworkTypeUDP6},
 		Urls:                   config.StunTurn.Load(),
 		CandidateTypes:         candidateTypes,
-		InterfaceFilter:        stdnet.InterfaceFilter(config.InterfaceBlackList),
+		InterfaceFilter:        stdnet.InterfaceFilter(config.InterfaceBlackList, config.WGDetector),
 		UDPMux:                 config.UDPMux,
 		UDPMuxSrflx:            config.UDPMuxSrflx,
 		NAT1To1IPs:             config.NATExternalIPs,
diff --git a/client/internal/peer/ice/config.go b/client/internal/peer/ice/config.go
index dd5d67403..9d6b19925 100644
--- a/client/internal/peer/ice/config.go
+++ b/client/internal/peer/ice/config.go
@@ -2,6 +2,8 @@ package ice
 
 import (
 	"github.com/pion/ice/v4"
+
+	"github.com/netbirdio/netbird/client/internal/stdnet"
 )
 
 type Config struct {
@@ -17,4 +19,8 @@ type Config struct {
 	UDPMuxSrflx ice.UniversalUDPMux
 
 	NATExternalIPs []string
+
+	// WGDetector is shared by every agent so that the WireGuard check the interface
+	// filter performs is not repeated for each of them.
+	WGDetector *stdnet.WGDetector
 }
diff --git a/client/internal/peer/ice/stdnet.go b/client/internal/peer/ice/stdnet.go
index 0c819ff66..fbbe4f388 100644
--- a/client/internal/peer/ice/stdnet.go
+++ b/client/internal/peer/ice/stdnet.go
@@ -8,6 +8,6 @@ import (
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 )
 
-func newStdNet(ctx context.Context, _ stdnet.ExternalIFaceDiscover, ifaceBlacklist []string) *stdnet.Net {
-	return stdnet.NewNet(ctx, ifaceBlacklist)
+func newStdNet(ctx context.Context, _ stdnet.ExternalIFaceDiscover, ifaceBlacklist []string, detector *stdnet.WGDetector) *stdnet.Net {
+	return stdnet.NewNet(ctx, ifaceBlacklist, detector)
 }
diff --git a/client/internal/peer/ice/stdnet_android.go b/client/internal/peer/ice/stdnet_android.go
index 2962ecf66..72f0c329e 100644
--- a/client/internal/peer/ice/stdnet_android.go
+++ b/client/internal/peer/ice/stdnet_android.go
@@ -6,6 +6,6 @@ import (
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 )
 
-func newStdNet(ctx context.Context, iFaceDiscover stdnet.ExternalIFaceDiscover, ifaceBlacklist []string) *stdnet.Net {
-	return stdnet.NewNetWithDiscover(ctx, iFaceDiscover, ifaceBlacklist)
+func newStdNet(ctx context.Context, iFaceDiscover stdnet.ExternalIFaceDiscover, ifaceBlacklist []string, detector *stdnet.WGDetector) *stdnet.Net {
+	return stdnet.NewNetWithDiscover(ctx, iFaceDiscover, ifaceBlacklist, detector)
 }
diff --git a/client/internal/relay/relay.go b/client/internal/relay/relay.go
index f0c65301e..e39eed39a 100644
--- a/client/internal/relay/relay.go
+++ b/client/internal/relay/relay.go
@@ -201,7 +201,7 @@ func (p *StunTurnProbe) probeSTUN(ctx context.Context, uri *stun.URI) (addr stri
 		}
 	}()
 
-	net := stdnet.NewNet(ctx, nil)
+	net := stdnet.NewNet(ctx, nil, nil)
 
 	client, err := stun.DialURI(uri, &stun.DialConfig{
 		Net: net,
@@ -286,7 +286,7 @@ func (p *StunTurnProbe) probeTURN(ctx context.Context, uri *stun.URI) (addr stri
 		}
 	}()
 
-	net := stdnet.NewNet(ctx, nil)
+	net := stdnet.NewNet(ctx, nil, nil)
 	cfg := &turn.ClientConfig{
 		STUNServerAddr: turnServerAddr,
 		TURNServerAddr: turnServerAddr,
diff --git a/client/internal/routemanager/manager_test.go b/client/internal/routemanager/manager_test.go
index a1624cf46..766ea1c61 100644
--- a/client/internal/routemanager/manager_test.go
+++ b/client/internal/routemanager/manager_test.go
@@ -407,7 +407,7 @@ func TestManagerUpdateRoutes(t *testing.T) {
 	for n, testCase := range testCases {
 		t.Run(testCase.name, func(t *testing.T) {
 			peerPrivateKey, _ := wgtypes.GeneratePrivateKey()
-			newNet := stdnet.NewNet(context.Background(), profilemanager.DefaultInterfaceBlacklist)
+			newNet := stdnet.NewNet(context.Background(), profilemanager.DefaultInterfaceBlacklist, nil)
 			opts := iface.WGIFaceOpts{
 				IFaceName:    fmt.Sprintf("utun43%d", n),
 				Address:      wgaddr.MustParseWGAddress("100.65.65.2/24"),
diff --git a/client/internal/routemanager/systemops/systemops_generic_test.go b/client/internal/routemanager/systemops/systemops_generic_test.go
index 5b569ebd6..f117ff751 100644
--- a/client/internal/routemanager/systemops/systemops_generic_test.go
+++ b/client/internal/routemanager/systemops/systemops_generic_test.go
@@ -437,7 +437,7 @@ func createWGInterface(t *testing.T, interfaceName, ipAddressCIDR string, listen
 	peerPrivateKey, err := wgtypes.GeneratePrivateKey()
 	require.NoError(t, err)
 
-	newNet := stdnet.NewNet(context.Background(), profilemanager.DefaultInterfaceBlacklist)
+	newNet := stdnet.NewNet(context.Background(), profilemanager.DefaultInterfaceBlacklist, nil)
 
 	opts := iface.WGIFaceOpts{
 		IFaceName:    interfaceName,
diff --git a/client/internal/stdnet/filter.go b/client/internal/stdnet/filter.go
index e45714001..07025ff1e 100644
--- a/client/internal/stdnet/filter.go
+++ b/client/internal/stdnet/filter.go
@@ -3,17 +3,13 @@ package stdnet
 import (
 	"runtime"
 	"strings"
-
-	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/wgctrl"
 )
 
 // InterfaceFilter is a function passed to ICE Agent to filter out not allowed interfaces
-// to avoid building tunnel over them.
-func InterfaceFilter(disallowList []string) func(string) bool {
-
+// to avoid building tunnel over them. A nil detector probes the interface on every call,
+// which is what the callers that build one filter for their whole lifetime want.
+func InterfaceFilter(disallowList []string, detector *WGDetector) func(string) bool {
 	return func(iFace string) bool {
-
 		if strings.HasPrefix(iFace, "lo") {
 			// hardcoded loopback check to support already installed agents
 			return false
@@ -24,17 +20,8 @@ func InterfaceFilter(disallowList []string) func(string) bool {
 				return false
 			}
 		}
-		// look for unlisted WireGuard interfaces
-		wg, err := wgctrl.New()
-		if err != nil {
-			log.Debugf("trying to create a wgctrl client failed with: %v", err)
-			return true
-		}
-		defer func() {
-			_ = wg.Close()
-		}()
 
-		_, err = wg.Device(iFace)
-		return err != nil
+		// look for unlisted WireGuard interfaces
+		return !detector.IsWireGuard(iFace)
 	}
 }
diff --git a/client/internal/stdnet/stdnet.go b/client/internal/stdnet/stdnet.go
index c3a9d3d97..32f030612 100644
--- a/client/internal/stdnet/stdnet.go
+++ b/client/internal/stdnet/stdnet.go
@@ -45,12 +45,12 @@ type Net struct {
 }
 
 // NewNetWithDiscover creates a new StdNet instance.
-func NewNetWithDiscover(ctx context.Context, iFaceDiscover ExternalIFaceDiscover, disallowList []string) *Net {
+func NewNetWithDiscover(ctx context.Context, iFaceDiscover ExternalIFaceDiscover, disallowList []string, detector *WGDetector) *Net {
 	if ctx == nil {
 		ctx = context.Background()
 	}
 	n := &Net{
-		interfaceFilter: InterfaceFilter(disallowList),
+		interfaceFilter: InterfaceFilter(disallowList, detector),
 		ctx:             ctx,
 	}
 	// current ExternalIFaceDiscover implement in android-client https://github.dev/netbirdio/android-client
@@ -64,13 +64,13 @@ func NewNetWithDiscover(ctx context.Context, iFaceDiscover ExternalIFaceDiscover
 }
 
 // NewNet creates a new StdNet instance.
-func NewNet(ctx context.Context, disallowList []string) *Net {
+func NewNet(ctx context.Context, disallowList []string, detector *WGDetector) *Net {
 	if ctx == nil {
 		ctx = context.Background()
 	}
 	return &Net{
 		iFaceDiscover:   pionDiscover{},
-		interfaceFilter: InterfaceFilter(disallowList),
+		interfaceFilter: InterfaceFilter(disallowList, detector),
 		ctx:             ctx,
 	}
 }
diff --git a/client/internal/stdnet/stdnet_test.go b/client/internal/stdnet/stdnet_test.go
index 822972f39..2b16a50c0 100644
--- a/client/internal/stdnet/stdnet_test.go
+++ b/client/internal/stdnet/stdnet_test.go
@@ -54,13 +54,13 @@ func TestNet_InterfacesDiscoversLazilyAndCaches(t *testing.T) {
 }
 
 func TestNewNet_DoesNotDiscoverAtConstruction(t *testing.T) {
-	n := NewNet(context.Background(), nil)
+	n := NewNet(context.Background(), nil, nil)
 	require.NotNil(t, n)
 	assert.True(t, n.lastUpdate.IsZero(), "constructor must leave the cache cold")
 }
 
 func TestNewNetWithDiscover_DoesNotDiscoverAtConstruction(t *testing.T) {
-	n := NewNetWithDiscover(context.Background(), nil, nil)
+	n := NewNetWithDiscover(context.Background(), nil, nil, nil)
 	require.NotNil(t, n)
 	assert.True(t, n.lastUpdate.IsZero(), "constructor must leave the cache cold")
 }
diff --git a/client/internal/stdnet/wgdetector.go b/client/internal/stdnet/wgdetector.go
new file mode 100644
index 000000000..f34e469e1
--- /dev/null
+++ b/client/internal/stdnet/wgdetector.go
@@ -0,0 +1,119 @@
+package stdnet
+
+import (
+	"sync"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sync/singleflight"
+	"golang.zx2c4.com/wireguard/wgctrl"
+)
+
+// wgDetectorTTL bounds how long a cached answer is trusted. An interface rarely
+// becomes, or stops being, a WireGuard device, and the window only has to be short
+// enough that ICE does not keep gathering candidates on one that just appeared.
+const wgDetectorTTL = 1 * time.Second
+
+type wgDetectorEntry struct {
+	isWireGuard bool
+	expireAt    time.Time
+}
+
+// WGDetector answers whether an interface is a WireGuard device, remembering the
+// answer for a short while.
+//
+// The question is asked once per interface for every ICE agent, and an agent is
+// created per peer connection attempt, so on a large network the uncached form runs
+// constantly. Answering it means opening a wgctrl client, which builds both a kernel
+// and a userspace client and resolves the netlink family, and then a round trip that
+// usually just reports the device does not exist.
+//
+// A detector is safe for concurrent use and is meant to be shared by every agent.
+type WGDetector struct {
+	ttl time.Duration
+	// probe is replaced in tests; it is the call this type exists to avoid repeating.
+	probe func(string) bool
+
+	mu    sync.RWMutex
+	cache map[string]wgDetectorEntry
+
+	sf singleflight.Group
+}
+
+// NewWGDetector returns a detector with the default time to live.
+func NewWGDetector() *WGDetector {
+	return &WGDetector{
+		ttl:   wgDetectorTTL,
+		probe: probeWireGuard,
+		cache: make(map[string]wgDetectorEntry),
+	}
+}
+
+// IsWireGuard reports whether the named interface is a WireGuard device. An interface
+// it cannot ask about is reported as not being one, which leaves it available to ICE
+// exactly as an uncached probe would.
+func (d *WGDetector) IsWireGuard(iFace string) bool {
+	if d == nil {
+		return probeWireGuard(iFace)
+	}
+
+	if isWireGuard, ok := d.cached(iFace); ok {
+		return isWireGuard
+	}
+
+	result, _, _ := d.sf.Do(iFace, func() (interface{}, error) {
+		// A caller that saw the entry expire may get here after another caller already
+		// refreshed it and left the singleflight group.
+		if isWireGuard, ok := d.cached(iFace); ok {
+			return isWireGuard, nil
+		}
+
+		isWireGuard := d.probe(iFace)
+
+		d.store(iFace, isWireGuard)
+
+		return isWireGuard, nil
+	})
+	return result.(bool)
+}
+
+func (d *WGDetector) cached(iFace string) (isWireGuard, ok bool) {
+	d.mu.RLock()
+	defer d.mu.RUnlock()
+
+	entry, found := d.cache[iFace]
+	if !found || !time.Now().Before(entry.expireAt) {
+		return false, false
+	}
+	return entry.isWireGuard, true
+}
+
+// store records an answer and drops the expired ones, so names of interfaces that came
+// and went, such as container veths, do not pile up for the life of the engine.
+func (d *WGDetector) store(iFace string, isWireGuard bool) {
+	now := time.Now()
+
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	for name, entry := range d.cache {
+		if !now.Before(entry.expireAt) {
+			delete(d.cache, name)
+		}
+	}
+	d.cache[iFace] = wgDetectorEntry{isWireGuard: isWireGuard, expireAt: now.Add(d.ttl)}
+}
+
+func probeWireGuard(iFace string) bool {
+	wg, err := wgctrl.New()
+	if err != nil {
+		log.Debugf("trying to create a wgctrl client failed with: %v", err)
+		return false
+	}
+	defer func() {
+		_ = wg.Close()
+	}()
+
+	_, err = wg.Device(iFace)
+	return err == nil
+}
diff --git a/client/internal/stdnet/wgdetector_test.go b/client/internal/stdnet/wgdetector_test.go
new file mode 100644
index 000000000..68260ae59
--- /dev/null
+++ b/client/internal/stdnet/wgdetector_test.go
@@ -0,0 +1,152 @@
+package stdnet
+
+import (
+	"runtime"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// newCountingDetector returns a detector whose probe records how often it ran, so a test
+// can assert on the thing this type exists for rather than on its return value alone.
+func newCountingDetector(t *testing.T, ttl time.Duration, answer bool) (*WGDetector, *atomic.Int64) {
+	t.Helper()
+
+	var calls atomic.Int64
+	d := &WGDetector{
+		ttl:   ttl,
+		cache: make(map[string]wgDetectorEntry),
+		probe: func(string) bool {
+			calls.Add(1)
+			return answer
+		},
+	}
+	return d, &calls
+}
+
+func TestWGDetectorAsksOncePerInterfaceWithinTheTTL(t *testing.T) {
+	d, calls := newCountingDetector(t, time.Minute, true)
+
+	for i := 0; i < 20; i++ {
+		assert.True(t, d.IsWireGuard("wt0"), "cached answer must not change")
+	}
+	assert.Equal(t, int64(1), calls.Load(), "the interface must be probed once within the TTL")
+
+	d.IsWireGuard("eth0")
+	assert.Equal(t, int64(2), calls.Load(), "a different interface is a different question and is probed on its own")
+}
+
+func TestWGDetectorReprobesAfterTheTTL(t *testing.T) {
+	d, calls := newCountingDetector(t, time.Millisecond, true)
+
+	require.True(t, d.IsWireGuard("wt0"), "first answer")
+	require.Equal(t, int64(1), calls.Load(), "first call probes")
+
+	time.Sleep(5 * time.Millisecond)
+
+	require.True(t, d.IsWireGuard("wt0"), "answer after expiry")
+	assert.Equal(t, int64(2), calls.Load(), "an expired entry must be probed again")
+}
+
+func TestWGDetectorCollapsesConcurrentProbes(t *testing.T) {
+	var calls atomic.Int64
+	release := make(chan struct{})
+	d := &WGDetector{
+		ttl:   time.Minute,
+		cache: make(map[string]wgDetectorEntry),
+		probe: func(string) bool {
+			calls.Add(1)
+			<-release
+			return true
+		},
+	}
+
+	var wg sync.WaitGroup
+	for i := 0; i < 50; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			d.IsWireGuard("wt0")
+		}()
+	}
+
+	// The sleep only lets the callers pile up on the blocked probe so the collapse is
+	// exercised. The count does not depend on it: a caller that arrives after the probe
+	// finished finds the fresh entry, either before or inside the singleflight group.
+	time.Sleep(20 * time.Millisecond)
+	close(release)
+	wg.Wait()
+
+	assert.Equal(t, int64(1), calls.Load(), "concurrent callers must share one probe")
+}
+
+func TestWGDetectorNilProbesEveryTime(t *testing.T) {
+	var d *WGDetector
+	// A nil detector keeps the uncached behaviour, which is what the callers that build one
+	// filter for their whole lifetime rely on. It must not panic.
+	assert.NotPanics(t, func() { d.IsWireGuard("definitely-not-an-interface-0") },
+		"a nil detector must fall back to probing")
+}
+
+func TestInterfaceFilter(t *testing.T) {
+	wgDetector, calls := newCountingDetector(t, time.Minute, true)
+	plainDetector, _ := newCountingDetector(t, time.Minute, false)
+
+	t.Run("loopback is rejected without probing", func(t *testing.T) {
+		filter := InterfaceFilter(nil, wgDetector)
+		assert.False(t, filter("lo"), "loopback must never be offered to ICE")
+		assert.Equal(t, int64(0), calls.Load(), "a name settled by prefix must not reach the probe")
+	})
+
+	t.Run("a disallowed interface is rejected without probing", func(t *testing.T) {
+		if runtime.GOOS == "ios" {
+			t.Skip("the disallow list is not applied on iOS")
+		}
+		filter := InterfaceFilter([]string{"wt"}, wgDetector)
+		assert.False(t, filter("wt0"), "a blacklisted interface must be rejected")
+		assert.Equal(t, int64(0), calls.Load(), "a name settled by the disallow list must not reach the probe")
+	})
+
+	t.Run("an unlisted WireGuard interface is rejected", func(t *testing.T) {
+		filter := InterfaceFilter(nil, wgDetector)
+		assert.False(t, filter("somewg0"), "a WireGuard interface must not be used to build a tunnel")
+	})
+
+	t.Run("an ordinary interface is allowed", func(t *testing.T) {
+		filter := InterfaceFilter(nil, plainDetector)
+		assert.True(t, filter("eth0"), "a plain interface must remain available to ICE")
+	})
+}
+
+func TestInterfaceFilterSharesOneProbeAcrossFilters(t *testing.T) {
+	d, calls := newCountingDetector(t, time.Minute, false)
+
+	// Every ICE agent builds its own filter, twice, and each one is asked about every
+	// interface. Sharing the detector is what keeps that from repeating the probe.
+	for i := 0; i < 10; i++ {
+		filter := InterfaceFilter(nil, d)
+		require.True(t, filter("eth0"), "a plain interface stays allowed")
+		require.True(t, filter("eth1"), "a plain interface stays allowed")
+	}
+
+	assert.Equal(t, int64(2), calls.Load(), "one probe per interface, not per filter")
+}
+
+func TestWGDetectorDropsExpiredEntries(t *testing.T) {
+	d, _ := newCountingDetector(t, time.Millisecond, false)
+
+	for _, name := range []string{"veth1", "veth2", "veth3"} {
+		d.IsWireGuard(name)
+	}
+	time.Sleep(5 * time.Millisecond)
+	d.IsWireGuard("eth0")
+
+	d.mu.RLock()
+	defer d.mu.RUnlock()
+	assert.Len(t, d.cache, 1, "expired entries of vanished interfaces must be dropped")
+	assert.Contains(t, d.cache, "eth0", "the fresh answer must be kept")
+}

From 3934e7c69784c910775ede4c02f205232db5cad7 Mon Sep 17 00:00:00 2001
From: Riccardo Manfrin <3090891+riccardomanfrin@users.noreply.github.com>
Date: Fri, 9 Oct 2026 11:44:08 +0200
Subject: [PATCH 30/70] [client] Evaluate the session deadline against the wall
 clock (#7959)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Skip session warnings that fire after their window

The warning timers run on the monotonic clock, which does not advance
while an Android device is suspended. A timer armed for T-10 or T-2 can
therefore fire long after the window it was armed for, delivering a
"session expires soon" notification once that window is already gone.

Gate both callbacks on the wall clock at fire time: the T-10 warning is
skipped once the final-warning window has been reached, and the final
warning is skipped once the deadline itself has passed. Both set their
edge guard before returning so a skipped warning cannot fire again for
the same deadline.

* Harden the late-warning guards

Clamp a non-positive final lead to zero in the T-10 guard so a disabled
final warning cannot move the cutoff past the deadline, matching how
armTimerLocked already treats it.

Strip the monotonic reading from both sides of the comparison so the
guard measures wall-clock time regardless of how the caller built the
deadline. The production deadline comes from a protobuf timestamp and
has no monotonic reading; this keeps the guard correct for callers that
derive one from time.Now.

* Log the deadline and lateness on skipped warnings

Include the deadline and how far past the cutoff the timer fired, so a
debug bundle shows how long the device was suspended.

* Inject the clock into the late-warning guard and cover it with tests

The guard read time.Now internally, so the skip paths were reachable
only through a deadline already in the past and the boundary depended
on real time. Extract the comparison into isLate and read the time
through a nowFn field, so tests can place a resume anywhere around the
deadline without sleeping.

* Send the final warning when the T-10 timer fires inside its window

A suspend between roughly eight and ten minutes long made the T-10
timer fire inside the final-warning window and the final timer fire
after the deadline, so both were skipped and a user who resumed with
time left got no warning at all. When the T-10 timer fires late but
before the deadline, send the final warning in its place and mark it
fired so the delayed final timer does not repeat it.

* Respect dismissal when promoting a late warning to the final one

fireFinal skips the final warning once the user dismissed the deadline,
but the promoted path did not, so a dismissed deadline could still get
a final warning. Check the dismissal first, and give each skip reason
its own log line so an already-fired final warning no longer logs a
negative lateness.

* Add a deadline-only mode to the session watcher

Android will schedule its own expiry warnings from the deadline, so
the engine must not arm the T-10 and T-2 timers there. NewDeadlineOnly
keeps the deadline validation, the recorder propagation and the
logging, and skips only the timers, so the status snapshot the app
reads stays correct and an out-of-range deadline is still rejected.

* Use the deadline-only watcher on Android and drop the warning callbacks

The warning timers run on the monotonic clock, which does not advance
while the device sleeps, so a warning armed for T-10 could fire long
after its window. The app now schedules the warnings itself with
WorkManager, anchored to the wall clock, from the deadline it reads
through SessionExpiresAtUnix on every OnStateChanged.

Wire the deadline-only watcher into the android build and remove the
event-driven path from the gomobile surface: OnSessionExpiring, the
event subscription behind it and DismissSessionWarning, which the app
never called.

* Describe the late-warning guard without naming Android

The guard stays for the desktop builds, where a timer can also stall
across a sleep. Android no longer arms the timers at all.

* [client] Evaluate the session deadline against the wall clock

The session deadline is an absolute instant published by management, but
the warnings for it were armed as relative timers. A relative timer runs
on the monotonic clock, which does not advance while a device is
suspended: it fires once that much awake time has passed, which can be
long after the deadline, and nothing re-evaluates when the device wakes
up. A device that suspends before the warning window and resumes with
minutes left is never told it can still extend. The same applies to a
device that boots before NTP has corrected its clock: the one-shot timer
has already fired by the time the correction lands.

Compare the tracked deadline against the wall clock on a ticker instead.
Every tick after a resume, or after a clock correction, sees the real
remaining time, so the warning is published whenever there is still time
to act on it and never once the deadline has passed. This supersedes the
late-callback guards: with no relative timer there is no late callback to
detect.

The warning windows keep their semantics. Each one publishes at most once
per deadline value, a dismissal still suppresses the final warning, and
inside the final window the interactive warning is skipped in favour of
the final one, since a device resuming there never saw it. Update
evaluates immediately so a deadline that already sits inside a window
does not wait for a tick, and Close stops the loop and waits for it.

Two trade-offs: a warning can land up to one tick (10s) after its lead,
which is noise against leads measured in minutes, and the loop runs from
the first tracked deadline until Close rather than being armed and
disarmed per deadline.

* [client] Poll whatever the clock reads when the deadline arrives

Update started the loop only for a deadline in the future, and read the
wall clock directly to decide. A device whose clock runs ahead before NTP
corrects it accepts the deadline as recent-past, starts nothing, and then
has no loop left to notice the correction: the next sync carries the same
deadline value, which Update treats as a no-op. The warning is lost for
exactly the case this mechanism exists to cover.

Start the loop for every accepted deadline. evaluate already ignores a
deadline that has genuinely passed, so the only cost is a ticker on an
expired session until the next deadline or Close.

Take the current time from nowFn there as well, so the sanity checks and
the evaluation agree on what time it is and a test can drive both.

* [client] Announce the deadline before any warning about it

Update released the lock before telling the recorder about the new
deadline, so a tick landing in that window could publish a warning for a
deadline consumers had not been told about yet, inverting the order the
function documents.

Gate publishing on the deadline the recorder has been told about: Update
records it after the recorder call, and an evaluation that finds the gate
shut leaves the warning for the next tick.

* [client] Describe the deadline-only mode in terms of the poll

The mode no longer skips arming timers, it skips the evaluation entirely,
and the doc comment said otherwise.

* [client] Publish warnings only from the evaluation loop

Update evaluated the new deadline on the caller's goroutine, so a warning
could still be on its way to the recorder after Close had returned: Close
waits for the evaluation loop, and that publish was not coming from it.

Hand the work to the loop instead. Update announces the deadline and
nudges a buffered wake channel, so a deadline that already sits inside a
warning window is still warned about at once, without this goroutine ever
touching the recorder. The loop is now the only caller of evaluate, which
makes waiting for it in Close enough.

* [client] Make a concurrent Close wait for the loop as well

The first Close stopped the evaluation loop and waited for it, but a
second concurrent Close saw the closed flag and returned straight away,
telling its caller the teardown was done while a warning was still on its
way to the recorder.

Keep the completion channel on the receiver after the teardown starts, so
the call that loses the race waits on the same loop.

* [client] Correct the poll start condition in the doc comment

Update starts the loop for every accepted deadline, including one that
already reads as expired, not only for a future one.

* [client] Unblock the parked publish on every test exit path

The concurrent-Close test parks the evaluation loop inside a publish and
releases it at the end. A t.Fatal before that line runs Goexit and skips
the release, stranding the loop and both Close calls for the rest of the
package run.

Release through a sync.Once registered with t.Cleanup, and close the
watcher there too, so an early failure reports itself instead of hanging.

* [client] Release the parked publish before closing in the test cleanup

t.Cleanup runs in reverse registration order, so the watcher was closed
before the release ran: Close waits for the evaluation loop, the loop was
still parked in the publish, and a t.Fatal hung the cleanup instead of
reporting the failure.

Register one cleanup that releases first and closes after.

---------

Co-authored-by: Zoltán Papp <zoltan.pmail@gmail.com>
---
 client/internal/auth/sessionwatch/watcher.go  | 347 +++++++------
 .../auth/sessionwatch/watcher_test.go         | 464 +++++++++++++-----
 2 files changed, 522 insertions(+), 289 deletions(-)

diff --git a/client/internal/auth/sessionwatch/watcher.go b/client/internal/auth/sessionwatch/watcher.go
index 496903044..f71689df1 100644
--- a/client/internal/auth/sessionwatch/watcher.go
+++ b/client/internal/auth/sessionwatch/watcher.go
@@ -4,12 +4,20 @@
 // T-WarningLead notification and a dismiss-gated T-FinalWarningLead
 // fallback dialog.
 //
+// The deadline is an absolute wall-clock instant, so the watcher compares
+// it against the wall clock on a ticker rather than arming a relative
+// timer for it. A relative timer runs on the monotonic clock, which does
+// not advance while a device is suspended: it fires once that much awake
+// time has passed, which can be long after the deadline, and nothing
+// re-evaluates when the device wakes up. Polling makes every tick after a
+// resume (or after an NTP correction) see the real remaining time.
+//
 // The watcher is idempotent: Update may be called as often as the network
 // map snapshots arrive. Repeating the same deadline is a no-op; a new
-// deadline reschedules the timers and arms a fresh warning cycle.
+// deadline starts a fresh warning cycle.
 //
-// Warning firing is edge-detected. Each unique deadline value fires each
-// warning callback at most once.
+// Warning firing is edge-detected. Each unique deadline value publishes
+// each warning at most once.
 package sessionwatch
 
 import (
@@ -28,9 +36,15 @@ const (
 
 	// maxDeadlineHorizon caps how far in the future an accepted deadline
 	// can sit. A timestamp beyond this is almost certainly a protocol
-	// glitch, and silently arming a 100-year timer would hide the bug.
+	// glitch, and silently tracking a 100-year deadline would hide the bug.
 	maxDeadlineHorizon = 10 * 365 * 24 * time.Hour
 
+	// defaultEvalInterval is how often the tracked deadline is compared
+	// against the wall clock. The leads are minutes, so a coarse tick costs
+	// nothing in accuracy and keeps the wakeup cheap on battery-powered
+	// devices.
+	defaultEvalInterval = 10 * time.Second
+
 	// WarningLead is how far before expiry the first (interactive)
 	// warning fires. Drives the T-10 OS notification with
 	// Extend/Dismiss actions.
@@ -92,18 +106,21 @@ type StatusRecorder interface {
 type Watcher struct {
 	lead         time.Duration
 	finalLead    time.Duration
-	deadlineOnly bool
+	interval     time.Duration
+	deadlineOnly bool // record the deadline, leave the warnings to the caller
 
 	mu           sync.Mutex
 	current      time.Time
-	timer        *time.Timer
-	finalTimer   *time.Timer
-	firedAt      time.Time // deadline value the T-WarningLead callback last fired against
-	finalFiredAt time.Time // deadline value the T-FinalWarningLead callback last fired against
-	dismissedAt  time.Time // deadline value the user dismissed via Dismiss(); gates fireFinal
+	firedAt      time.Time // deadline value the T-WarningLead warning last published for
+	finalFiredAt time.Time // deadline value the T-FinalWarningLead warning last published for
+	dismissedAt  time.Time // deadline value the user dismissed via Dismiss(); gates the final warning
+	announcedAt  time.Time // deadline value the recorder has been told about; gates publishing
 	closed       bool
 	recorder     StatusRecorder
 	nowFn        func() time.Time
+	stop         chan struct{} // closed to stop the evaluation loop; nil while it is not running
+	done         chan struct{} // closed by the loop on its way out
+	wake         chan struct{} // buffered nudge asking the loop to evaluate before its next tick
 }
 
 // New returns a watcher with the package defaults WarningLead and
@@ -115,20 +132,24 @@ func New(recorder StatusRecorder) *Watcher {
 }
 
 // NewWithLeads returns a watcher with custom lead times. Useful for tests.
-// final must be strictly less than lead; otherwise both timers fire in the
-// wrong order or simultaneously and the UI flow breaks. A zero final lead
-// disables the final-warning timer entirely (see armTimerLocked) so a
-// millisecond-scale deadline doesn't flush both timers in one tick.
+// final must be strictly less than lead; otherwise the final warning takes
+// over the whole warning window and the interactive notification never
+// shows. A zero final lead disables the final warning entirely (see
+// evaluate), leaving the interactive one as the only warning.
 func NewWithLeads(lead, final time.Duration, recorder StatusRecorder) *Watcher {
 	return &Watcher{
 		lead:      lead,
 		finalLead: final,
+		interval:  defaultEvalInterval,
 		recorder:  recorder,
 		nowFn:     time.Now,
 	}
 }
 
-// NewDeadlineOnly returns a watcher that validates and records deadlines but arms no warning timers.
+// NewDeadlineOnly returns a watcher that validates and records deadlines
+// but publishes no warnings about them, and runs no evaluation loop to
+// decide. Used where the deadline is handed on to something that schedules
+// the warnings itself, such as the Android app.
 func NewDeadlineOnly(recorder StatusRecorder) *Watcher {
 	w := New(recorder)
 	w.deadlineOnly = true
@@ -139,11 +160,12 @@ func NewDeadlineOnly(recorder StatusRecorder) *Watcher {
 // a Sync push from the server omits the field because login expiration
 // was disabled).
 //
-// Same-value updates are no-ops. A different non-zero value cancels any
-// pending timer, resets the "already fired" guards, and — when the
-// deadline lies in the future — arms fresh warning timers. A deadline
-// already in the past (within maxPastHorizon) is recorded as-is with no
-// timers: the session has expired and consumers render it that way.
+// Same-value updates are no-ops. A different non-zero value resets the
+// "already fired" guards and starts a fresh warning cycle, evaluated
+// immediately so a deadline that already sits inside a warning window
+// warns without waiting for the next tick. A deadline already in the past
+// (within maxPastHorizon) is recorded as-is and warns nothing: the session
+// has expired and consumers render it that way.
 //
 // Returns one of the sentinel Err* values when the deadline fails the
 // sanity checks (pre-epoch, far future, or past beyond maxPastHorizon).
@@ -163,7 +185,7 @@ func (w *Watcher) Update(deadline time.Time) error {
 		return nil
 	}
 
-	now := time.Now()
+	now := w.nowFn()
 	switch {
 	case deadline.Before(time.Unix(0, 0)):
 		w.clearLocked()
@@ -181,18 +203,22 @@ func (w *Watcher) Update(deadline time.Time) error {
 		return nil
 	}
 
-	w.stopTimerLocked()
 	w.current = deadline
-	// Reset every per-deadline guard so a refreshed deadline arms a fresh
+	// Reset every per-deadline guard so a refreshed deadline starts a fresh
 	// warning cycle: both edge triggers and the user Dismiss decision
 	// (the user agreed to the old deadline expiring; a new deadline
 	// restarts the contract).
 	w.firedAt = time.Time{}
 	w.finalFiredAt = time.Time{}
 	w.dismissedAt = time.Time{}
+	w.announcedAt = time.Time{}
 
-	if deadline.After(now) && !w.deadlineOnly {
-		w.armTimerLocked(deadline)
+	// Poll every accepted deadline, including one that reads as already
+	// expired: the clock may be running ahead of real time and get
+	// corrected later, and evaluate ignores a deadline that has genuinely
+	// passed anyway.
+	if !w.deadlineOnly {
+		w.startPollLocked()
 	}
 	recorder := w.recorder
 	w.mu.Unlock()
@@ -200,6 +226,28 @@ func (w *Watcher) Update(deadline time.Time) error {
 		recorder.SetSessionExpiresAt(deadline)
 	}
 	log.Infof("auth session deadline set to: %s (in %s)", deadline.Format(time.RFC3339), time.Until(deadline).Round(time.Second))
+
+	// Open the gate only once the recorder knows the new deadline, so a
+	// warning that refers to it can never reach consumers before the state
+	// change itself. A tick landing in between finds the gate shut.
+	w.mu.Lock()
+	if w.closed || !w.current.Equal(deadline) {
+		w.mu.Unlock()
+		return nil
+	}
+	w.announcedAt = deadline
+	wake := w.wake
+	w.mu.Unlock()
+
+	// Hand the evaluation to the loop rather than running it here, so a
+	// deadline that already sits inside a warning window is published at
+	// once without this goroutine ever touching the recorder.
+	if wake != nil {
+		select {
+		case wake <- struct{}{}:
+		default:
+		}
+	}
 	return nil
 }
 
@@ -212,9 +260,9 @@ func (w *Watcher) Deadline() time.Time {
 }
 
 // Dismiss records the user's "Dismiss" action against the current deadline
-// and suppresses the upcoming final-warning callback for that deadline.
-// Idempotent: repeated calls are no-ops. A subsequent Update with a fresh
-// deadline resets the dismissal so the final-warning cycle re-arms.
+// and suppresses the final warning for that deadline. Idempotent: repeated
+// calls are no-ops. A subsequent Update with a fresh deadline resets the
+// dismissal so the final-warning cycle starts over.
 //
 // No-op when the watcher holds no deadline or has been closed.
 func (w *Watcher) Dismiss() {
@@ -227,35 +275,48 @@ func (w *Watcher) Dismiss() {
 		return
 	}
 	w.dismissedAt = w.current
-	// Cancel the armed final-warning timer eagerly. fireFinal would also
-	// gate on dismissedAt, but stopping the timer avoids a wakeup with
-	// nothing to do and makes the intent visible.
-	if w.finalTimer != nil {
-		w.finalTimer.Stop()
-		w.finalTimer = nil
-	}
 	log.Infof("auth session final-warning dismissed for deadline %s", w.current.Format(time.RFC3339))
 }
 
-// Close stops any pending timer. Update calls after Close are ignored.
-// The recorder keeps its deadline: the watcher is engine-scoped and closes
-// on every engine restart (network change, sleep/wake, stream errors)
-// while the SSO deadline stays valid across those, so clearing here would
-// blank the UI's "expires in" row on every transient reconnect. The
-// client run loop clears the server-scoped recorder when it exits for
-// real (Down, profile switch, permanent login failure).
+// Close stops the evaluation loop and waits for it to exit. Update calls
+// after Close are ignored. The recorder keeps its deadline: the watcher is
+// engine-scoped and closes on every engine restart (network change,
+// sleep/wake, stream errors) while the SSO deadline stays valid across
+// those, so clearing here would blank the UI's "expires in" row on every
+// transient reconnect. The client run loop clears the server-scoped
+// recorder when it exits for real (Down, profile switch, permanent login
+// failure).
 func (w *Watcher) Close() {
 	w.mu.Lock()
-	defer w.mu.Unlock()
 	if w.closed {
+		// A concurrent Close is already tearing down. w.done outlives it,
+		// so this caller waits for the same loop rather than returning
+		// while a warning is still on its way to the recorder.
+		done := w.done
+		w.mu.Unlock()
+		if done != nil {
+			<-done
+		}
 		return
 	}
 	w.closed = true
-	w.stopTimerLocked()
 	w.current = time.Time{}
 	w.firedAt = time.Time{}
 	w.finalFiredAt = time.Time{}
 	w.dismissedAt = time.Time{}
+	w.announcedAt = time.Time{}
+	// Copy the channels out before releasing the lock: the loop takes w.mu
+	// on every tick, so waiting for it while holding the lock would
+	// deadlock. w.done stays on the receiver for the branch above.
+	stop, done := w.stop, w.done
+	w.stop, w.wake = nil, nil
+	w.mu.Unlock()
+
+	if stop == nil {
+		return
+	}
+	close(stop)
+	<-done
 }
 
 // clearLocked drops the tracked deadline and notifies the recorder so
@@ -267,11 +328,11 @@ func (w *Watcher) clearLocked() {
 		w.mu.Unlock()
 		return
 	}
-	w.stopTimerLocked()
 	w.current = time.Time{}
 	w.firedAt = time.Time{}
 	w.finalFiredAt = time.Time{}
 	w.dismissedAt = time.Time{}
+	w.announcedAt = time.Time{}
 	recorder := w.recorder
 	w.mu.Unlock()
 	if recorder != nil {
@@ -280,133 +341,121 @@ func (w *Watcher) clearLocked() {
 	log.Infof("auth session deadline cleared")
 }
 
-func (w *Watcher) stopTimerLocked() {
-	if w.timer != nil {
-		w.timer.Stop()
-		w.timer = nil
+// startPollLocked starts the evaluation loop unless it is already
+// running. The loop starts lazily on the first accepted deadline, so a
+// client whose server never publishes a session expiry never pays for a
+// ticker, and it runs until Close: the watcher is engine-scoped, and a
+// cleared deadline is normally followed by a fresh one on the next sync.
+// Caller must hold w.mu.
+func (w *Watcher) startPollLocked() {
+	if w.stop != nil {
+		return
 	}
-	if w.finalTimer != nil {
-		w.finalTimer.Stop()
-		w.finalTimer = nil
+	stop := make(chan struct{})
+	done := make(chan struct{})
+	wake := make(chan struct{}, 1)
+	w.stop, w.done, w.wake = stop, done, wake
+	go w.poll(stop, done, wake, w.interval)
+}
+
+// poll re-evaluates the tracked deadline every interval, and as soon as a
+// new deadline is announced. It is the only caller of evaluate, so Close
+// waiting for it to exit is enough to know no warning is still on its way
+// to the recorder. Its channels and interval are passed in rather than
+// read off the receiver, so Close can clear them without racing it.
+func (w *Watcher) poll(stop <-chan struct{}, done chan<- struct{}, wake <-chan struct{}, interval time.Duration) {
+	defer close(done)
+
+	ticker := time.NewTicker(interval)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-stop:
+			return
+		case <-wake:
+			w.evaluate()
+		case <-ticker.C:
+			w.evaluate()
+		}
 	}
 }
 
-func (w *Watcher) armTimerLocked(deadline time.Time) {
-	w.timer = armOneShotLocked(deadline.Add(-w.lead), func() { w.fire(deadline) })
-	// finalLead <= 0 disables the final-warning timer entirely. Used by
-	// tests that predate the final-warning fallback so a millisecond-scale
-	// deadline does not flush both timers at once.
-	if w.finalLead > 0 {
-		w.finalTimer = armOneShotLocked(deadline.Add(-w.finalLead), func() { w.fireFinal(deadline) })
-	}
-}
-
-func (w *Watcher) fire(armedFor time.Time) {
+// evaluate compares the tracked deadline against the wall clock and
+// publishes whichever warning the remaining time calls for. Inside the
+// final-warning window the interactive warning is stale, so the final one
+// is published in its place: a device that resumes there never saw the
+// T-WarningLead notification.
+func (w *Watcher) evaluate() {
 	w.mu.Lock()
-	if w.closed || !w.current.Equal(armedFor) {
-		// Deadline moved while we were waiting (e.g. a successful extend).
-		// The reschedule path armed a fresh timer; this one is stale.
+	if w.closed || w.deadlineOnly || w.current.IsZero() {
 		w.mu.Unlock()
 		return
 	}
-	if !w.firedAt.IsZero() && w.firedAt.Equal(armedFor) {
-		w.mu.Unlock()
-		return
-	}
-	now := w.nowFn()
-	if isLate(now, armedFor, max(w.finalLead, 0)) {
-		w.fireLateLocked(armedFor, now)
-		return
-	}
-	w.firedAt = armedFor
-	recorder := w.recorder
-	w.mu.Unlock()
-	if recorder == nil {
-		return
-	}
-	log.Infof("auth session expiry soon warning fired")
-	publishWarning(recorder, armedFor, false)
-}
 
-// fireFinal mirrors fire for the T-FinalWarningLead timer with an extra
-// dismiss-gate: if the user dismissed the T-WarningLead notification for
-// this deadline, the final warning is suppressed entirely.
-func (w *Watcher) fireFinal(armedFor time.Time) {
-	w.mu.Lock()
-	if w.closed || !w.current.Equal(armedFor) {
+	deadline := w.current
+	if !w.announcedAt.Equal(deadline) {
+		// Update is still on its way to the recorder with this deadline.
 		w.mu.Unlock()
 		return
 	}
-	if !w.finalFiredAt.IsZero() && w.finalFiredAt.Equal(armedFor) {
-		w.mu.Unlock()
-		return
-	}
-	if w.dismissedAt.Equal(armedFor) {
-		w.mu.Unlock()
-		log.Infof("auth session final-warning skipped (dismissed by user)")
-		return
-	}
-	now := w.nowFn()
-	if isLate(now, armedFor, 0) {
-		w.finalFiredAt = armedFor
-		w.mu.Unlock()
-		log.Infof("auth session final-warning skipped for deadline %s (passed %s ago)",
-			armedFor.Format(time.RFC3339), now.Round(0).Sub(armedFor).Round(time.Second))
-		return
-	}
-	w.finalFiredAt = armedFor
-	recorder := w.recorder
-	w.mu.Unlock()
-	if recorder == nil {
-		return
-	}
-	log.Infof("auth session final-warning fired")
-	publishWarning(recorder, armedFor, true)
-}
+	// Round(0) strips the monotonic reading so the comparison is wall
+	// clock on both sides, whether the deadline came off the wire or from
+	// a caller that derived it from time.Now.
+	remaining := deadline.Round(0).Sub(w.nowFn().Round(0))
 
-// fireLateLocked handles a T-WarningLead callback that fired inside the
-// final-warning window: it sends the final warning in its place while the
-// deadline has not passed and the user has not dismissed it, so a resume
-// with time left still warns. The caller must hold w.mu; this helper
-// releases it.
-func (w *Watcher) fireLateLocked(armedFor, now time.Time) {
-	w.firedAt = armedFor
 	switch {
-	case w.dismissedAt.Equal(armedFor):
+	case remaining <= 0:
+		// Already expired: the post-mortem SessionExpired flow owns it.
 		w.mu.Unlock()
-		log.Infof("auth session expiry soon warning skipped (dismissed by user)")
-		return
-	case w.finalFiredAt.Equal(armedFor):
+	case w.finalLead > 0 && remaining <= w.finalLead:
+		w.publishFinalLocked(deadline, remaining)
+	case remaining <= w.lead:
+		w.publishWarningLocked(deadline, remaining)
+	default:
 		w.mu.Unlock()
-		log.Infof("auth session expiry soon warning skipped (final warning already fired)")
-		return
-	case isLate(now, armedFor, 0):
+	}
+}
+
+// publishWarningLocked emits the interactive T-WarningLead warning, at
+// most once per deadline value. Caller must hold w.mu; this helper
+// releases it.
+func (w *Watcher) publishWarningLocked(deadline time.Time, remaining time.Duration) {
+	if w.firedAt.Equal(deadline) {
 		w.mu.Unlock()
-		log.Infof("auth session expiry soon warning skipped for deadline %s (passed %s ago)",
-			armedFor.Format(time.RFC3339), now.Round(0).Sub(armedFor).Round(time.Second))
 		return
 	}
-	w.finalFiredAt = armedFor
+	w.firedAt = deadline
 	recorder := w.recorder
 	w.mu.Unlock()
 	if recorder == nil {
 		return
 	}
-	log.Infof("auth session expiry soon warning fired inside the final-warning window, sending final warning for deadline %s",
-		armedFor.Format(time.RFC3339))
-	publishWarning(recorder, armedFor, true)
+	log.Infof("auth session expiry soon warning fired for deadline %s (in %s)",
+		deadline.Format(time.RFC3339), remaining.Round(time.Second))
+	publishWarning(recorder, deadline, false)
 }
 
-// armOneShotLocked schedules cb at fireAt. When fireAt is already in the
-// past it dispatches on the next scheduler tick so a state-change recorder
-// notification (invoked after w.mu is released) lands first. Caller must
-// hold w.mu.
-func armOneShotLocked(fireAt time.Time, cb func()) *time.Timer {
-	delay := time.Until(fireAt)
-	if delay <= 0 {
-		return time.AfterFunc(0, cb)
+// publishFinalLocked emits the final warning, at most once per deadline
+// value and never once the user dismissed that deadline. It marks the
+// interactive warning as handled too: the final window is open, so a
+// "expires in WarningLead minutes" notification would be wrong. Caller
+// must hold w.mu; this helper releases it.
+func (w *Watcher) publishFinalLocked(deadline time.Time, remaining time.Duration) {
+	if w.finalFiredAt.Equal(deadline) || w.dismissedAt.Equal(deadline) {
+		w.mu.Unlock()
+		return
 	}
-	return time.AfterFunc(delay, cb)
+	w.firedAt = deadline
+	w.finalFiredAt = deadline
+	recorder := w.recorder
+	w.mu.Unlock()
+	if recorder == nil {
+		return
+	}
+	log.Infof("auth session final-warning fired for deadline %s (in %s)",
+		deadline.Format(time.RFC3339), remaining.Round(time.Second))
+	publishWarning(recorder, deadline, true)
 }
 
 // publishWarning composes the SystemEvent for a watcher-fired warning and
@@ -436,11 +485,3 @@ func publishWarning(recorder StatusRecorder, deadline time.Time, final bool) {
 		meta,
 	)
 }
-
-// isLate reports whether the wall clock now has already reached armedFor
-// minus cutoffLead. The timers run on the monotonic clock, which can stall
-// while the host sleeps, so a timer can fire long after the window it was
-// armed for.
-func isLate(now, armedFor time.Time, cutoffLead time.Duration) bool {
-	return !now.Round(0).Before(armedFor.Add(-cutoffLead).Round(0))
-}
diff --git a/client/internal/auth/sessionwatch/watcher_test.go b/client/internal/auth/sessionwatch/watcher_test.go
index cb2800978..f0cc3ed88 100644
--- a/client/internal/auth/sessionwatch/watcher_test.go
+++ b/client/internal/auth/sessionwatch/watcher_test.go
@@ -19,6 +19,9 @@ type fakeRecorder struct {
 	mu           sync.Mutex
 	events       []event
 	lastDeadline time.Time
+	// setDelay stalls SetSessionExpiresAt, widening the window in which a
+	// concurrent evaluation could publish a warning out of order.
+	setDelay time.Duration
 }
 
 type eventKind int
@@ -43,6 +46,12 @@ type event struct {
 // is the zero time, so an initial clear before any deadline is set emits
 // nothing — matching the real recorder.
 func (r *fakeRecorder) SetSessionExpiresAt(deadline time.Time) {
+	r.mu.Lock()
+	delay := r.setDelay
+	r.mu.Unlock()
+	// Stall without the lock held, so a concurrent publish can still record.
+	time.Sleep(delay)
+
 	r.mu.Lock()
 	defer r.mu.Unlock()
 	if r.lastDeadline.Equal(deadline) {
@@ -116,10 +125,54 @@ func waitForEvents(t *testing.T, r *fakeRecorder, want int) []event {
 	return nil
 }
 
-// newWatcher builds a watcher with the final timer disabled (finalLead=0),
+// testInterval keeps the ticker-driven tests fast; the leads they use are
+// in the same millisecond scale.
+const testInterval = 2 * time.Millisecond
+
+// newWatcher builds a watcher with the final warning disabled (finalLead=0),
 // matching the lead-only behaviour the pre-final-warning tests assume.
 func newWatcher(lead time.Duration, r *fakeRecorder) *Watcher {
-	return NewWithLeads(lead, 0, r)
+	return newWatcherWithLeads(lead, 0, r)
+}
+
+// newWatcherWithLeads builds a watcher that evaluates on testInterval. The
+// interval is set before Update, so the evaluation loop does not exist yet
+// and the write cannot race it.
+func newWatcherWithLeads(lead, final time.Duration, r StatusRecorder) *Watcher {
+	w := NewWithLeads(lead, final, r)
+	w.interval = testInterval
+	return w
+}
+
+// fakeClock is the watcher's wall clock under test. Reads come from the
+// evaluation goroutine while the test writes, so both go through the mutex.
+type fakeClock struct {
+	mu sync.Mutex
+	t  time.Time
+}
+
+func newFakeClock(t time.Time) *fakeClock {
+	return &fakeClock{t: t}
+}
+
+func (c *fakeClock) now() time.Time {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.t
+}
+
+// set jumps the clock, standing in for a resume from suspension or for an
+// NTP correction.
+func (c *fakeClock) set(t time.Time) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.t = t
+}
+
+// settle waits out a handful of evaluation ticks so a test can assert that
+// nothing was published.
+func settle() {
+	time.Sleep(20 * testInterval)
 }
 
 func TestUpdateZeroBeforeAnythingIsNoop(t *testing.T) {
@@ -410,7 +463,7 @@ func TestCloseWithoutDeadlineLeavesRecorderUntouched(t *testing.T) {
 func TestFinalWarningFiresAfterRegularWarning(t *testing.T) {
 	r := &fakeRecorder{}
 	// Warning fires at deadline-80ms, final at deadline-30ms.
-	w := NewWithLeads(80*time.Millisecond, 30*time.Millisecond, r)
+	w := newWatcherWithLeads(80*time.Millisecond, 30*time.Millisecond, r)
 	defer w.Close()
 
 	d := time.Now().Add(100 * time.Millisecond)
@@ -446,7 +499,7 @@ func TestFinalWarningFiresAfterRegularWarning(t *testing.T) {
 
 func TestDismissSuppressesFinalWarning(t *testing.T) {
 	r := &fakeRecorder{}
-	w := NewWithLeads(80*time.Millisecond, 30*time.Millisecond, r)
+	w := newWatcherWithLeads(80*time.Millisecond, 30*time.Millisecond, r)
 	defer w.Close()
 
 	d := time.Now().Add(100 * time.Millisecond)
@@ -477,7 +530,7 @@ func TestDismissSuppressesFinalWarning(t *testing.T) {
 
 func TestDismissResetByNewDeadline(t *testing.T) {
 	r := &fakeRecorder{}
-	w := NewWithLeads(80*time.Millisecond, 30*time.Millisecond, r)
+	w := newWatcherWithLeads(80*time.Millisecond, 30*time.Millisecond, r)
 	defer w.Close()
 
 	first := time.Now().Add(100 * time.Millisecond)
@@ -507,7 +560,7 @@ func TestDismissResetByNewDeadline(t *testing.T) {
 
 func TestDismissBeforeUpdateIsNoop(t *testing.T) {
 	r := &fakeRecorder{}
-	w := NewWithLeads(80*time.Millisecond, 30*time.Millisecond, r)
+	w := newWatcherWithLeads(80*time.Millisecond, 30*time.Millisecond, r)
 	defer w.Close()
 
 	// No deadline tracked yet; Dismiss must be a no-op (no panic, no state).
@@ -528,157 +581,139 @@ func TestDismissBeforeUpdateIsNoop(t *testing.T) {
 	t.Fatalf("final-warning did not publish after no-op pre-Update Dismiss, events=%+v", r.snapshot())
 }
 
-func TestIsLate(t *testing.T) {
-	armedFor := time.Date(2026, 10, 1, 12, 0, 0, 0, time.UTC)
-	lead := 2 * time.Minute
-	tests := []struct {
-		name       string
-		now        time.Time
-		cutoffLead time.Duration
-		want       bool
-	}{
-		{"before cutoff", armedFor.Add(-3 * time.Minute), lead, false},
-		{"at cutoff", armedFor.Add(-lead), lead, true},
-		{"after cutoff", armedFor.Add(-time.Minute), lead, true},
-		{"zero lead before deadline", armedFor.Add(-time.Second), 0, false},
-		{"zero lead at deadline", armedFor, 0, true},
-		{"zero lead after deadline", armedFor.Add(time.Second), 0, true},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if got := isLate(tt.now, armedFor, tt.cutoffLead); got != tt.want {
-				t.Fatalf("isLate(%s, %s, %s) = %v, want %v", tt.now, armedFor, tt.cutoffLead, got, tt.want)
-			}
-		})
-	}
-}
+// The tests below drive the watcher's wall clock directly. The deadline sits
+// an hour out in real time and the fake clock jumps, standing in for a device
+// that was suspended and resumed somewhere inside — or past — the warning
+// windows. The evaluation loop is what reacts to the jump, so these exercise
+// the same path production takes on a resume.
+func newResumeWatcher(t *testing.T, r *fakeRecorder) (*Watcher, *fakeClock, time.Time) {
+	t.Helper()
 
-func TestIsLateIgnoresMonotonicReading(t *testing.T) {
-	now := time.Now()
-	wallOnly := now.Round(0)
-	if isLate(now, wallOnly.Add(time.Second), 0) {
-		t.Fatalf("now with monotonic reading must compare as wall clock before a later wall-only deadline")
-	}
-	if !isLate(now, wallOnly, 0) {
-		t.Fatalf("now with monotonic reading must compare as wall clock at an equal wall-only deadline")
-	}
-}
+	w := newWatcherWithLeads(WarningLead, FinalWarningLead, r)
+	start := time.Now()
+	clock := newFakeClock(start)
+	// Set before Update: the evaluation loop does not exist yet.
+	w.nowFn = clock.now
+	t.Cleanup(w.Close)
 
-func TestLateTimerFiring(t *testing.T) {
-	tests := []struct {
-		name       string
-		final      bool
-		beforeDl   time.Duration
-		wantWarns  int
-		wantFinals int
-	}{
-		{"warning on resume inside window", false, 3 * time.Minute, 1, 0},
-		{"warning promoted to final inside final window", false, time.Minute, 0, 1},
-		{"warning skipped past deadline", false, -time.Minute, 0, 0},
-		{"final on resume before deadline", true, time.Minute, 0, 1},
-		{"final skipped past deadline", true, -time.Minute, 0, 0},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			r := &fakeRecorder{}
-			w := New(r)
-			defer w.Close()
-
-			// The deadline is an hour out so the real timers never fire
-			// during the test; the late callback is invoked directly with an
-			// injected clock that simulates a resume near the deadline.
-			d := time.Now().Add(time.Hour).Round(0)
-			w.nowFn = func() time.Time { return d.Add(-tt.beforeDl) }
-			if err := w.Update(d); err != nil {
-				t.Fatalf("Update: %v", err)
-			}
-
-			if tt.final {
-				w.fireFinal(d)
-			} else {
-				w.fire(d)
-			}
-
-			events := r.snapshot()
-			if got := countWhere(events, event.isWarning); got != tt.wantWarns {
-				t.Fatalf("expected %d warning publishes, got %d: %+v", tt.wantWarns, got, events)
-			}
-			if got := countWhere(events, event.isFinalWarning); got != tt.wantFinals {
-				t.Fatalf("expected %d final-warning publishes, got %d: %+v", tt.wantFinals, got, events)
-			}
-		})
-	}
-}
-
-func TestPromotedFinalWarningIsNotRepeated(t *testing.T) {
-	r := &fakeRecorder{}
-	w := New(r)
-	defer w.Close()
-
-	d := time.Now().Add(time.Hour).Round(0)
-	now := d.Add(-time.Minute)
-	w.nowFn = func() time.Time { return now }
-	if err := w.Update(d); err != nil {
+	deadline := start.Add(time.Hour).Round(0)
+	if err := w.Update(deadline); err != nil {
 		t.Fatalf("Update: %v", err)
 	}
+	return w, clock, deadline
+}
 
-	w.fire(d)
-	// The final timer was suspended too, so it fires even later than the
-	// warning timer, here still just before the deadline.
-	now = d.Add(-30 * time.Second)
-	w.fireFinal(d)
+func TestResumeInsideWarningWindowWarns(t *testing.T) {
+	r := &fakeRecorder{}
+	_, clock, deadline := newResumeWatcher(t, r)
 
-	events := r.snapshot()
-	if got := countWhere(events, event.isFinalWarning); got != 1 {
-		t.Fatalf("expected exactly 1 final-warning publish, got %d: %+v", got, events)
+	clock.set(deadline.Add(-5 * time.Minute))
+
+	events := waitForEvents(t, r, 2)
+	if !events[1].isWarning() {
+		t.Fatalf("expected the interactive warning after the resume, got %+v", events[1])
 	}
-	if got := countWhere(events, event.isWarning); got != 0 {
-		t.Fatalf("expected no regular warning publish, got %d: %+v", got, events)
+	if n := countWhere(events, event.isFinalWarning); n != 0 {
+		t.Fatalf("final-warning must wait for its own window, got %d: %+v", n, events)
 	}
 }
 
-func TestPromotionRespectsDismiss(t *testing.T) {
+func TestResumeInsideFinalWindowSendsFinalWarningOnly(t *testing.T) {
 	r := &fakeRecorder{}
-	w := New(r)
-	defer w.Close()
+	_, clock, deadline := newResumeWatcher(t, r)
 
-	d := time.Now().Add(time.Hour).Round(0)
-	w.nowFn = func() time.Time { return d.Add(-time.Minute) }
-	if err := w.Update(d); err != nil {
-		t.Fatalf("Update: %v", err)
+	clock.set(deadline.Add(-time.Minute))
+
+	events := waitForEvents(t, r, 2)
+	if !events[1].isFinalWarning() {
+		t.Fatalf("expected the final warning after the resume, got %+v", events[1])
+	}
+	settle()
+	if n := countWhere(r.snapshot(), event.isWarning); n != 0 {
+		t.Fatalf("the interactive warning is stale inside the final window, got %d: %+v", n, r.snapshot())
+	}
+}
+
+func TestResumePastDeadlinePublishesNothing(t *testing.T) {
+	r := &fakeRecorder{}
+	_, clock, deadline := newResumeWatcher(t, r)
+
+	clock.set(deadline.Add(time.Minute))
+
+	settle()
+	if n := countWhere(r.snapshot(), func(e event) bool { return e.kind == publish }); n != 0 {
+		t.Fatalf("an expired session must not warn, got %d publishes: %+v", n, r.snapshot())
+	}
+}
+
+func TestWarningPublishesOncePerDeadline(t *testing.T) {
+	r := &fakeRecorder{}
+	_, clock, deadline := newResumeWatcher(t, r)
+
+	clock.set(deadline.Add(-5 * time.Minute))
+	waitForEvents(t, r, 2)
+
+	// Many ticks pass inside the same window.
+	settle()
+	if n := countWhere(r.snapshot(), event.isWarning); n != 1 {
+		t.Fatalf("expected exactly 1 warning publish across ticks, got %d: %+v", n, r.snapshot())
+	}
+}
+
+// TestWarningRecoversFromAClockRunningAhead covers the device that boots
+// before NTP has corrected it: the deadline looks long gone, nothing is
+// published, and the warning still arrives once the clock is fixed.
+func TestWarningRecoversFromAClockRunningAhead(t *testing.T) {
+	r := &fakeRecorder{}
+	_, clock, deadline := newResumeWatcher(t, r)
+
+	clock.set(deadline.Add(2 * time.Hour))
+	settle()
+	if n := countWhere(r.snapshot(), func(e event) bool { return e.kind == publish }); n != 0 {
+		t.Fatalf("a deadline that looks expired must not warn, got %d publishes: %+v", n, r.snapshot())
 	}
 
+	clock.set(deadline.Add(-5 * time.Minute))
+
+	events := waitForEvents(t, r, 2)
+	if !events[1].isWarning() {
+		t.Fatalf("expected the warning once the clock was corrected, got %+v", events[1])
+	}
+}
+
+func TestResumeInsideFinalWindowRespectsDismiss(t *testing.T) {
+	r := &fakeRecorder{}
+	w, clock, deadline := newResumeWatcher(t, r)
+
+	// The user dismissed the warning for this deadline before the device
+	// was suspended; resuming inside the final window must not reopen it.
 	w.Dismiss()
-	w.fire(d)
+	clock.set(deadline.Add(-time.Minute))
 
-	events := r.snapshot()
-	if got := countWhere(events, func(e event) bool { return e.kind == publish }); got != 0 {
-		t.Fatalf("expected no publish after dismiss, got %d: %+v", got, events)
+	settle()
+	if n := countWhere(r.snapshot(), func(e event) bool { return e.kind == publish }); n != 0 {
+		t.Fatalf("a dismissed deadline must not warn on resume, got %d: %+v", n, r.snapshot())
 	}
 }
 
-func TestPromotionSkippedWhenFinalAlreadyFired(t *testing.T) {
+func TestCloseStopsTheEvaluationLoop(t *testing.T) {
 	r := &fakeRecorder{}
-	w := New(r)
-	defer w.Close()
+	w := newWatcherWithLeads(WarningLead, FinalWarningLead, r)
+	start := time.Now()
+	clock := newFakeClock(start)
+	w.nowFn = clock.now
 
-	// Both timers fall in the past after a long suspend and are dispatched
-	// with a zero delay, so the final callback can run before the warning one.
-	d := time.Now().Add(time.Hour).Round(0)
-	w.nowFn = func() time.Time { return d.Add(-time.Minute) }
-	if err := w.Update(d); err != nil {
+	deadline := start.Add(time.Hour).Round(0)
+	if err := w.Update(deadline); err != nil {
 		t.Fatalf("Update: %v", err)
 	}
+	w.Close()
 
-	w.fireFinal(d)
-	w.fire(d)
+	clock.set(deadline.Add(-5 * time.Minute))
+	settle()
 
-	events := r.snapshot()
-	if got := countWhere(events, event.isFinalWarning); got != 1 {
-		t.Fatalf("expected exactly 1 final-warning publish, got %d: %+v", got, events)
-	}
-	if got := countWhere(events, event.isWarning); got != 0 {
-		t.Fatalf("expected no regular warning publish, got %d: %+v", got, events)
+	if n := countWhere(r.snapshot(), func(e event) bool { return e.kind == publish }); n != 0 {
+		t.Fatalf("a closed watcher must not publish, got %d: %+v", n, r.snapshot())
 	}
 }
 
@@ -687,8 +722,8 @@ func TestDeadlineOnlyRecordsDeadlineWithoutWarnings(t *testing.T) {
 	w := NewDeadlineOnly(r)
 	defer w.Close()
 
-	// With the default leads this deadline would otherwise fire both
-	// timers on the next tick.
+	// With the default leads this deadline sits inside the final-warning
+	// window, so a watcher that warns at all would publish on the spot.
 	d := time.Now().Add(50 * time.Millisecond).Round(0)
 	if err := w.Update(d); err != nil {
 		t.Fatalf("Update: %v", err)
@@ -703,8 +738,11 @@ func TestDeadlineOnlyRecordsDeadlineWithoutWarnings(t *testing.T) {
 	if got := countWhere(events, func(e event) bool { return e.kind == publish }); got != 0 {
 		t.Fatalf("expected no publish in deadline-only mode, got %d: %+v", got, events)
 	}
-	if w.timer != nil || w.finalTimer != nil {
-		t.Fatal("expected no timers armed in deadline-only mode")
+	w.mu.Lock()
+	polling := w.stop != nil
+	w.mu.Unlock()
+	if polling {
+		t.Fatal("expected no evaluation loop in deadline-only mode")
 	}
 }
 
@@ -725,3 +763,157 @@ func TestDeadlineOnlyStillRejectsOutOfRangeDeadlines(t *testing.T) {
 		t.Fatalf("expected recorder cleared after rejection, got %v", got)
 	}
 }
+
+// TestClockAheadAtUpdateStillWarnsOnceCorrected covers a client that connects
+// while its clock runs ahead of real time: the deadline reads as already
+// expired when it arrives, so nothing publishes, and the warning must still
+// come once NTP pulls the clock back.
+func TestClockAheadAtUpdateStillWarnsOnceCorrected(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcherWithLeads(WarningLead, FinalWarningLead, r)
+	deadline := time.Now().Add(time.Hour).Round(0)
+	// Two hours past the deadline from the device's point of view, well
+	// inside maxPastHorizon, so Update accepts and records it.
+	clock := newFakeClock(deadline.Add(2 * time.Hour))
+	w.nowFn = clock.now
+	t.Cleanup(w.Close)
+
+	if err := w.Update(deadline); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+
+	settle()
+	if n := countWhere(r.snapshot(), func(e event) bool { return e.kind == publish }); n != 0 {
+		t.Fatalf("a deadline that reads as expired must not warn, got %d: %+v", n, r.snapshot())
+	}
+
+	clock.set(deadline.Add(-5 * time.Minute))
+
+	events := waitForEvents(t, r, 2)
+	if !events[1].isWarning() {
+		t.Fatalf("expected the warning once the clock was corrected, got %+v", events[1])
+	}
+}
+
+// TestWarningNeverPrecedesTheDeadlineStateChange pins the ordering Update
+// documents: consumers learn the new deadline before they see a warning that
+// refers to it. The deadline here already sits inside the warning window, and
+// the recorder stalls, so the evaluation loop gets many chances to publish
+// while Update is still announcing.
+func TestWarningNeverPrecedesTheDeadlineStateChange(t *testing.T) {
+	r := &fakeRecorder{setDelay: 50 * time.Millisecond}
+	w := newWatcherWithLeads(WarningLead, FinalWarningLead, r)
+	deadline := time.Now().Add(time.Hour).Round(0)
+	clock := newFakeClock(deadline.Add(-5 * time.Minute))
+	w.nowFn = clock.now
+	t.Cleanup(w.Close)
+
+	if err := w.Update(deadline); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+
+	events := waitForEvents(t, r, 2)
+	if events[0].kind != stateChange {
+		t.Fatalf("event[0] should be the deadline state change, got %+v", events)
+	}
+	if !events[1].isWarning() {
+		t.Fatalf("event[1] should be the warning, got %+v", events)
+	}
+}
+
+// TestUpdateWakesTheLoopWithoutWaitingForATick pins the hand-off: Update
+// publishes nothing itself, it nudges the evaluation loop, so a deadline that
+// already sits inside a warning window is warned about at once even though the
+// ticker here would not fire for an hour.
+func TestUpdateWakesTheLoopWithoutWaitingForATick(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcherWithLeads(WarningLead, FinalWarningLead, r)
+	w.interval = time.Hour
+	t.Cleanup(w.Close)
+
+	d := time.Now().Add(5 * time.Minute).Round(0)
+	if err := w.Update(d); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+
+	events := waitForEvents(t, r, 2)
+	if !events[1].isWarning() {
+		t.Fatalf("expected the warning on the wake-up, got %+v", events[1])
+	}
+}
+
+// blockingRecorder holds a publish open until the test releases it, so the
+// evaluation loop can be parked mid-publish while Close is called.
+type blockingRecorder struct {
+	fakeRecorder
+	entered chan struct{}
+	release chan struct{}
+}
+
+func (r *blockingRecorder) PublishEvent(
+	severity cProto.SystemEvent_Severity,
+	category cProto.SystemEvent_Category,
+	message string,
+	userMessage string,
+	metadata map[string]string,
+) {
+	select {
+	case r.entered <- struct{}{}:
+	default:
+	}
+	<-r.release
+	r.fakeRecorder.PublishEvent(severity, category, message, userMessage, metadata)
+}
+
+// TestConcurrentCloseWaitsForTheLoop pins the contract for the caller that
+// loses the race: Close returns only once the loop is done, whichever of the
+// two calls got there first.
+func TestConcurrentCloseWaitsForTheLoop(t *testing.T) {
+	r := &blockingRecorder{entered: make(chan struct{}, 1), release: make(chan struct{})}
+	var releaseOnce sync.Once
+	release := func() { releaseOnce.Do(func() { close(r.release) }) }
+
+	w := newWatcherWithLeads(WarningLead, FinalWarningLead, r)
+	w.interval = time.Hour
+	// Order matters: Close waits for the loop, which stays parked in the
+	// publish until the release, so a t.Fatal below would hang the cleanup
+	// instead of reporting the failure.
+	t.Cleanup(func() {
+		release()
+		w.Close()
+	})
+
+	d := time.Now().Add(5 * time.Minute).Round(0)
+	if err := w.Update(d); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+
+	// The loop is now parked inside the warning publish.
+	select {
+	case <-r.entered:
+	case <-time.After(2 * time.Second):
+		t.Fatal("the loop never reached the publish")
+	}
+
+	first := make(chan struct{})
+	second := make(chan struct{})
+	go func() { w.Close(); close(first) }()
+	go func() { w.Close(); close(second) }()
+
+	select {
+	case <-first:
+		t.Fatal("Close returned while the loop was still publishing")
+	case <-second:
+		t.Fatal("Close returned while the loop was still publishing")
+	case <-time.After(100 * time.Millisecond):
+	}
+
+	release()
+	for _, done := range []chan struct{}{first, second} {
+		select {
+		case <-done:
+		case <-time.After(2 * time.Second):
+			t.Fatal("Close did not return after the publish completed")
+		}
+	}
+}

From fe0e9042add59e4ede9c70c18f909d20c5087869 Mon Sep 17 00:00:00 2001
From: Zoltan Papp <zoltan.pmail@gmail.com>
Date: Fri, 9 Oct 2026 12:56:41 +0200
Subject: [PATCH 31/70] [client] Drop the pending login flow when a login
 switches the profile (#7882)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* [client] Force interactive login when extending the auth session

A session extend must be answered from the account the peer is registered
under. With a silent PKCE flow (DisablePromptLogin or max_age=0) the IdP
answers from whatever session it already holds, which need not be the
peer's account when several are signed in; the token then fails the
user match in ExtendAuthSession with no way to pick another account.

Mark the PKCE flow request as a session extend so the management server
can force prompt=login for it, overriding the configured silent flow.

* [client] Reduce cognitive complexity of Server.Login

Login sat at cognitive complexity 27, over the 25 the linter allows.

Extract the interactive SSO branch into startSSOLogin, and split the
nested in-flight-flow reuse check out of it into reuseOAuthFlow, which
flattens the original if/else into early returns: it returns the cached
auth info when the previous flow targets the same client and still has
more than 90s left, otherwise cancels the stale wait and returns nil so
the caller requests a fresh flow.

The helpers take the contextState through a small statusSetter
interface, since internal.contextState is unexported and re-deriving it
with CtxGetState inside the helper would resolve against callerCtx
rather than rootCtx.

No behavior change: same ordering of state transitions, same mutex scope
around the oauthAuthFlow write, same error paths. Login is now at 21.

* [client] Respect DisablePromptLogin when extending the auth session

Forcing prompt=login on a session extend overrode DisablePromptLogin, which
is set for IdPs that break on it: Authentik triggers a double authentication
and social logins fail outright. Overriding it there trades a recoverable
extend for a login that cannot complete at all.

Keep the LoginFlag override, which only replaces max_age=0 or none with
prompt=login so the IdP honours login_hint, and leave DisablePromptLogin as
configured. Those deployments keep the silent flow, and with several accounts
signed in an extend answered from the wrong one still fails the user match.

* [client] Guard the shared OAuth flow state with the server mutex

reuseOAuthFlow read flow, expiresAt, waitCancel and info without holding
s.mutex, while startSSOLogin and WaitSSOLogin write them under it. Reading the
fields one at a time could also answer with auth info from a flow that was
already replaced, or cancel a wait that no longer belongs to the flow just
judged stale. Take one snapshot under the lock and decide from it.

WaitSSOLogin read oauthAuthFlow.flow twice outside the lock; both now use a
value snapshotted in the critical section that already installs actCancel.

Its stale waitCancel was read and called in a separate section from the one
installing the new one, so two racing calls could read the same predecessor and
leave one wait uncancelled. Swap the two in a single critical section. Both
cancels run after unlocking: the displaced wait takes s.mutex as it unwinds.

* [client] Verify the SSO login came back for the hinted account

login_hint is a suggestion the IdP may ignore: with a silent flow configured
(DisablePromptLogin or max_age=0) and a live IdP session for another account,
the login completes with that account's token. On a registered peer the
management server rejects it as a user mismatch, but on a fresh profile the
peer silently registers under the wrong account and the profile is then bound
to it — every later login follows the stored hint straight back.

After the token exchange, compare the ID token's email against the hint the
flow was sent with. On a mismatch, do not log in to management with the token;
run one more round asking the IdP to re-decide the account (prompt=login, via
ForceAccountPrompt — DisablePromptLogin still wins there). If the prompted
round also comes back different, proceed with a warning: the address may
legitimately have changed, and refusing forever would lock the user out of the
profile while the management server still rejects a token that does not own
the peer. A token or profile with no email to compare is not judged.

The retry differs per platform because of who opens the browser:

- CLI (netbird login foreground) and Android run the whole flow in one
  process, so the mismatch retries automatically: the browser reopens with
  the account prompt within the same login attempt.
- On desktop the login is split between the daemon and the GUI: Login hands
  the authorize URL to the GUI, WaitSSOLogin blocks for the token, and only
  the GUI can open a browser. A new URL cannot be handed out from inside
  WaitSSOLogin (its response has no field for one, kept that way to avoid a
  proto change), so the daemon arms forceAccountPrompt, fails the round with
  "connect again to choose the account", and builds the next Login's flow
  with the prompt — the user's next connect is the retry.

The flag and the flow annotations live in daemon memory only; SwitchProfile
drops them so the previous profile's hint cannot judge the next profile's
token. The device code flow has no prompt parameter (RFC 8628), so a prompted
round there runs as-is and a repeated mismatch is let through with the
warning rather than looping.

* [client] Address review comments on PKCE session extend flow

Fail the PKCE authorization flow test on request error instead of
continuing into a nil dereference, and make the godoc comments on the
touched exported symbols identifier-leading full sentences.

* [client] Match accounts only on the email claim of the ID token

The name-claim fallback in the ID token parsing is kept for the login
hint and display, but account matching now only considers a value that
came from the email claim, so a token without one no longer produces a
false account mismatch.

* [client] Drop the pending session extend on a profile switch

The profile-switch cleanup dropped the pending login flow and the
account-prompt flag, but left extendAuthSessionFlow untouched. Its device
code was issued by the previous profile's IdP client, so a
WaitExtendAuthSession still parked on the browser leg would submit the
resulting token against the new profile's engine.

* [client] Judge the SSO account against the flow that produced the token

WaitSSOLogin snapshotted the flow on entry but re-read the info, hint and
accountPrompted from the live s.oauthAuthFlow afterwards, in separate
critical sections. WaitToken blocks for the whole browser leg, so a
concurrent Login or RequestJWTAuth could replace the flow meanwhile and
the mismatch check would compare this wait's token against another flow's
account: either arming the prompt spuriously or letting a wrong-account
token through against an unrelated profile's hint. Take all of it in the
entry snapshot.

* [client] Keep the forced account prompt from being lost to flow reuse

startSSOLogin consumed forceAccountPrompt and applied the prompt to the
freshly built flow, but reuseOAuthFlow could then answer from a cached
flow for the same client — one built without prompt=login, e.g. by
RequestJWTAuth. The user got the same silent authorization URL that
produced the mismatch, with the flag already spent, so no later round
asked either. Rule reuse out when the prompt is forced, while still
cancelling the predecessor's wait.

RequestJWTAuth also wrote the flow fields one by one, leaving the previous
login's hint and accountPrompted behind for WaitSSOLogin to judge a later
token against. Both sites now replace the whole record.

* [client] Consume the forced account prompt after the retry

forceAccountPrompt was never cleared, so a flow that outlived the retry it
was armed for kept sending prompt=login on every later authorization
request and re-authenticated the user each time. RequestAuthInfo now takes
the flag as it builds the request.

* [client] Cancel the caller context in the SSO login tests

WaitSSOLogin parks a goroutine on the caller's context for the whole
browser leg. The tests passed context.Background(), which never cancels,
so each left one goroutine behind for the lifetime of the test binary.

* [client] Cancel the wait displaced by an OAuth flow replacement

Replacing the shared record with a whole struct value dropped the previous
flow's waitCancel, so an SSO browser wait still parked on it lost its
cancel: nothing could preempt it, and it could go on to run attemptLogin
or mutate the record behind the new flow. Both replacement sites now take
the displaced cancel over in the same critical section, via a shared
replaceOAuthFlow, and invoke it after the unlock.

* [client] Guard OAuth flow mutations by the flow that owns the wait

* [client] Arm the account prompt only from the wait that owns the flow

* [client] Drop the pending login flow when a login switches the profile

SwitchProfile cancels the pending OAuth wait and clears the flow record,
the account-prompt flag and the pending session extend, because they
describe the previous profile's login. A Login or Up that carries a
ProfileName switches the profile through switchProfileIfNeeded without
that cleanup, so reuseOAuthFlow could hand the new profile the previous
profile's flow: the same IdP client ID, the previous account's
login_hint in the URL, and a record whose hint WaitSSOLogin would judge
the new profile's token against. That either fails the login with a
spurious account mismatch or lets a fresh peer register under the other
account.

switchProfileIfNeeded now reports whether it switched, and its callers
run the same cleanup on a switch. A login on the same profile keeps the
pending flow, so a second client can still join it.

* [client] Clear the JWT cache when a login switches the profile

The daemon keeps the user's JWT in a cache for SSH logins. When the user
switches to another profile, this token belongs to the old profile, so it
must not be used for the new one.

SwitchProfile already cleared the cache. A login or up request can also
switch the profile, but it did not clear the cache. After such a switch,
SSH could still use the old profile's token, and a sign-in still running
for the old profile could save its token into the new profile's cache.

Clear the cache in dropPendingAuthFlows, so every profile switch does it.

* [client] Bump the JWT cache generation with the config swap in Login

RequestJWTAuth snapshots s.config and the cache generation under one
s.mutex section and relies on the two flipping together. Login cleared
the cache right after the profile switch but replaced s.config only
later, after getConfig, so a JWT flow started in between carried the
previous profile's config with the new generation, and its token landed
in the cache the new profile then served.

The swap now bumps the generation under the same lock. The early drop
stays: it covers a login that fails after the switch, where a retry no
longer sees a profile change.
---
 client/server/login_account_test.go | 121 ++++++++++++++++++++++++++++
 client/server/server.go             | 118 ++++++++++++++++-----------
 2 files changed, 190 insertions(+), 49 deletions(-)

diff --git a/client/server/login_account_test.go b/client/server/login_account_test.go
index c113c8bfe..6198a00bc 100644
--- a/client/server/login_account_test.go
+++ b/client/server/login_account_test.go
@@ -2,6 +2,8 @@ package server
 
 import (
 	"context"
+	"errors"
+	"path/filepath"
 	"testing"
 	"time"
 
@@ -9,9 +11,24 @@ import (
 
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/auth"
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
 	"github.com/netbirdio/netbird/client/proto"
 )
 
+type jwtStoringMDMFetcher struct {
+	cache      *jwtCache
+	caller     ipcauth.Identity
+	generation uint64
+}
+
+func (f *jwtStoringMDMFetcher) Fetch() map[string]any {
+	f.generation = f.cache.currentGeneration()
+	f.cache.store("previous-profile-token", f.caller, time.Minute, f.generation)
+	return nil
+}
+
 type stubOAuthFlow struct {
 	token  auth.TokenInfo
 	onWait func()
@@ -123,6 +140,110 @@ func TestSwitchProfile_DropsAccountPromptAndPendingFlow(t *testing.T) {
 	require.False(t, pending, "the previous profile's extend flow leaked across a profile switch")
 }
 
+func TestLogin_ProfileSwitchDropsAccountPromptAndPendingFlow(t *testing.T) {
+	s, _, _, username, cfgPath := setupServerWithProfile(t)
+	s.rootCtx = internal.CtxInitState(context.Background())
+	s.isLoginRequiredFn = func(context.Context) (bool, error) {
+		return true, nil
+	}
+
+	other := "other-profile"
+	otherPath := filepath.Join(filepath.Dir(cfgPath), other+".json")
+	_, err := profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
+		ConfigPath:    otherPath,
+		ManagementURL: "https://api.netbird.io:443",
+	})
+	require.NoError(t, err)
+	breakProfilePrivateKey(t, otherPath)
+
+	s.forceAccountPrompt = true
+	cancelled := false
+	s.oauthAuthFlow = oauthAuthFlow{
+		flow:       &stubOAuthFlow{},
+		hint:       "user@example.com",
+		waitCancel: func() { cancelled = true },
+	}
+
+	extendCancelled := false
+	s.extendAuthSessionFlow.Set(&stubOAuthFlow{}, auth.AuthFlowInfo{DeviceCode: "device"})
+	s.extendAuthSessionFlow.SetWaitCancel(func() { extendCancelled = true })
+
+	generation := s.jwtCache.currentGeneration()
+
+	_, err = s.Login(userCtx(), &proto.LoginRequest{ProfileName: &other, Username: &username})
+	require.Error(t, err, "the broken key must stop the login before a flow is built")
+
+	active, err := s.profileManager.GetActiveProfileState()
+	require.NoError(t, err)
+	require.Equal(t, profilemanager.ID(other), active.ID, "the login did not switch the profile")
+
+	require.False(t, s.forceAccountPrompt, "the prompt flag leaked across a login-driven profile switch")
+	require.Nil(t, s.oauthAuthFlow.flow, "the previous profile's flow leaked across a login-driven profile switch")
+	require.Empty(t, s.oauthAuthFlow.hint)
+	require.True(t, cancelled, "the pending wait was not cancelled")
+
+	require.True(t, extendCancelled, "the pending extend wait was not cancelled")
+	_, _, pending := s.extendAuthSessionFlow.Get()
+	require.False(t, pending, "the previous profile's extend flow leaked across a login-driven profile switch")
+
+	require.Greater(t, s.jwtCache.currentGeneration(), generation, "the previous profile's JWT cache survived a login-driven profile switch")
+}
+
+func TestLogin_ProfileSwitchRejectsJWTObtainedUnderPreviousConfig(t *testing.T) {
+	s, _, _, username, cfgPath := setupServerWithProfile(t)
+	s.rootCtx = internal.CtxInitState(context.Background())
+	s.isLoginRequiredFn = func(context.Context) (bool, error) {
+		return false, errors.New("stop once the config is swapped")
+	}
+
+	other := "other-profile"
+	_, err := profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
+		ConfigPath:    filepath.Join(filepath.Dir(cfgPath), other+".json"),
+		ManagementURL: "https://api.netbird.io:443",
+	})
+	require.NoError(t, err)
+
+	// getConfig loads the MDM policy right before Login swaps s.config, so the
+	// fetcher runs where a RequestJWTAuth racing the login would land: after the
+	// switch dropped the previous profile's state, while s.config still belongs
+	// to the previous profile. It caches a token under the generation current at
+	// that point, as WaitJWTToken would.
+	generation := s.jwtCache.currentGeneration()
+	fetcher := &jwtStoringMDMFetcher{cache: s.jwtCache, caller: unprivilegedIdentity()}
+	s.mdmLoader = mdm.NewLoader(fetcher)
+
+	_, err = s.Login(userCtx(), &proto.LoginRequest{ProfileName: &other, Username: &username})
+	require.Error(t, err)
+
+	require.Greater(t, fetcher.generation, generation, "the token was not cached after the switch dropped the previous profile's state")
+	_, found := s.jwtCache.get(fetcher.caller)
+	require.False(t, found, "a JWT obtained under the previous profile's config survived the login-driven switch")
+}
+
+func TestLogin_SameProfileKeepsPendingFlow(t *testing.T) {
+	s, _, profName, username, cfgPath := setupServerWithProfile(t)
+	s.rootCtx = internal.CtxInitState(context.Background())
+	s.isLoginRequiredFn = func(context.Context) (bool, error) {
+		return true, nil
+	}
+	breakProfilePrivateKey(t, cfgPath)
+
+	cancelled := false
+	flow := &stubOAuthFlow{}
+	s.oauthAuthFlow = oauthAuthFlow{
+		flow:       flow,
+		hint:       "user@example.com",
+		waitCancel: func() { cancelled = true },
+	}
+
+	_, err := s.Login(userCtx(), &proto.LoginRequest{ProfileName: &profName, Username: &username})
+	require.Error(t, err, "the broken key must stop the login before a flow is built")
+
+	require.Equal(t, flow, s.oauthAuthFlow.flow, "a login on the same profile dropped the flow a second client could join")
+	require.Equal(t, "user@example.com", s.oauthAuthFlow.hint)
+	require.False(t, cancelled, "a login on the same profile cancelled the pending wait")
+}
+
 func TestWaitSSOLogin_JudgesTheFlowThatProducedTheToken(t *testing.T) {
 	s := newSSOTestServer(t, "user@example.com", false, "user@example.com")
 	attempts := 0
diff --git a/client/server/server.go b/client/server/server.go
index 916d7041b..e082e1f2a 100644
--- a/client/server/server.go
+++ b/client/server/server.go
@@ -722,7 +722,7 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 		}
 	}()
 
-	ctx, activeProf, err := s.authorizeAndPrepareLogin(callerCtx, msg, activeProf)
+	ctx, activeProf, switched, err := s.authorizeAndPrepareLogin(callerCtx, msg, activeProf)
 	if err != nil {
 		// The RPC boundary is where this gets recorded: nothing logs handler
 		// errors for us, and a caller that retries would otherwise leave no
@@ -752,6 +752,9 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 	}
 	s.mutex.Lock()
 	s.config = config
+	if switched {
+		s.jwtCache.clear()
+	}
 	s.mutex.Unlock()
 
 	s.localMetrics.Reconcile(config.LocalMetricsEnabled, config.LocalMetricsAddress)
@@ -1192,11 +1195,15 @@ func (s *Server) Up(callerCtx context.Context, msg *proto.UpRequest) (*proto.UpR
 	}
 
 	if msg != nil && msg.ProfileName != nil {
-		if _, err := s.switchProfileIfNeeded(*msg.ProfileName, msg.Username, activeProf); err != nil {
+		switched, err := s.switchProfileIfNeeded(*msg.ProfileName, msg.Username, activeProf)
+		if err != nil {
 			s.mutex.Unlock()
 			log.Errorf("failed to switch profile: %v", err)
 			return nil, err
 		}
+		if switched {
+			s.dropPendingAuthFlows()
+		}
 	}
 
 	activeProf, err = s.profileManager.GetActiveProfileState()
@@ -1334,12 +1341,12 @@ func (s *Server) resolveProfileHandle(handle, username string) (*profilemanager.
 }
 
 // switchProfileIfNeeded resolves the user-supplied handle, updates the
-// active profile state if it differs from the current one, and returns
-// the resolved profile so callers can include its ID in RPC responses.
-func (s *Server) switchProfileIfNeeded(handle string, userName *string, activeProf *profilemanager.ActiveProfileState) (*profilemanager.Profile, error) {
+// active profile state if it differs from the current one, and reports
+// whether the active profile changed.
+func (s *Server) switchProfileIfNeeded(handle string, userName *string, activeProf *profilemanager.ActiveProfileState) (bool, error) {
 	if handle != profilemanager.DefaultProfileName && (userName == nil || *userName == "") {
 		log.Errorf("profile name is set to %s, but username is not provided", handle)
-		return nil, fmt.Errorf("profile name is set to %s, but username is not provided", handle)
+		return false, fmt.Errorf("profile name is set to %s, but username is not provided", handle)
 	}
 
 	var username string
@@ -1349,26 +1356,48 @@ func (s *Server) switchProfileIfNeeded(handle string, userName *string, activePr
 
 	resolved, err := s.resolveProfileHandle(handle, username)
 	if err != nil {
-		return nil, err
+		return false, err
 	}
 
-	if resolved.ID != activeProf.ID || username != activeProf.Username {
-		if s.checkProfilesDisabled() {
-			log.Errorf("profiles are disabled, you cannot use this feature without profiles enabled")
-			return nil, gstatus.Errorf(codes.Unavailable, errProfilesDisabled)
-		}
-
-		log.Infof("switching to profile %s (%s) for user %s", resolved.Name, resolved.ID, username)
-		if err := s.profileManager.SetActiveProfileState(&profilemanager.ActiveProfileState{
-			ID:       resolved.ID,
-			Username: username,
-		}); err != nil {
-			log.Errorf("failed to set active profile state: %v", err)
-			return nil, fmt.Errorf("failed to set active profile state: %w", err)
-		}
+	if resolved.ID == activeProf.ID && username == activeProf.Username {
+		return false, nil
 	}
 
-	return resolved, nil
+	if s.checkProfilesDisabled() {
+		log.Errorf("profiles are disabled, you cannot use this feature without profiles enabled")
+		return false, gstatus.Errorf(codes.Unavailable, errProfilesDisabled)
+	}
+
+	log.Infof("switching to profile %s (%s) for user %s", resolved.Name, resolved.ID, username)
+	if err := s.profileManager.SetActiveProfileState(&profilemanager.ActiveProfileState{
+		ID:       resolved.ID,
+		Username: username,
+	}); err != nil {
+		log.Errorf("failed to set active profile state: %v", err)
+		return false, fmt.Errorf("failed to set active profile state: %w", err)
+	}
+
+	return true, nil
+}
+
+func (s *Server) dropPendingAuthFlows() {
+	// A pending login flow and the account-prompt flag describe the previous
+	// profile's login; carried across a switch they would judge the new
+	// profile's token against the old profile's account. CancelFunc is
+	// non-blocking, so calling it under the mutex is safe.
+	if cancel := s.oauthAuthFlow.waitCancel; cancel != nil {
+		cancel()
+	}
+	s.oauthAuthFlow = oauthAuthFlow{}
+	s.forceAccountPrompt = false
+
+	// A pending session extend belongs to the previous profile too: its device
+	// code was issued by that profile's IdP client, and WaitExtendAuthSession
+	// would submit the resulting token against the new profile's engine.
+	s.extendAuthSessionFlow.CancelWait()
+	s.extendAuthSessionFlow.Clear()
+
+	s.jwtCache.clear()
 }
 
 // SwitchProfile switches the active profile in the daemon.
@@ -1402,23 +1431,7 @@ func (s *Server) SwitchProfile(callerCtx context.Context, msg *proto.SwitchProfi
 	s.config = config
 	s.localMetrics.Reconcile(config.LocalMetricsEnabled, config.LocalMetricsAddress)
 
-	s.jwtCache.clear()
-
-	// A pending login flow and the account-prompt flag describe the previous
-	// profile's login; carried across a switch they would judge the new
-	// profile's token against the old profile's account. CancelFunc is
-	// non-blocking, so calling it under the mutex is safe.
-	if cancel := s.oauthAuthFlow.waitCancel; cancel != nil {
-		cancel()
-	}
-	s.oauthAuthFlow = oauthAuthFlow{}
-	s.forceAccountPrompt = false
-
-	// A pending session extend belongs to the previous profile too: its device
-	// code was issued by that profile's IdP client, and WaitExtendAuthSession
-	// would submit the resulting token against the new profile's engine.
-	s.extendAuthSessionFlow.CancelWait()
-	s.extendAuthSessionFlow.Clear()
+	s.dropPendingAuthFlows()
 
 	if msg != nil && msg.ProfileName != nil {
 		s.publishProfileListChanged(*msg.ProfileName)
@@ -2862,7 +2875,7 @@ var afterLoginPreCheck func()
 // of this is reached; this one exists because that check is not synchronized
 // against a concurrent privileged request that enables the SSH server, and a
 // caller refused here must not have cancelled or switched anything either.
-func (s *Server) authorizeAndPrepareLogin(callerCtx context.Context, msg *proto.LoginRequest, activeProf *profilemanager.ActiveProfileState) (context.Context, *profilemanager.ActiveProfileState, error) {
+func (s *Server) authorizeAndPrepareLogin(callerCtx context.Context, msg *proto.LoginRequest, activeProf *profilemanager.ActiveProfileState) (context.Context, *profilemanager.ActiveProfileState, bool, error) {
 	if afterLoginPreCheck != nil {
 		afterLoginPreCheck()
 	}
@@ -2872,10 +2885,10 @@ func (s *Server) authorizeAndPrepareLogin(callerCtx context.Context, msg *proto.
 
 	stored, err := s.storedLoginConfig(activeProf, msg)
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, false, err
 	}
 	if err := requirePrivilegeForConfigChange(callerCtx, stored, privilegedChangeFromLogin(msg)); err != nil {
-		return nil, nil, err
+		return nil, nil, false, err
 	}
 
 	// The update-settings decision is re-taken here for the same reason as the
@@ -2884,7 +2897,7 @@ func (s *Server) authorizeAndPrepareLogin(callerCtx context.Context, msg *proto.
 	// authoritative check, and it is the last read before persistLoginOverrides
 	// writes.
 	if s.checkUpdateSettingsDisabled() && configChangeRequested(stored, loginOverridesInput(msg)) {
-		return nil, nil, gstatus.Errorf(codes.FailedPrecondition, errUpdateSettingsDisabled)
+		return nil, nil, false, gstatus.Errorf(codes.FailedPrecondition, errUpdateSettingsDisabled)
 	}
 
 	s.mutex.Lock()
@@ -2902,19 +2915,26 @@ func (s *Server) authorizeAndPrepareLogin(callerCtx context.Context, msg *proto.
 		log.Warnf(errRestoreResidualState, err)
 	}
 
+	switched := false
 	if msg.ProfileName != nil {
-		if _, err := s.switchProfileIfNeeded(*msg.ProfileName, msg.Username, activeProf); err != nil {
-			return nil, nil, fmt.Errorf("switch profile: %w", err)
+		switched, err = s.switchProfileIfNeeded(*msg.ProfileName, msg.Username, activeProf)
+		if err != nil {
+			return nil, nil, false, fmt.Errorf("switch profile: %w", err)
+		}
+		if switched {
+			s.mutex.Lock()
+			s.dropPendingAuthFlows()
+			s.mutex.Unlock()
 		}
 	}
 
 	activeProf, err = s.profileManager.GetActiveProfileState()
 	if err != nil {
-		return nil, nil, fmt.Errorf("active profile state: %w", err)
+		return nil, nil, false, fmt.Errorf("active profile state: %w", err)
 	}
 
 	if err := persistLoginOverrides(activeProf, msg); err != nil {
-		return nil, nil, fmt.Errorf("persist login overrides: %w", err)
+		return nil, nil, false, fmt.Errorf("persist login overrides: %w", err)
 	}
 
 	// Provisioning under the same lock as the decision above, and next to the
@@ -2923,10 +2943,10 @@ func (s *Server) authorizeAndPrepareLogin(callerCtx context.Context, msg *proto.
 	// had already answered its caller would be overwritten by the config this
 	// login read before it landed.
 	if _, _, err := provisionProfileIdentity(activeProf); err != nil {
-		return nil, nil, err
+		return nil, nil, false, err
 	}
 
-	return ctx, activeProf, nil
+	return ctx, activeProf, switched, nil
 }
 
 // persistLoginOverrides writes the config fields a login request is allowed to

From a5834fdaab96834bde79303b247113d23ebb1380 Mon Sep 17 00:00:00 2001
From: Nicolas Frati <nicofrati@gmail.com>
Date: Fri, 9 Oct 2026 13:37:25 +0200
Subject: [PATCH 32/70] [management,signal] Make the Let's Encrypt challenge
 listener address configurable (#7706)

* [management,signal] Make the Let's Encrypt challenge listener address configurable

With Let's Encrypt enabled and --port set to something other than 443,
signal and management also opened a separate challenge listener that was
hard-coded to :443. Non-root deployments, such as the UBI images, could
not start that listener.

Add --letsencrypt-listen-address to both. It defaults to :443, so current
behavior is unchanged. An empty value disables the separate listener for
setups that forward public port 443 to --port, where the main TLS
listener already answers TLS-ALPN-01 challenges.

Signal now fails on startup when the challenge listener cannot bind, and
exits non-zero when a server stops unexpectedly instead of exiting 0. A
failure reported before the run loop waited was previously dropped.
Management no longer opens a new :443 listener on shutdown just to close it.

* [management,signal] Keep the challenge listener change additive

Remove the Signal fail-fast changes from this PR. They change the
behavior that existing installations see after an upgrade, so they move
to a separate PR.

If the challenge listener cannot bind, Signal now logs the error and
continues. The main TLS listener still answers TLS-ALPN-01 challenges.
Management keeps its previous behavior and stops with an error.

The check for an empty address moves to the caller, so the function
does not return a nil listener with a nil error. Also add assertion
messages, guard a nil listener in a test cleanup, and add the flag to
the Signal README.
---
 management/cmd/management.go                  |  1 +
 management/cmd/root.go                        |  2 +
 management/internals/server/server.go         | 40 +++++++++++---
 .../server/server_letsencrypt_test.go         | 55 +++++++++++++++++++
 signal/README.md                              |  1 +
 signal/cmd/run.go                             | 47 ++++++++++++----
 signal/cmd/run_test.go                        | 52 ++++++++++++++++++
 7 files changed, 181 insertions(+), 17 deletions(-)
 create mode 100644 management/internals/server/server_letsencrypt_test.go
 create mode 100644 signal/cmd/run_test.go

diff --git a/management/cmd/management.go b/management/cmd/management.go
index fc6bd0a46..434ad8402 100644
--- a/management/cmd/management.go
+++ b/management/cmd/management.go
@@ -143,6 +143,7 @@ var (
 				MgmtPort:                    mgmtPort,
 				MgmtMetricsPort:             mgmtMetricsPort,
 				DisableLegacyManagementPort: disableLegacyManagementPort,
+				LetsEncryptListenAddress:    mgmtLetsencryptListen,
 				DisableMetrics:              disableMetrics,
 				DisableGeoliteUpdate:        disableGeoliteUpdate,
 				UserDeleteFromIDPEnabled:    userDeleteFromIDPEnabled,
diff --git a/management/cmd/root.go b/management/cmd/root.go
index ae03a09e8..466ee133f 100644
--- a/management/cmd/root.go
+++ b/management/cmd/root.go
@@ -29,6 +29,7 @@ var (
 	mgmtMetricsPort             int
 	disableLegacyManagementPort bool
 	mgmtLetsencryptDomain       string
+	mgmtLetsencryptListen       string
 	mgmtSingleAccModeDomain     string
 	certFile                    string
 	certKey                     string
@@ -70,6 +71,7 @@ func init() {
 	mgmtCmd.Flags().StringVar(&mgmtDataDir, "datadir", defaultMgmtDataDir, "server data directory location")
 	mgmtCmd.Flags().StringVar(&nbconfig.MgmtConfigPath, "config", defaultMgmtConfig, "Netbird config file location. Config params specified via command line (e.g. datadir) have a precedence over configuration from this file")
 	mgmtCmd.Flags().StringVar(&mgmtLetsencryptDomain, "letsencrypt-domain", "", "a domain to issue Let's Encrypt certificate for. Enables TLS using Let's Encrypt. Will fetch and renew certificate, and run the server with TLS")
+	mgmtCmd.Flags().StringVar(&mgmtLetsencryptListen, "letsencrypt-listen-address", ":443", "address of the separate Let's Encrypt challenge listener, used when --port is not 443. Set it empty when public port 443 is forwarded to --port, which answers the challenges itself")
 	mgmtCmd.Flags().StringVar(&mgmtSingleAccModeDomain, "single-account-mode-domain", defaultSingleAccModeDomain, "Enables single account mode. This means that all the users will be under the same account grouped by the specified domain. If the installation has more than one account, the property is ineffective. Enabled by default with the default domain "+defaultSingleAccModeDomain)
 	mgmtCmd.Flags().BoolVar(&disableSingleAccMode, "disable-single-account-mode", false, "If set to true, disables single account mode. The --single-account-mode-domain property will be ignored and every new user will have a separate NetBird account.")
 	mgmtCmd.Flags().StringVar(&certFile, "cert-file", "", "Location of your SSL certificate. Can be used when you have an existing certificate and don't want a new certificate be generated automatically. If letsencrypt-domain is specified this property has no effect")
diff --git a/management/internals/server/server.go b/management/internals/server/server.go
index 6d51745a7..bbf0f389d 100644
--- a/management/internals/server/server.go
+++ b/management/internals/server/server.go
@@ -68,6 +68,7 @@ type BaseServer struct {
 	mgmtMetricsPort             int
 	mgmtPort                    int
 	disableLegacyManagementPort bool
+	letsEncryptListenAddress    string
 	autoResolveDomains          bool
 
 	proxyAuthClose    func()
@@ -82,6 +83,8 @@ type BaseServer struct {
 	tlsConfig   *tls.Config
 	certManager *autocert.Manager
 	update      *version.Update
+	// certListener serves Let's Encrypt challenges when mgmtPort is not 443.
+	certListener net.Listener
 
 	errCh  chan error
 	wg     sync.WaitGroup
@@ -103,6 +106,9 @@ type Config struct {
 	UserDeleteFromIDPEnabled    bool
 	AutoResolveDomains          bool
 	TLSConfig                   *tls.Config
+	// LetsEncryptListenAddress is the separate Let's Encrypt challenge listener
+	// used when MgmtPort is not 443. Empty disables it.
+	LetsEncryptListenAddress string
 }
 
 // NewServer initializes and configures a new Server instance
@@ -117,6 +123,7 @@ func NewServer(cfg *Config) *BaseServer {
 		userDeleteFromIDPEnabled:    cfg.UserDeleteFromIDPEnabled,
 		mgmtPort:                    cfg.MgmtPort,
 		disableLegacyManagementPort: cfg.DisableLegacyManagementPort,
+		letsEncryptListenAddress:    cfg.LetsEncryptListenAddress,
 		mgmtMetricsPort:             cfg.MgmtMetricsPort,
 		autoResolveDomains:          cfg.AutoResolveDomains,
 		tlsConfig:                   cfg.TLSConfig,
@@ -210,19 +217,18 @@ func (s *BaseServer) start(ctx context.Context) error {
 	rootHandler := s.handlerFunc(srvCtx, s.GRPCServer(), s.APIHandler(), s.IDPHandler(), s.Metrics().GetMeter())
 	switch {
 	case s.certManager != nil:
-		// a call to certManager.Listener() always creates a new listener so we do it once
-		cml := s.certManager.Listener()
 		if s.mgmtPort == 443 {
 			// CertManager, HTTP and gRPC API all on the same port
 			rootHandler = s.certManager.HTTPHandler(rootHandler)
-			s.listener = cml
+			s.listener = s.certManager.Listener()
 		} else {
 			s.listener, err = tls.Listen("tcp", fmt.Sprintf(":%d", s.mgmtPort), s.certManager.TLSConfig())
 			if err != nil {
 				return fmt.Errorf("failed creating TLS listener on port %d: %v", s.mgmtPort, err)
 			}
-			log.WithContext(ctx).Infof("running HTTP server (LetsEncrypt challenge handler): %s", cml.Addr().String())
-			s.serveHTTP(ctx, cml, s.certManager.HTTPHandler(nil))
+			if err := s.serveLetsEncryptChallenges(ctx); err != nil {
+				return err
+			}
 		}
 	case s.tlsConfig != nil:
 		s.listener, err = tls.Listen("tcp", fmt.Sprintf(":%d", s.mgmtPort), s.tlsConfig)
@@ -309,8 +315,8 @@ func (s *BaseServer) Stop() error {
 	if s.listener != nil {
 		_ = s.listener.Close()
 	}
-	if s.certManager != nil {
-		_ = s.certManager.Listener().Close()
+	if s.certListener != nil {
+		_ = s.certListener.Close()
 	}
 	s.GRPCServer().Stop()
 	if s.proxyAuthClose != nil {
@@ -416,6 +422,26 @@ func (s *BaseServer) serveGRPC(ctx context.Context, grpcServer *grpc.Server, por
 	return listener, nil
 }
 
+// serveLetsEncryptChallenges starts the separate Let's Encrypt challenge listener
+// unless it is disabled. The main TLS listener uses the cert manager's TLS
+// config, so it still answers TLS-ALPN-01 challenges when public port 443 is
+// forwarded to it.
+func (s *BaseServer) serveLetsEncryptChallenges(ctx context.Context) error {
+	if s.letsEncryptListenAddress == "" {
+		log.WithContext(ctx).Infof("LetsEncrypt challenge server disabled, challenges are answered on port %d", s.mgmtPort)
+		return nil
+	}
+
+	cml, err := tls.Listen("tcp", s.letsEncryptListenAddress, s.certManager.TLSConfig())
+	if err != nil {
+		return fmt.Errorf("create LetsEncrypt challenge listener on %s: %w", s.letsEncryptListenAddress, err)
+	}
+	s.certListener = cml
+	log.WithContext(ctx).Infof("running HTTP server (LetsEncrypt challenge handler): %s", cml.Addr().String())
+	s.serveHTTP(ctx, cml, s.certManager.HTTPHandler(nil))
+	return nil
+}
+
 func (s *BaseServer) serveHTTP(ctx context.Context, httpListener net.Listener, handler http.Handler) {
 	s.wg.Add(1)
 	go func() {
diff --git a/management/internals/server/server_letsencrypt_test.go b/management/internals/server/server_letsencrypt_test.go
new file mode 100644
index 000000000..0827d5e5d
--- /dev/null
+++ b/management/internals/server/server_letsencrypt_test.go
@@ -0,0 +1,55 @@
+package server
+
+import (
+	"context"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/acme/autocert"
+
+	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
+)
+
+func newLetsEncryptTestServer(address string) *BaseServer {
+	srv := NewServer(&Config{NbConfig: &nbconfig.Config{}, MgmtPort: 8443, LetsEncryptListenAddress: address})
+	srv.certManager = &autocert.Manager{}
+	return srv
+}
+
+func TestServeLetsEncryptChallenges_Disabled(t *testing.T) {
+	srv := newLetsEncryptTestServer("")
+
+	require.NoError(t, srv.serveLetsEncryptChallenges(context.Background()))
+	require.Nil(t, srv.certListener, "no challenge listener should be created when the address is empty")
+}
+
+func TestServeLetsEncryptChallenges_CustomAddress(t *testing.T) {
+	srv := newLetsEncryptTestServer("127.0.0.1:0")
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(func() {
+		cancel()
+		if srv.certListener != nil {
+			_ = srv.certListener.Close()
+		}
+		srv.wg.Wait()
+	})
+
+	require.NoError(t, srv.serveLetsEncryptChallenges(ctx))
+	require.NotNil(t, srv.certListener, "challenge listener should be created on the configured address")
+
+	conn, err := net.DialTimeout("tcp", srv.certListener.Addr().String(), time.Second)
+	require.NoError(t, err)
+	require.NoError(t, conn.Close())
+}
+
+func TestServeLetsEncryptChallenges_BindFailure(t *testing.T) {
+	occupied, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = occupied.Close() })
+	srv := newLetsEncryptTestServer(occupied.Addr().String())
+
+	require.Error(t, srv.serveLetsEncryptChallenges(context.Background()))
+	require.Nil(t, srv.certListener, "no challenge listener should be stored when the bind fails")
+}
diff --git a/signal/README.md b/signal/README.md
index 0033eaf90..dd57252ad 100644
--- a/signal/README.md
+++ b/signal/README.md
@@ -16,6 +16,7 @@ Usage:
 Flags:
   -h, --help                        help for run
       --letsencrypt-domain string   a domain to issue Let's Encrypt certificate for. Enables TLS using Let's Encrypt. Will fetch and renew certificate, and run the server with TLS
+      --letsencrypt-listen-address string   address of the separate Let's Encrypt challenge listener, used when --port is not 443. Set it empty when public port 443 is forwarded to --port, which answers the challenges itself (default ":443")
       --port int                    Server port to listen on (e.g. 10000) (default 10000)
       --ssl-dir string              server ssl directory location. *Required only for Let's Encrypt certificates. (default "/var/lib/netbird/")
       --cert-file string            Location of your SSL certificate. Can be used when you have an existing certificate and don't want a new certificate be generated automatically. If letsencrypt-domain is specified this property has no effect
diff --git a/signal/cmd/run.go b/signal/cmd/run.go
index 42b7d2505..ffb596909 100644
--- a/signal/cmd/run.go
+++ b/signal/cmd/run.go
@@ -36,7 +36,12 @@ import (
 	"google.golang.org/grpc/keepalive"
 )
 
-const legacyGRPCPort = 10000
+const (
+	legacyGRPCPort = 10000
+	// defaultLetsencryptListenAddress is where Let's Encrypt connects for
+	// TLS-ALPN-01 challenges unless public port 443 is forwarded elsewhere.
+	defaultLetsencryptListenAddress = ":443"
+)
 
 var (
 	signalPort               int
@@ -44,6 +49,7 @@ var (
 	signalLetsencryptDomain  string
 	signalLetsencryptEmail   string
 	signalLetsencryptDataDir string
+	signalLetsencryptListen  string
 	signalCertFile           string
 	signalCertKey            string
 
@@ -124,8 +130,18 @@ var (
 
 			grpcRootHandler := grpcHandlerFunc(grpcServer, metricsServer.Meter)
 
-			if certManager != nil {
-				startServerWithCertManager(certManager, grpcRootHandler)
+			var certListener net.Listener
+			switch {
+			case certManager == nil:
+			case signalPort != 443 && signalLetsencryptListen == "":
+				// The main TLS listener uses the cert manager's TLS config, so it still
+				// answers TLS-ALPN-01 challenges when public port 443 is forwarded to it.
+				log.Infof("LetsEncrypt challenge server disabled, challenges are answered on port %d", signalPort)
+			default:
+				certListener, err = startServerWithCertManager(certManager, grpcRootHandler)
+				if err != nil {
+					log.Errorf("LetsEncrypt challenge server not started: %v", err)
+				}
 			}
 
 			var compatListener net.Listener
@@ -169,6 +185,10 @@ var (
 			SetupCloseHandler()
 
 			<-stopCh
+			if certListener != nil {
+				_ = certListener.Close()
+				log.Infof("stopped LetsEncrypt challenge server")
+			}
 			if grpcListener != nil {
 				_ = grpcListener.Close()
 				log.Infof("stopped gRPC server")
@@ -245,18 +265,24 @@ func getTLSConfigurations() ([]grpc.ServerOption, *autocert.Manager, *tls.Config
 	return []grpc.ServerOption{grpc.Creds(transportCredentials)}, certManager, tlsConfig, err
 }
 
-func startServerWithCertManager(certManager *autocert.Manager, grpcRootHandler http.Handler) {
-	// a call to certManager.Listener() always creates a new listener so we do it once
-	httpListener := certManager.Listener()
+func startServerWithCertManager(certManager *autocert.Manager, grpcRootHandler http.Handler) (net.Listener, error) {
 	if signalPort == 443 {
+		// a call to certManager.Listener() always creates a new listener so we do it once
+		httpListener := certManager.Listener()
 		// running gRPC and HTTP cert manager on the same port
 		serveHTTP(httpListener, certManager.HTTPHandler(grpcRootHandler))
 		log.Infof("running HTTP server (LetsEncrypt challenge handler) and gRPC server on the same port: %s", httpListener.Addr().String())
-	} else {
-		// Start the HTTP cert manager server separately
-		serveHTTP(httpListener, certManager.HTTPHandler(nil))
-		log.Infof("running HTTP server (LetsEncrypt challenge handler): %s", httpListener.Addr().String())
+		return httpListener, nil
 	}
+
+	httpListener, err := tls.Listen("tcp", signalLetsencryptListen, certManager.TLSConfig())
+	if err != nil {
+		return nil, fmt.Errorf("create LetsEncrypt challenge listener on %s: %w", signalLetsencryptListen, err)
+	}
+	// Start the HTTP cert manager server separately
+	serveHTTP(httpListener, certManager.HTTPHandler(nil))
+	log.Infof("running HTTP server (LetsEncrypt challenge handler): %s", httpListener.Addr().String())
+	return httpListener, nil
 }
 
 func grpcHandlerFunc(grpcServer *grpc.Server, meter metric.Meter) http.Handler {
@@ -334,6 +360,7 @@ func init() {
 	runCmd.PersistentFlags().StringVar(&signalLetsencryptDataDir, "letsencrypt-data-dir", "", "a directory to store Let's Encrypt data. Required if Let's Encrypt is enabled.")
 	runCmd.PersistentFlags().StringVar(&signalLetsencryptDataDir, "ssl-dir", "", "server ssl directory location. *Required only for Let's Encrypt certificates. Deprecated: use --letsencrypt-data-dir")
 	runCmd.PersistentFlags().StringVar(&signalLetsencryptDomain, "letsencrypt-domain", "", "a domain to issue Let's Encrypt certificate for. Enables TLS using Let's Encrypt. Will fetch and renew certificate, and run the server with TLS")
+	runCmd.PersistentFlags().StringVar(&signalLetsencryptListen, "letsencrypt-listen-address", defaultLetsencryptListenAddress, "address of the separate Let's Encrypt challenge listener, used when --port is not 443. Set it empty when public port 443 is forwarded to --port, which answers the challenges itself")
 	runCmd.PersistentFlags().StringVar(&signalLetsencryptEmail, "letsencrypt-email", "", "email address to use for Let's Encrypt certificate registration")
 	runCmd.PersistentFlags().StringVar(&signalCertFile, "cert-file", "", "Location of your SSL certificate. Can be used when you have an existing certificate and don't want a new certificate be generated automatically. If letsencrypt-domain is specified this property has no effect")
 	runCmd.PersistentFlags().StringVar(&signalCertKey, "cert-key", "", "Location of your SSL certificate private key. Can be used when you have an existing certificate and don't want a new certificate be generated automatically. If letsencrypt-domain is specified this property has no effect")
diff --git a/signal/cmd/run_test.go b/signal/cmd/run_test.go
new file mode 100644
index 000000000..e0a07e923
--- /dev/null
+++ b/signal/cmd/run_test.go
@@ -0,0 +1,52 @@
+package cmd
+
+import (
+	"net"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/acme"
+	"golang.org/x/crypto/acme/autocert"
+)
+
+func setLetsencryptListen(t *testing.T, port int, address string) {
+	t.Helper()
+	oldPort, oldAddress := signalPort, signalLetsencryptListen
+	signalPort, signalLetsencryptListen = port, address
+	t.Cleanup(func() {
+		signalPort, signalLetsencryptListen = oldPort, oldAddress
+	})
+}
+
+func TestStartServerWithCertManager_CustomAddress(t *testing.T) {
+	setLetsencryptListen(t, 10000, "127.0.0.1:0")
+
+	listener, err := startServerWithCertManager(&autocert.Manager{}, http.NotFoundHandler())
+	require.NoError(t, err)
+	require.NotNil(t, listener, "challenge listener should be created on the configured address")
+	t.Cleanup(func() { _ = listener.Close() })
+
+	conn, err := net.DialTimeout("tcp", listener.Addr().String(), time.Second)
+	require.NoError(t, err)
+	require.NoError(t, conn.Close())
+}
+
+func TestStartServerWithCertManager_BindFailure(t *testing.T) {
+	occupied, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = occupied.Close() })
+	setLetsencryptListen(t, 10000, occupied.Addr().String())
+
+	listener, err := startServerWithCertManager(&autocert.Manager{}, http.NotFoundHandler())
+	require.Error(t, err)
+	require.Nil(t, listener, "no listener should be returned when the bind fails")
+}
+
+func TestCertManagerTLSConfigAnswersTLSALPN01(t *testing.T) {
+	// Disabling the separate listener relies on the main listener answering
+	// TLS-ALPN-01 challenges through the cert manager's TLS config.
+	cfg := (&autocert.Manager{}).TLSConfig()
+	require.Contains(t, cfg.NextProtos, acme.ALPNProto, "cert manager TLS config should offer the ACME TLS-ALPN protocol")
+}

From 53a14551c8db592a7693a13dc9d2a945ea82179c Mon Sep 17 00:00:00 2001
From: Pascal Fischer <32096965+pascal-fischer@users.noreply.github.com>
Date: Fri, 9 Oct 2026 14:57:00 +0200
Subject: [PATCH 33/70] [client, management] implement certificate posture
 check (#7535)

Co-authored-by: mlsmaycon <mlsmaycon@gmail.com>
---
 .github/workflows/release.yml                 |    4 +-
 .goreleaser.yaml                              |   26 +-
 client/cmd/posture.go                         |   30 +
 client/cmd/root.go                            |    3 +
 client/internal/certproof/README.md           |  277 ++
 client/internal/certproof/collect.go          |  114 +
 client/internal/certproof/collect_darwin.go   |   96 +
 client/internal/certproof/collect_other.go    |   24 +
 client/internal/certproof/collect_test.go     |  108 +
 client/internal/certproof/collect_windows.go  |  101 +
 .../internal/certproof/consoleuser_darwin.go  |  113 +
 .../certproof/consoleuser_darwin_test.go      |   39 +
 .../internal/certproof/desktopuser_windows.go |  126 +
 client/internal/certproof/helper.go           |   66 +
 client/internal/certproof/helper_spawn.go     |   63 +
 .../internal/certproof/helper_spawn_test.go   |   56 +
 client/internal/certproof/helper_test.go      |   63 +
 client/internal/certproof/keychain_darwin.go  |  363 +++
 client/internal/certproof/keystore.go         |   77 +
 client/internal/certproof/keystore_test.go    |   87 +
 client/internal/certproof/pkcs11store.go      |  294 ++
 client/internal/certproof/pkcs11store_test.go |  331 ++
 client/internal/certproof/store.go            |  215 ++
 client/internal/certproof/store_other.go      |   25 +
 client/internal/certproof/store_other_test.go |   36 +
 client/internal/certproof/store_tpm_test.go   |   98 +
 .../internal/certproof/systemstore_windows.go |  251 ++
 client/internal/connect.go                    |    6 +
 client/internal/engine.go                     |   18 +
 client/internal/engine_test.go                |   26 +
 client/internal/pkcs11/driver_linux.go        |  328 ++
 client/internal/pkcs11/driver_linux_test.go   |   72 +
 client/internal/pkcs11/driver_stub.go         |    7 +
 client/internal/pkcs11/pkcs11.go              |  259 ++
 client/internal/pkcs11/publickey.go           |   95 +
 client/internal/pkcs11/publickey_test.go      |   87 +
 client/internal/pkcs11/uri.go                 |   98 +
 client/internal/pkcs11/uri_test.go            |   87 +
 client/internal/profilemanager/config.go      |   14 +
 client/internal/tpm/open_linux.go             |   29 +
 client/internal/tpm/open_other.go             |    9 +
 client/internal/tpm/signer.go                 |   61 +
 client/internal/tpm/signer_test.go            |   64 +
 client/internal/tpm/tpm.go                    |   19 +
 client/internal/tpm/tpmtest/tpmtest.go        |   48 +
 client/system/info.go                         |    2 +
 go.mod                                        |   95 +-
 go.sum                                        |  196 +-
 .../network_map_data_golden.json              |    6 +-
 management/cmd/management.go                  |    3 +
 .../network_map/nmaptest/legacyaccount.go     |    3 +
 .../internals/network_map_db/pgsql/peer.go    |    2 +-
 .../internals/network_map_db/shared_types.go  |    7 +
 .../internals/network_map_db/sqlite/peer.go   |    2 +-
 .../internals/shared/grpc/certposture.go      |   72 +
 .../internals/shared/grpc/certposture_test.go |   75 +
 .../shared/grpc/peer_update_handler.go        |    1 +
 management/internals/shared/grpc/server.go    |   14 +-
 management/server/peer/peer.go                |    7 +-
 management/server/posture/certificate.go      |   36 +
 management/server/posture/certificate_test.go |   68 +
 management/server/posture/checks.go           |   19 +
 management/server/store/sql_store_peer.go     |    9 +-
 .../server/types/account_networkmapdata.go    |    4 +
 .../certposture/certposture_test.go           |  182 ++
 .../certposture/certtest/certtest.go          |  109 +
 shared/management/certposture/chain.go        |  106 +
 shared/management/certposture/challenge.go    |   68 +
 shared/management/certposture/proof.go        |  154 +
 shared/management/client/grpc.go              |   16 +-
 shared/management/http/api/openapi.yml        |   14 +
 shared/management/http/api/types.gen.go       |    9 +
 shared/management/networkmap/nmdata/peer.go   |    1 +
 .../management/networkmap/nmdata/posture.go   |    4 +
 .../networkmap/nmdata/posture_certificate.go  |   16 +
 .../nmdata/posture_certificate_test.go        |   28 +
 shared/management/proto/management.pb.go      | 2650 +++++++++--------
 shared/management/proto/management.proto      |   19 +
 78 files changed, 7028 insertions(+), 1382 deletions(-)
 create mode 100644 client/cmd/posture.go
 create mode 100644 client/internal/certproof/README.md
 create mode 100644 client/internal/certproof/collect.go
 create mode 100644 client/internal/certproof/collect_darwin.go
 create mode 100644 client/internal/certproof/collect_other.go
 create mode 100644 client/internal/certproof/collect_test.go
 create mode 100644 client/internal/certproof/collect_windows.go
 create mode 100644 client/internal/certproof/consoleuser_darwin.go
 create mode 100644 client/internal/certproof/consoleuser_darwin_test.go
 create mode 100644 client/internal/certproof/desktopuser_windows.go
 create mode 100644 client/internal/certproof/helper.go
 create mode 100644 client/internal/certproof/helper_spawn.go
 create mode 100644 client/internal/certproof/helper_spawn_test.go
 create mode 100644 client/internal/certproof/helper_test.go
 create mode 100644 client/internal/certproof/keychain_darwin.go
 create mode 100644 client/internal/certproof/keystore.go
 create mode 100644 client/internal/certproof/keystore_test.go
 create mode 100644 client/internal/certproof/pkcs11store.go
 create mode 100644 client/internal/certproof/pkcs11store_test.go
 create mode 100644 client/internal/certproof/store.go
 create mode 100644 client/internal/certproof/store_other.go
 create mode 100644 client/internal/certproof/store_other_test.go
 create mode 100644 client/internal/certproof/store_tpm_test.go
 create mode 100644 client/internal/certproof/systemstore_windows.go
 create mode 100644 client/internal/pkcs11/driver_linux.go
 create mode 100644 client/internal/pkcs11/driver_linux_test.go
 create mode 100644 client/internal/pkcs11/driver_stub.go
 create mode 100644 client/internal/pkcs11/pkcs11.go
 create mode 100644 client/internal/pkcs11/publickey.go
 create mode 100644 client/internal/pkcs11/publickey_test.go
 create mode 100644 client/internal/pkcs11/uri.go
 create mode 100644 client/internal/pkcs11/uri_test.go
 create mode 100644 client/internal/tpm/open_linux.go
 create mode 100644 client/internal/tpm/open_other.go
 create mode 100644 client/internal/tpm/signer.go
 create mode 100644 client/internal/tpm/signer_test.go
 create mode 100644 client/internal/tpm/tpm.go
 create mode 100644 client/internal/tpm/tpmtest/tpmtest.go
 create mode 100644 management/internals/shared/grpc/certposture.go
 create mode 100644 management/internals/shared/grpc/certposture_test.go
 create mode 100644 management/server/posture/certificate.go
 create mode 100644 management/server/posture/certificate_test.go
 create mode 100644 shared/management/certposture/certposture_test.go
 create mode 100644 shared/management/certposture/certtest/certtest.go
 create mode 100644 shared/management/certposture/chain.go
 create mode 100644 shared/management/certposture/challenge.go
 create mode 100644 shared/management/certposture/proof.go
 create mode 100644 shared/management/networkmap/nmdata/posture_certificate.go
 create mode 100644 shared/management/networkmap/nmdata/posture_certificate_test.go

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a79357505..d133d87f1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -363,7 +363,9 @@ jobs:
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
         with:
           name: linux-packages
-          path: dist/netbird_linux**
+          path: |
+            dist/netbird_linux**
+            dist/netbird-pkcs11_linux**
           retention-days: 7
       - name: upload windows packages
         id: upload_windows_packages
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 0e9b11bc5..a16bd8cf5 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -40,7 +40,28 @@ builds:
     tags:
       - load_wgnt_from_rsrc
 
-  # Single-arch builds: nfpm provides is not templated, so the RPM splits per arch.
+  # deb and rpm packages target glibc distributions, so they carry the PKCS#11 store, which
+  # links libc. Tarballs and the Alpine-based images keep the static build above.
+  - id: netbird-pkcs11
+    dir: client
+    binary: netbird
+    env: [CGO_ENABLED=0]
+    goos:
+      - linux
+    goarch:
+      - arm
+      - amd64
+      - arm64
+      - 386
+    ldflags:
+      - -s -w -X github.com/netbirdio/netbird/version.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}} -X main.builtBy=goreleaser
+    mod_timestamp: "{{ .CommitTimestamp }}"
+    tags:
+      - load_wgnt_from_rsrc
+      - pkcs11
+
+  # Single-arch builds: nfpm provides is not templated, so the RPM splits per arch. They
+  # carry the PKCS#11 store like the deb build above.
   - &netbird_rpm_build
     id: netbird-rpm-amd64
     dir: client
@@ -53,6 +74,7 @@ builds:
     mod_timestamp: "{{ .CommitTimestamp }}"
     tags:
       - load_wgnt_from_rsrc
+      - pkcs11
 
   - <<: *netbird_rpm_build
     id: netbird-rpm-arm64
@@ -268,7 +290,7 @@ nfpms:
     id: netbird_deb
     bindir: /usr/bin
     builds:
-      - netbird
+      - netbird-pkcs11
     formats:
       - deb
     scripts:
diff --git a/client/cmd/posture.go b/client/cmd/posture.go
new file mode 100644
index 000000000..b0870233d
--- /dev/null
+++ b/client/cmd/posture.go
@@ -0,0 +1,30 @@
+package cmd
+
+import (
+	"github.com/spf13/cobra"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/certproof"
+)
+
+var postureCmd = &cobra.Command{
+	Use:    "posture",
+	Short:  "Posture helpers invoked by the NetBird daemon",
+	Hidden: true,
+}
+
+var postureCertProofCmd = &cobra.Command{
+	Use:   "cert-proof",
+	Short: "Answer certificate posture challenges from the calling user's keychain",
+	Long: "Reads a certificate challenge set as JSON on stdin and writes the proofs as JSON on stdout.\n" +
+		"The daemon launches this in the console user's desktop session, because a login keychain\n" +
+		"cannot be reached from a root daemon. Not intended to be run by hand.",
+	Hidden:       true,
+	SilenceUsage: true,
+	RunE: func(cmd *cobra.Command, args []string) error {
+		// Proofs travel on stdout, so every log line has to go elsewhere.
+		log.SetOutput(cmd.ErrOrStderr())
+		return certproof.RunHelper(cmd.Context(), cmd.InOrStdin(), cmd.OutOrStdout())
+	},
+}
diff --git a/client/cmd/root.go b/client/cmd/root.go
index 4525a9bd6..51179f77c 100644
--- a/client/cmd/root.go
+++ b/client/cmd/root.go
@@ -180,6 +180,9 @@ func init() {
 	rootCmd.AddCommand(debugCmd)
 	rootCmd.AddCommand(profileCmd)
 	rootCmd.AddCommand(exposeCmd)
+	rootCmd.AddCommand(postureCmd)
+
+	postureCmd.AddCommand(postureCertProofCmd)
 
 	networksCMD.AddCommand(routesListCmd)
 	networksCMD.AddCommand(routesSelectCmd, routesDeselectCmd)
diff --git a/client/internal/certproof/README.md b/client/internal/certproof/README.md
new file mode 100644
index 000000000..9f7831bc0
--- /dev/null
+++ b/client/internal/certproof/README.md
@@ -0,0 +1,277 @@
+# Certificate posture proofs
+
+A peer answers a management certificate challenge by signing the challenge nonce with a
+private key it holds, and sending back the certificate chain. Management verifies the
+chain against the CAs configured on the check and verifies the signature, which proves
+the peer holds the key rather than merely a copy of the certificate.
+
+The signature covers `netbird-posture-cert-v1 || nonce || peerKey`, so a proof is bound
+to one WireGuard peer key and cannot be replayed by another peer.
+
+## Where certificates come from
+
+| Platform | Store | Read by |
+| --- | --- | --- |
+| macOS | System keychain | the daemon, directly |
+| macOS | console user's login keychain | a helper in that user's desktop session |
+| Windows | `LocalMachine\MY` | the service, directly |
+| Windows | signed-in user's `CurrentUser\MY` | a helper launched with that session's token |
+| Linux and others | PEM directory: `CertStoreDir` in the profile config, else `NB_CERT_STORE_DIR`, else `/etc/netbird/certs` | the daemon, directly |
+| Linux | a `TSS2 PRIVATE KEY` file in that directory, signed by the TPM | the daemon, through `/dev/tpmrm0` |
+| Linux | a PKCS#11 token, tpm2-pkcs11 for one, enabled by `CertPKCS11PIN` in the profile config | the daemon, through the token's module, in builds with the `pkcs11` tag |
+
+macOS and Windows both keep per-user certificates out of reach of a privileged daemon,
+and both are handled the same way: the daemon reads the machine store itself and
+launches `netbird posture cert-proof` as the signed-in user for the rest. Only the
+signature and the chain come back. The helper, the request and response types and the
+subcommand are shared; only the way the child is launched differs.
+
+## macOS: why the daemon cannot read a login keychain
+
+The daemon runs as root from a LaunchDaemon. Its keychain search list is the System
+keychain, which is where MDM installs device identities, and nothing else. A user's
+login keychain is out of reach for reasons that are not about privilege:
+
+- `login.keychain-db` is unlocked by `securityd` **in the user's session**. The daemon
+  lives in a different Mach bootstrap namespace, so from where it stands the keychain is
+  locked no matter which uid it runs as.
+- Every private key carries an ACL naming the applications allowed to use it. A process
+  that is not listed causes a consent prompt *in the user's session*. A daemon has no
+  session to show one in, so it receives `errSecInteractionNotAllowed (-25308)` instead.
+
+Dropping to the user's uid with `SysProcAttr.Credential` does **not** fix this: uid is
+not what selects the securityd instance, the bootstrap namespace is. The process has to
+enter the user's session, which is what `launchctl asuser` does.
+
+## macOS: the console user helper
+
+When a certificate challenge arrives and the daemon is root, it:
+
+1. Reads the System keychain itself, so MDM device identities are answered with no user
+   session involved.
+2. Resolves the console user with `SCDynamicStoreCopyConsoleUser`.
+3. Launches itself as that user with
+   `launchctl asuser <uid> sudo -u <user> -H netbird posture cert-proof`, writing the
+   challenges to the child's stdin as JSON and reading proofs from its stdout.
+4. Merges both sets of proofs, dropping a leaf that both keychains hold.
+
+The child runs `RunHelper`, which uses the ordinary `KeychainStore` — inside the user's
+session it simply works. **The private key never crosses the boundary; only the
+signature and the certificate chain come back.**
+
+`-H` matters: it sets `HOME`, which is how the login keychain path is resolved.
+
+`netbird posture cert-proof` is hidden and not meant to be run by hand. It writes proofs
+to stdout and every log line to stderr, so stdout stays parseable.
+
+## Windows: the service and the signed-in user
+
+`LocalMachine\MY` is what the service reads, and it is where AD and Intune enrol device
+certificates. `CurrentUser\MY` lives in the signed-in user's registry hive with private
+keys protected by DPAPI against their profile, so it is only readable while running as
+that user.
+
+The failure mode differs from macOS in an important way: a service that opens
+`CURRENT_USER` does **not** get an error. "Current user" resolves to the service
+account's own hive, `HKU\S-1-5-18`, so it silently reads an empty and irrelevant store.
+There is nothing to log. That is why the service only ever opens `LocalMachine` and asks
+a helper for the rest.
+
+Windows does let a privileged service assume a user identity, which macOS does not for
+keychains, so no external tooling is involved:
+
+```go
+windows.WTSQueryUserToken(session, &token)
+cmd.SysProcAttr = &syscall.SysProcAttr{Token: syscall.Token(token), CreationFlags: windows.CREATE_NO_WINDOW}
+```
+
+`CREATE_NO_WINDOW` matters: without it a console window flashes on the user's desktop on
+every sync.
+
+Session selection prefers the physical console, then falls back to any active session,
+so remote desktop and VDI hosts work. `WTSQueryUserToken` needs `SE_TCB_NAME`, which
+LocalSystem holds and an ordinary process does not, so a user-run `netbird up` skips the
+helper and reads the machine store alone.
+
+In-process impersonation would also work, but it is per-OS-thread while goroutines
+migrate freely, so it would need `runtime.LockOSThread` around every key operation. The
+child process avoids that class of bug entirely.
+
+Unlike macOS, the Windows store acquires keys with `CRYPT_ACQUIRE_SILENT_FLAG`, so a key
+that would need a prompt fails immediately instead of blocking. That also means a
+smartcard PIN can never be satisfied this way.
+
+## Linux: keys held by the TPM
+
+Enrollment tooling on Linux keeps a TPM-resident key as a `TSS2 PRIVATE KEY` PEM file,
+the format of draft-bottomley-tpm2-keys that tpm2-openssl, tpm2-tss-engine and
+`tpm2_encodeobject` write. The file holds the key wrapped by its parent; the TPM is the
+only thing that can use it. Drop it next to the certificate as usual:
+
+```
+openssl genpkey -provider tpm2 -algorithm EC -pkeyopt group:P-256 -out /etc/netbird/certs/device.key
+openssl req -provider tpm2 -provider default -new -key /etc/netbird/certs/device.key -subj /CN=device -out device.csr
+```
+
+Sign the CSR with the organisation CA and store the result as `device.pem`. The store
+parses the key file without touching the TPM, so the certificate is listed as a
+candidate like any other, and every signature opens `/dev/tpmrm0`, loads the key under
+its parent, signs, flushes and closes again. `NB_TPM_DEVICE` overrides the device path.
+
+What the key file may look like:
+
+- **Parent.** A persistent handle such as `0x81000001` is used as is. The owner
+  hierarchy, which both tpm2-openssl and tpm2-tss-engine default to, means the key was
+  created under a transient primary from the TCG default ECC P-256 template, and that
+  same primary is derived again before loading.
+- **No authorization value.** A key created with a password needs someone to type it,
+  which the daemon cannot arrange, so the certificate is skipped with a log line rather
+  than blocking on a TPM auth failure.
+- **RSA-2048 or P-256, sometimes P-384.** Those are what the PC Client profile requires
+  of a TPM; P-384 depends on the chip. The TPM chooses the RSA-PSS salt itself, which is
+  why management verifies PSS proofs with `rsa.PSSSaltLengthAuto`.
+
+Windows needs none of this: a certificate enrolled into the TPM sits behind the Microsoft
+Platform Crypto Provider and the CNG path above signs with it unchanged. macOS has no
+TPM; its Secure Enclave keys are reachable only through the keychain path.
+
+To exercise the path without hardware, run a software TPM and point the end-to-end test
+at it:
+
+```
+swtpm socket --tpm2 --server type=unixio,path=/tmp/swtpm.sock --ctrl type=unixio,path=/tmp/swtpm.ctrl --flags not-need-init,startup-clear
+NB_TPM_DEVICE=/tmp/swtpm.sock go test ./client/internal/certproof/ -run TestCollect_TPMKeyEndToEnd -v
+```
+
+## Linux: keys behind a PKCS#11 token
+
+Distributions that follow Red Hat's guidance reach the TPM through tpm2-pkcs11, a PKCS#11
+module whose token holds both the key and, after `tpm2_ptool addcert`, the certificate.
+The store reads that token when the profile config, `/etc/netbird/config.json` by default,
+carries the token's user PIN:
+
+```json
+"CertPKCS11PIN": "1234"
+```
+
+That alone opens the first token the p11-kit proxy exposes, which is tpm2-pkcs11 on a
+stock setup that has registered it. `CertPKCS11URI`, an RFC 7512 URI, narrows that down
+on a host with several tokens or without p11-kit:
+
+```json
+"CertPKCS11URI": "pkcs11:token=netbird?module-path=/usr/lib/x86_64-linux-gnu/libtpm2_pkcs11.so"
+```
+
+`token` selects the token by label, or the first token present when absent. `module-path`
+names the library to load; `module-name=tpm2_pkcs11` resolves to `libtpm2_pkcs11.so` on
+the loader's search path, and with neither the p11-kit proxy is loaded, which exposes every
+module the system has registered. The URI may carry the PIN itself, as `pin-value` inline
+or `pin-source` naming a file, and `CertPKCS11PIN` takes precedence over both. Without any
+PIN no login happens, and tpm2-pkcs11 then shows no private keys at all. Every other
+attribute is ignored.
+
+The certificate may live on the token or in the PEM directory: `CertStoreDir` in the
+profile config, else `NB_CERT_STORE_DIR`, else `/etc/netbird/certs`. On the token,
+certificates and private keys are paired by `CKA_ID`,
+which is what `tpm2_ptool addcert` and `pkcs11-tool` set. In the directory, a certificate
+file without a key of its own is paired with the token key whose public key it carries, so
+`device.pem` alone next to a key that only the TPM holds is enough; the token's public key
+object, which `tpm2_ptool addkey` and `import` create alongside the private one, is what
+the store compares against. Chains are completed from the certificates on the token and in
+the directory together, so intermediates may sit in either place.
+
+Each operation opens a session, logs in, works, logs out and closes, so no token handle
+outlives a call, and the PEM directory keeps working when the token does not: the two are
+queried together and a failing token is logged rather than hiding file certificates.
+
+Two consequences of the PIN are worth knowing. It is a secret on disk, which the profile
+config already is: it holds the WireGuard private key and is written readable by root
+alone, and the debug bundle's config dump leaves `CertPKCS11PIN` out. And a wrong PIN
+counts against the TPM's dictionary-attack lockout, which is shared with everything else
+on the machine that uses the TPM.
+
+The module is loaded at runtime without cgo, through `purego`, which means the binary is
+dynamically linked against libc. The store is therefore compiled in only with `-tags pkcs11`
+on linux/amd64 and linux/arm64: the deb and rpm packages are built that way, since they
+target glibc distributions, while the release tarballs and the Alpine-based container
+images keep the fully static build. Without the tag, setting `CertPKCS11PIN` logs that
+the build lacks the support.
+
+To exercise the path without hardware, initialise a SoftHSM token and run the end-to-end
+test, which imports a key and certificate itself:
+
+```
+softhsm2-util --init-token --free --label netbird --pin 1234 --so-pin 1234
+NB_TEST_PKCS11_URI='pkcs11:token=netbird?module-path=/usr/lib/softhsm/libsofthsm2.so&pin-value=1234' \
+  go test -tags pkcs11 ./client/internal/certproof/ -run PKCS11 -v
+```
+
+## Only the signed-in user can be validated
+
+This is the central limitation of the design, and it is deliberate.
+
+A proof from a user store can only ever be produced for **the user whose session is
+currently open**. Consequences worth designing around:
+
+- **At the sign-in screen there is no user proof.** macOS reports no console user or
+  attributes the console to root, and `CurrentConsoleUser` returns false for both.
+  Windows reports no active session with a token. Only machine proofs are sent, so a
+  posture check that demands a user certificate fails on a machine nobody has signed
+  into yet.
+- **Signing out changes the answer.** Posture can flip between compliant and
+  non-compliant across a sign-out, so management should treat "no proof" as its own
+  state rather than as a failed check, or users get disconnected at the sign-in screen.
+- **One session is asked, not all of them.** macOS asks the console user, so other
+  fast-user-switched accounts are skipped even though their keychains are unlocked.
+  Windows prefers the console and otherwise takes the first active session. If you ever
+  need every signed-in user, both platforms would have to enumerate sessions and ask
+  each one.
+- **A locked keychain still blocks signing.** A user can be logged in with their
+  keychain locked (locked on sleep, or manually). The helper then needs an unlock prompt
+  and may block, which is why the spawn has a 30s timeout and a failure is reported as
+  "no proof" rather than an error.
+- **The first signature prompts.** The user sees "netbird wants to use your confidential
+  information stored in ...". Choosing *Always Allow* records the helper's designated
+  requirement in the key's ACL, so it persists across restarts and updates while the
+  signing identity is stable. Unsigned or ad-hoc development builds re-prompt every run.
+
+## What a user proof does and does not attest
+
+It attests: *some process in that user's session had ACL permission to use a private key
+whose certificate chains to CA X, and signed a nonce bound to this peer key*.
+
+It does not attest that the daemon controls the key, that the key is hardware-bound, or
+that a particular binary produced the signature. Any code running in that user's session
+with an existing ACL grant can produce the same signature by calling
+`SecKeyCreateSignature` directly — the proof format is not a secret. The helper does not
+create that capability, it only packages it.
+
+If you need a stronger guarantee, use a device identity that never involves a user
+session (MDM into the System keychain, which the daemon reads directly), or a key that
+requires user presence for each signature (Secure Enclave or a PIV token).
+
+## Reading the logs
+
+Everything in this path logs at info. A healthy macOS run shows, in order:
+
+```
+certificate posture: answering N certificate challenges from store *certproof.KeychainStore
+macOS Security framework loaded for certificate posture, running as uid=0 euid=0
+keychain search list contains 2 keychains
+keychain search list[0]: /Library/Keychains/System.keychain
+keychain identity query returned N items
+certificate posture: asking the desktop session of "user" (uid 501) to answer N challenges
+certificate posture: desktop session of "user" returned N proofs
+peer meta carries N certificate posture proofs
+```
+
+Common outcomes and what they mean:
+
+| Log line | Meaning |
+| --- | --- |
+| `keychain identity query returned errSecItemNotFound (-25300)` | The keychain is readable and holds no identity of that class. Any other OSStatus is a real access failure. |
+| `holds no identities usable for certificate posture, but N readable certificates` | Reading works; the certificate is present without its private key, or is not there at all. |
+| `no console user is logged in` | Login window. Device proofs only. |
+| `has no issuer in the keychain` | The chain ships leaf-only and verifies only if the challenge supplies that exact root. |
+| `challenge N rejected "..." : x509: unhandled critical extension` | The chain is fine but Go refuses an extension in it, which is common for Apple-issued certificates. |
+| `challenge N matched none of the M candidates` | Every candidate was rejected; the preceding lines give the reason for each. |
diff --git a/client/internal/certproof/collect.go b/client/internal/certproof/collect.go
new file mode 100644
index 000000000..d2b5d87b0
--- /dev/null
+++ b/client/internal/certproof/collect.go
@@ -0,0 +1,114 @@
+package certproof
+
+import (
+	"context"
+	"crypto/sha256"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// Collect answers the certificate challenges in checks: for each challenge it picks a
+// stored certificate that chains to the challenge's CAs and signs the nonce with its
+// key. The same certificate is proven once even if several checks accept it.
+func Collect(ctx context.Context, store Store, checks []*proto.Checks, peerKey []byte) []certposture.Proof {
+	challenges := certificateChallenges(checks)
+	if len(challenges) == 0 {
+		logNoChallenges(checks)
+		return nil
+	}
+	return CollectChallenges(ctx, store, challenges, peerKey)
+}
+
+func logNoChallenges(checks []*proto.Checks) {
+	if len(checks) > 0 {
+		log.Infof("certificate posture: %d posture checks received, none carries a certificate challenge", len(checks))
+	}
+}
+
+// CollectChallenges answers challenges already extracted from the posture checks, so a
+// caller that ships them across a process boundary reuses the same matching and signing.
+func CollectChallenges(ctx context.Context, store Store, challenges []*proto.CertificateChallenge, peerKey []byte) []certposture.Proof {
+	log.Infof("certificate posture: answering %d certificate challenges from store %T", len(challenges), store)
+
+	candidates, err := store.Candidates(ctx)
+	if err != nil {
+		log.Warnf("failed loading certificates for posture checks: %v", err)
+		return nil
+	}
+	if len(candidates) == 0 {
+		log.Info("certificate posture: certificate store holds no candidates, no proof will be sent")
+		return nil
+	}
+	log.Infof("certificate posture: store holds %d candidate certificates", len(candidates))
+
+	now := time.Now()
+	proven := make(map[[sha256.Size]byte]struct{})
+	var proofs []certposture.Proof
+	for i, challenge := range challenges {
+		roots, err := certposture.ParseCAs(challenge.GetCaCertificates())
+		if err != nil {
+			log.Warnf("skipping certificate challenge with invalid CA certificates: %v", err)
+			continue
+		}
+		log.Infof("certificate posture: challenge %d accepts %d CA certificates, nonce is %d bytes", i, len(challenge.GetCaCertificates()), len(challenge.GetNonce()))
+
+		matched := false
+		for _, candidate := range candidates {
+			if len(candidate.Chain) == 0 {
+				continue
+			}
+			leaf := candidate.Chain[0]
+			if err := certposture.VerifyChain(candidate.Chain, roots, now); err != nil {
+				log.Infof("certificate posture: challenge %d rejected %q issued by %q, chain of %d: %v", i, leaf.Subject, leaf.Issuer, len(candidate.Chain), err)
+				continue
+			}
+			matched = true
+
+			fingerprint := sha256.Sum256(leaf.Raw)
+			if _, done := proven[fingerprint]; done {
+				log.Infof("certificate posture: challenge %d matched %q, already proven for an earlier challenge", i, leaf.Subject)
+				break
+			}
+			proof, err := prove(candidate, challenge.GetNonce(), peerKey)
+			if err != nil {
+				log.Warnf("failed signing certificate proof for %s: %v", leaf.Subject, err)
+				continue
+			}
+			log.Infof("certificate posture: challenge %d proven by %q with %s, signature %d bytes, chain of %d", i, leaf.Subject, proof.SigAlg, len(proof.Signature), len(proof.Chain))
+			proven[fingerprint] = struct{}{}
+			proofs = append(proofs, proof)
+			break
+		}
+		if !matched {
+			log.Infof("certificate posture: challenge %d matched none of the %d candidates", i, len(candidates))
+		}
+	}
+	log.Infof("certificate posture: %d challenges produced %d proofs", len(challenges), len(proofs))
+	return proofs
+}
+
+func certificateChallenges(checks []*proto.Checks) []*proto.CertificateChallenge {
+	var challenges []*proto.CertificateChallenge
+	for _, check := range checks {
+		if challenge := check.GetCertificateChallenge(); challenge != nil && len(challenge.GetNonce()) > 0 {
+			challenges = append(challenges, challenge)
+		}
+	}
+	return challenges
+}
+
+func prove(candidate Candidate, nonce, peerKey []byte) (certposture.Proof, error) {
+	sigAlg, sig, err := certposture.Sign(candidate.Signer, nonce, peerKey)
+	if err != nil {
+		return certposture.Proof{}, err
+	}
+	chain := make([][]byte, 0, len(candidate.Chain))
+	for _, cert := range candidate.Chain {
+		chain = append(chain, cert.Raw)
+	}
+	return certposture.Proof{Nonce: nonce, Chain: chain, SigAlg: sigAlg, Signature: sig}, nil
+}
diff --git a/client/internal/certproof/collect_darwin.go b/client/internal/certproof/collect_darwin.go
new file mode 100644
index 000000000..b52f00e50
--- /dev/null
+++ b/client/internal/certproof/collect_darwin.go
@@ -0,0 +1,96 @@
+package certproof
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"os/exec"
+	"strconv"
+	"strings"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+const helperTimeout = 30 * time.Second
+
+// CollectProofs answers the certificate challenges in checks from every store this Mac
+// can reach. The root daemon reads the System keychain itself, which is where MDM
+// installs device identities, and reaches the console user's login keychain only by
+// launching a helper into that user's session. A Mac sitting at the login window
+// therefore yields device proofs alone.
+func CollectProofs(ctx context.Context, checks []*proto.Checks, peerKey []byte, _ Config) []certposture.Proof {
+	challenges := certificateChallenges(checks)
+	if len(challenges) == 0 {
+		logNoChallenges(checks)
+		return nil
+	}
+
+	// A helper already runs inside the user's session, so it reads its own keychain
+	// directly and must never launch another one.
+	if os.Geteuid() != 0 {
+		return CollectChallenges(ctx, DefaultStore(), challenges, peerKey)
+	}
+
+	proofs := CollectChallenges(ctx, DefaultStore(), challenges, peerKey)
+
+	userProofs, err := collectAsConsoleUser(ctx, challenges, peerKey)
+	if err != nil {
+		log.Infof("certificate posture: console user keychain unavailable: %v", err)
+	}
+	return mergeProofs(proofs, userProofs)
+}
+
+// collectAsConsoleUser runs the helper inside the desktop session of the logged-in
+// user. Dropping to their uid is not enough: keychain access is an XPC call to a
+// per-session securityd, so the helper has to enter their Mach bootstrap namespace,
+// which is what launchctl asuser does.
+func collectAsConsoleUser(ctx context.Context, challenges []*proto.CertificateChallenge, peerKey []byte) ([]certposture.Proof, error) {
+	user, ok := CurrentConsoleUser()
+	if !ok {
+		return nil, nil
+	}
+
+	binary, err := os.Executable()
+	if err != nil {
+		return nil, fmt.Errorf("resolve own binary: %w", err)
+	}
+
+	payload, err := json.Marshal(helperRequest(challenges, peerKey))
+	if err != nil {
+		return nil, fmt.Errorf("encode helper request: %w", err)
+	}
+
+	ctx, cancel := context.WithTimeout(ctx, helperTimeout)
+	defer cancel()
+
+	uid := strconv.FormatUint(uint64(user.UID), 10)
+	cmd := exec.CommandContext(ctx, "launchctl", "asuser", uid, "sudo", "-u", user.Name, "-H", binary, "posture", "cert-proof")
+	cmd.Stdin = bytes.NewReader(payload)
+	var stdout, stderr bytes.Buffer
+	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
+
+	log.Infof("certificate posture: asking the desktop session of %q (uid %s) to answer %d challenges", user.Name, uid, len(challenges))
+	if err := cmd.Run(); err != nil {
+		return nil, fmt.Errorf("run helper as %s: %w: %s", user.Name, err, strings.TrimSpace(stderr.String()))
+	}
+
+	var resp HelperResponse
+	if err := json.Unmarshal(stdout.Bytes(), &resp); err != nil {
+		return nil, fmt.Errorf("decode helper response: %w", err)
+	}
+	log.Infof("certificate posture: desktop session of %q returned %d proofs", user.Name, len(resp.Proofs))
+	return resp.Proofs, nil
+}
+
+// helperStore is the store the helper reads. On macOS the keychain search list of the
+// user's own session already is that user's keychain, so the platform default is right.
+func helperStore() Store {
+	return DefaultStore()
+}
diff --git a/client/internal/certproof/collect_other.go b/client/internal/certproof/collect_other.go
new file mode 100644
index 000000000..d9c49c807
--- /dev/null
+++ b/client/internal/certproof/collect_other.go
@@ -0,0 +1,24 @@
+//go:build !darwin && !windows
+
+package certproof
+
+import (
+	"context"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// CollectProofs answers the certificate challenges in checks from the PEM directory cfg
+// names, joined by its PKCS#11 token when it names one. Only macOS and Windows keep
+// per-user certificates out of reach of a privileged daemon, so every other platform
+// reads its store in the daemon itself.
+func CollectProofs(ctx context.Context, checks []*proto.Checks, peerKey []byte, cfg Config) []certposture.Proof {
+	return Collect(ctx, storeWithToken(cfg), checks, peerKey)
+}
+
+// helperStore is the store the helper reads. Nothing launches a helper on these
+// platforms, so it is the platform default.
+func helperStore() Store {
+	return DefaultStore()
+}
diff --git a/client/internal/certproof/collect_test.go b/client/internal/certproof/collect_test.go
new file mode 100644
index 000000000..16768b974
--- /dev/null
+++ b/client/internal/certproof/collect_test.go
@@ -0,0 +1,108 @@
+package certproof
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/certposture/certtest"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+var peerKey = []byte("peer-public-key-aaaaaaaaaaaaaaaa")
+
+func TestCollect_ProvesOneMatchingCertificatePerChallenge(t *testing.T) {
+	corpCA := certtest.NewCA(t, "corp-root")
+	otherCA := certtest.NewCA(t, "other-root")
+	unrelatedCA := certtest.NewCA(t, "unrelated-root")
+
+	dir := t.TempDir()
+	deviceKey := certtest.ECDSAKey(t)
+	device := corpCA.Issue(t, deviceKey, "device")
+	writeFile(t, dir, "device.pem", certtest.CertPEM(device)+certtest.KeyPEM(t, deviceKey))
+
+	otherKey := certtest.RSAKey(t)
+	writeFile(t, dir, "other.crt", certtest.CertPEM(otherCA.Issue(t, otherKey, "other")))
+	writeFile(t, dir, "other.key", certtest.KeyPEM(t, otherKey))
+
+	writeFile(t, dir, "keyless.crt", certtest.CertPEM(corpCA.Issue(t, certtest.ECDSAKey(t), "keyless")))
+	writeFile(t, dir, "notes.txt", "ignored")
+
+	challenger := certposture.NewChallenger([]byte("secret"))
+	nonce := challenger.Nonce(peerKey, time.Now())
+	challenge := func(cas ...string) *proto.Checks {
+		return &proto.Checks{CertificateChallenge: &proto.CertificateChallenge{Nonce: nonce, CaCertificates: cas}}
+	}
+	checks := []*proto.Checks{
+		{Files: []string{"/usr/bin/agent"}},
+		challenge(corpCA.PEM),
+		challenge(corpCA.PEM),
+		challenge(otherCA.PEM),
+		challenge(unrelatedCA.PEM),
+		challenge("not a pem"),
+	}
+
+	proofs := Collect(context.Background(), NewFileStore(dir), checks, peerKey)
+
+	require.Len(t, proofs, 2)
+	var subjects []string
+	for _, p := range proofs {
+		chain, err := challenger.Verify(p, peerKey, time.Now())
+		require.NoError(t, err)
+		subjects = append(subjects, chain[0].Subject.CommonName)
+	}
+	assert.ElementsMatch(t, []string{"device", "other"}, subjects)
+}
+
+func TestCollect_NothingToProve(t *testing.T) {
+	dir := t.TempDir()
+	key := certtest.ECDSAKey(t)
+	ca := certtest.NewCA(t, "root")
+	writeFile(t, dir, "device.pem", certtest.CertPEM(ca.Issue(t, key, "device"))+certtest.KeyPEM(t, key))
+
+	tests := []struct {
+		name   string
+		store  Store
+		checks []*proto.Checks
+	}{
+		{"no checks", NewFileStore(dir), nil},
+		{"files only", NewFileStore(dir), []*proto.Checks{{Files: []string{"/bin/x"}}}},
+		{"challenge without nonce", NewFileStore(dir), []*proto.Checks{{CertificateChallenge: &proto.CertificateChallenge{CaCertificates: []string{ca.PEM}}}}},
+		{"missing store dir", NewFileStore(filepath.Join(dir, "missing")), []*proto.Checks{{CertificateChallenge: &proto.CertificateChallenge{Nonce: []byte{1}, CaCertificates: []string{ca.PEM}}}}},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Nil(t, Collect(context.Background(), tt.store, tt.checks, peerKey))
+		})
+	}
+}
+
+func TestFileStore_ChainWithIntermediate(t *testing.T) {
+	root := certtest.NewCA(t, "root")
+	intermediate := certtest.NewIntermediate(t, root, "intermediate")
+	key := certtest.ECDSAKey(t)
+	leaf := intermediate.Issue(t, key, "device")
+
+	dir := t.TempDir()
+	writeFile(t, dir, "device.pem", certtest.CertPEM(leaf)+certtest.CertPEM(intermediate.Cert)+certtest.KeyPEM(t, key))
+
+	candidates, err := NewFileStore(dir).Candidates(context.Background())
+	require.NoError(t, err)
+	require.Len(t, candidates, 1)
+	require.Len(t, candidates[0].Chain, 2)
+
+	roots, err := certposture.ParseCAs([]string{root.PEM})
+	require.NoError(t, err)
+	assert.NoError(t, certposture.VerifyChain(candidates[0].Chain, roots, time.Now()))
+}
+
+func writeFile(t *testing.T, dir, name, content string) {
+	t.Helper()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, name), []byte(content), 0o600))
+}
diff --git a/client/internal/certproof/collect_windows.go b/client/internal/certproof/collect_windows.go
new file mode 100644
index 000000000..074662fdb
--- /dev/null
+++ b/client/internal/certproof/collect_windows.go
@@ -0,0 +1,101 @@
+package certproof
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+	"syscall"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+const helperTimeout = 30 * time.Second
+
+// CollectProofs answers the certificate challenges in checks from every store this
+// machine can reach. The service reads the local machine store itself, where AD and
+// Intune enrol device certificates, and reaches the signed-in user's store by launching
+// a helper with that session's token. A machine at the sign-in screen therefore proves
+// device certificates alone.
+func CollectProofs(ctx context.Context, checks []*proto.Checks, peerKey []byte, _ Config) []certposture.Proof {
+	challenges := certificateChallenges(checks)
+	if len(challenges) == 0 {
+		logNoChallenges(checks)
+		return nil
+	}
+
+	proofs := CollectChallenges(ctx, DefaultStore(), challenges, peerKey)
+
+	// The helper already runs as the signed-in user, and an ordinary process has no
+	// right to a session token, so only the service goes looking for one.
+	if !runningAsLocalSystem() {
+		return proofs
+	}
+
+	userProofs, err := collectAsDesktopUser(ctx, challenges, peerKey)
+	if err != nil {
+		log.Infof("certificate posture: user certificate store unavailable: %v", err)
+	}
+	return mergeProofs(proofs, userProofs)
+}
+
+// helperStore is the store the helper reads. It runs as the signed-in user, so it wants
+// that user's store rather than the machine store the service already read.
+func helperStore() Store {
+	return NewUserStore()
+}
+
+// collectAsDesktopUser runs the helper inside the interactive session of the signed-in
+// user. Unlike a keychain on macOS, a Windows service can assume a user identity
+// directly, so the session token goes straight into the child process.
+func collectAsDesktopUser(ctx context.Context, challenges []*proto.CertificateChallenge, peerKey []byte) ([]certposture.Proof, error) {
+	user, ok := CurrentDesktopUser()
+	if !ok {
+		return nil, nil
+	}
+	defer user.Close()
+
+	binary, err := os.Executable()
+	if err != nil {
+		return nil, fmt.Errorf("resolve own binary: %w", err)
+	}
+
+	payload, err := json.Marshal(helperRequest(challenges, peerKey))
+	if err != nil {
+		return nil, fmt.Errorf("encode helper request: %w", err)
+	}
+
+	ctx, cancel := context.WithTimeout(ctx, helperTimeout)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, binary, "posture", "cert-proof")
+	cmd.SysProcAttr = &syscall.SysProcAttr{
+		Token:         syscall.Token(user.Token),
+		HideWindow:    true,
+		CreationFlags: windows.CREATE_NO_WINDOW,
+	}
+	cmd.Stdin = bytes.NewReader(payload)
+	var stdout, stderr bytes.Buffer
+	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
+
+	log.Infof("certificate posture: asking the session of %q (session %d) to answer %d challenges", user.Name, user.Session, len(challenges))
+	if err := cmd.Run(); err != nil {
+		return nil, fmt.Errorf("run helper as %s: %w: %s", user.Name, err, strings.TrimSpace(stderr.String()))
+	}
+
+	var resp HelperResponse
+	if err := json.Unmarshal(stdout.Bytes(), &resp); err != nil {
+		return nil, fmt.Errorf("decode helper response: %w", err)
+	}
+	log.Infof("certificate posture: session of %q returned %d proofs", user.Name, len(resp.Proofs))
+	return resp.Proofs, nil
+}
diff --git a/client/internal/certproof/consoleuser_darwin.go b/client/internal/certproof/consoleuser_darwin.go
new file mode 100644
index 000000000..f0489d605
--- /dev/null
+++ b/client/internal/certproof/consoleuser_darwin.go
@@ -0,0 +1,113 @@
+package certproof
+
+import (
+	"bytes"
+	"fmt"
+	"sync"
+
+	"github.com/ebitengine/purego"
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	systemConfigurationFramework = "/System/Library/Frameworks/SystemConfiguration.framework/SystemConfiguration"
+
+	encodingUTF8       = 0x08000100
+	consoleNameBufSize = 256
+)
+
+var (
+	consoleOnce sync.Once
+	consoleErr  error
+
+	scDynamicStoreCopyConsoleUser func(store uintptr, uid, gid *uint32) uintptr
+	cfStringGetCString            func(str uintptr, buffer *byte, size int, encoding uint32) bool
+)
+
+// ConsoleUser is the account whose desktop session owns the display. Its login keychain
+// is the only user keychain a NetBird daemon can reach, and only while it is logged in.
+type ConsoleUser struct {
+	Name string
+	UID  uint32
+	GID  uint32
+}
+
+// CurrentConsoleUser reports the user sitting at the desktop. The second return value is
+// false when nobody is: at the login window macOS either reports no console user at all
+// or attributes the session to root, and neither has a login keychain to offer.
+func CurrentConsoleUser() (ConsoleUser, bool) {
+	if err := loadConsoleUser(); err != nil {
+		log.Infof("console user lookup unavailable: %v", err)
+		return ConsoleUser{}, false
+	}
+
+	var uid, gid uint32
+	name := scDynamicStoreCopyConsoleUser(0, &uid, &gid)
+	if name == 0 {
+		log.Info("no console user is logged in, no login keychain is reachable")
+		return ConsoleUser{}, false
+	}
+	defer cfRelease(name)
+
+	user := ConsoleUser{Name: cfString(name), UID: uid, GID: gid}
+	if !user.hasDesktop() {
+		log.Infof("console session belongs to %q uid=%d, which is not a desktop login, no login keychain is reachable", user.Name, user.UID)
+		return ConsoleUser{}, false
+	}
+	return user, true
+}
+
+// hasDesktop reports whether the console session is a real user desktop. The login
+// window runs as root and some macOS releases name it "loginwindow" instead.
+func (u ConsoleUser) hasDesktop() bool {
+	switch u.Name {
+	case "", "root", "loginwindow":
+		return false
+	}
+	return u.UID != 0
+}
+
+func cfString(str uintptr) string {
+	buf := make([]byte, consoleNameBufSize)
+	if !cfStringGetCString(str, &buf[0], len(buf), encodingUTF8) {
+		return ""
+	}
+	if end := bytes.IndexByte(buf, 0); end >= 0 {
+		return string(buf[:end])
+	}
+	return string(buf)
+}
+
+// loadConsoleUser resolves the console user symbols. It loads the keychain bindings
+// first because CFRelease is resolved there and released strings depend on it.
+func loadConsoleUser() error {
+	if err := loadKeychain(); err != nil {
+		return err
+	}
+	consoleOnce.Do(func() { consoleErr = resolveConsoleUser() })
+	return consoleErr
+}
+
+func resolveConsoleUser() error {
+	systemConfiguration, err := purego.Dlopen(systemConfigurationFramework, purego.RTLD_LAZY|purego.RTLD_GLOBAL)
+	if err != nil {
+		return fmt.Errorf("open %s: %w", systemConfigurationFramework, err)
+	}
+	coreFoundation, err := purego.Dlopen(coreFoundationFramework, purego.RTLD_LAZY|purego.RTLD_GLOBAL)
+	if err != nil {
+		return fmt.Errorf("open %s: %w", coreFoundationFramework, err)
+	}
+
+	symbol, err := purego.Dlsym(systemConfiguration, "SCDynamicStoreCopyConsoleUser")
+	if err != nil {
+		return fmt.Errorf("resolve SCDynamicStoreCopyConsoleUser: %w", err)
+	}
+	purego.RegisterFunc(&scDynamicStoreCopyConsoleUser, symbol)
+
+	symbol, err = purego.Dlsym(coreFoundation, "CFStringGetCString")
+	if err != nil {
+		return fmt.Errorf("resolve CFStringGetCString: %w", err)
+	}
+	purego.RegisterFunc(&cfStringGetCString, symbol)
+	return nil
+}
diff --git a/client/internal/certproof/consoleuser_darwin_test.go b/client/internal/certproof/consoleuser_darwin_test.go
new file mode 100644
index 000000000..a3ecba217
--- /dev/null
+++ b/client/internal/certproof/consoleuser_darwin_test.go
@@ -0,0 +1,39 @@
+package certproof
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestConsoleUser_OnlyADesktopSessionCanBeValidated(t *testing.T) {
+	tests := []struct {
+		name    string
+		user    ConsoleUser
+		desktop bool
+	}{
+		{"logged in user", ConsoleUser{Name: "maycon", UID: 501, GID: 20}, true},
+		{"login window as root", ConsoleUser{Name: "root", UID: 0}, false},
+		{"login window by name", ConsoleUser{Name: "loginwindow", UID: 0}, false},
+		{"named user still at uid 0", ConsoleUser{Name: "admin", UID: 0}, false},
+		{"no console user", ConsoleUser{}, false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.desktop, tt.user.hasDesktop(), "only a real desktop session offers a login keychain")
+		})
+	}
+}
+
+// CurrentConsoleUser runs against the real SystemConfiguration framework. A machine with
+// a desktop open must report a non-root user; a headless runner must report none.
+func TestCurrentConsoleUser_AgreesWithItself(t *testing.T) {
+	user, ok := CurrentConsoleUser()
+	if !ok {
+		t.Log("no console user, running headless")
+		return
+	}
+	assert.NotEmpty(t, user.Name, "a console user must have a name")
+	assert.NotZero(t, user.UID, "a desktop session never belongs to uid 0")
+	assert.True(t, user.hasDesktop(), "a reported console user must be a desktop session")
+}
diff --git a/client/internal/certproof/desktopuser_windows.go b/client/internal/certproof/desktopuser_windows.go
new file mode 100644
index 000000000..ae6a7221b
--- /dev/null
+++ b/client/internal/certproof/desktopuser_windows.go
@@ -0,0 +1,126 @@
+package certproof
+
+import (
+	"fmt"
+	"unsafe"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+)
+
+const (
+	noActiveSession = 0xFFFFFFFF
+
+	// wtsCurrentServer is WTS_CURRENT_SERVER_HANDLE and wtsActive is WTSActive of
+	// WTS_CONNECTSTATE_CLASS. Neither is exported by x/sys/windows.
+	wtsCurrentServer = windows.Handle(0)
+	wtsActive        = 0
+)
+
+// DesktopUser is an interactive session and the account signed into it. The user's
+// certificate store is readable only from a process running as that account, because
+// its private keys are protected against the user profile rather than the machine.
+type DesktopUser struct {
+	Session uint32
+	Name    string
+	Token   windows.Token
+}
+
+// Close releases the session token.
+func (u DesktopUser) Close() {
+	if err := u.Token.Close(); err != nil {
+		log.Debugf("failed closing desktop session token: %v", err)
+	}
+}
+
+// CurrentDesktopUser returns a token for the interactive user whose certificate store
+// should be asked. The physical console comes first, and an active remote desktop
+// session is used when nobody is at the console, which is how servers and VDI hosts are
+// normally reached. The second return is false at the sign-in screen, where no
+// interactive session exists and only machine certificates can be proven.
+//
+// Obtaining the token needs SE_TCB_NAME, which the LocalSystem service has and an
+// ordinary process does not.
+func CurrentDesktopUser() (DesktopUser, bool) {
+	if session := windows.WTSGetActiveConsoleSessionId(); session != noActiveSession {
+		if user, ok := desktopUser(session); ok {
+			return user, true
+		}
+		log.Infof("console session %d has nobody signed in, looking for an active remote session", session)
+	}
+
+	sessions, err := activeSessions()
+	if err != nil {
+		log.Infof("cannot enumerate terminal sessions: %v", err)
+		return DesktopUser{}, false
+	}
+	for _, session := range sessions {
+		if user, ok := desktopUser(session); ok {
+			return user, true
+		}
+	}
+
+	log.Info("no interactive session is signed in, no user certificate store is reachable")
+	return DesktopUser{}, false
+}
+
+func desktopUser(session uint32) (DesktopUser, bool) {
+	var token windows.Token
+	if err := windows.WTSQueryUserToken(session, &token); err != nil {
+		log.Debugf("no user token for session %d: %v", session, err)
+		return DesktopUser{}, false
+	}
+
+	name, err := tokenAccount(token)
+	if err != nil {
+		log.Infof("session %d token has no readable account: %v", session, err)
+		if closeErr := token.Close(); closeErr != nil {
+			log.Debugf("failed closing session token: %v", closeErr)
+		}
+		return DesktopUser{}, false
+	}
+	return DesktopUser{Session: session, Name: name, Token: token}, true
+}
+
+func tokenAccount(token windows.Token) (string, error) {
+	user, err := token.GetTokenUser()
+	if err != nil {
+		return "", fmt.Errorf("read token user: %w", err)
+	}
+	account, domain, _, err := user.User.Sid.LookupAccount("")
+	if err != nil {
+		return "", fmt.Errorf("look up account: %w", err)
+	}
+	if domain == "" {
+		return account, nil
+	}
+	return domain + `\` + account, nil
+}
+
+func activeSessions() ([]uint32, error) {
+	var info *windows.WTS_SESSION_INFO
+	var count uint32
+	if err := windows.WTSEnumerateSessions(wtsCurrentServer, 0, 1, &info, &count); err != nil {
+		return nil, fmt.Errorf("enumerate sessions: %w", err)
+	}
+	defer windows.WTSFreeMemory(uintptr(unsafe.Pointer(info)))
+
+	var active []uint32
+	for _, session := range unsafe.Slice(info, count) {
+		if session.State == wtsActive {
+			active = append(active, session.SessionID)
+		}
+	}
+	return active, nil
+}
+
+// runningAsLocalSystem reports whether this process is the service. The helper runs as
+// the signed-in user and must read its own store rather than launching another helper.
+func runningAsLocalSystem() bool {
+	user, err := windows.GetCurrentProcessToken().GetTokenUser()
+	if err != nil {
+		log.Debugf("failed reading own token user: %v", err)
+		return false
+	}
+	return user.User.Sid.IsWellKnown(windows.WinLocalSystemSid)
+}
diff --git a/client/internal/certproof/helper.go b/client/internal/certproof/helper.go
new file mode 100644
index 000000000..26d719044
--- /dev/null
+++ b/client/internal/certproof/helper.go
@@ -0,0 +1,66 @@
+package certproof
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// HelperRequest is the work the daemon hands to a helper running in a user session. The
+// peer key binds every signature to this machine, so a proof cannot be replayed onto
+// another peer.
+type HelperRequest struct {
+	PeerKey    []byte            `json:"peerKey"`
+	Challenges []HelperChallenge `json:"challenges"`
+}
+
+// HelperChallenge is one certificate challenge in the form the helper needs.
+type HelperChallenge struct {
+	Nonce          []byte   `json:"nonce"`
+	CACertificates []string `json:"caCertificates"`
+}
+
+// HelperResponse carries the proofs the helper produced from its own keychain.
+type HelperResponse struct {
+	Proofs []certposture.Proof `json:"proofs"`
+}
+
+// RunHelper answers the challenges on in from the store of the user running this
+// process and writes the proofs to out. It is the child half of the console user
+// lookup: the daemon cannot read a login keychain, so it launches this in the user's
+// session instead. Only the signature crosses back, never the private key.
+func RunHelper(ctx context.Context, in io.Reader, out io.Writer) error {
+	return runHelper(ctx, helperStore(), in, out)
+}
+
+func runHelper(ctx context.Context, store Store, in io.Reader, out io.Writer) error {
+	var req HelperRequest
+	if err := json.NewDecoder(in).Decode(&req); err != nil {
+		return fmt.Errorf("decode helper request: %w", err)
+	}
+
+	challenges := make([]*proto.CertificateChallenge, 0, len(req.Challenges))
+	for _, challenge := range req.Challenges {
+		challenges = append(challenges, &proto.CertificateChallenge{
+			Nonce:          challenge.Nonce,
+			CaCertificates: challenge.CACertificates,
+		})
+	}
+
+	var proofs []certposture.Proof
+	if len(challenges) > 0 {
+		proofs = CollectChallenges(ctx, store, challenges, req.PeerKey)
+	}
+	log.Infof("certificate posture helper: answering %d challenges with %d proofs", len(challenges), len(proofs))
+
+	if err := json.NewEncoder(out).Encode(HelperResponse{Proofs: proofs}); err != nil {
+		return fmt.Errorf("encode helper response: %w", err)
+	}
+	return nil
+}
diff --git a/client/internal/certproof/helper_spawn.go b/client/internal/certproof/helper_spawn.go
new file mode 100644
index 000000000..ccf0567a5
--- /dev/null
+++ b/client/internal/certproof/helper_spawn.go
@@ -0,0 +1,63 @@
+//go:build darwin || windows
+
+package certproof
+
+import (
+	"crypto/sha256"
+	"crypto/x509"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+func helperRequest(challenges []*proto.CertificateChallenge, peerKey []byte) HelperRequest {
+	req := HelperRequest{PeerKey: peerKey, Challenges: make([]HelperChallenge, 0, len(challenges))}
+	for _, challenge := range challenges {
+		req.Challenges = append(req.Challenges, HelperChallenge{
+			Nonce:          challenge.GetNonce(),
+			CACertificates: challenge.GetCaCertificates(),
+		})
+	}
+	return req
+}
+
+// mergeProofs appends the user session proofs to the device proofs, dropping a leaf that
+// both stores hold so the same certificate is proven once.
+func mergeProofs(device, user []certposture.Proof) []certposture.Proof {
+	if len(user) == 0 {
+		return device
+	}
+
+	seen := make(map[[sha256.Size]byte]struct{}, len(device))
+	for _, proof := range device {
+		if len(proof.Chain) > 0 {
+			seen[sha256.Sum256(proof.Chain[0])] = struct{}{}
+		}
+	}
+
+	merged := device
+	for _, proof := range user {
+		if len(proof.Chain) == 0 {
+			continue
+		}
+		fingerprint := sha256.Sum256(proof.Chain[0])
+		if _, done := seen[fingerprint]; done {
+			continue
+		}
+		seen[fingerprint] = struct{}{}
+		merged = append(merged, proof)
+		logUserProof(proof)
+	}
+	return merged
+}
+
+func logUserProof(proof certposture.Proof) {
+	leaf, err := x509.ParseCertificate(proof.Chain[0])
+	if err != nil {
+		log.Infof("certificate posture: user proof carries an unparsable leaf: %v", err)
+		return
+	}
+	log.Infof("certificate posture: signed-in user proved %q issued by %q", leaf.Subject, leaf.Issuer)
+}
diff --git a/client/internal/certproof/helper_spawn_test.go b/client/internal/certproof/helper_spawn_test.go
new file mode 100644
index 000000000..5356a9b00
--- /dev/null
+++ b/client/internal/certproof/helper_spawn_test.go
@@ -0,0 +1,56 @@
+//go:build darwin || windows
+
+package certproof
+
+import (
+	"crypto/sha256"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/certposture/certtest"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+func TestMergeProofs_ProvesACertificateHeldByBothStoresOnce(t *testing.T) {
+	ca := certtest.NewCA(t, "corp-root")
+	shared := ca.Issue(t, certtest.ECDSAKey(t), "shared")
+	userOnly := ca.Issue(t, certtest.ECDSAKey(t), "user-only")
+
+	device := []certposture.Proof{{Chain: [][]byte{shared.Raw}}}
+	user := []certposture.Proof{{Chain: [][]byte{shared.Raw}}, {Chain: [][]byte{userOnly.Raw}}, {}}
+
+	merged := mergeProofs(device, user)
+
+	require.Len(t, merged, 2, "the shared leaf is proven once and the empty chain is dropped")
+	assert.Equal(t, shared.Raw, merged[0].Chain[0], "the device proof keeps its place")
+	assert.Equal(t, userOnly.Raw, merged[1].Chain[0], "the user-only certificate is appended")
+}
+
+func TestMergeProofs_KeepsDeviceProofsWhenNoUserSession(t *testing.T) {
+	ca := certtest.NewCA(t, "corp-root")
+	device := []certposture.Proof{{Chain: [][]byte{ca.Issue(t, certtest.ECDSAKey(t), "device").Raw}}}
+
+	merged := mergeProofs(device, nil)
+
+	require.Len(t, merged, 1, "a machine with nobody signed in still sends its device proof")
+	assert.Equal(t, sha256.Sum256(device[0].Chain[0]), sha256.Sum256(merged[0].Chain[0]), "the device proof is unchanged")
+}
+
+func TestHelperRequest_CarriesEveryChallenge(t *testing.T) {
+	ca := certtest.NewCA(t, "corp-root")
+	challenges := []*proto.CertificateChallenge{
+		{Nonce: []byte("first"), CaCertificates: []string{ca.PEM}},
+		{Nonce: []byte("second")},
+	}
+
+	req := helperRequest(challenges, peerKey)
+
+	require.Len(t, req.Challenges, 2, "every challenge must reach the helper")
+	assert.Equal(t, peerKey, req.PeerKey, "the peer key binds the signature to this machine")
+	assert.Equal(t, []byte("first"), req.Challenges[0].Nonce, "the nonce must survive unchanged")
+	assert.Equal(t, []string{ca.PEM}, req.Challenges[0].CACertificates, "the accepted CAs must survive unchanged")
+	assert.Empty(t, req.Challenges[1].CACertificates, "a challenge without CAs stays without CAs")
+}
diff --git a/client/internal/certproof/helper_test.go b/client/internal/certproof/helper_test.go
new file mode 100644
index 000000000..b70bd71f3
--- /dev/null
+++ b/client/internal/certproof/helper_test.go
@@ -0,0 +1,63 @@
+package certproof
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/certposture/certtest"
+)
+
+func TestRunHelper_ProofSurvivesTheProcessBoundary(t *testing.T) {
+	ca := certtest.NewCA(t, "corp-root")
+	dir := t.TempDir()
+	key := certtest.ECDSAKey(t)
+	writeFile(t, dir, "device.pem", certtest.CertPEM(ca.Issue(t, key, "device"))+certtest.KeyPEM(t, key))
+
+	challenger := certposture.NewChallenger([]byte("secret"))
+	nonce := challenger.Nonce(peerKey, time.Now())
+	request, err := json.Marshal(HelperRequest{
+		PeerKey:    peerKey,
+		Challenges: []HelperChallenge{{Nonce: nonce, CACertificates: []string{ca.PEM}}},
+	})
+	require.NoError(t, err, "request must encode")
+
+	var stdout bytes.Buffer
+	require.NoError(t, runHelper(context.Background(), NewFileStore(dir), bytes.NewReader(request), &stdout))
+
+	var resp HelperResponse
+	require.NoError(t, json.Unmarshal(stdout.Bytes(), &resp), "helper must emit decodable JSON")
+	require.Len(t, resp.Proofs, 1, "the matching certificate should produce one proof")
+
+	// Verify exactly as management does, so the proof is proven to survive the encode,
+	// the process boundary and the decode intact.
+	chain, err := challenger.Verify(resp.Proofs[0], peerKey, time.Now())
+	require.NoError(t, err, "the decoded proof must verify against the issued nonce")
+	assert.Equal(t, "device", chain[0].Subject.CommonName, "the proven leaf should be the device certificate")
+}
+
+func TestRunHelper_NoChallengesYieldsEmptyResponse(t *testing.T) {
+	request, err := json.Marshal(HelperRequest{PeerKey: peerKey})
+	require.NoError(t, err)
+
+	var stdout bytes.Buffer
+	require.NoError(t, runHelper(context.Background(), NewFileStore(t.TempDir()), bytes.NewReader(request), &stdout))
+
+	var resp HelperResponse
+	require.NoError(t, json.Unmarshal(stdout.Bytes(), &resp), "an empty request must still emit valid JSON")
+	assert.Empty(t, resp.Proofs, "no challenges should produce no proofs")
+}
+
+func TestRunHelper_RejectsMalformedRequest(t *testing.T) {
+	var stdout bytes.Buffer
+	err := runHelper(context.Background(), NewFileStore(t.TempDir()), bytes.NewReader([]byte("not json")), &stdout)
+
+	require.Error(t, err, "a malformed request must fail rather than emit an empty proof set")
+	assert.Empty(t, stdout.String(), "nothing should be written to stdout on a decode failure")
+}
diff --git a/client/internal/certproof/keychain_darwin.go b/client/internal/certproof/keychain_darwin.go
new file mode 100644
index 000000000..d53c15b27
--- /dev/null
+++ b/client/internal/certproof/keychain_darwin.go
@@ -0,0 +1,363 @@
+package certproof
+
+import (
+	"bytes"
+	"context"
+	"crypto"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"sync"
+	"unsafe"
+
+	"github.com/ebitengine/purego"
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	securityFramework       = "/System/Library/Frameworks/Security.framework/Security"
+	coreFoundationFramework = "/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation"
+
+	errSecItemNotFound = -25300
+)
+
+var (
+	keychainOnce sync.Once
+	keychainErr  error
+
+	secItemCopyMatching        func(query uintptr, result *uintptr) int32
+	secIdentityCopyCertificate func(identity uintptr, cert *uintptr) int32
+	secIdentityCopyPrivateKey  func(identity uintptr, key *uintptr) int32
+	secCertificateCopyData     func(cert uintptr) uintptr
+	secKeyCreateSignature      func(key, algorithm, data uintptr, err *uintptr) uintptr
+
+	secKeychainCopySearchList func(searchList *uintptr) int32
+	secKeychainGetPath        func(keychain uintptr, pathLength *uint32, path *byte) int32
+
+	cfDictionaryCreate     func(alloc uintptr, keys, values *uintptr, count int, keyCallBacks, valueCallBacks uintptr) uintptr
+	cfArrayGetCount        func(array uintptr) int
+	cfArrayGetValueAtIndex func(array uintptr, index int) uintptr
+	cfDataCreate           func(alloc uintptr, data *byte, length int) uintptr
+	cfDataGetLength        func(data uintptr) int
+	cfDataGetBytePtr       func(data uintptr) unsafe.Pointer
+	cfErrorGetCode         func(err uintptr) int
+	cfRelease              func(ref uintptr)
+
+	kSecClass, kSecClassIdentity, kSecClassCertificate, kSecMatchLimit, kSecMatchLimitAll, kSecReturnRef uintptr
+	kSecKeyAlgorithmECDSASHA256, kSecKeyAlgorithmECDSASHA384, kSecKeyAlgorithmRSAPSSSHA256               uintptr
+	kCFBooleanTrue, kCFTypeDictionaryKeyCallBacks, kCFTypeDictionaryValueCallBacks                       uintptr
+)
+
+// DefaultStore is the keychain search list of the daemon, which for the root daemon is
+// the System keychain where MDM installs device identities.
+func DefaultStore() Store {
+	return NewKeychainStore()
+}
+
+// KeychainStore yields the identities of the process's keychain search list, reached
+// through purego so the client keeps building with CGO_ENABLED=0.
+type KeychainStore struct{}
+
+func NewKeychainStore() *KeychainStore {
+	return &KeychainStore{}
+}
+
+func (s *KeychainStore) Candidates(_ context.Context) ([]Candidate, error) {
+	if err := loadKeychain(); err != nil {
+		return nil, err
+	}
+	var leaves []*x509.Certificate
+	err := eachIdentity(func(_ uintptr, der []byte) (bool, error) {
+		cert, err := x509.ParseCertificate(der)
+		if err != nil {
+			log.Warnf("skipping keychain identity: %v", err)
+			return false, nil
+		}
+		log.Infof("keychain identity: subject=%q issuer=%q serial=%s expires=%s", cert.Subject, cert.Issuer, cert.SerialNumber, cert.NotAfter)
+		leaves = append(leaves, cert)
+		return false, nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	// The certificate query runs even without identities: it separates a keychain that is
+	// readable but holds no identity from one the process cannot read at all.
+	pool, err := keychainCertificates()
+	if err != nil {
+		return nil, err
+	}
+	if len(leaves) == 0 {
+		log.Infof("keychain search list holds no identities usable for certificate posture, but %d readable certificates: an identity needs its private key in the same keychain", len(pool))
+		return nil, nil
+	}
+	log.Infof("keychain search list holds %d identities and %d certificates for chain building", len(leaves), len(pool))
+
+	candidates := make([]Candidate, 0, len(leaves))
+	for _, leaf := range leaves {
+		chain := buildChain(leaf, pool)
+		log.Infof("keychain candidate %q issued by %q built a chain of %d certificates", leaf.Subject, leaf.Issuer, len(chain))
+		if len(chain) == 1 && leaf.CheckSignatureFrom(leaf) != nil {
+			log.Infof("keychain candidate %q has no issuer in the keychain, its proof carries the leaf alone and only verifies if the challenge supplies %q", leaf.Subject, leaf.Issuer)
+		}
+		candidates = append(candidates, Candidate{Chain: chain, Signer: &keychainSigner{leaf: leaf}})
+	}
+	return candidates, nil
+}
+
+// keychainSigner holds only the certificate; the identity is looked up again at signing
+// time so no keychain references outlive a call.
+type keychainSigner struct {
+	leaf *x509.Certificate
+}
+
+func (s *keychainSigner) Public() crypto.PublicKey {
+	return s.leaf.PublicKey
+}
+
+func (s *keychainSigner) Sign(_ io.Reader, digest []byte, opts crypto.SignerOpts) ([]byte, error) {
+	scheme, err := schemeFor(s.leaf.PublicKey, opts)
+	if err != nil {
+		return nil, err
+	}
+	log.Infof("signing certificate posture challenge with keychain key of %q", s.leaf.Subject)
+
+	algorithm := keychainAlgorithm(scheme)
+	var signature []byte
+	err = eachIdentity(func(identity uintptr, der []byte) (bool, error) {
+		if !bytes.Equal(der, s.leaf.Raw) {
+			return false, nil
+		}
+		signature, err = signWithIdentity(identity, algorithm, digest)
+		return true, err
+	})
+	if err != nil {
+		return nil, err
+	}
+	if signature == nil {
+		return nil, errors.New("certificate is no longer in the keychain")
+	}
+	log.Infof("keychain signed certificate posture challenge for %q, %d bytes", s.leaf.Subject, len(signature))
+	return signature, nil
+}
+
+func keychainAlgorithm(scheme sigScheme) uintptr {
+	switch scheme {
+	case schemeECDSASHA384:
+		return kSecKeyAlgorithmECDSASHA384
+	case schemeRSAPSSSHA256:
+		return kSecKeyAlgorithmRSAPSSSHA256
+	default:
+		return kSecKeyAlgorithmECDSASHA256
+	}
+}
+
+func signWithIdentity(identity, algorithm uintptr, digest []byte) ([]byte, error) {
+	var key uintptr
+	if status := secIdentityCopyPrivateKey(identity, &key); status != 0 {
+		return nil, fmt.Errorf("SecIdentityCopyPrivateKey: %d", status)
+	}
+	defer cfRelease(key)
+
+	data := cfDataCreate(0, &digest[0], len(digest))
+	defer cfRelease(data)
+
+	var cfErr uintptr
+	signature := secKeyCreateSignature(key, algorithm, data, &cfErr)
+	if signature == 0 {
+		defer cfRelease(cfErr)
+		return nil, fmt.Errorf("SecKeyCreateSignature: CFError %d", cfErrorGetCode(cfErr))
+	}
+	defer cfRelease(signature)
+	return dataBytes(signature), nil
+}
+
+func eachIdentity(fn func(identity uintptr, der []byte) (bool, error)) error {
+	return eachMatching(kSecClassIdentity, "identity", func(identity uintptr) (bool, error) {
+		var cert uintptr
+		if status := secIdentityCopyCertificate(identity, &cert); status != 0 {
+			return true, fmt.Errorf("SecIdentityCopyCertificate: %d", status)
+		}
+		der := certificateDER(cert)
+		cfRelease(cert)
+		return fn(identity, der)
+	})
+}
+
+func keychainCertificates() ([]*x509.Certificate, error) {
+	var certs []*x509.Certificate
+	var unparsable int
+	err := eachMatching(kSecClassCertificate, "certificate", func(item uintptr) (bool, error) {
+		if cert, err := x509.ParseCertificate(certificateDER(item)); err == nil {
+			certs = append(certs, cert)
+			return false, nil
+		}
+		unparsable++
+		return false, nil
+	})
+	log.Infof("keychain holds %d parsable certificates, %d unparsable", len(certs), unparsable)
+	return certs, err
+}
+
+func eachMatching(class uintptr, name string, fn func(item uintptr) (bool, error)) error {
+	keys := []uintptr{kSecClass, kSecMatchLimit, kSecReturnRef}
+	values := []uintptr{class, kSecMatchLimitAll, kCFBooleanTrue}
+	query := cfDictionaryCreate(0, &keys[0], &values[0], len(keys), kCFTypeDictionaryKeyCallBacks, kCFTypeDictionaryValueCallBacks)
+	defer cfRelease(query)
+
+	var items uintptr
+	switch status := secItemCopyMatching(query, &items); status {
+	case 0:
+	case errSecItemNotFound:
+		log.Infof("keychain %s query returned errSecItemNotFound (%d): the search list holds no item of this class", name, errSecItemNotFound)
+		return nil
+	default:
+		log.Infof("keychain %s query returned OSStatus %d", name, status)
+		return fmt.Errorf("SecItemCopyMatching: %d", status)
+	}
+	defer cfRelease(items)
+
+	n := cfArrayGetCount(items)
+	log.Infof("keychain %s query returned %d items", name, n)
+	for i := 0; i < n; i++ {
+		if stop, err := fn(cfArrayGetValueAtIndex(items, i)); stop || err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func certificateDER(cert uintptr) []byte {
+	data := secCertificateCopyData(cert)
+	defer cfRelease(data)
+	return dataBytes(data)
+}
+
+func dataBytes(data uintptr) []byte {
+	return bytes.Clone(unsafe.Slice((*byte)(cfDataGetBytePtr(data)), cfDataGetLength(data)))
+}
+
+func loadKeychain() error {
+	keychainOnce.Do(func() {
+		if keychainErr = resolveKeychain(); keychainErr != nil {
+			log.Infof("macOS keychain unavailable for certificate posture: %v", keychainErr)
+			return
+		}
+		log.Infof("macOS Security framework loaded for certificate posture, running as uid=%d euid=%d", os.Getuid(), os.Geteuid())
+		logSearchList()
+	})
+	return keychainErr
+}
+
+// logSearchList reports the keychains the process searches. The root daemon sees the
+// System keychain and System Roots, never a user's login keychain.
+func logSearchList() {
+	if secKeychainCopySearchList == nil || secKeychainGetPath == nil {
+		log.Info("keychain search list diagnostics unavailable on this macOS version")
+		return
+	}
+
+	var list uintptr
+	if status := secKeychainCopySearchList(&list); status != 0 {
+		log.Infof("SecKeychainCopySearchList returned OSStatus %d", status)
+		return
+	}
+	defer cfRelease(list)
+
+	n := cfArrayGetCount(list)
+	log.Infof("keychain search list contains %d keychains", n)
+	for i := 0; i < n; i++ {
+		log.Infof("keychain search list[%d]: %s", i, keychainPath(cfArrayGetValueAtIndex(list, i)))
+	}
+}
+
+func keychainPath(keychain uintptr) string {
+	path := make([]byte, 1024)
+	length := uint32(len(path))
+	if status := secKeychainGetPath(keychain, &length, &path[0]); status != 0 {
+		return fmt.Sprintf("<SecKeychainGetPath: %d>", status)
+	}
+	return string(path[:length])
+}
+
+func resolveKeychain() error {
+	security, err := purego.Dlopen(securityFramework, purego.RTLD_LAZY|purego.RTLD_GLOBAL)
+	if err != nil {
+		return fmt.Errorf("open %s: %w", securityFramework, err)
+	}
+	coreFoundation, err := purego.Dlopen(coreFoundationFramework, purego.RTLD_LAZY|purego.RTLD_GLOBAL)
+	if err != nil {
+		return fmt.Errorf("open %s: %w", coreFoundationFramework, err)
+	}
+
+	for _, fn := range []struct {
+		ptr  any
+		lib  uintptr
+		name string
+	}{
+		{&secItemCopyMatching, security, "SecItemCopyMatching"},
+		{&secIdentityCopyCertificate, security, "SecIdentityCopyCertificate"},
+		{&secIdentityCopyPrivateKey, security, "SecIdentityCopyPrivateKey"},
+		{&secCertificateCopyData, security, "SecCertificateCopyData"},
+		{&secKeyCreateSignature, security, "SecKeyCreateSignature"},
+		{&cfDictionaryCreate, coreFoundation, "CFDictionaryCreate"},
+		{&cfArrayGetCount, coreFoundation, "CFArrayGetCount"},
+		{&cfArrayGetValueAtIndex, coreFoundation, "CFArrayGetValueAtIndex"},
+		{&cfDataCreate, coreFoundation, "CFDataCreate"},
+		{&cfDataGetLength, coreFoundation, "CFDataGetLength"},
+		{&cfDataGetBytePtr, coreFoundation, "CFDataGetBytePtr"},
+		{&cfErrorGetCode, coreFoundation, "CFErrorGetCode"},
+		{&cfRelease, coreFoundation, "CFRelease"},
+	} {
+		symbol, err := purego.Dlsym(fn.lib, fn.name)
+		if err != nil {
+			return fmt.Errorf("resolve %s: %w", fn.name, err)
+		}
+		purego.RegisterFunc(fn.ptr, symbol)
+	}
+
+	for _, global := range []struct {
+		ptr   *uintptr
+		lib   uintptr
+		name  string
+		deref bool
+	}{
+		{&kSecClass, security, "kSecClass", true},
+		{&kSecClassIdentity, security, "kSecClassIdentity", true},
+		{&kSecClassCertificate, security, "kSecClassCertificate", true},
+		{&kSecMatchLimit, security, "kSecMatchLimit", true},
+		{&kSecMatchLimitAll, security, "kSecMatchLimitAll", true},
+		{&kSecReturnRef, security, "kSecReturnRef", true},
+		{&kSecKeyAlgorithmECDSASHA256, security, "kSecKeyAlgorithmECDSASignatureDigestX962SHA256", true},
+		{&kSecKeyAlgorithmECDSASHA384, security, "kSecKeyAlgorithmECDSASignatureDigestX962SHA384", true},
+		{&kSecKeyAlgorithmRSAPSSSHA256, security, "kSecKeyAlgorithmRSASignatureDigestPSSSHA256", true},
+		{&kCFBooleanTrue, coreFoundation, "kCFBooleanTrue", true},
+		{&kCFTypeDictionaryKeyCallBacks, coreFoundation, "kCFTypeDictionaryKeyCallBacks", false},
+		{&kCFTypeDictionaryValueCallBacks, coreFoundation, "kCFTypeDictionaryValueCallBacks", false},
+	} {
+		addr, err := purego.Dlsym(global.lib, global.name)
+		if err != nil {
+			return fmt.Errorf("resolve %s: %w", global.name, err)
+		}
+		if global.deref {
+			addr = **(**uintptr)(unsafe.Pointer(&addr))
+		}
+		*global.ptr = addr
+	}
+
+	resolveOptional(security, "SecKeychainCopySearchList", &secKeychainCopySearchList)
+	resolveOptional(security, "SecKeychainGetPath", &secKeychainGetPath)
+	return nil
+}
+
+// resolveOptional binds a diagnostic-only symbol, leaving it nil when the framework no
+// longer exports it so keychain lookups keep working without it.
+func resolveOptional(lib uintptr, name string, ptr any) {
+	symbol, err := purego.Dlsym(lib, name)
+	if err != nil {
+		log.Infof("keychain diagnostics: %s unavailable: %v", name, err)
+		return
+	}
+	purego.RegisterFunc(ptr, symbol)
+}
diff --git a/client/internal/certproof/keystore.go b/client/internal/certproof/keystore.go
new file mode 100644
index 000000000..7ce676b4c
--- /dev/null
+++ b/client/internal/certproof/keystore.go
@@ -0,0 +1,77 @@
+package certproof
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/asn1"
+	"errors"
+	"fmt"
+	"math/big"
+	"slices"
+)
+
+var errUnsupportedScheme = errors.New("unsupported signature scheme for OS keystore")
+
+type sigScheme int
+
+const (
+	schemeECDSASHA256 sigScheme = iota + 1
+	schemeECDSASHA384
+	schemeRSAPSSSHA256
+)
+
+// schemeFor maps a crypto.Signer request onto the schemes the OS keystores perform.
+func schemeFor(pub crypto.PublicKey, opts crypto.SignerOpts) (sigScheme, error) {
+	switch pub.(type) {
+	case *ecdsa.PublicKey:
+		switch opts.HashFunc() {
+		case crypto.SHA256:
+			return schemeECDSASHA256, nil
+		case crypto.SHA384:
+			return schemeECDSASHA384, nil
+		}
+	case *rsa.PublicKey:
+		if pss, ok := opts.(*rsa.PSSOptions); ok && pss.Hash == crypto.SHA256 {
+			return schemeRSAPSSSHA256, nil
+		}
+	}
+	return 0, fmt.Errorf("%w: %T with %v", errUnsupportedScheme, pub, opts.HashFunc())
+}
+
+// buildChain extends leaf with the issuers found in pool up to a self-signed certificate.
+func buildChain(leaf *x509.Certificate, pool []*x509.Certificate) []*x509.Certificate {
+	chain := []*x509.Certificate{leaf}
+	current := leaf
+	for current.CheckSignatureFrom(current) != nil {
+		issuer := issuerIn(current, pool, chain)
+		if issuer == nil {
+			break
+		}
+		chain = append(chain, issuer)
+		current = issuer
+	}
+	return chain
+}
+
+func issuerIn(cert *x509.Certificate, pool, seen []*x509.Certificate) *x509.Certificate {
+	for _, candidate := range pool {
+		if slices.ContainsFunc(seen, candidate.Equal) {
+			continue
+		}
+		if cert.CheckSignatureFrom(candidate) == nil {
+			return candidate
+		}
+	}
+	return nil
+}
+
+// ecdsaSignatureASN1 converts the fixed-width r||s form emitted by CNG into the DER form Go verifies.
+func ecdsaSignatureASN1(raw []byte) ([]byte, error) {
+	if len(raw) == 0 || len(raw)%2 != 0 {
+		return nil, errors.New("malformed raw ECDSA signature")
+	}
+	half := len(raw) / 2
+	return asn1.Marshal(struct{ R, S *big.Int }{new(big.Int).SetBytes(raw[:half]), new(big.Int).SetBytes(raw[half:])})
+}
diff --git a/client/internal/certproof/keystore_test.go b/client/internal/certproof/keystore_test.go
new file mode 100644
index 000000000..592d7414f
--- /dev/null
+++ b/client/internal/certproof/keystore_test.go
@@ -0,0 +1,87 @@
+package certproof
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"crypto/x509"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/certposture/certtest"
+)
+
+func TestBuildChain_FollowsIssuersThroughThePool(t *testing.T) {
+	root := certtest.NewCA(t, "root")
+	intermediate := certtest.NewIntermediate(t, root, "intermediate")
+	unrelated := certtest.NewCA(t, "unrelated")
+	leaf := intermediate.Issue(t, certtest.ECDSAKey(t), "device")
+	pool := []*x509.Certificate{unrelated.Cert, root.Cert, leaf, intermediate.Cert}
+
+	chain := buildChain(leaf, pool)
+
+	require.Equal(t, []*x509.Certificate{leaf, intermediate.Cert, root.Cert}, chain)
+	roots, err := certposture.ParseCAs([]string{root.PEM})
+	require.NoError(t, err)
+	assert.NoError(t, certposture.VerifyChain(chain, roots, time.Now()))
+}
+
+func TestBuildChain_StopsWhereThePoolEnds(t *testing.T) {
+	root := certtest.NewCA(t, "root")
+	intermediate := certtest.NewIntermediate(t, root, "intermediate")
+	leaf := intermediate.Issue(t, certtest.ECDSAKey(t), "device")
+
+	assert.Equal(t, []*x509.Certificate{leaf}, buildChain(leaf, nil))
+	assert.Equal(t, []*x509.Certificate{leaf, intermediate.Cert}, buildChain(leaf, []*x509.Certificate{intermediate.Cert}))
+}
+
+func TestSchemeFor(t *testing.T) {
+	ecKey := certtest.ECDSAKey(t)
+	rsaKey := certtest.RSAKey(t)
+	pss := &rsa.PSSOptions{SaltLength: rsa.PSSSaltLengthEqualsHash, Hash: crypto.SHA256}
+
+	tests := []struct {
+		name string
+		pub  crypto.PublicKey
+		opts crypto.SignerOpts
+		want sigScheme
+	}{
+		{"ecdsa sha256", ecKey.Public(), crypto.SHA256, schemeECDSASHA256},
+		{"ecdsa sha384", ecKey.Public(), crypto.SHA384, schemeECDSASHA384},
+		{"rsa pss sha256", rsaKey.Public(), pss, schemeRSAPSSSHA256},
+		{"rsa pkcs1v15", rsaKey.Public(), crypto.SHA256, 0},
+		{"ed25519", certtest.Ed25519Key(t).Public(), crypto.Hash(0), 0},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := schemeFor(tc.pub, tc.opts)
+			if tc.want == 0 {
+				assert.ErrorIs(t, err, errUnsupportedScheme)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tc.want, got)
+		})
+	}
+}
+
+func TestECDSASignatureASN1(t *testing.T) {
+	key := certtest.ECDSAKey(t).(*ecdsa.PrivateKey)
+	digest := sha256.Sum256([]byte("nonce"))
+	r, s, err := ecdsa.Sign(rand.Reader, key, digest[:])
+	require.NoError(t, err)
+	raw := append(r.FillBytes(make([]byte, 32)), s.FillBytes(make([]byte, 32))...)
+
+	der, err := ecdsaSignatureASN1(raw)
+	require.NoError(t, err)
+	assert.True(t, ecdsa.VerifyASN1(&key.PublicKey, digest[:], der))
+
+	_, err = ecdsaSignatureASN1(raw[:63])
+	assert.Error(t, err)
+}
diff --git a/client/internal/certproof/pkcs11store.go b/client/internal/certproof/pkcs11store.go
new file mode 100644
index 000000000..24d0a3b5f
--- /dev/null
+++ b/client/internal/certproof/pkcs11store.go
@@ -0,0 +1,294 @@
+package certproof
+
+import (
+	"context"
+	"crypto"
+	"crypto/sha256"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"io"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/pkcs11"
+)
+
+// PKCS11Config names the token whose certificates the store yields. URI is an RFC 7512
+// PKCS#11 URI, or empty for the first token the p11-kit proxy exposes. PIN is the user
+// PIN, and takes precedence over a pin-value or pin-source the URI carries.
+type PKCS11Config struct {
+	URI string
+	PIN string
+}
+
+// PKCS11Store yields the identities of a PKCS#11 token, which is how tpm2-pkcs11 exposes
+// TPM-held keys on Linux. Certificates on the token are paired with keys by CKA_ID, the
+// convention tpm2_ptool addcert and pkcs11-tool follow; certificate files in the PEM
+// directory by public key. Every signature happens on the token.
+type PKCS11Store struct {
+	uri     *pkcs11.URI
+	pin     string
+	certDir string
+}
+
+// NewPKCS11Store parses cfg.URI, standing in the bare defaults when it is empty. Files in
+// certDir without a key of their own are paired with the token's keys by public key.
+func NewPKCS11Store(cfg PKCS11Config, certDir string) (*PKCS11Store, error) {
+	store := &PKCS11Store{uri: &pkcs11.URI{}, pin: cfg.PIN, certDir: certDir}
+	if cfg.URI == "" {
+		return store, nil
+	}
+	parsed, err := pkcs11.ParseURI(cfg.URI)
+	if err != nil {
+		return nil, err
+	}
+	store.uri = parsed
+	return store, nil
+}
+
+func (s *PKCS11Store) Candidates(_ context.Context) ([]Candidate, error) {
+	session, err := s.open()
+	if err != nil {
+		return nil, err
+	}
+	defer session.Close()
+
+	certs, err := tokenCertificates(session)
+	if err != nil {
+		return nil, err
+	}
+	fileChains, err := s.fileChains()
+	if err != nil {
+		return nil, err
+	}
+	log.Infof("%s holds %d certificates, %d certificate files without a key wait for its keys", s, len(certs), len(fileChains))
+
+	pool := make([]*x509.Certificate, 0, len(certs))
+	for _, cert := range certs {
+		pool = append(pool, cert.cert)
+	}
+	for _, chain := range fileChains {
+		pool = append(pool, chain...)
+	}
+
+	var candidates []Candidate
+	for _, cert := range certs {
+		if _, err := privateKey(session, cert.id); err != nil {
+			log.Infof("%s certificate %q has no usable private key: %v", s, cert.cert.Subject, err)
+			continue
+		}
+		candidates = append(candidates, s.candidate(cert.cert, cert.id, pool))
+	}
+	if len(fileChains) == 0 {
+		return candidates, nil
+	}
+
+	keys, err := tokenPublicKeys(session)
+	if err != nil {
+		return nil, err
+	}
+	for _, chain := range fileChains {
+		leaf := chain[0]
+		id, ok := keys.idFor(leaf.PublicKey)
+		if !ok {
+			log.Debugf("%s holds no key for certificate %q from %s", s, leaf.Subject, s.certDir)
+			continue
+		}
+		candidates = append(candidates, s.candidate(leaf, id, pool))
+	}
+	return candidates, nil
+}
+
+func (s *PKCS11Store) candidate(leaf *x509.Certificate, id []byte, pool []*x509.Certificate) Candidate {
+	chain := buildChain(leaf, pool)
+	log.Infof("%s candidate %q issued by %q built a chain of %d certificates", s, leaf.Subject, leaf.Issuer, len(chain))
+	return Candidate{Chain: chain, Signer: &pkcs11Signer{store: s, leaf: leaf, id: id}}
+}
+
+// fileChains reads the certificate files in the PEM directory that carry no key of their
+// own; the file store answers for the ones that do.
+func (s *PKCS11Store) fileChains() ([][]*x509.Certificate, error) {
+	if s.certDir == "" {
+		return nil, nil
+	}
+	paths, err := certFiles(s.certDir)
+	if err != nil {
+		return nil, err
+	}
+	var chains [][]*x509.Certificate
+	for _, path := range paths {
+		chain, signer, err := loadPEM(path)
+		if err != nil || signer != nil {
+			continue
+		}
+		chains = append(chains, chain)
+	}
+	return chains, nil
+}
+
+type tokenKey struct {
+	id     []byte
+	public crypto.PublicKey
+}
+
+type tokenKeys []tokenKey
+
+func tokenPublicKeys(session *pkcs11.Session) (tokenKeys, error) {
+	objects, err := session.FindObjects(pkcs11.Attribute{Type: pkcs11.AttrClass, Value: pkcs11.ULong(pkcs11.ClassPublicKey)})
+	if err != nil {
+		return nil, err
+	}
+	keys := make(tokenKeys, 0, len(objects))
+	for _, object := range objects {
+		id, err := session.Attribute(object, pkcs11.AttrID)
+		if err != nil {
+			return nil, err
+		}
+		public, err := session.PublicKey(object)
+		if err != nil {
+			log.Debugf("skipping public key on PKCS#11 token: %v", err)
+			continue
+		}
+		keys = append(keys, tokenKey{id: id, public: public})
+	}
+	return keys, nil
+}
+
+// idFor finds the token key whose public half is pub, so a certificate kept outside the
+// token is still signed for by the key inside it.
+func (k tokenKeys) idFor(pub crypto.PublicKey) ([]byte, bool) {
+	for _, key := range k {
+		equaler, ok := key.public.(interface{ Equal(crypto.PublicKey) bool })
+		if ok && len(key.id) > 0 && equaler.Equal(pub) {
+			return key.id, true
+		}
+	}
+	return nil, false
+}
+
+func (s *PKCS11Store) String() string {
+	if s.uri.Token == "" {
+		return "PKCS#11 token"
+	}
+	return fmt.Sprintf("PKCS#11 token %q", s.uri.Token)
+}
+
+func (s *PKCS11Store) open() (*pkcs11.Session, error) {
+	module, err := pkcs11.Load(s.uri.Module())
+	if err != nil {
+		return nil, err
+	}
+	pin, err := s.userPIN()
+	if err != nil {
+		return nil, err
+	}
+	return module.OpenSession(s.uri.Token, pin)
+}
+
+func (s *PKCS11Store) userPIN() ([]byte, error) {
+	if s.pin != "" {
+		return []byte(s.pin), nil
+	}
+	return s.uri.PIN()
+}
+
+type tokenCertificate struct {
+	cert *x509.Certificate
+	id   []byte
+}
+
+func tokenCertificates(session *pkcs11.Session) ([]tokenCertificate, error) {
+	objects, err := session.FindObjects(
+		pkcs11.Attribute{Type: pkcs11.AttrClass, Value: pkcs11.ULong(pkcs11.ClassCertificate)},
+		pkcs11.Attribute{Type: pkcs11.AttrCertificateType, Value: pkcs11.ULong(pkcs11.CertificateX509)},
+	)
+	if err != nil {
+		return nil, err
+	}
+	certs := make([]tokenCertificate, 0, len(objects))
+	for _, object := range objects {
+		der, err := session.Attribute(object, pkcs11.AttrValue)
+		if err != nil {
+			return nil, err
+		}
+		cert, err := x509.ParseCertificate(der)
+		if err != nil {
+			log.Warnf("skipping unparsable certificate on PKCS#11 token: %v", err)
+			continue
+		}
+		id, err := session.Attribute(object, pkcs11.AttrID)
+		if err != nil {
+			return nil, err
+		}
+		certs = append(certs, tokenCertificate{cert: cert, id: id})
+	}
+	return certs, nil
+}
+
+var errNoPrivateKey = errors.New("no private key shares the certificate's CKA_ID")
+
+func privateKey(session *pkcs11.Session, id []byte) (pkcs11.Object, error) {
+	if len(id) == 0 {
+		return 0, errNoPrivateKey
+	}
+	keys, err := session.FindObjects(
+		pkcs11.Attribute{Type: pkcs11.AttrClass, Value: pkcs11.ULong(pkcs11.ClassPrivateKey)},
+		pkcs11.Attribute{Type: pkcs11.AttrID, Value: id},
+	)
+	if err != nil {
+		return 0, err
+	}
+	if len(keys) == 0 {
+		return 0, errNoPrivateKey
+	}
+	return keys[0], nil
+}
+
+// pkcs11Signer holds only the certificate and its CKA_ID; the key is looked up in a fresh
+// session at signing time so no token handle outlives a call.
+type pkcs11Signer struct {
+	store *PKCS11Store
+	leaf  *x509.Certificate
+	id    []byte
+}
+
+func (s *pkcs11Signer) Public() crypto.PublicKey {
+	return s.leaf.PublicKey
+}
+
+func (s *pkcs11Signer) Sign(_ io.Reader, digest []byte, opts crypto.SignerOpts) ([]byte, error) {
+	scheme, err := schemeFor(s.leaf.PublicKey, opts)
+	if err != nil {
+		return nil, err
+	}
+	session, err := s.store.open()
+	if err != nil {
+		return nil, err
+	}
+	defer session.Close()
+
+	key, err := privateKey(session, s.id)
+	if err != nil {
+		return nil, err
+	}
+	signature, err := session.Sign(pkcs11Mechanism(scheme), key, digest)
+	if err != nil {
+		return nil, err
+	}
+	if scheme == schemeRSAPSSSHA256 {
+		return signature, nil
+	}
+	return ecdsaSignatureASN1(signature)
+}
+
+// pkcs11Mechanism maps a signature scheme onto the token mechanism that consumes a digest.
+func pkcs11Mechanism(scheme sigScheme) pkcs11.Mechanism {
+	if scheme == schemeRSAPSSSHA256 {
+		return pkcs11.Mechanism{
+			Type: pkcs11.MechRSAPKCSPSS,
+			PSS:  &pkcs11.PSSParams{Hash: pkcs11.MechSHA256, MGF: pkcs11.MGF1SHA256, SaltLen: sha256.Size},
+		}
+	}
+	return pkcs11.Mechanism{Type: pkcs11.MechECDSA}
+}
diff --git a/client/internal/certproof/pkcs11store_test.go b/client/internal/certproof/pkcs11store_test.go
new file mode 100644
index 000000000..2a99bb296
--- /dev/null
+++ b/client/internal/certproof/pkcs11store_test.go
@@ -0,0 +1,331 @@
+package certproof
+
+import (
+	"context"
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/asn1"
+	"errors"
+	"math/big"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/pkcs11"
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/certposture/certtest"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+const testPKCS11URIEnv = "NB_TEST_PKCS11_URI"
+
+type failingStore struct{}
+
+func (failingStore) Candidates(context.Context) ([]Candidate, error) {
+	return nil, errors.New("token unplugged")
+}
+
+func TestStores_KeepsFileCertificatesWhenTokenFails(t *testing.T) {
+	ca := certtest.NewCA(t, "corp")
+	key := certtest.ECDSAKey(t)
+	dir := t.TempDir()
+	writeFile(t, dir, "device.pem", certtest.CertPEM(ca.Issue(t, key, "device"))+certtest.KeyPEM(t, key))
+
+	candidates, err := Stores{failingStore{}, NewFileStore(dir)}.Candidates(context.Background())
+	require.NoError(t, err)
+	assert.Len(t, candidates, 1, "the directory's certificate must survive a failing token")
+}
+
+// TestCollect_PKCS11TokenEndToEnd needs an initialised token with a user PIN, named by
+// NB_TEST_PKCS11_URI. With SoftHSM:
+//
+//	softhsm2-util --init-token --free --label netbird --pin 1234 --so-pin 1234
+//	NB_TEST_PKCS11_URI='pkcs11:token=netbird?module-path=/usr/lib/softhsm/libsofthsm2.so&pin-value=1234' \
+//	  go test -tags pkcs11 ./client/internal/certproof/ -run PKCS11 -v
+//
+// It imports a key and its certificate as token objects, then proves the certificate
+// through the store the way the daemon would. Every run adds one more identity to the token.
+func TestCollect_PKCS11TokenEndToEnd(t *testing.T) {
+	store, uri := pkcs11TestStore(t, "")
+
+	keys := map[string]crypto.Signer{"ecdsa": certtest.ECDSAKey(t), "rsa": certtest.RSAKey(t)}
+	for name, key := range keys {
+		t.Run(name, func(t *testing.T) {
+			ca := certtest.NewCA(t, "corp-"+name)
+			leaf := ca.Issue(t, key, "device-"+name)
+			importIdentity(t, uri, key, leaf)
+
+			challenger := certposture.NewChallenger([]byte("secret"))
+			now := time.Now()
+			nonce := challenger.Nonce(peerKey, now)
+			checks := []*proto.Checks{{CertificateChallenge: &proto.CertificateChallenge{Nonce: nonce, CaCertificates: []string{ca.PEM}}}}
+
+			proofs := Collect(context.Background(), store, checks, peerKey)
+			require.Len(t, proofs, 1, "the token-held key must prove exactly this run's certificate")
+			chain, err := challenger.Verify(proofs[0], peerKey, now)
+			require.NoError(t, err)
+			assert.True(t, leaf.Equal(chain[0]), "proof must carry the imported certificate")
+		})
+	}
+}
+
+// Attribute types the import needs and the store does not.
+const (
+	attrPrivate         = 0x2
+	attrIssuer          = 0x81
+	attrSerialNumber    = 0x82
+	attrSensitive       = 0x103
+	attrSign            = 0x108
+	attrVerify          = 0x10a
+	attrPrivateExponent = 0x123
+	attrPrime1          = 0x124
+	attrPrime2          = 0x125
+	attrExponent1       = 0x126
+	attrExponent2       = 0x127
+	attrCoefficient     = 0x128
+)
+
+var (
+	ckTrue  = []byte{1}
+	ckFalse = []byte{0}
+	// The P-256 named curve OID in DER, which is what CKA_EC_PARAMS carries.
+	oidP256 = []byte{0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07}
+)
+
+// importIdentity stores key and leaf on the token the way tpm2_ptool import and addcert
+// do: private and public key objects plus the certificate, all under one CKA_ID.
+func importIdentity(t *testing.T, uri string, key crypto.Signer, leaf *x509.Certificate) {
+	t.Helper()
+	id := importKey(t, uri, key, leaf.Subject.CommonName)
+	importCertificate(t, uri, leaf, id)
+}
+
+func importKey(t *testing.T, uri string, key crypto.Signer, label string) []byte {
+	t.Helper()
+	session := readWriteSession(t, uri)
+	defer session.Close()
+
+	id := make([]byte, 8)
+	_, err := rand.Read(id)
+	require.NoError(t, err)
+
+	private := []pkcs11.Attribute{
+		attr(pkcs11.AttrClass, pkcs11.ULong(pkcs11.ClassPrivateKey)),
+		attr(pkcs11.AttrToken, ckTrue),
+		attr(attrPrivate, ckTrue),
+		attr(attrSensitive, ckTrue),
+		attr(attrSign, ckTrue),
+		attr(pkcs11.AttrLabel, []byte(label)),
+		attr(pkcs11.AttrID, id),
+	}
+	_, err = session.CreateObject(append(private, privateKeyAttributes(t, key)...)...)
+	require.NoError(t, err, "import private key")
+
+	public := []pkcs11.Attribute{
+		attr(pkcs11.AttrClass, pkcs11.ULong(pkcs11.ClassPublicKey)),
+		attr(pkcs11.AttrToken, ckTrue),
+		attr(attrPrivate, ckFalse),
+		attr(attrVerify, ckTrue),
+		attr(pkcs11.AttrLabel, []byte(label)),
+		attr(pkcs11.AttrID, id),
+	}
+	_, err = session.CreateObject(append(public, publicKeyAttributes(t, key)...)...)
+	require.NoError(t, err, "import public key")
+	return id
+}
+
+func importCertificate(t *testing.T, uri string, leaf *x509.Certificate, id []byte) {
+	t.Helper()
+	session := readWriteSession(t, uri)
+	defer session.Close()
+
+	serial, err := asn1.Marshal(leaf.SerialNumber)
+	require.NoError(t, err)
+	_, err = session.CreateObject(
+		attr(pkcs11.AttrClass, pkcs11.ULong(pkcs11.ClassCertificate)),
+		attr(pkcs11.AttrCertificateType, pkcs11.ULong(pkcs11.CertificateX509)),
+		attr(pkcs11.AttrToken, ckTrue),
+		attr(attrPrivate, ckFalse),
+		attr(pkcs11.AttrLabel, []byte(leaf.Subject.CommonName)),
+		attr(pkcs11.AttrID, id),
+		attr(pkcs11.AttrSubject, leaf.RawSubject),
+		attr(attrIssuer, leaf.RawIssuer),
+		attr(attrSerialNumber, serial),
+		attr(pkcs11.AttrValue, leaf.Raw),
+	)
+	require.NoError(t, err, "import certificate")
+}
+
+func readWriteSession(t *testing.T, uri string) *pkcs11.Session {
+	t.Helper()
+	parsed, err := pkcs11.ParseURI(uri)
+	require.NoError(t, err)
+	module, err := pkcs11.Load(parsed.Module())
+	require.NoError(t, err)
+	pin, err := parsed.PIN()
+	require.NoError(t, err)
+	session, err := module.OpenReadWriteSession(parsed.Token, pin)
+	require.NoError(t, err)
+	return session
+}
+
+func privateKeyAttributes(t *testing.T, key crypto.Signer) []pkcs11.Attribute {
+	t.Helper()
+	switch k := key.(type) {
+	case *ecdsa.PrivateKey:
+		return []pkcs11.Attribute{
+			attr(pkcs11.AttrKeyType, pkcs11.ULong(pkcs11.KeyEC)),
+			attr(pkcs11.AttrECParams, oidP256),
+			attr(pkcs11.AttrValue, k.D.FillBytes(make([]byte, 32))),
+		}
+	case *rsa.PrivateKey:
+		k.Precompute()
+		return []pkcs11.Attribute{
+			attr(pkcs11.AttrKeyType, pkcs11.ULong(pkcs11.KeyRSA)),
+			attr(pkcs11.AttrModulus, k.N.Bytes()),
+			attr(pkcs11.AttrPublicExponent, big.NewInt(int64(k.E)).Bytes()),
+			attr(attrPrivateExponent, k.D.Bytes()),
+			attr(attrPrime1, k.Primes[0].Bytes()),
+			attr(attrPrime2, k.Primes[1].Bytes()),
+			attr(attrExponent1, k.Precomputed.Dp.Bytes()),
+			attr(attrExponent2, k.Precomputed.Dq.Bytes()),
+			attr(attrCoefficient, k.Precomputed.Qinv.Bytes()),
+		}
+	}
+	t.Fatalf("unsupported key %T", key)
+	return nil
+}
+
+// publicKeyAttributes describes the CKO_PUBLIC_KEY object tokens keep next to a private
+// key, which is what the store reads to pair a certificate file with its key.
+func publicKeyAttributes(t *testing.T, key crypto.Signer) []pkcs11.Attribute {
+	t.Helper()
+	switch k := key.(type) {
+	case *ecdsa.PrivateKey:
+		point := append([]byte{4}, k.X.FillBytes(make([]byte, 32))...)
+		point = append(point, k.Y.FillBytes(make([]byte, 32))...)
+		wrapped, err := asn1.Marshal(point)
+		require.NoError(t, err)
+		return []pkcs11.Attribute{
+			attr(pkcs11.AttrKeyType, pkcs11.ULong(pkcs11.KeyEC)),
+			attr(pkcs11.AttrECParams, oidP256),
+			attr(pkcs11.AttrECPoint, wrapped),
+		}
+	case *rsa.PrivateKey:
+		return []pkcs11.Attribute{
+			attr(pkcs11.AttrKeyType, pkcs11.ULong(pkcs11.KeyRSA)),
+			attr(pkcs11.AttrModulus, k.N.Bytes()),
+			attr(pkcs11.AttrPublicExponent, big.NewInt(int64(k.E)).Bytes()),
+		}
+	}
+	t.Fatalf("unsupported key %T", key)
+	return nil
+}
+
+func attr(typ uint, value []byte) pkcs11.Attribute {
+	return pkcs11.Attribute{Type: typ, Value: value}
+}
+
+// pkcs11TestStore builds the store for the token NB_TEST_PKCS11_URI names, skipping when
+// no token is configured or this build lacks PKCS#11 support.
+func pkcs11TestStore(t *testing.T, certDir string) (*PKCS11Store, string) {
+	t.Helper()
+	uri := os.Getenv(testPKCS11URIEnv)
+	if uri == "" {
+		t.Skipf("set %s to a PKCS#11 URI with a PIN to run", testPKCS11URIEnv)
+	}
+	store, err := NewPKCS11Store(PKCS11Config{URI: uri}, certDir)
+	require.NoError(t, err)
+	if _, err := pkcs11.Load(store.uri.Module()); errors.Is(err, pkcs11.ErrUnsupported) {
+		t.Skip(err)
+	}
+	return store, uri
+}
+
+// TestCollect_PKCS11KeyWithFileCertificate covers the split layout: the key lives on the
+// token, the certificate is a PEM file in the directory, and the two are paired by public
+// key because nothing on the token carries the certificate's CKA_ID.
+func TestCollect_PKCS11KeyWithFileCertificate(t *testing.T) {
+	dir := t.TempDir()
+	store, uri := pkcs11TestStore(t, dir)
+
+	keys := map[string]crypto.Signer{"ecdsa": certtest.ECDSAKey(t), "rsa": certtest.RSAKey(t)}
+	for name, key := range keys {
+		t.Run(name, func(t *testing.T) {
+			ca := certtest.NewCA(t, "corp-file-"+name)
+			leaf := ca.Issue(t, key, "device-file-"+name)
+			importKey(t, uri, key, "device-file-"+name)
+			writeFile(t, dir, "device-"+name+".pem", certtest.CertPEM(leaf))
+
+			challenger := certposture.NewChallenger([]byte("secret"))
+			now := time.Now()
+			nonce := challenger.Nonce(peerKey, now)
+			checks := []*proto.Checks{{CertificateChallenge: &proto.CertificateChallenge{Nonce: nonce, CaCertificates: []string{ca.PEM}}}}
+
+			proofs := Collect(context.Background(), store, checks, peerKey)
+			require.Len(t, proofs, 1, "the token key must prove the certificate kept on disk")
+			chain, err := challenger.Verify(proofs[0], peerKey, now)
+			require.NoError(t, err)
+			assert.True(t, leaf.Equal(chain[0]), "proof must carry the certificate from the directory")
+		})
+	}
+}
+
+func TestPKCS11Store_FileChains(t *testing.T) {
+	ca := certtest.NewCA(t, "corp")
+	dir := t.TempDir()
+	// Only certificate files without a key of their own belong to the token; the file
+	// store answers for the others, and non-certificate files are ignored.
+	writeFile(t, dir, "device.pem", certtest.CertPEM(ca.Issue(t, certtest.ECDSAKey(t), "device")))
+	writeFile(t, dir, "ca.crt", ca.PEM)
+	keyed := certtest.ECDSAKey(t)
+	writeFile(t, dir, "inline.pem", certtest.CertPEM(ca.Issue(t, keyed, "inline"))+certtest.KeyPEM(t, keyed))
+	writeFile(t, dir, "sibling.crt", certtest.CertPEM(ca.Issue(t, keyed, "sibling")))
+	writeFile(t, dir, "sibling.key", certtest.KeyPEM(t, keyed))
+	writeFile(t, dir, "notes.txt", "not a certificate")
+
+	chains, err := (&PKCS11Store{uri: &pkcs11.URI{}, certDir: dir}).fileChains()
+	require.NoError(t, err)
+	var subjects []string
+	for _, chain := range chains {
+		subjects = append(subjects, chain[0].Subject.CommonName)
+	}
+	assert.ElementsMatch(t, []string{"device", "corp"}, subjects, "only key-less certificate files are left to the token")
+
+	chains, err = (&PKCS11Store{uri: &pkcs11.URI{}}).fileChains()
+	require.NoError(t, err)
+	assert.Empty(t, chains, "no directory configured means no file certificates")
+}
+
+func TestNewPKCS11Store_PIN(t *testing.T) {
+	tests := []struct {
+		name       string
+		cfg        PKCS11Config
+		wantPIN    []byte
+		wantModule string
+	}{
+		{"pin alone opens the first p11-kit token", PKCS11Config{PIN: "1234"}, []byte("1234"), pkcs11.DefaultModule},
+		{"pin field wins over pin-value", PKCS11Config{URI: "pkcs11:?module-path=/lib/x.so&pin-value=0000", PIN: "1234"}, []byte("1234"), "/lib/x.so"},
+		{"uri pin-value stands in for a missing field", PKCS11Config{URI: "pkcs11:?pin-value=0000"}, []byte("0000"), pkcs11.DefaultModule},
+		{"no pin at all means no login", PKCS11Config{URI: "pkcs11:token=netbird"}, nil, pkcs11.DefaultModule},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			store, err := NewPKCS11Store(tt.cfg, "")
+			require.NoError(t, err)
+			pin, err := store.userPIN()
+			require.NoError(t, err)
+			assert.Equal(t, tt.wantPIN, pin, "PIN, nil meaning no login")
+			assert.Equal(t, tt.wantModule, store.uri.Module(), "module to load")
+		})
+	}
+
+	_, err := NewPKCS11Store(PKCS11Config{URI: "not-a-pkcs11-uri", PIN: "1234"}, "")
+	assert.Error(t, err, "a malformed URI must not be silently replaced by the defaults")
+}
diff --git a/client/internal/certproof/store.go b/client/internal/certproof/store.go
new file mode 100644
index 000000000..666bb1be3
--- /dev/null
+++ b/client/internal/certproof/store.go
@@ -0,0 +1,215 @@
+package certproof
+
+import (
+	"context"
+	"crypto"
+	"crypto/x509"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/tpm"
+)
+
+const (
+	StoreDirEnv     = "NB_CERT_STORE_DIR"
+	defaultStoreDir = "/etc/netbird/certs"
+)
+
+// Candidate is a certificate chain the peer can sign for. Signer never exposes the key.
+type Candidate struct {
+	Chain  []*x509.Certificate
+	Signer crypto.Signer
+}
+
+// Store yields the certificates a peer may prove possession of. FileStore is the PEM
+// directory implementation; OS keystores (CNG, Keychain, PKCS#11) slot in here.
+type Store interface {
+	Candidates(ctx context.Context) ([]Candidate, error)
+}
+
+// Config selects where the Linux daemon looks for certificates: Dir is the PEM directory,
+// empty for NB_CERT_STORE_DIR or /etc/netbird/certs, and PKCS11 names a token whose keys
+// sign for certificates on the token or in that directory.
+type Config struct {
+	Dir    string
+	PKCS11 PKCS11Config
+}
+
+func (c Config) dir() string {
+	if c.Dir != "" {
+		return c.Dir
+	}
+	return StoreDir()
+}
+
+// FileStore reads PEM files from a directory. A file holds the chain (leaf first) and
+// either its private key or a sibling "<name>.key" file holds it. The key is a plain
+// PKCS#8, EC or RSA key, or a TSS2 key the TPM signs with.
+type FileStore struct {
+	dir string
+}
+
+func NewFileStore(dir string) *FileStore {
+	return &FileStore{dir: dir}
+}
+
+func StoreDir() string {
+	if dir := os.Getenv(StoreDirEnv); dir != "" {
+		return dir
+	}
+	return defaultStoreDir
+}
+
+func (s *FileStore) Candidates(_ context.Context) ([]Candidate, error) {
+	paths, err := certFiles(s.dir)
+	if err != nil {
+		return nil, err
+	}
+
+	var candidates []Candidate
+	for _, path := range paths {
+		chain, signer, err := loadPEM(path)
+		if err != nil {
+			log.Warnf("skipping certificate %s: %v", path, err)
+			continue
+		}
+		if signer == nil {
+			log.Debugf("certificate %s has no key file, only a token can sign for it", path)
+			continue
+		}
+		candidates = append(candidates, Candidate{Chain: chain, Signer: signer})
+	}
+	return candidates, nil
+}
+
+// certFiles lists the certificate files in dir, none when the directory does not exist.
+func certFiles(dir string) ([]string, error) {
+	entries, err := os.ReadDir(dir)
+	if errors.Is(err, os.ErrNotExist) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, fmt.Errorf("read certificate store %s: %w", dir, err)
+	}
+	var paths []string
+	for _, entry := range entries {
+		if !entry.IsDir() && isCertFile(entry.Name()) {
+			paths = append(paths, filepath.Join(dir, entry.Name()))
+		}
+	}
+	return paths, nil
+}
+
+// loadPEM reads a certificate file and its private key, held in the file itself or in
+// the sibling "<name>.key" file. The signer is nil when neither holds a key.
+func loadPEM(path string) ([]*x509.Certificate, crypto.Signer, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, nil, err
+	}
+	chain, signer, err := parsePEM(data)
+	if err != nil {
+		return nil, nil, err
+	}
+	if len(chain) == 0 {
+		return nil, nil, errors.New("no certificate")
+	}
+	if signer != nil {
+		return chain, signer, nil
+	}
+	keyData, err := os.ReadFile(strings.TrimSuffix(path, filepath.Ext(path)) + ".key")
+	if errors.Is(err, os.ErrNotExist) {
+		return chain, nil, nil
+	}
+	if err != nil {
+		return nil, nil, fmt.Errorf("read key file: %w", err)
+	}
+	if _, signer, err = parsePEM(keyData); err != nil {
+		return nil, nil, err
+	}
+	if signer == nil {
+		return nil, nil, errors.New("no private key in key file")
+	}
+	return chain, signer, nil
+}
+
+func parsePEM(data []byte) ([]*x509.Certificate, crypto.Signer, error) {
+	var chain []*x509.Certificate
+	var signer crypto.Signer
+	for {
+		var block *pem.Block
+		block, data = pem.Decode(data)
+		if block == nil {
+			return chain, signer, nil
+		}
+		switch block.Type {
+		case "CERTIFICATE":
+			cert, err := x509.ParseCertificate(block.Bytes)
+			if err != nil {
+				return nil, nil, fmt.Errorf("parse certificate: %w", err)
+			}
+			chain = append(chain, cert)
+		case "PRIVATE KEY", "EC PRIVATE KEY", "RSA PRIVATE KEY", tpm.KeyPEMType:
+			key, err := parsePrivateKey(block)
+			if err != nil {
+				return nil, nil, err
+			}
+			signer = key
+		}
+	}
+}
+
+func parsePrivateKey(block *pem.Block) (crypto.Signer, error) {
+	var key any
+	var err error
+	switch block.Type {
+	case tpm.KeyPEMType:
+		return tpm.ParseKey(block.Bytes)
+	case "EC PRIVATE KEY":
+		key, err = x509.ParseECPrivateKey(block.Bytes)
+	case "RSA PRIVATE KEY":
+		key, err = x509.ParsePKCS1PrivateKey(block.Bytes)
+	default:
+		key, err = x509.ParsePKCS8PrivateKey(block.Bytes)
+	}
+	if err != nil {
+		return nil, fmt.Errorf("parse private key: %w", err)
+	}
+	signer, ok := key.(crypto.Signer)
+	if !ok {
+		return nil, errors.New("private key cannot sign")
+	}
+	return signer, nil
+}
+
+func isCertFile(name string) bool {
+	switch strings.ToLower(filepath.Ext(name)) {
+	case ".pem", ".crt", ".cer":
+		return true
+	}
+	return false
+}
+
+// Stores queries several stores and carries on when one fails, so a broken token cannot
+// hide the certificates a directory holds. A failure is logged instead of returned
+// because Collect treats a store error as "no proofs at all".
+type Stores []Store
+
+func (s Stores) Candidates(ctx context.Context) ([]Candidate, error) {
+	var all []Candidate
+	for _, store := range s {
+		candidates, err := store.Candidates(ctx)
+		if err != nil {
+			log.Warnf("certificate store %T unavailable: %v", store, err)
+			continue
+		}
+		all = append(all, candidates...)
+	}
+	return all, nil
+}
diff --git a/client/internal/certproof/store_other.go b/client/internal/certproof/store_other.go
new file mode 100644
index 000000000..be467fa51
--- /dev/null
+++ b/client/internal/certproof/store_other.go
@@ -0,0 +1,25 @@
+//go:build !darwin && !windows
+
+package certproof
+
+import log "github.com/sirupsen/logrus"
+
+// DefaultStore is the PEM directory named by NB_CERT_STORE_DIR, or /etc/netbird/certs.
+func DefaultStore() Store {
+	return NewFileStore(StoreDir())
+}
+
+// storeWithToken reads the PEM directory cfg names, joined by the PKCS#11 token when cfg
+// names one. The token pairs the directory's key-less certificates with its own keys.
+func storeWithToken(cfg Config) Store {
+	files := NewFileStore(cfg.dir())
+	if cfg.PKCS11.URI == "" && cfg.PKCS11.PIN == "" {
+		return files
+	}
+	token, err := NewPKCS11Store(cfg.PKCS11, cfg.dir())
+	if err != nil {
+		log.Warnf("ignoring PKCS#11 URI: %v", err)
+		return files
+	}
+	return Stores{files, token}
+}
diff --git a/client/internal/certproof/store_other_test.go b/client/internal/certproof/store_other_test.go
new file mode 100644
index 000000000..5787df9f9
--- /dev/null
+++ b/client/internal/certproof/store_other_test.go
@@ -0,0 +1,36 @@
+//go:build !darwin && !windows
+
+package certproof
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestStoreWithToken(t *testing.T) {
+	dir := t.TempDir()
+
+	files, ok := storeWithToken(Config{Dir: dir}).(*FileStore)
+	require.True(t, ok, "a directory alone reads that directory alone")
+	assert.Equal(t, dir, files.dir, "the configured directory replaces the default")
+
+	files, ok = storeWithToken(Config{}).(*FileStore)
+	require.True(t, ok, "nothing configured reads the PEM directory alone")
+	assert.Equal(t, StoreDir(), files.dir, "no directory configured falls back to the environment or the default")
+
+	assert.IsType(t, &FileStore{}, storeWithToken(Config{PKCS11: PKCS11Config{URI: "not-a-pkcs11-uri"}}), "an invalid URI must not hide the PEM directory")
+
+	for name, cfg := range map[string]PKCS11Config{
+		"pin alone": {PIN: "1234"},
+		"uri alone": {URI: "pkcs11:token=netbird?pin-value=1234"},
+	} {
+		store, ok := storeWithToken(Config{Dir: dir, PKCS11: cfg}).(Stores)
+		require.True(t, ok, "%s joins the token to the PEM directory", name)
+		require.Len(t, store, 2, name)
+		token, ok := store[1].(*PKCS11Store)
+		require.True(t, ok, name)
+		assert.Equal(t, dir, token.certDir, "%s: the token pairs certificates from the same directory", name)
+	}
+}
diff --git a/client/internal/certproof/store_tpm_test.go b/client/internal/certproof/store_tpm_test.go
new file mode 100644
index 000000000..09f54e0b0
--- /dev/null
+++ b/client/internal/certproof/store_tpm_test.go
@@ -0,0 +1,98 @@
+package certproof
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"encoding/pem"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/google/go-tpm/legacy/tpm2"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.step.sm/crypto/tpm/tss2"
+
+	"github.com/netbirdio/netbird/client/internal/tpm"
+	"github.com/netbirdio/netbird/client/internal/tpm/tpmtest"
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/certposture/certtest"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+func TestFileStore_TPMKeyFile(t *testing.T) {
+	ca := certtest.NewCA(t, "corp")
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+	leaf := ca.Issue(t, key, "device")
+
+	dir := t.TempDir()
+	writeFile(t, dir, "device.pem", certtest.CertPEM(leaf))
+	writeFile(t, dir, "device.key", tpmtest.KeyPEM(t, &key.PublicKey))
+
+	// A key that needs a password can never be used silently, so its certificate is skipped.
+	locked := certtest.ECDSAKey(t)
+	withAuth := func(k *tss2.TPMKey) { k.EmptyAuth = false }
+	writeFile(t, dir, "locked.pem", certtest.CertPEM(ca.Issue(t, locked, "locked")))
+	writeFile(t, dir, "locked.key", tpmtest.KeyPEM(t, locked.Public().(*ecdsa.PublicKey), withAuth))
+
+	candidates, err := NewFileStore(dir).Candidates(context.Background())
+	require.NoError(t, err)
+	require.Len(t, candidates, 1, "only the key without an authorization value is usable")
+	assert.True(t, leaf.Equal(candidates[0].Chain[0]), "candidate must carry the device certificate")
+	assert.True(t, key.PublicKey.Equal(candidates[0].Signer.Public()), "signer must report the certificate's key")
+}
+
+// TestCollect_TPMKeyEndToEnd runs against the TPM named by NB_TPM_DEVICE, for example a
+// swtpm started with:
+//
+//	swtpm socket --tpm2 --server type=unixio,path=/tmp/swtpm.sock \
+//	  --ctrl type=unixio,path=/tmp/swtpm.ctrl --flags not-need-init,startup-clear
+//
+// It creates a key the way tpm2-openssl does, under a transient ECC primary in the owner
+// hierarchy, and proves the certificate for it through the regular file store.
+func TestCollect_TPMKeyEndToEnd(t *testing.T) {
+	if os.Getenv(tpm.DeviceEnv) == "" {
+		t.Skipf("set %s to a TPM device or swtpm socket to run", tpm.DeviceEnv)
+	}
+	public, private := createTPMKey(t)
+	keyPEM := tpmtest.EncodePEM(t, public, private)
+	block, _ := pem.Decode([]byte(keyPEM))
+	require.NotNil(t, block)
+	signer, err := tpm.ParseKey(block.Bytes)
+	require.NoError(t, err)
+
+	ca := certtest.NewCA(t, "corp")
+	leaf := ca.Issue(t, signer, "device")
+	dir := t.TempDir()
+	writeFile(t, dir, "device.pem", certtest.CertPEM(leaf))
+	writeFile(t, dir, "device.key", keyPEM)
+
+	challenger := certposture.NewChallenger([]byte("secret"))
+	now := time.Now()
+	nonce := challenger.Nonce(peerKey, now)
+	checks := []*proto.Checks{{CertificateChallenge: &proto.CertificateChallenge{Nonce: nonce, CaCertificates: []string{ca.PEM}}}}
+
+	proofs := Collect(context.Background(), NewFileStore(dir), checks, peerKey)
+	require.Len(t, proofs, 1, "the TPM-held key must prove the certificate")
+	chain, err := challenger.Verify(proofs[0], peerKey, now)
+	require.NoError(t, err)
+	assert.True(t, leaf.Equal(chain[0]), "proof must carry the device certificate")
+}
+
+func createTPMKey(t *testing.T) (public, private []byte) {
+	t.Helper()
+	rwc, err := tpm.Open()
+	require.NoError(t, err)
+	defer func() { _ = rwc.Close() }()
+
+	parent, _, err := tpm2.CreatePrimary(rwc, tpm2.HandleOwner, tpm2.PCRSelection{}, "", "", tss2.ECCSRKTemplate)
+	require.NoError(t, err)
+	defer func() { _ = tpm2.FlushContext(rwc, parent) }()
+
+	private, public, _, _, _, err = tpm2.CreateKey(rwc, parent, tpm2.PCRSelection{}, "", "", tpmtest.SigningTemplate())
+	require.NoError(t, err)
+	return public, private
+}
diff --git a/client/internal/certproof/systemstore_windows.go b/client/internal/certproof/systemstore_windows.go
new file mode 100644
index 000000000..0a91aa557
--- /dev/null
+++ b/client/internal/certproof/systemstore_windows.go
@@ -0,0 +1,251 @@
+package certproof
+
+import (
+	"bytes"
+	"context"
+	"crypto"
+	"crypto/sha256"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"io"
+	"slices"
+	"unsafe"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+)
+
+const (
+	personalStore     = "MY"
+	intermediateStore = "CA"
+
+	cryptAcquireSilentFlag          = 0x00000040
+	cryptAcquirePreferNCryptKeyFlag = 0x00020000
+	certNCryptKeySpec               = 0xFFFFFFFF
+	bcryptPadPSS                    = 0x00000008
+)
+
+var (
+	crypt32 = windows.NewLazySystemDLL("crypt32.dll")
+	ncrypt  = windows.NewLazySystemDLL("ncrypt.dll")
+
+	procCryptAcquireCertificatePrivateKey = crypt32.NewProc("CryptAcquireCertificatePrivateKey")
+	procNCryptSignHash                    = ncrypt.NewProc("NCryptSignHash")
+	procNCryptFreeObject                  = ncrypt.NewProc("NCryptFreeObject")
+)
+
+type bcryptPSSPaddingInfo struct {
+	algID *uint16
+	salt  uint32
+}
+
+// DefaultStore is the local machine's personal certificate store, where device
+// certificates enrolled through AD or Intune are kept.
+func DefaultStore() Store {
+	return NewSystemStore()
+}
+
+// SystemStore yields the identities of a personal certificate store, completing their
+// chains from the matching intermediate CA store. Keys are used through CNG and never
+// exported.
+//
+// The location decides whose certificates these are. The local machine store is the one
+// a service reads; the current user store lives in the signed-in user's registry hive
+// with keys protected against their profile, so it is only readable while running as
+// that user.
+type SystemStore struct {
+	location uint32
+}
+
+// NewSystemStore reads the local machine store, which is what the daemon uses.
+func NewSystemStore() *SystemStore {
+	return &SystemStore{location: windows.CERT_SYSTEM_STORE_LOCAL_MACHINE}
+}
+
+// NewUserStore reads the calling user's personal store. It is only useful in a process
+// already running as that user, which is what the posture helper is.
+func NewUserStore() *SystemStore {
+	return &SystemStore{location: windows.CERT_SYSTEM_STORE_CURRENT_USER}
+}
+
+func (s *SystemStore) Candidates(_ context.Context) ([]Candidate, error) {
+	leaves, err := storeCertificates(s.location, personalStore)
+	if err != nil {
+		return nil, err
+	}
+	intermediates, err := storeCertificates(s.location, intermediateStore)
+	if err != nil {
+		return nil, err
+	}
+	log.Infof("certificate store %s holds %d personal certificates and %d intermediates", s, len(leaves), len(intermediates))
+	if len(leaves) == 0 {
+		return nil, nil
+	}
+
+	pool := slices.Concat(intermediates, leaves)
+	candidates := make([]Candidate, 0, len(leaves))
+	for _, leaf := range leaves {
+		chain := buildChain(leaf, pool)
+		log.Infof("certificate store %s candidate %q issued by %q built a chain of %d certificates", s, leaf.Subject, leaf.Issuer, len(chain))
+		candidates = append(candidates, Candidate{Chain: chain, Signer: &systemStoreSigner{leaf: leaf, location: s.location}})
+	}
+	return candidates, nil
+}
+
+// String names the store location the way the Windows documentation does.
+func (s *SystemStore) String() string {
+	if s.location == windows.CERT_SYSTEM_STORE_CURRENT_USER {
+		return "CurrentUser"
+	}
+	return "LocalMachine"
+}
+
+// systemStoreSigner holds only the certificate; the store entry and its key are acquired
+// at signing time so no handles outlive a call.
+type systemStoreSigner struct {
+	leaf     *x509.Certificate
+	location uint32
+}
+
+func (s *systemStoreSigner) Public() crypto.PublicKey {
+	return s.leaf.PublicKey
+}
+
+func (s *systemStoreSigner) Sign(_ io.Reader, digest []byte, opts crypto.SignerOpts) ([]byte, error) {
+	scheme, err := schemeFor(s.leaf.PublicKey, opts)
+	if err != nil {
+		return nil, err
+	}
+	store, err := openStore(s.location, personalStore)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = windows.CertCloseStore(store, 0) }()
+
+	var signature []byte
+	err = eachCertificate(store, func(ctx *windows.CertContext) (bool, error) {
+		if !bytes.Equal(encodedCert(ctx), s.leaf.Raw) {
+			return false, nil
+		}
+		signature, err = signWithContext(ctx, scheme, digest)
+		return true, err
+	})
+	if err != nil {
+		return nil, err
+	}
+	if signature == nil {
+		return nil, errors.New("certificate is no longer in the personal store")
+	}
+	return signature, nil
+}
+
+func signWithContext(ctx *windows.CertContext, scheme sigScheme, digest []byte) ([]byte, error) {
+	var key uintptr
+	var keySpec uint32
+	var callerFree int32
+	ok, _, err := procCryptAcquireCertificatePrivateKey.Call(uintptr(unsafe.Pointer(ctx)), cryptAcquireSilentFlag|cryptAcquirePreferNCryptKeyFlag, 0,
+		uintptr(unsafe.Pointer(&key)), uintptr(unsafe.Pointer(&keySpec)), uintptr(unsafe.Pointer(&callerFree)))
+	if ok == 0 {
+		return nil, fmt.Errorf("acquire private key: %w", err)
+	}
+	if keySpec != certNCryptKeySpec {
+		if callerFree != 0 {
+			_ = windows.CryptReleaseContext(windows.Handle(key), 0)
+		}
+		return nil, errors.New("legacy CryptoAPI keys are not supported")
+	}
+	if callerFree != 0 {
+		defer func() { _, _, _ = procNCryptFreeObject.Call(key) }()
+	}
+
+	var padding unsafe.Pointer
+	var flags uintptr
+	if scheme == schemeRSAPSSSHA256 {
+		algID, _ := windows.UTF16PtrFromString("SHA256")
+		info := bcryptPSSPaddingInfo{algID: algID, salt: sha256.Size}
+		padding, flags = unsafe.Pointer(&info), bcryptPadPSS
+	}
+	size, err := ncryptSignHash(key, padding, digest, nil, flags)
+	if err != nil {
+		return nil, err
+	}
+	signature := make([]byte, size)
+	if size, err = ncryptSignHash(key, padding, digest, signature, flags); err != nil {
+		return nil, err
+	}
+	signature = signature[:size]
+	if scheme == schemeRSAPSSSHA256 {
+		return signature, nil
+	}
+	return ecdsaSignatureASN1(signature)
+}
+
+func ncryptSignHash(key uintptr, padding unsafe.Pointer, digest, signature []byte, flags uintptr) (uint32, error) {
+	var result uint32
+	var signaturePtr uintptr
+	if len(signature) > 0 {
+		signaturePtr = uintptr(unsafe.Pointer(&signature[0]))
+	}
+	status, _, _ := procNCryptSignHash.Call(key, uintptr(padding), uintptr(unsafe.Pointer(&digest[0])), uintptr(len(digest)),
+		signaturePtr, uintptr(len(signature)), uintptr(unsafe.Pointer(&result)), flags)
+	if uint32(status) != 0 {
+		return 0, fmt.Errorf("NCryptSignHash: 0x%08x", uint32(status))
+	}
+	return result, nil
+}
+
+func storeCertificates(location uint32, name string) ([]*x509.Certificate, error) {
+	store, err := openStore(location, name)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = windows.CertCloseStore(store, 0) }()
+
+	var certs []*x509.Certificate
+	err = eachCertificate(store, func(ctx *windows.CertContext) (bool, error) {
+		cert, err := x509.ParseCertificate(bytes.Clone(encodedCert(ctx)))
+		if err != nil {
+			log.Warnf("skipping certificate in %s store: %v", name, err)
+			return false, nil
+		}
+		certs = append(certs, cert)
+		return false, nil
+	})
+	return certs, err
+}
+
+func openStore(location uint32, name string) (windows.Handle, error) {
+	namePtr, err := windows.UTF16PtrFromString(name)
+	if err != nil {
+		return 0, err
+	}
+	flags := location | uint32(windows.CERT_STORE_READONLY_FLAG|windows.CERT_STORE_OPEN_EXISTING_FLAG)
+	store, err := windows.CertOpenStore(windows.CERT_STORE_PROV_SYSTEM, 0, 0, flags, uintptr(unsafe.Pointer(namePtr)))
+	if err != nil {
+		return 0, fmt.Errorf("open %s certificate store: %w", name, err)
+	}
+	return store, nil
+}
+
+func eachCertificate(store windows.Handle, fn func(*windows.CertContext) (bool, error)) error {
+	var ctx *windows.CertContext
+	for {
+		next, err := windows.CertEnumCertificatesInStore(store, ctx)
+		if next == nil {
+			if errors.Is(err, windows.Errno(windows.CRYPT_E_NOT_FOUND)) || errors.Is(err, windows.ERROR_NO_MORE_FILES) {
+				return nil
+			}
+			return fmt.Errorf("enumerate certificates: %w", err)
+		}
+		ctx = next
+		if stop, err := fn(ctx); stop || err != nil {
+			_ = windows.CertFreeCertificateContext(ctx)
+			return err
+		}
+	}
+}
+
+func encodedCert(ctx *windows.CertContext) []byte {
+	return unsafe.Slice(ctx.EncodedCert, ctx.Length)
+}
diff --git a/client/internal/connect.go b/client/internal/connect.go
index b42ef9818..3283b8897 100644
--- a/client/internal/connect.go
+++ b/client/internal/connect.go
@@ -26,6 +26,7 @@ import (
 	"github.com/netbirdio/netbird/client/iface"
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/netstack"
+	"github.com/netbirdio/netbird/client/internal/certproof"
 	"github.com/netbirdio/netbird/client/internal/dns"
 	"github.com/netbirdio/netbird/client/internal/lazyconn"
 	"github.com/netbirdio/netbird/client/internal/listener"
@@ -675,6 +676,11 @@ func createEngineConfig(key wgtypes.Key, config *profilemanager.Config, peerConf
 
 		LazyConnection: lazyconn.ParseState(config.LazyConnection),
 
+		CertStore: certproof.Config{
+			Dir:    config.CertStoreDir,
+			PKCS11: certproof.PKCS11Config{URI: config.CertPKCS11URI, PIN: config.CertPKCS11PIN},
+		},
+
 		MTU:     selectMTU(config.MTU, peerConfig.Mtu),
 		LogPath: logPath,
 
diff --git a/client/internal/engine.go b/client/internal/engine.go
index ccff974d8..cb957eb2c 100644
--- a/client/internal/engine.go
+++ b/client/internal/engine.go
@@ -37,6 +37,7 @@ import (
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/internal/acl"
+	"github.com/netbirdio/netbird/client/internal/certproof"
 	"github.com/netbirdio/netbird/client/internal/debug"
 	"github.com/netbirdio/netbird/client/internal/dns"
 	dnsconfig "github.com/netbirdio/netbird/client/internal/dns/config"
@@ -170,6 +171,8 @@ type EngineConfig struct {
 
 	MTU uint16
 
+	CertStore certproof.Config
+
 	// for debug bundle generation
 	ProfileConfig *profilemanager.Config
 
@@ -1240,6 +1243,7 @@ func (e *Engine) updateChecksIfNew(checks []*mgmProto.Checks) error {
 		return nil
 	}
 	e.applyInfoFlags(info)
+	e.attachCertificateProofs(info, checks)
 
 	if err := e.mgmClient.SyncMeta(info); err != nil {
 		return fmt.Errorf("could not sync meta: error %s", err)
@@ -1271,9 +1275,17 @@ func (e *Engine) applyInfoFlags(info *system.Info) {
 	)
 }
 
+// attachCertificateProofs answers the certificate challenges in checks with the
+// certificates reachable on this device, signing each challenge nonce for our peer key.
+func (e *Engine) attachCertificateProofs(info *system.Info, checks []*mgmProto.Checks) {
+	peerKey := e.config.WgPrivateKey.PublicKey()
+	info.CertificateProofs = certproof.CollectProofs(e.ctx, checks, peerKey[:], e.config.CertStore)
+}
+
 func (e *Engine) currentSystemInfo(ctx context.Context) *system.Info {
 	info := e.infoSource.Current(ctx, e.overlayAddresses()...)
 	e.applyInfoFlags(info)
+	e.attachCertificateProofs(info, e.checks)
 	return info
 }
 
@@ -1289,6 +1301,7 @@ func (e *Engine) syncInfoFunc(refreshed *system.Info) func(ctx context.Context)
 		info := refreshed
 		refreshed = nil
 		e.applyInfoFlags(info)
+		e.attachCertificateProofs(info, e.checks)
 		return info
 	}
 }
@@ -2746,6 +2759,11 @@ func isChecksEqual(checks1, checks2 []*mgmProto.Checks) bool {
 			sortedFiles := slices.Clone(check.Files)
 			sort.Strings(sortedFiles)
 			normalized[i] = strings.Join(sortedFiles, "|")
+			if challenge := check.GetCertificateChallenge(); challenge != nil {
+				sortedCAs := slices.Clone(challenge.GetCaCertificates())
+				sort.Strings(sortedCAs)
+				normalized[i] += fmt.Sprintf("#%x|%s", challenge.GetNonce(), strings.Join(sortedCAs, "|"))
+			}
 		}
 
 		sort.Strings(normalized)
diff --git a/client/internal/engine_test.go b/client/internal/engine_test.go
index bfde05c04..d33ac773f 100644
--- a/client/internal/engine_test.go
+++ b/client/internal/engine_test.go
@@ -1179,6 +1179,32 @@ func Test_CheckFilesEqual(t *testing.T) {
 			},
 			expectedBool: true,
 		},
+		{
+			name: "Same files with rotated certificate challenge nonce should return false",
+			inputChecks1: []*mgmtProto.Checks{
+				{
+					Files:                []string{"testfile1"},
+					CertificateChallenge: &mgmtProto.CertificateChallenge{Nonce: []byte{1}, CaCertificates: []string{"ca-a"}},
+				},
+			},
+			inputChecks2: []*mgmtProto.Checks{
+				{
+					Files:                []string{"testfile1"},
+					CertificateChallenge: &mgmtProto.CertificateChallenge{Nonce: []byte{2}, CaCertificates: []string{"ca-a"}},
+				},
+			},
+			expectedBool: false,
+		},
+		{
+			name: "Same certificate challenge with CA certificates in different order should return true",
+			inputChecks1: []*mgmtProto.Checks{
+				{CertificateChallenge: &mgmtProto.CertificateChallenge{Nonce: []byte{1}, CaCertificates: []string{"ca-a", "ca-b"}}},
+			},
+			inputChecks2: []*mgmtProto.Checks{
+				{CertificateChallenge: &mgmtProto.CertificateChallenge{Nonce: []byte{1}, CaCertificates: []string{"ca-b", "ca-a"}}},
+			},
+			expectedBool: true,
+		},
 	}
 	for _, testCase := range testCases {
 		t.Run(testCase.name, func(t *testing.T) {
diff --git a/client/internal/pkcs11/driver_linux.go b/client/internal/pkcs11/driver_linux.go
new file mode 100644
index 000000000..0d9eb8705
--- /dev/null
+++ b/client/internal/pkcs11/driver_linux.go
@@ -0,0 +1,328 @@
+//go:build pkcs11 && linux && (amd64 || arm64)
+
+package pkcs11
+
+import (
+	"errors"
+	"fmt"
+	"runtime"
+	"strings"
+	"unsafe"
+
+	"github.com/ebitengine/purego"
+)
+
+// ulong is CK_ULONG, an unsigned long, which is pointer-sized on the 64-bit Linux ABIs
+// this file builds for. The struct layouts below assume that width and natural alignment.
+type ulong = uintptr
+
+const (
+	unavailableInformation = ^ulong(0)
+
+	flagOSLockingOK   = 0x2
+	flagRWSession     = 0x2
+	flagSerialSession = 0x4
+	userTypeUser      = 0x1
+
+	findBatch = 32
+)
+
+type version struct {
+	major byte
+	minor byte
+}
+
+type attribute struct {
+	typ   ulong
+	value unsafe.Pointer
+	len   ulong
+}
+
+type mechanism struct {
+	typ       ulong
+	parameter unsafe.Pointer
+	len       ulong
+}
+
+type pssParams struct {
+	hashAlg ulong
+	mgf     ulong
+	saltLen ulong
+}
+
+type tokenInfo struct {
+	label          [32]byte
+	manufacturerID [32]byte
+	model          [16]byte
+	serialNumber   [16]byte
+	flags          ulong
+	counters       [10]ulong
+	hardware       version
+	firmware       version
+	utcTime        [16]byte
+}
+
+type initializeArgs struct {
+	createMutex  uintptr
+	destroyMutex uintptr
+	lockMutex    uintptr
+	unlockMutex  uintptr
+	flags        ulong
+	reserved     unsafe.Pointer
+}
+
+// functionList mirrors CK_FUNCTION_LIST: a CK_VERSION padded to pointer alignment, then
+// the PKCS#11 v2.40 entry points in specification order.
+type functionList struct {
+	version version
+	_       [6]byte
+	fn      [68]uintptr
+}
+
+const (
+	fnInitialize        = 0
+	fnGetSlotList       = 4
+	fnGetTokenInfo      = 6
+	fnOpenSession       = 12
+	fnCloseSession      = 13
+	fnLogin             = 18
+	fnLogout            = 19
+	fnCreateObject      = 20
+	fnGetAttributeValue = 24
+	fnFindObjectsInit   = 26
+	fnFindObjects       = 27
+	fnFindObjectsFinal  = 28
+	fnSignInit          = 42
+	fnSign              = 43
+)
+
+// module holds the entry points of one loaded library, bound straight from its
+// CK_FUNCTION_LIST.
+type module struct {
+	cInitialize        func(args *initializeArgs) ulong
+	cGetSlotList       func(tokenPresent byte, slots *ulong, count *ulong) ulong
+	cGetTokenInfo      func(slot ulong, info *tokenInfo) ulong
+	cOpenSession       func(slot ulong, flags ulong, application unsafe.Pointer, notify uintptr, session *ulong) ulong
+	cCloseSession      func(session ulong) ulong
+	cLogin             func(session ulong, userType ulong, pin *byte, pinLen ulong) ulong
+	cLogout            func(session ulong) ulong
+	cCreateObject      func(session ulong, template *attribute, count ulong, object *ulong) ulong
+	cGetAttributeValue func(session ulong, object ulong, template *attribute, count ulong) ulong
+	cFindObjectsInit   func(session ulong, template *attribute, count ulong) ulong
+	cFindObjects       func(session ulong, objects *ulong, max ulong, count *ulong) ulong
+	cFindObjectsFinal  func(session ulong) ulong
+	cSignInit          func(session ulong, mech *mechanism, key ulong) ulong
+	cSign              func(session ulong, data *byte, dataLen ulong, signature *byte, signatureLen *ulong) ulong
+}
+
+func load(path string) (driver, error) {
+	lib, err := purego.Dlopen(path, purego.RTLD_NOW|purego.RTLD_LOCAL)
+	if err != nil {
+		return nil, fmt.Errorf("open PKCS#11 module %s: %w", path, err)
+	}
+	symbol, err := purego.Dlsym(lib, "C_GetFunctionList")
+	if err != nil {
+		return nil, fmt.Errorf("%s is not a PKCS#11 module: %w", path, err)
+	}
+	var getFunctionList func(list **functionList) ulong
+	purego.RegisterFunc(&getFunctionList, symbol)
+	var list *functionList
+	if rv := getFunctionList(&list); rv != rvOK || list == nil {
+		return nil, Error{Op: "C_GetFunctionList", Code: uint(rv)}
+	}
+
+	m := &module{}
+	for _, entry := range []struct {
+		fn    any
+		index int
+	}{
+		{&m.cInitialize, fnInitialize},
+		{&m.cGetSlotList, fnGetSlotList},
+		{&m.cGetTokenInfo, fnGetTokenInfo},
+		{&m.cOpenSession, fnOpenSession},
+		{&m.cCloseSession, fnCloseSession},
+		{&m.cLogin, fnLogin},
+		{&m.cLogout, fnLogout},
+		{&m.cCreateObject, fnCreateObject},
+		{&m.cGetAttributeValue, fnGetAttributeValue},
+		{&m.cFindObjectsInit, fnFindObjectsInit},
+		{&m.cFindObjects, fnFindObjects},
+		{&m.cFindObjectsFinal, fnFindObjectsFinal},
+		{&m.cSignInit, fnSignInit},
+		{&m.cSign, fnSign},
+	} {
+		if list.fn[entry.index] == 0 {
+			return nil, fmt.Errorf("%s lacks PKCS#11 entry point %d", path, entry.index)
+		}
+		purego.RegisterFunc(entry.fn, list.fn[entry.index])
+	}
+
+	args := &initializeArgs{flags: flagOSLockingOK}
+	if rv := m.cInitialize(args); rv != rvOK && rv != rvAlreadyInitialized {
+		return nil, Error{Op: "C_Initialize", Code: uint(rv)}
+	}
+	return m, nil
+}
+
+func (m *module) tokens() ([]Token, error) {
+	var count ulong
+	if rv := m.cGetSlotList(1, nil, &count); rv != rvOK {
+		return nil, Error{Op: "C_GetSlotList", Code: uint(rv)}
+	}
+	if count == 0 {
+		return nil, nil
+	}
+	slots := make([]ulong, count)
+	if rv := m.cGetSlotList(1, &slots[0], &count); rv != rvOK {
+		return nil, Error{Op: "C_GetSlotList", Code: uint(rv)}
+	}
+
+	tokens := make([]Token, 0, count)
+	for _, slot := range slots[:count] {
+		var info tokenInfo
+		if rv := m.cGetTokenInfo(slot, &info); rv != rvOK {
+			continue
+		}
+		tokens = append(tokens, Token{Slot: uint(slot), Label: strings.TrimRight(string(info.label[:]), " \x00")})
+	}
+	return tokens, nil
+}
+
+func (m *module) openSession(slot uint, readWrite bool) (uint, error) {
+	flags := ulong(flagSerialSession)
+	if readWrite {
+		flags |= flagRWSession
+	}
+	var session ulong
+	if rv := m.cOpenSession(ulong(slot), flags, nil, 0, &session); rv != rvOK {
+		return 0, Error{Op: "C_OpenSession", Code: uint(rv)}
+	}
+	return uint(session), nil
+}
+
+func (m *module) closeSession(session uint) {
+	m.cCloseSession(ulong(session))
+}
+
+func (m *module) login(session uint, pin []byte) error {
+	var pinPtr *byte
+	if len(pin) > 0 {
+		pinPtr = &pin[0]
+	}
+	rv := m.cLogin(ulong(session), userTypeUser, pinPtr, ulong(len(pin)))
+	runtime.KeepAlive(pin)
+	if rv != rvOK && rv != rvUserAlreadyLoggedIn {
+		return Error{Op: "C_Login", Code: uint(rv)}
+	}
+	return nil
+}
+
+func (m *module) logout(session uint) {
+	m.cLogout(ulong(session))
+}
+
+func (m *module) findObjects(session uint, template []Attribute) ([]Object, error) {
+	attrs := toAttributes(template)
+	rv := m.cFindObjectsInit(ulong(session), first(attrs), ulong(len(attrs)))
+	runtime.KeepAlive(template)
+	if rv != rvOK {
+		return nil, Error{Op: "C_FindObjectsInit", Code: uint(rv)}
+	}
+	defer m.cFindObjectsFinal(ulong(session))
+
+	var objects []Object
+	for {
+		var batch [findBatch]ulong
+		var count ulong
+		if rv := m.cFindObjects(ulong(session), &batch[0], findBatch, &count); rv != rvOK {
+			return nil, Error{Op: "C_FindObjects", Code: uint(rv)}
+		}
+		for _, handle := range batch[:count] {
+			objects = append(objects, Object(handle))
+		}
+		if count < findBatch {
+			return objects, nil
+		}
+	}
+}
+
+func (m *module) attribute(session uint, obj Object, typ uint) ([]byte, error) {
+	attr := attribute{typ: ulong(typ)}
+	if rv := m.cGetAttributeValue(ulong(session), ulong(obj), &attr, 1); rv != rvOK {
+		return nil, Error{Op: "C_GetAttributeValue", Code: uint(rv)}
+	}
+	if attr.len == unavailableInformation {
+		return nil, fmt.Errorf("attribute 0x%x is unavailable", typ)
+	}
+	if attr.len == 0 {
+		return nil, nil
+	}
+	value := make([]byte, attr.len)
+	attr.value = unsafe.Pointer(&value[0])
+	rv := m.cGetAttributeValue(ulong(session), ulong(obj), &attr, 1)
+	runtime.KeepAlive(value)
+	if rv != rvOK {
+		return nil, Error{Op: "C_GetAttributeValue", Code: uint(rv)}
+	}
+	return value[:attr.len], nil
+}
+
+func (m *module) sign(session uint, mech Mechanism, key Object, data []byte) ([]byte, error) {
+	if len(data) == 0 {
+		return nil, errors.New("nothing to sign")
+	}
+	native := mechanism{typ: ulong(mech.Type)}
+	var params *pssParams
+	if mech.PSS != nil {
+		params = &pssParams{hashAlg: ulong(mech.PSS.Hash), mgf: ulong(mech.PSS.MGF), saltLen: ulong(mech.PSS.SaltLen)}
+		native.parameter = unsafe.Pointer(params)
+		native.len = ulong(unsafe.Sizeof(*params))
+	}
+	rv := m.cSignInit(ulong(session), &native, ulong(key))
+	runtime.KeepAlive(params)
+	if rv != rvOK {
+		return nil, Error{Op: "C_SignInit", Code: uint(rv)}
+	}
+
+	var size ulong
+	if rv := m.cSign(ulong(session), &data[0], ulong(len(data)), nil, &size); rv != rvOK {
+		return nil, Error{Op: "C_Sign", Code: uint(rv)}
+	}
+	signature := make([]byte, size)
+	rv = m.cSign(ulong(session), &data[0], ulong(len(data)), &signature[0], &size)
+	runtime.KeepAlive(data)
+	if rv != rvOK {
+		return nil, Error{Op: "C_Sign", Code: uint(rv)}
+	}
+	return signature[:size], nil
+}
+
+func (m *module) createObject(session uint, template []Attribute) (Object, error) {
+	attrs := toAttributes(template)
+	var object ulong
+	rv := m.cCreateObject(ulong(session), first(attrs), ulong(len(attrs)), &object)
+	runtime.KeepAlive(template)
+	if rv != rvOK {
+		return 0, Error{Op: "C_CreateObject", Code: uint(rv)}
+	}
+	return Object(object), nil
+}
+
+func toAttributes(template []Attribute) []attribute {
+	attrs := make([]attribute, len(template))
+	for i, a := range template {
+		attrs[i].typ = ulong(a.Type)
+		if len(a.Value) > 0 {
+			attrs[i].value = unsafe.Pointer(&a.Value[0])
+			attrs[i].len = ulong(len(a.Value))
+		}
+	}
+	return attrs
+}
+
+func first(attrs []attribute) *attribute {
+	if len(attrs) == 0 {
+		return nil
+	}
+	return &attrs[0]
+}
diff --git a/client/internal/pkcs11/driver_linux_test.go b/client/internal/pkcs11/driver_linux_test.go
new file mode 100644
index 000000000..b47b22890
--- /dev/null
+++ b/client/internal/pkcs11/driver_linux_test.go
@@ -0,0 +1,72 @@
+//go:build pkcs11 && linux && (amd64 || arm64)
+
+package pkcs11
+
+import (
+	"crypto/x509"
+	"os"
+	"testing"
+	"unsafe"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestStructLayoutsMatchTheCABI(t *testing.T) {
+	assert.Equal(t, uintptr(24), unsafe.Sizeof(attribute{}), "CK_ATTRIBUTE")
+	assert.Equal(t, uintptr(24), unsafe.Sizeof(mechanism{}), "CK_MECHANISM")
+	assert.Equal(t, uintptr(24), unsafe.Sizeof(pssParams{}), "CK_RSA_PKCS_PSS_PARAMS")
+	assert.Equal(t, uintptr(208), unsafe.Sizeof(tokenInfo{}), "CK_TOKEN_INFO")
+	assert.Equal(t, uintptr(48), unsafe.Sizeof(initializeArgs{}), "CK_C_INITIALIZE_ARGS")
+	assert.Equal(t, uintptr(8), unsafe.Offsetof(functionList{}.fn), "entry points follow the padded CK_VERSION")
+	assert.Equal(t, uintptr(8+68*8), unsafe.Sizeof(functionList{}), "CK_FUNCTION_LIST v2.40")
+}
+
+// TestTrustModule_ListsSystemCertificates drives a real module through the binding:
+// p11-kit's trust module exposes the system CA store as certificate objects with no login.
+func TestTrustModule_ListsSystemCertificates(t *testing.T) {
+	module := loadFirst(t,
+		"/usr/lib/pkcs11/p11-kit-trust.so",
+		"/usr/lib/x86_64-linux-gnu/pkcs11/p11-kit-trust.so",
+		"/usr/lib/aarch64-linux-gnu/pkcs11/p11-kit-trust.so",
+		"/usr/lib64/pkcs11/p11-kit-trust.so",
+	)
+
+	tokens, err := module.Tokens()
+	require.NoError(t, err)
+	require.NotEmpty(t, tokens, "the trust module must present at least one token")
+
+	parsed := 0
+	for _, token := range tokens {
+		session, err := module.OpenSession(token.Label, nil)
+		require.NoError(t, err, token.Label)
+		objects, err := session.FindObjects(
+			Attribute{Type: AttrClass, Value: ULong(ClassCertificate)},
+			Attribute{Type: AttrCertificateType, Value: ULong(CertificateX509)},
+		)
+		require.NoError(t, err, token.Label)
+		for _, object := range objects {
+			der, err := session.Attribute(object, AttrValue)
+			require.NoError(t, err)
+			_, err = x509.ParseCertificate(der)
+			require.NoError(t, err, "CKA_VALUE must be a DER certificate")
+			parsed++
+		}
+		session.Close()
+	}
+	assert.Positive(t, parsed, "system trust anchors must be readable through the binding")
+}
+
+func loadFirst(t *testing.T, paths ...string) *Module {
+	t.Helper()
+	for _, path := range paths {
+		if _, err := os.Stat(path); err != nil {
+			continue
+		}
+		module, err := Load(path)
+		require.NoError(t, err, path)
+		return module
+	}
+	t.Skip("p11-kit trust module not installed")
+	return nil
+}
diff --git a/client/internal/pkcs11/driver_stub.go b/client/internal/pkcs11/driver_stub.go
new file mode 100644
index 000000000..1f870bd8e
--- /dev/null
+++ b/client/internal/pkcs11/driver_stub.go
@@ -0,0 +1,7 @@
+//go:build !(pkcs11 && linux && (amd64 || arm64))
+
+package pkcs11
+
+func load(string) (driver, error) {
+	return nil, ErrUnsupported
+}
diff --git a/client/internal/pkcs11/pkcs11.go b/client/internal/pkcs11/pkcs11.go
new file mode 100644
index 000000000..8f93da2a3
--- /dev/null
+++ b/client/internal/pkcs11/pkcs11.go
@@ -0,0 +1,259 @@
+// Package pkcs11 is a minimal PKCS#11 client. It loads a module at runtime without cgo,
+// opens a token session, lists objects and signs with keys the token holds. It exists so
+// certificates whose keys live in a TPM behind tpm2-pkcs11 can be proven; whatever a
+// certificate store does not need is left out.
+package pkcs11
+
+import (
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"sync"
+)
+
+// Object classes, attribute types, mechanisms and generators from PKCS#11 v2.40.
+const (
+	ClassCertificate = 0x1
+	ClassPublicKey   = 0x2
+	ClassPrivateKey  = 0x3
+
+	CertificateX509 = 0x0
+
+	AttrClass           = 0x0
+	AttrToken           = 0x1
+	AttrLabel           = 0x3
+	AttrValue           = 0x11
+	AttrCertificateType = 0x80
+	AttrKeyType         = 0x100
+	AttrSubject         = 0x101
+	AttrID              = 0x102
+	AttrModulus         = 0x120
+	AttrPublicExponent  = 0x122
+	AttrECParams        = 0x180
+	AttrECPoint         = 0x181
+
+	KeyRSA = 0x0
+	KeyEC  = 0x3
+
+	MechRSAPKCSPSS = 0xd
+	MechSHA256     = 0x250
+	MechSHA384     = 0x260
+	MechECDSA      = 0x1041
+
+	MGF1SHA256 = 0x2
+	MGF1SHA384 = 0x3
+
+	rvOK                  = 0x0
+	rvUserAlreadyLoggedIn = 0x100
+	rvAlreadyInitialized  = 0x191
+)
+
+var ErrUnsupported = errors.New("PKCS#11 modules need a build with the pkcs11 tag on linux/amd64 or linux/arm64")
+
+// Error is a PKCS#11 return value other than CKR_OK.
+type Error struct {
+	Op   string
+	Code uint
+}
+
+func (e Error) Error() string {
+	if name, ok := returnValueNames[e.Code]; ok {
+		return fmt.Sprintf("%s: %s", e.Op, name)
+	}
+	return fmt.Sprintf("%s: CKR 0x%x", e.Op, e.Code)
+}
+
+var returnValueNames = map[uint]string{
+	0x2:   "CKR_HOST_MEMORY",
+	0x3:   "CKR_SLOT_ID_INVALID",
+	0x5:   "CKR_GENERAL_ERROR",
+	0x7:   "CKR_ARGUMENTS_BAD",
+	0x12:  "CKR_ATTRIBUTE_TYPE_INVALID",
+	0x13:  "CKR_ATTRIBUTE_VALUE_INVALID",
+	0x30:  "CKR_DEVICE_ERROR",
+	0x54:  "CKR_FUNCTION_NOT_SUPPORTED",
+	0x68:  "CKR_KEY_FUNCTION_NOT_PERMITTED",
+	0x70:  "CKR_MECHANISM_INVALID",
+	0x71:  "CKR_MECHANISM_PARAM_INVALID",
+	0x82:  "CKR_OBJECT_HANDLE_INVALID",
+	0xa0:  "CKR_PIN_INCORRECT",
+	0xa4:  "CKR_PIN_LOCKED",
+	0xb3:  "CKR_SESSION_HANDLE_INVALID",
+	0xd0:  "CKR_TEMPLATE_INCOMPLETE",
+	0xd1:  "CKR_TEMPLATE_INCONSISTENT",
+	0xe0:  "CKR_TOKEN_NOT_PRESENT",
+	0x101: "CKR_USER_NOT_LOGGED_IN",
+	0x150: "CKR_BUFFER_TOO_SMALL",
+	0x190: "CKR_CRYPTOKI_NOT_INITIALIZED",
+}
+
+// Attribute is one entry of a PKCS#11 template. Integer-valued attributes such as the
+// object class are encoded with ULong.
+type Attribute struct {
+	Type  uint
+	Value []byte
+}
+
+// Mechanism selects a signing algorithm. PSS carries the parameters CKM_RSA_PKCS_PSS needs.
+type Mechanism struct {
+	Type uint
+	PSS  *PSSParams
+}
+
+type PSSParams struct {
+	Hash    uint
+	MGF     uint
+	SaltLen uint
+}
+
+// Object is a handle the token issued for one of its objects.
+type Object uint
+
+// Token is a slot with a token present.
+type Token struct {
+	Slot  uint
+	Label string
+}
+
+// Module is a loaded and initialised PKCS#11 library. A module is loaded once per path
+// and never finalised: tokens such as tpm2-pkcs11 do real work in C_Initialize, and the
+// process exit releases everything anyway.
+type Module struct {
+	d driver
+}
+
+var (
+	modulesMu sync.Mutex
+	modules   = map[string]*Module{}
+)
+
+// Load opens the shared library at path and initialises it, or returns the module already
+// loaded from that path.
+func Load(path string) (*Module, error) {
+	modulesMu.Lock()
+	defer modulesMu.Unlock()
+	if m, ok := modules[path]; ok {
+		return m, nil
+	}
+	d, err := load(path)
+	if err != nil {
+		return nil, err
+	}
+	m := &Module{d: d}
+	modules[path] = m
+	return m, nil
+}
+
+func (m *Module) Tokens() ([]Token, error) {
+	return m.d.tokens()
+}
+
+// OpenSession opens a read-only session with the token carrying label, or with the first
+// token when label is empty, and logs in as the user when pin is not nil. An empty,
+// non-nil pin still logs in.
+func (m *Module) OpenSession(label string, pin []byte) (*Session, error) {
+	return m.openSession(label, pin, false)
+}
+
+// OpenReadWriteSession is OpenSession for callers that create objects on the token.
+func (m *Module) OpenReadWriteSession(label string, pin []byte) (*Session, error) {
+	return m.openSession(label, pin, true)
+}
+
+func (m *Module) openSession(label string, pin []byte, readWrite bool) (*Session, error) {
+	token, err := m.token(label)
+	if err != nil {
+		return nil, err
+	}
+	handle, err := m.d.openSession(token.Slot, readWrite)
+	if err != nil {
+		return nil, err
+	}
+	s := &Session{d: m.d, handle: handle}
+	if pin == nil {
+		return s, nil
+	}
+	if err := m.d.login(handle, pin); err != nil {
+		s.Close()
+		return nil, err
+	}
+	s.loggedIn = true
+	return s, nil
+}
+
+func (m *Module) token(label string) (Token, error) {
+	tokens, err := m.Tokens()
+	if err != nil {
+		return Token{}, err
+	}
+	for _, token := range tokens {
+		if label == "" || token.Label == label {
+			return token, nil
+		}
+	}
+	if label == "" {
+		return Token{}, errors.New("no token present")
+	}
+	return Token{}, fmt.Errorf("no token labelled %q among %d tokens", label, len(tokens))
+}
+
+// Session is an open session with one token. Close logs out again if the session logged in.
+type Session struct {
+	d        driver
+	handle   uint
+	loggedIn bool
+}
+
+func (s *Session) Close() {
+	if s.loggedIn {
+		s.d.logout(s.handle)
+	}
+	s.d.closeSession(s.handle)
+}
+
+// FindObjects returns the handles of every object matching all attributes of template.
+func (s *Session) FindObjects(template ...Attribute) ([]Object, error) {
+	return s.d.findObjects(s.handle, template)
+}
+
+// Attribute reads one attribute of an object.
+func (s *Session) Attribute(obj Object, typ uint) ([]byte, error) {
+	return s.d.attribute(s.handle, obj, typ)
+}
+
+// Sign signs data, normally a digest, with the token-held key in a single operation.
+func (s *Session) Sign(mech Mechanism, key Object, data []byte) ([]byte, error) {
+	return s.d.sign(s.handle, mech, key, data)
+}
+
+// CreateObject stores a new object described by template on the token.
+func (s *Session) CreateObject(template ...Attribute) (Object, error) {
+	return s.d.createObject(s.handle, template)
+}
+
+type driver interface {
+	tokens() ([]Token, error)
+	openSession(slot uint, readWrite bool) (uint, error)
+	closeSession(session uint)
+	login(session uint, pin []byte) error
+	logout(session uint)
+	findObjects(session uint, template []Attribute) ([]Object, error)
+	attribute(session uint, obj Object, typ uint) ([]byte, error)
+	sign(session uint, mech Mechanism, key Object, data []byte) ([]byte, error)
+	createObject(session uint, template []Attribute) (Object, error)
+}
+
+// ulongSize is the width of CK_ULONG on the 64-bit platforms the driver builds for.
+const ulongSize = 8
+
+// ULong encodes an integer attribute value the way the module reads a CK_ULONG.
+func ULong(v uint) []byte {
+	return binary.NativeEndian.AppendUint64(nil, uint64(v))
+}
+
+func ulongValue(b []byte) (uint, error) {
+	if len(b) != ulongSize {
+		return 0, fmt.Errorf("CK_ULONG value has %d bytes", len(b))
+	}
+	return uint(binary.NativeEndian.Uint64(b)), nil
+}
diff --git a/client/internal/pkcs11/publickey.go b/client/internal/pkcs11/publickey.go
new file mode 100644
index 000000000..70955e348
--- /dev/null
+++ b/client/internal/pkcs11/publickey.go
@@ -0,0 +1,95 @@
+package pkcs11
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rsa"
+	"encoding/asn1"
+	"errors"
+	"fmt"
+	"math"
+	"math/big"
+)
+
+var curvesByOID = map[string]elliptic.Curve{
+	"1.2.840.10045.3.1.7": elliptic.P256(),
+	"1.3.132.0.34":        elliptic.P384(),
+	"1.3.132.0.35":        elliptic.P521(),
+}
+
+// PublicKey reads a CKO_PUBLIC_KEY object as a Go public key. RSA and EC keys are
+// supported, the two kinds a certificate posture proof can be signed with.
+func (s *Session) PublicKey(obj Object) (crypto.PublicKey, error) {
+	raw, err := s.Attribute(obj, AttrKeyType)
+	if err != nil {
+		return nil, err
+	}
+	keyType, err := ulongValue(raw)
+	if err != nil {
+		return nil, fmt.Errorf("CKA_KEY_TYPE: %w", err)
+	}
+	switch keyType {
+	case KeyRSA:
+		modulus, exponent, err := s.attributes(obj, AttrModulus, AttrPublicExponent)
+		if err != nil {
+			return nil, err
+		}
+		return rsaPublicKey(modulus, exponent)
+	case KeyEC:
+		params, point, err := s.attributes(obj, AttrECParams, AttrECPoint)
+		if err != nil {
+			return nil, err
+		}
+		return ecPublicKey(params, point)
+	}
+	return nil, fmt.Errorf("unsupported key type 0x%x", keyType)
+}
+
+func (s *Session) attributes(obj Object, first, second uint) ([]byte, []byte, error) {
+	a, err := s.Attribute(obj, first)
+	if err != nil {
+		return nil, nil, err
+	}
+	b, err := s.Attribute(obj, second)
+	if err != nil {
+		return nil, nil, err
+	}
+	return a, b, nil
+}
+
+func rsaPublicKey(modulus, exponent []byte) (*rsa.PublicKey, error) {
+	e := new(big.Int).SetBytes(exponent)
+	if e.Sign() <= 0 || e.Cmp(big.NewInt(math.MaxInt32)) > 0 {
+		return nil, errors.New("CKA_PUBLIC_EXPONENT is out of range")
+	}
+	return &rsa.PublicKey{N: new(big.Int).SetBytes(modulus), E: int(e.Int64())}, nil
+}
+
+// ecPublicKey decodes CKA_EC_PARAMS, the named curve OID, and CKA_EC_POINT, the
+// uncompressed point wrapped in a DER OCTET STRING, which some modules hand out bare.
+func ecPublicKey(params, point []byte) (*ecdsa.PublicKey, error) {
+	var oid asn1.ObjectIdentifier
+	if _, err := asn1.Unmarshal(params, &oid); err != nil {
+		return nil, fmt.Errorf("CKA_EC_PARAMS: %w", err)
+	}
+	curve, ok := curvesByOID[oid.String()]
+	if !ok {
+		return nil, fmt.Errorf("unsupported curve %s", oid)
+	}
+	size := (curve.Params().BitSize + 7) / 8
+	raw := point
+	if len(raw) != 1+2*size {
+		if _, err := asn1.Unmarshal(point, &raw); err != nil {
+			return nil, fmt.Errorf("CKA_EC_POINT: %w", err)
+		}
+	}
+	if len(raw) != 1+2*size || raw[0] != 4 {
+		return nil, errors.New("CKA_EC_POINT is not an uncompressed point")
+	}
+	return &ecdsa.PublicKey{
+		Curve: curve,
+		X:     new(big.Int).SetBytes(raw[1 : 1+size]),
+		Y:     new(big.Int).SetBytes(raw[1+size:]),
+	}, nil
+}
diff --git a/client/internal/pkcs11/publickey_test.go b/client/internal/pkcs11/publickey_test.go
new file mode 100644
index 000000000..527d6db46
--- /dev/null
+++ b/client/internal/pkcs11/publickey_test.go
@@ -0,0 +1,87 @@
+package pkcs11
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/rsa"
+	"encoding/asn1"
+	"math/big"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestECPublicKey(t *testing.T) {
+	curves := []struct {
+		name  string
+		curve elliptic.Curve
+		oid   asn1.ObjectIdentifier
+	}{
+		{"P-256", elliptic.P256(), asn1.ObjectIdentifier{1, 2, 840, 10045, 3, 1, 7}},
+		{"P-384", elliptic.P384(), asn1.ObjectIdentifier{1, 3, 132, 0, 34}},
+	}
+	for _, tt := range curves {
+		t.Run(tt.name, func(t *testing.T) {
+			key, err := ecdsa.GenerateKey(tt.curve, rand.Reader)
+			require.NoError(t, err)
+			params, err := asn1.Marshal(tt.oid)
+			require.NoError(t, err)
+			point := uncompressedPoint(key)
+			wrapped, err := asn1.Marshal(point)
+			require.NoError(t, err)
+
+			// PKCS#11 wraps the point in an OCTET STRING, but some modules return it bare.
+			for form, encoded := range map[string][]byte{"DER octet string": wrapped, "bare point": point} {
+				pub, err := ecPublicKey(params, encoded)
+				require.NoError(t, err, form)
+				assert.True(t, key.PublicKey.Equal(pub), "%s must decode to the generated key", form)
+			}
+		})
+	}
+}
+
+func TestECPublicKey_Rejections(t *testing.T) {
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+	p256, err := asn1.Marshal(asn1.ObjectIdentifier{1, 2, 840, 10045, 3, 1, 7})
+	require.NoError(t, err)
+	brainpool, err := asn1.Marshal(asn1.ObjectIdentifier{1, 3, 36, 3, 3, 2, 8, 1, 1, 7})
+	require.NoError(t, err)
+	point := uncompressedPoint(key)
+
+	_, err = ecPublicKey(brainpool, point)
+	assert.Error(t, err, "curves the proof cannot use must be rejected")
+	_, err = ecPublicKey(p256, point[:len(point)-1])
+	assert.Error(t, err, "a truncated point must be rejected")
+	_, err = ecPublicKey([]byte("junk"), point)
+	assert.Error(t, err, "malformed parameters must be rejected")
+}
+
+func TestRSAPublicKey(t *testing.T) {
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	require.NoError(t, err)
+
+	pub, err := rsaPublicKey(key.N.Bytes(), big.NewInt(int64(key.E)).Bytes())
+	require.NoError(t, err)
+	assert.True(t, key.PublicKey.Equal(pub), "modulus and exponent must decode to the generated key")
+
+	_, err = rsaPublicKey(key.N.Bytes(), nil)
+	assert.Error(t, err, "a missing exponent must be rejected")
+}
+
+func TestULongRoundTrip(t *testing.T) {
+	v, err := ulongValue(ULong(ClassPrivateKey))
+	require.NoError(t, err)
+	assert.Equal(t, uint(ClassPrivateKey), v)
+
+	_, err = ulongValue([]byte{1, 2, 3})
+	assert.Error(t, err, "a value of the wrong width must be rejected")
+}
+
+func uncompressedPoint(key *ecdsa.PrivateKey) []byte {
+	size := (key.Curve.Params().BitSize + 7) / 8
+	point := append([]byte{4}, key.X.FillBytes(make([]byte, size))...)
+	return append(point, key.Y.FillBytes(make([]byte, size))...)
+}
diff --git a/client/internal/pkcs11/uri.go b/client/internal/pkcs11/uri.go
new file mode 100644
index 000000000..8794b7020
--- /dev/null
+++ b/client/internal/pkcs11/uri.go
@@ -0,0 +1,98 @@
+package pkcs11
+
+import (
+	"errors"
+	"fmt"
+	"net/url"
+	"os"
+	"strings"
+)
+
+// DefaultModule is p11-kit's proxy, which exposes every module the system has registered,
+// tpm2-pkcs11 included, so a URI without module-path works on a stock p11-kit setup.
+const DefaultModule = "p11-kit-proxy.so"
+
+// URI is the subset of an RFC 7512 PKCS#11 URI this client understands: the token label,
+// the module to load and where the user PIN comes from. Unknown attributes are ignored.
+type URI struct {
+	Token      string
+	ModulePath string
+	pinValue   *string
+	pinSource  string
+}
+
+func ParseURI(raw string) (*URI, error) {
+	rest, ok := strings.CutPrefix(raw, "pkcs11:")
+	if !ok {
+		return nil, errors.New("PKCS#11 URI must start with pkcs11:")
+	}
+	path, query, _ := strings.Cut(rest, "?")
+
+	u := &URI{}
+	if err := eachAttribute(path, ";", func(name, value string) {
+		if name == "token" {
+			u.Token = value
+		}
+	}); err != nil {
+		return nil, err
+	}
+	err := eachAttribute(query, "&", func(name, value string) {
+		switch name {
+		case "module-path":
+			u.ModulePath = value
+		case "module-name":
+			u.ModulePath = "lib" + value + ".so"
+		case "pin-value":
+			u.pinValue = &value
+		case "pin-source":
+			u.pinSource = value
+		}
+	})
+	if err != nil {
+		return nil, err
+	}
+	return u, nil
+}
+
+func eachAttribute(list, sep string, fn func(name, value string)) error {
+	if list == "" {
+		return nil
+	}
+	for _, pair := range strings.Split(list, sep) {
+		name, value, ok := strings.Cut(pair, "=")
+		if !ok {
+			return fmt.Errorf("PKCS#11 URI attribute %q has no value", pair)
+		}
+		value, err := url.PathUnescape(value)
+		if err != nil {
+			return fmt.Errorf("PKCS#11 URI attribute %s: %w", name, err)
+		}
+		fn(name, value)
+	}
+	return nil
+}
+
+// Module is the library to load, DefaultModule when the URI names none.
+func (u *URI) Module() string {
+	if u.ModulePath == "" {
+		return DefaultModule
+	}
+	return u.ModulePath
+}
+
+// PIN returns the user PIN, or nil when the URI carries none and no login should happen.
+// A pin-source names a file whose single line is the PIN.
+func (u *URI) PIN() ([]byte, error) {
+	if u.pinValue != nil {
+		return []byte(*u.pinValue), nil
+	}
+	if u.pinSource == "" {
+		return nil, nil
+	}
+	path := strings.TrimPrefix(strings.TrimPrefix(u.pinSource, "file://"), "file:")
+	pin, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("read PIN: %w", err)
+	}
+	return []byte(strings.TrimRight(string(pin), "\r\n")), nil
+}
diff --git a/client/internal/pkcs11/uri_test.go b/client/internal/pkcs11/uri_test.go
new file mode 100644
index 000000000..63fc66d9a
--- /dev/null
+++ b/client/internal/pkcs11/uri_test.go
@@ -0,0 +1,87 @@
+package pkcs11
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseURI(t *testing.T) {
+	tests := []struct {
+		name       string
+		raw        string
+		wantToken  string
+		wantModule string
+		wantPIN    []byte
+	}{
+		{
+			name:       "token with module path and pin value",
+			raw:        "pkcs11:token=netbird?module-path=/usr/lib/libtpm2_pkcs11.so&pin-value=1234",
+			wantToken:  "netbird",
+			wantModule: "/usr/lib/libtpm2_pkcs11.so",
+			wantPIN:    []byte("1234"),
+		},
+		{
+			name:       "module name becomes a library file",
+			raw:        "pkcs11:token=netbird?module-name=tpm2_pkcs11",
+			wantToken:  "netbird",
+			wantModule: "libtpm2_pkcs11.so",
+		},
+		{
+			name:       "percent encoding and unknown attributes",
+			raw:        "pkcs11:model=SoftHSM%20v2;token=my%20token;serial=1?max-sessions=1",
+			wantToken:  "my token",
+			wantModule: DefaultModule,
+		},
+		{
+			name:       "bare scheme uses the p11-kit proxy and no login",
+			raw:        "pkcs11:",
+			wantModule: DefaultModule,
+		},
+		{
+			name:       "empty pin value still logs in",
+			raw:        "pkcs11:?pin-value=",
+			wantModule: DefaultModule,
+			wantPIN:    []byte{},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			uri, err := ParseURI(tt.raw)
+			require.NoError(t, err)
+			assert.Equal(t, tt.wantToken, uri.Token, "token label")
+			assert.Equal(t, tt.wantModule, uri.Module(), "module to load")
+			pin, err := uri.PIN()
+			require.NoError(t, err)
+			assert.Equal(t, tt.wantPIN, pin, "PIN, nil meaning no login")
+		})
+	}
+}
+
+func TestParseURI_Rejections(t *testing.T) {
+	for _, raw := range []string{"pkcs11", "https://example.com", "pkcs11:token", "pkcs11:token=%zz"} {
+		_, err := ParseURI(raw)
+		assert.Error(t, err, raw)
+	}
+}
+
+func TestURI_PINFromFile(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "pin")
+	require.NoError(t, os.WriteFile(path, []byte("secret\n"), 0o600))
+
+	for _, source := range []string{path, "file:" + path, "file://" + path} {
+		uri, err := ParseURI("pkcs11:token=netbird?pin-source=" + source)
+		require.NoError(t, err)
+		pin, err := uri.PIN()
+		require.NoError(t, err)
+		assert.Equal(t, []byte("secret"), pin, "PIN from %s must drop the trailing newline", source)
+	}
+
+	uri, err := ParseURI("pkcs11:?pin-source=" + filepath.Join(t.TempDir(), "missing"))
+	require.NoError(t, err)
+	_, err = uri.PIN()
+	assert.Error(t, err, "a missing PIN file must fail loudly instead of logging in without a PIN")
+}
diff --git a/client/internal/profilemanager/config.go b/client/internal/profilemanager/config.go
index ac1b90a62..f713b0b57 100644
--- a/client/internal/profilemanager/config.go
+++ b/client/internal/profilemanager/config.go
@@ -185,6 +185,20 @@ type Config struct {
 
 	ClientCertKeyPair *tls.Certificate `json:"-"`
 
+	// CertStoreDir is the directory of PEM certificates, with their keys or with keys a
+	// PKCS#11 token holds, that answer certificate posture checks on Linux. Empty means
+	// NB_CERT_STORE_DIR or /etc/netbird/certs; see client/internal/certproof/README.md.
+	CertStoreDir string
+
+	// CertPKCS11PIN is the user PIN of the PKCS#11 token, tpm2-pkcs11 for one, whose
+	// certificates answer certificate posture checks on Linux. Setting it enables the
+	// token store; see client/internal/certproof/README.md.
+	CertPKCS11PIN string
+
+	// CertPKCS11URI is the RFC 7512 URI selecting that token and its module. Empty means
+	// the first token the p11-kit proxy exposes.
+	CertPKCS11URI string
+
 	// LazyConnection is the MDM-managed lazy-connection override ("on"/"off"/"").
 	// Runtime-only: re-derived from MDM policy on each load, never persisted.
 	LazyConnection string `json:"-"`
diff --git a/client/internal/tpm/open_linux.go b/client/internal/tpm/open_linux.go
new file mode 100644
index 000000000..b6356112a
--- /dev/null
+++ b/client/internal/tpm/open_linux.go
@@ -0,0 +1,29 @@
+package tpm
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"os"
+
+	"github.com/google/go-tpm/tpmutil"
+)
+
+// The kernel resource manager multiplexes clients and flushes what they leave behind,
+// so it is tried before the raw device.
+var devicePaths = []string{"/dev/tpmrm0", "/dev/tpm0"}
+
+func open() (io.ReadWriteCloser, error) {
+	if path := os.Getenv(DeviceEnv); path != "" {
+		return tpmutil.OpenTPM(path)
+	}
+	var errs error
+	for _, path := range devicePaths {
+		rwc, err := tpmutil.OpenTPM(path)
+		if err == nil {
+			return rwc, nil
+		}
+		errs = errors.Join(errs, err)
+	}
+	return nil, fmt.Errorf("open TPM: %w", errs)
+}
diff --git a/client/internal/tpm/open_other.go b/client/internal/tpm/open_other.go
new file mode 100644
index 000000000..58bc38db9
--- /dev/null
+++ b/client/internal/tpm/open_other.go
@@ -0,0 +1,9 @@
+//go:build !linux
+
+package tpm
+
+import "io"
+
+func open() (io.ReadWriteCloser, error) {
+	return nil, ErrUnsupported
+}
diff --git a/client/internal/tpm/signer.go b/client/internal/tpm/signer.go
new file mode 100644
index 000000000..b36097538
--- /dev/null
+++ b/client/internal/tpm/signer.go
@@ -0,0 +1,61 @@
+package tpm
+
+import (
+	"crypto"
+	"errors"
+	"fmt"
+	"io"
+
+	"go.step.sm/crypto/tpm/tss2"
+)
+
+// KeyPEMType is the PEM block type of a TPM 2.0 key file as defined by
+// draft-bottomley-tpm2-keys and written by tpm2-openssl and tpm2-tss-engine.
+const KeyPEMType = "TSS2 PRIVATE KEY"
+
+var ErrKeyNeedsAuth = errors.New("TPM key requires an authorization value")
+
+// ParseKey reads a TSS2 key file and returns a signer that produces every signature
+// inside the TPM; only the digest goes in and only the signature comes out. A key with
+// a persistent parent is loaded under it, a key whose parent is a hierarchy under the
+// TCG default ECC primary that tpm2-openssl and tpm2-tss-engine derive as well. Keys
+// guarded by an authorization value are rejected, since nothing can supply it without
+// prompting.
+func ParseKey(der []byte) (crypto.Signer, error) {
+	key, err := tss2.ParsePrivateKey(der)
+	if err != nil {
+		return nil, fmt.Errorf("parse TSS2 key: %w", err)
+	}
+	if !key.EmptyAuth {
+		return nil, ErrKeyNeedsAuth
+	}
+	public, err := key.Public()
+	if err != nil {
+		return nil, fmt.Errorf("decode TSS2 public key: %w", err)
+	}
+	return &keySigner{key: key, public: public}, nil
+}
+
+type keySigner struct {
+	key    *tss2.TPMKey
+	public crypto.PublicKey
+}
+
+func (s *keySigner) Public() crypto.PublicKey {
+	return s.public
+}
+
+func (s *keySigner) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts) ([]byte, error) {
+	rwc, err := Open()
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = rwc.Close() }()
+
+	signer, err := tss2.CreateSigner(rwc, s.key)
+	if err != nil {
+		return nil, fmt.Errorf("load TSS2 key: %w", err)
+	}
+	signer.SetSRKTemplate(tss2.ECCSRKTemplate)
+	return signer.Sign(rand, digest, opts)
+}
diff --git a/client/internal/tpm/signer_test.go b/client/internal/tpm/signer_test.go
new file mode 100644
index 000000000..d1be2636c
--- /dev/null
+++ b/client/internal/tpm/signer_test.go
@@ -0,0 +1,64 @@
+package tpm
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/pem"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.step.sm/crypto/tpm/tss2"
+
+	"github.com/netbirdio/netbird/client/internal/tpm/tpmtest"
+)
+
+func TestParseKey_ReportsPublicKeyWithoutTouchingTPM(t *testing.T) {
+	key := newP256Key(t)
+
+	signer, err := ParseKey(decodePEM(t, tpmtest.KeyPEM(t, &key.PublicKey)))
+	require.NoError(t, err)
+	assert.True(t, key.PublicKey.Equal(signer.Public()), "signer must expose the key the TPM holds")
+}
+
+func TestParseKey_RejectsKeyWithAuthorization(t *testing.T) {
+	key := newP256Key(t)
+	withAuth := func(k *tss2.TPMKey) { k.EmptyAuth = false }
+
+	_, err := ParseKey(decodePEM(t, tpmtest.KeyPEM(t, &key.PublicKey, withAuth)))
+	assert.ErrorIs(t, err, ErrKeyNeedsAuth)
+}
+
+func TestParseKey_RejectsMalformedKey(t *testing.T) {
+	_, err := ParseKey([]byte("not a TSS2 key"))
+	assert.Error(t, err)
+}
+
+func TestSign_FailsWhenTPMIsUnreachable(t *testing.T) {
+	t.Setenv(DeviceEnv, filepath.Join(t.TempDir(), "missing"))
+	signer, err := ParseKey(decodePEM(t, tpmtest.KeyPEM(t, &newP256Key(t).PublicKey)))
+	require.NoError(t, err)
+
+	digest := sha256.Sum256([]byte("challenge"))
+	_, err = signer.Sign(rand.Reader, digest[:], crypto.SHA256)
+	assert.Error(t, err, "signing must not fall back to software when the TPM is missing")
+}
+
+func newP256Key(t *testing.T) *ecdsa.PrivateKey {
+	t.Helper()
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+	return key
+}
+
+func decodePEM(t *testing.T, pemData string) []byte {
+	t.Helper()
+	block, _ := pem.Decode([]byte(pemData))
+	require.NotNil(t, block)
+	require.Equal(t, KeyPEMType, block.Type)
+	return block.Bytes
+}
diff --git a/client/internal/tpm/tpm.go b/client/internal/tpm/tpm.go
new file mode 100644
index 000000000..ca519caa9
--- /dev/null
+++ b/client/internal/tpm/tpm.go
@@ -0,0 +1,19 @@
+// Package tpm is the client's one door to the platform TPM 2.0. It opens the device
+// and turns TPM-held key files into signers; every operation opens the TPM, runs and
+// closes it, so no handle outlives a call.
+package tpm
+
+import (
+	"errors"
+	"io"
+)
+
+// DeviceEnv overrides the TPM device path, which also lets tests point at a swtpm socket.
+const DeviceEnv = "NB_TPM_DEVICE"
+
+var ErrUnsupported = errors.New("TPM is not supported on this platform")
+
+// Open connects to the platform TPM 2.0. The caller closes it after one operation.
+func Open() (io.ReadWriteCloser, error) {
+	return open()
+}
diff --git a/client/internal/tpm/tpmtest/tpmtest.go b/client/internal/tpm/tpmtest/tpmtest.go
new file mode 100644
index 000000000..c119eb55d
--- /dev/null
+++ b/client/internal/tpm/tpmtest/tpmtest.go
@@ -0,0 +1,48 @@
+// Package tpmtest builds TSS2 key files for tests, with or without a TPM behind them.
+package tpmtest
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"testing"
+
+	"github.com/google/go-tpm/legacy/tpm2"
+	"github.com/stretchr/testify/require"
+	"go.step.sm/crypto/tpm/tss2"
+)
+
+const p256Bytes = 32
+
+// SigningTemplate is the public area of an unrestricted P-256 signing key with no fixed
+// scheme, the shape tpm2-openssl creates certificate keys in.
+func SigningTemplate() tpm2.Public {
+	return tpm2.Public{
+		Type:          tpm2.AlgECC,
+		NameAlg:       tpm2.AlgSHA256,
+		Attributes:    tpm2.FlagSign | tpm2.FlagFixedTPM | tpm2.FlagFixedParent | tpm2.FlagSensitiveDataOrigin | tpm2.FlagUserWithAuth | tpm2.FlagNoDA,
+		ECCParameters: &tpm2.ECCParams{CurveID: tpm2.CurveNISTP256},
+	}
+}
+
+// KeyPEM encodes pub as a TSS2 PRIVATE KEY over a placeholder private blob: it parses
+// and reports pub, but no TPM can load it.
+func KeyPEM(t *testing.T, pub *ecdsa.PublicKey, opts ...tss2.TPMOption) string {
+	t.Helper()
+	require.Equal(t, elliptic.P256(), pub.Curve, "fixture keys must be P-256")
+	area := SigningTemplate()
+	area.ECCParameters.Point = tpm2.ECPoint{
+		XRaw: pub.X.FillBytes(make([]byte, p256Bytes)),
+		YRaw: pub.Y.FillBytes(make([]byte, p256Bytes)),
+	}
+	encoded, err := area.Encode()
+	require.NoError(t, err)
+	return EncodePEM(t, encoded, []byte("placeholder"), opts...)
+}
+
+// EncodePEM wraps the public and private blobs TPM2_Create returned into a TSS2 PRIVATE KEY.
+func EncodePEM(t *testing.T, public, private []byte, opts ...tss2.TPMOption) string {
+	t.Helper()
+	pemBytes, err := tss2.New(public, private, opts...).EncodeToMemory()
+	require.NoError(t, err)
+	return string(pemBytes)
+}
diff --git a/client/system/info.go b/client/system/info.go
index 273c7a533..7cac34261 100644
--- a/client/system/info.go
+++ b/client/system/info.go
@@ -11,6 +11,7 @@ import (
 	log "github.com/sirupsen/logrus"
 	"google.golang.org/grpc/metadata"
 
+	"github.com/netbirdio/netbird/shared/management/certposture"
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
@@ -61,6 +62,7 @@ type Info struct {
 	SystemManufacturer string
 	Environment        Environment
 	Files              []File // for posture checks
+	CertificateProofs  []certposture.Proof
 
 	RosenpassEnabled    bool
 	RosenpassPermissive bool
diff --git a/go.mod b/go.mod
index 1d6dccd75..1642de4e0 100644
--- a/go.mod
+++ b/go.mod
@@ -17,27 +17,27 @@ require (
 	github.com/onsi/ginkgo v1.16.5
 	github.com/onsi/gomega v1.34.1
 	github.com/rs/cors v1.8.0
-	github.com/sirupsen/logrus v1.9.4
+	github.com/sirupsen/logrus v1.10.1
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
 	github.com/vishvananda/netlink v1.3.1
-	golang.org/x/crypto v0.55.0
-	golang.org/x/sys v0.47.0
+	golang.org/x/crypto v0.57.0
+	golang.org/x/sys v0.48.0
 	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10
 	golang.zx2c4.com/wireguard/windows v0.5.3
-	google.golang.org/grpc v1.80.0
-	google.golang.org/protobuf v1.36.11
+	google.golang.org/grpc v1.83.2
+	google.golang.org/protobuf v1.36.12
 )
 
 require (
 	github.com/DeRuina/timberjack v1.4.2
 	github.com/Microsoft/go-winio v0.6.2
 	github.com/awnumar/memguard v0.23.0
-	github.com/aws/aws-sdk-go-v2 v1.38.3
+	github.com/aws/aws-sdk-go-v2 v1.47.0
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.1
-	github.com/aws/aws-sdk-go-v2/config v1.31.6
-	github.com/aws/aws-sdk-go-v2/credentials v1.18.10
+	github.com/aws/aws-sdk-go-v2/config v1.33.4
+	github.com/aws/aws-sdk-go-v2/credentials v1.20.4
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.87.3
 	github.com/c-robinson/iplib v1.0.3
 	github.com/caarlos0/env/v11 v11.4.1
@@ -65,6 +65,7 @@ require (
 	github.com/godbus/dbus/v5 v5.2.2
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/google/go-cmp v0.7.0
+	github.com/google/go-tpm v0.9.8
 	github.com/google/gopacket v1.1.19
 	github.com/google/nftables v0.3.0
 	github.com/gopacket/gopacket v1.4.0
@@ -73,7 +74,7 @@ require (
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/hashicorp/go-secure-stdlib/base62 v0.1.2
-	github.com/hashicorp/go-version v1.7.0
+	github.com/hashicorp/go-version v1.9.0
 	github.com/jackc/pgx/v5 v5.10.0
 	github.com/libdns/route53 v1.5.0
 	github.com/libp2p/go-netroute v0.4.0
@@ -92,8 +93,6 @@ require (
 	github.com/ory/dockertest/v4 v4.0.0
 	github.com/oschwald/maxminddb-golang v1.12.0
 	github.com/patrickmn/go-cache v2.1.0+incompatible
-	github.com/pb33f/libopenapi v0.41.2
-	github.com/pb33f/libopenapi-validator v0.15.0
 	github.com/petermattis/goid v0.0.0-20250303134427-723919f7f203
 	github.com/pion/ice/v4 v4.0.0-00010101000000-000000000000
 	github.com/pion/logging v0.2.4
@@ -125,23 +124,24 @@ require (
 	github.com/yusufpapurcu/wmi v1.2.4
 	github.com/zcalusic/sysinfo v1.1.3
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0
-	go.opentelemetry.io/otel v1.43.0
+	go.opentelemetry.io/otel v1.44.0
 	go.opentelemetry.io/otel/exporters/prometheus v0.64.0
-	go.opentelemetry.io/otel/metric v1.43.0
-	go.opentelemetry.io/otel/sdk/metric v1.43.0
+	go.opentelemetry.io/otel/metric v1.44.0
+	go.opentelemetry.io/otel/sdk/metric v1.44.0
+	go.step.sm/crypto v0.91.0
 	go.uber.org/mock v0.6.0
 	go.uber.org/zap v1.27.0
 	goauthentik.io/api/v3 v3.2023051.3
 	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f
 	golang.org/x/mobile v0.0.0-20260816165457-f98cc9b3c733
-	golang.org/x/mod v0.39.0
-	golang.org/x/net v0.58.0
+	golang.org/x/mod v0.41.0
+	golang.org/x/net v0.59.0
 	golang.org/x/oauth2 v0.36.0
 	golang.org/x/sync v0.23.0
-	golang.org/x/term v0.45.0
+	golang.org/x/term v0.46.0
 	golang.org/x/time v0.15.0
-	google.golang.org/api v0.276.0
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9
+	google.golang.org/api v0.297.0
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688
 	gopkg.in/yaml.v3 v3.0.1
 	gorm.io/driver/mysql v1.5.7
 	gorm.io/driver/postgres v1.5.7
@@ -152,18 +152,18 @@ require (
 )
 
 require (
-	cloud.google.com/go/auth v0.20.0 // indirect
+	cloud.google.com/go/auth v0.23.2 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
 	dario.cat/mergo v1.0.2 // indirect
-	filippo.io/edwards25519 v1.1.1 // indirect
+	filippo.io/edwards25519 v1.2.0 // indirect
 	git.sr.ht/~jackmordaunt/go-toast/v2 v2.0.3 // indirect
 	github.com/AppsFlyer/go-sundheit v0.6.0 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
 	github.com/Azure/go-ntlmssp v0.1.0 // indirect
 	github.com/BurntSushi/toml v1.6.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
-	github.com/Masterminds/semver/v3 v3.4.0 // indirect
+	github.com/Masterminds/semver/v3 v3.5.0 // indirect
 	github.com/Masterminds/sprig/v3 v3.3.0 // indirect
 	github.com/ProtonMail/go-crypto v1.3.0 // indirect
 	github.com/adrg/xdg v0.5.3 // indirect
@@ -171,20 +171,20 @@ require (
 	github.com/apapsch/go-jsonmerge/v2 v2.0.0 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
 	github.com/awnumar/memcall v0.4.0 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.6 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.6 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.6 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.0 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.3 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.3 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.8.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.3 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.6 // indirect
 	github.com/aws/aws-sdk-go-v2/service/route53 v1.42.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.29.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.34.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.38.2 // indirect
-	github.com/aws/smithy-go v1.23.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/signin v1.10.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.38.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.50.0 // indirect
+	github.com/aws/smithy-go v1.28.1 // indirect
 	github.com/bahlo/generic-list-go v0.2.0 // indirect
 	github.com/basgys/goxml2json v1.1.1-0.20231018121955-e66ee54ceaad // indirect
 	github.com/beevik/etree v1.6.0 // indirect
@@ -207,7 +207,7 @@ require (
 	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
-	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/felixge/httpsnoop v1.1.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.1 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
@@ -238,10 +238,9 @@ require (
 	github.com/golang/mock v1.6.0 // indirect
 	github.com/google/btree v1.1.3 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
-	github.com/google/go-tpm v0.9.8 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.14 // indirect
-	github.com/googleapis/gax-go/v2 v2.21.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.20 // indirect
+	github.com/googleapis/gax-go/v2 v2.24.1 // indirect
 	github.com/goreleaser/chglog v0.7.4 // indirect
 	github.com/gorilla/handlers v1.5.2 // indirect
 	github.com/grafana/pyroscope-go/godeltaprof v0.1.11 // indirect
@@ -279,8 +278,8 @@ require (
 	github.com/magiconair/properties v1.8.10 // indirect
 	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/mattermost/xml-roundtrip-validator v0.1.0 // indirect
-	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-colorable v0.1.15 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/mattn/go-sqlite3 v1.14.42 // indirect
 	github.com/mdelapenya/tlscert v0.2.0 // indirect
 	github.com/mdlayher/genetlink v1.3.2 // indirect
@@ -305,8 +304,10 @@ require (
 	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/pb33f/go-yaml v0.1.1 // indirect
 	github.com/pb33f/jsonpath v0.8.4 // indirect
+	github.com/pb33f/libopenapi v0.41.2
+	github.com/pb33f/libopenapi-validator v0.15.0
 	github.com/pb33f/ordered-map/v2 v2.3.2 // indirect
-	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
+	github.com/pelletier/go-toml/v2 v2.4.3 // indirect
 	github.com/philhofer/fwd v1.2.0 // indirect
 	github.com/pion/dtls/v2 v2.2.10 // indirect
 	github.com/pion/dtls/v3 v3.0.9 // indirect
@@ -323,7 +324,7 @@ require (
 	github.com/russellhaering/goxmldsig v1.6.0 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
 	github.com/sagikazarmark/locafero v0.11.0 // indirect
-	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 // indirect
 	github.com/sergi/go-diff v1.4.0 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/skeema/knownhosts v1.3.2 // indirect
@@ -345,16 +346,16 @@ require (
 	gitlab.com/digitalxero/go-conventional-commit v1.0.7 // indirect
 	go.mongodb.org/mongo-driver v1.17.9 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.43.0 // indirect
-	go.opentelemetry.io/otel/trace v1.43.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.44.0 // indirect
+	go.opentelemetry.io/otel/trace v1.44.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
-	golang.org/x/text v0.41.0 // indirect
-	golang.org/x/tools v0.49.0 // indirect
+	golang.org/x/text v0.42.0 // indirect
+	golang.org/x/tools v0.50.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260715232425-e75dac1f907d // indirect
 	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
 	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
diff --git a/go.sum b/go.sum
index 2a0b10d4e..0f39bc53e 100644
--- a/go.sum
+++ b/go.sum
@@ -1,5 +1,5 @@
-cloud.google.com/go/auth v0.20.0 h1:kXTssoVb4azsVDoUiF8KvxAqrsQcQtB53DcSgta74CA=
-cloud.google.com/go/auth v0.20.0/go.mod h1:942/yi/itH1SsmpyrbnTMDgGfdy2BUqIKyd0cyYLc5Q=
+cloud.google.com/go/auth v0.23.2 h1:pxSCpfiji41hpzpPdMCftEUCezpgpqmmDdYiAjCKXxo=
+cloud.google.com/go/auth v0.23.2/go.mod h1:4DhBRcqvtljQN3dJ57qtqbib5ZGCYE5f2crfiiC2EM0=
 cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
 cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
 cloud.google.com/go/compute/metadata v0.2.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
@@ -11,8 +11,8 @@ cunicu.li/go-rosenpass v0.5.42 h1:fRDsGwCxd7DhDgZI1Pxeo8GtNyq8BESZJ7w2/BGGJtU=
 cunicu.li/go-rosenpass v0.5.42/go.mod h1:YRBeyKOe/gWpSX2kpDUec5p9t0XOLsshTguId5gTGVg=
 dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
 dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
-filippo.io/edwards25519 v1.1.1 h1:YpjwWWlNmGIDyXOn8zLzqiD+9TyIlPhGFG96P39uBpw=
-filippo.io/edwards25519 v1.1.1/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
+filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
+filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
 git.sr.ht/~jackmordaunt/go-toast/v2 v2.0.3 h1:N3IGoHHp9pb6mj1cbXbuaSXV/UMKwmbKLf53nQmtqMA=
 git.sr.ht/~jackmordaunt/go-toast/v2 v2.0.3/go.mod h1:QtOLZGz8olr4qH2vWK0QH0w0O4T9fEIjMuWpKUsH7nc=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=
@@ -29,8 +29,8 @@ github.com/DeRuina/timberjack v1.4.2 h1:4bKlzhKdsR+2oNkgef9mqb4n11ICow8VK88RfzJP
 github.com/DeRuina/timberjack v1.4.2/go.mod h1:RLoeQrwrCGIEF8gO5nV5b/gMD0QIy7bzQhBUgpp1EqE=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
-github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
-github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=
+github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/Masterminds/sprig/v3 v3.3.0 h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=
 github.com/Masterminds/sprig/v3 v3.3.0/go.mod h1:Zy1iXRYNqNLUolqCpL4uhk6SHUMAOSCzdgBfDb35Lz0=
 github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
@@ -55,44 +55,44 @@ github.com/awnumar/memcall v0.4.0 h1:B7hgZYdfH6Ot1Goaz8jGne/7i8xD4taZie/PNSFZ29g
 github.com/awnumar/memcall v0.4.0/go.mod h1:8xOx1YbfyuCg3Fy6TO8DK0kZUua3V42/goA5Ru47E8w=
 github.com/awnumar/memguard v0.23.0 h1:sJ3a1/SWlcuKIQ7MV+R9p0Pvo9CWsMbGZvcZQtmc68A=
 github.com/awnumar/memguard v0.23.0/go.mod h1:olVofBrsPdITtJ2HgxQKrEYEMyIBAIciVG4wNnZhW9M=
-github.com/aws/aws-sdk-go-v2 v1.38.3 h1:B6cV4oxnMs45fql4yRH+/Po/YU+597zgWqvDpYMturk=
-github.com/aws/aws-sdk-go-v2 v1.38.3/go.mod h1:sDioUELIUO9Znk23YVmIk86/9DOpkbyyVb1i/gUNFXY=
+github.com/aws/aws-sdk-go-v2 v1.47.0 h1:0jsHallhJCeaU0Ko48c/3FK1ctOQ7NpzggxriJOQ8MQ=
+github.com/aws/aws-sdk-go-v2 v1.47.0/go.mod h1:bttEH6JqnUL8LepvDVfdrds/fZ5bCIxzpe3abyUrhDU=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.1 h1:i8p8P4diljCr60PpJp6qZXNlgX4m2yQFpYk+9ZT+J4E=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.1/go.mod h1:ddqbooRZYNoJ2dsTwOty16rM+/Aqmk/GOXrK8cg7V00=
-github.com/aws/aws-sdk-go-v2/config v1.31.6 h1:a1t8fXY4GT4xjyJExz4knbuoxSCacB5hT/WgtfPyLjo=
-github.com/aws/aws-sdk-go-v2/config v1.31.6/go.mod h1:5ByscNi7R+ztvOGzeUaIu49vkMk2soq5NaH5PYe33MQ=
-github.com/aws/aws-sdk-go-v2/credentials v1.18.10 h1:xdJnXCouCx8Y0NncgoptztUocIYLKeQxrCgN6x9sdhg=
-github.com/aws/aws-sdk-go-v2/credentials v1.18.10/go.mod h1:7tQk08ntj914F/5i9jC4+2HQTAuJirq7m1vZVIhEkWs=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.6 h1:wbjnrrMnKew78/juW7I2BtKQwa1qlf6EjQgS69uYY14=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.6/go.mod h1:AtiqqNrDioJXuUgz3+3T0mBWN7Hro2n9wll2zRUc0ww=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.6 h1:uF68eJA6+S9iVr9WgX1NaRGyQ/6MdIyc4JNUo6TN1FA=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.6/go.mod h1:qlPeVZCGPiobx8wb1ft0GHT5l+dc6ldnwInDFaMvC7Y=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.6 h1:pa1DEC6JoI0zduhZePp3zmhWvk/xxm4NB8Hy/Tlsgos=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.6/go.mod h1:gxEjPebnhWGJoaDdtDkA0JX46VRg1wcTHYe63OfX5pE=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 h1:bIqFDwgGXXN1Kpp99pDOdKMTTb5d2KyU5X/BZxjOkRo=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3/go.mod h1:H5O/EsxDWyU+LP/V8i5sm8cxoZgc2fdNR9bxlOFrQTo=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.6 h1:R0tNFJqfjHL3900cqhXuwQ+1K4G0xc9Yf8EDbFXCKEw=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.6/go.mod h1:y/7sDdu+aJvPtGXr4xYosdpq9a6T9Z0jkXfugmti0rI=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 h1:oegbebPEMA/1Jny7kvwejowCaHz1FWZAQ94WXFNCyTM=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1/go.mod h1:kemo5Myr9ac0U9JfSjMo9yHLtw+pECEHsFtJ9tqCEI8=
+github.com/aws/aws-sdk-go-v2/config v1.33.4 h1:FzvkXKSzwqHni4U7nDigHg4jjtqMpVUuHgmZfSoJVQ0=
+github.com/aws/aws-sdk-go-v2/config v1.33.4/go.mod h1:VZqGZnZsCWVfK/iGPptJIyNIX3XEX6iQU2Rel4sLrr8=
+github.com/aws/aws-sdk-go-v2/credentials v1.20.4 h1:hTvrJJseKbvw32kmiE0G+u/9ZqpqscjDrTigHIXP2qs=
+github.com/aws/aws-sdk-go-v2/credentials v1.20.4/go.mod h1:gWp9O1ZBWwpcIrgV+mVHk4gZUurAEDkgypu/OXOlIaw=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.0 h1:AM4hHjww+PSFtt6E+UrBrPlZkWsePCLEt9AjkfQX+yM=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.0/go.mod h1:3x/yXezeQjpOvBb4jEMxrS8SXvpdvJ5abv6l5c1gWM8=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.3 h1:Hp/VgjP0BysR3OgLlR057Vz2LcbbVnoWeJ+3qWiS/fY=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.3/go.mod h1:nwGV5qw7F1IZPgxCvA/ph8N2TAuz+BkRG/bXn808qMA=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.3 h1:MUaM4f+kj1ZIBPZfUS8cxP1GKXXZtHJjAthy93AN7SM=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.3/go.mod h1:6YmVmEVRI5ZZzRjCSsb9SryKH0hAlMRdgA7kG9aDvBU=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.3 h1:fuSCw4Z2qfRCztMPO3GXJNSiEp6Wee+WOLwrHHUMy9c=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.3/go.mod h1:6SxcHheD1pPR5+kWm1wGvjlL/YqUsh267sAfEmN4K7A=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19 h1:bAdDl/HkGCcGPoe25ToSHEw23VIxt6CT5fLcg111BKg=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19/go.mod h1:KaUzbLxv4CeSxh6ZCl9B4m7CuFenS8kUEaDs+f/DQr4=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.8.6 h1:hncKj/4gR+TPauZgTAsxOxNcvBayhUlYZ6LO/BYiQ30=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.8.6/go.mod h1:OiIh45tp6HdJDDJGnja0mw8ihQGz3VGrUflLqSL0SmM=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.6 h1:LHS1YAIJXJ4K9zS+1d/xa9JAA9sL2QyXIQCQFQW/X08=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.6/go.mod h1:c9PCiTEuh0wQID5/KqA32J+HAgZxN9tOGXKCiYJjTZI=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.3 h1:bON1rJf67TSTDCKg816AAIE4xSTtoo9tl0XRkO72R+I=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.3/go.mod h1:c5BBpjJcQXpfeq9iASyVKA3T6vX6B6LEXY4mL/gklDY=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.6 h1:nEXUSAwyUfLTgnc9cxlDWy637qsq4UWwp3sNAfl0Z3Y=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.6/go.mod h1:HGzIULx4Ge3Do2V0FaiYKcyKzOqwrhUZgCI77NisswQ=
 github.com/aws/aws-sdk-go-v2/service/route53 v1.42.3 h1:MmLCRqP4U4Cw9gJ4bNrCG0mWqEtBlmAVleyelcHARMU=
 github.com/aws/aws-sdk-go-v2/service/route53 v1.42.3/go.mod h1:AMPjK2YnRh0YgOID3PqhJA1BRNfXDfGOnSsKHtAe8yA=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.87.3 h1:ETkfWcXP2KNPLecaDa++5bsQhCRa5M5sLUJa5DWYIIg=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.87.3/go.mod h1:+/3ZTqoYb3Ur7DObD00tarKMLMuKg8iqz5CHEanqTnw=
-github.com/aws/aws-sdk-go-v2/service/sso v1.29.1 h1:8OLZnVJPvjnrxEwHFg9hVUof/P4sibH+Ea4KKuqAGSg=
-github.com/aws/aws-sdk-go-v2/service/sso v1.29.1/go.mod h1:27M3BpVi0C02UiQh1w9nsBEit6pLhlaH3NHna6WUbDE=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.34.2 h1:gKWSTnqudpo8dAxqBqZnDoDWCiEh/40FziUjr/mo6uA=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.34.2/go.mod h1:x7+rkNmRoEN1U13A6JE2fXne9EWyJy54o3n6d4mGaXQ=
-github.com/aws/aws-sdk-go-v2/service/sts v1.38.2 h1:YZPjhyaGzhDQEvsffDEcpycq49nl7fiGcfJTIo8BszI=
-github.com/aws/aws-sdk-go-v2/service/sts v1.38.2/go.mod h1:2dIN8qhQfv37BdUYGgEC8Q3tteM3zFxTI1MLO2O3J3c=
-github.com/aws/smithy-go v1.23.0 h1:8n6I3gXzWJB2DxBDnfxgBaSX6oe0d/t10qGz7OKqMCE=
-github.com/aws/smithy-go v1.23.0/go.mod h1:t1ufH5HMublsJYulve2RKmHDC15xu1f26kHCp/HgceI=
+github.com/aws/aws-sdk-go-v2/service/signin v1.10.0 h1:ZD5qFpWcaOKdTuhBi431pIDkCgrMkMlMT6jlpSPoIRI=
+github.com/aws/aws-sdk-go-v2/service/signin v1.10.0/go.mod h1:8Nuuf+tR346PjJ3MvZPh9pekbLiLQFWJhzMXfwy7alA=
+github.com/aws/aws-sdk-go-v2/service/sso v1.38.0 h1:JGeeBcMlhg1xtOXYpeCaTQBZObtXMPQCUqBcmr65NRA=
+github.com/aws/aws-sdk-go-v2/service/sso v1.38.0/go.mod h1:XwteswG9EOMRFm73UT0t+MbTwyLxMrEXkU6e+v92Lzo=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.0 h1:obhahQXDEdVEv8y5bTKXR30LVaxYe1kyYM0L7l2Iq+k=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.0/go.mod h1:6twZZ/aXHNy1vXUO8koUbp++MYzMASkOgEBdkbJYmO0=
+github.com/aws/aws-sdk-go-v2/service/sts v1.50.0 h1:khXV3+K5D3f4e8xtplaRdSFn1bEg3gj5EBHQvbCOZbQ=
+github.com/aws/aws-sdk-go-v2/service/sts v1.50.0/go.mod h1:/8JRcdTt//hG0Q4BTmGbuOplT7ABe+5rdtqUHqXvYIM=
+github.com/aws/smithy-go v1.28.1 h1:R/nXH00c8qcfCzQVELtRw+eLQWtzv+VAIEFJ1/xxXlQ=
+github.com/aws/smithy-go v1.28.1/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/bahlo/generic-list-go v0.2.0 h1:5sz/EEAK+ls5wF+NeqDpk5+iNdMDXrh3z3nPnH1Wvgk=
 github.com/bahlo/generic-list-go v0.2.0/go.mod h1:2KvAjgMlE5NNynlg/5iLrrCCZ2+5xWbdbCW3pNTGyYg=
 github.com/basgys/goxml2json v1.1.1-0.20231018121955-e66ee54ceaad h1:3swAvbzgfaI6nKuDDU7BiKfZRdF+h2ZwKgMHd8Ha4t8=
@@ -183,10 +183,10 @@ github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o
 github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE=
 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
 github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
-github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
-github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
-github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
-github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
+github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
+github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=
+github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE=
 github.com/fortytw2/leaktest v1.3.0 h1:u8491cBMTQ8ft8aeV+adlcytMZylmA5nnwwkRZjI8vw=
 github.com/fortytw2/leaktest v1.3.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
@@ -316,8 +316,8 @@ github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD
 github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
 github.com/google/go-tpm v0.9.8/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
-github.com/google/go-tpm-tools v0.3.13-0.20230620182252-4639ecce2aba h1:qJEJcuLzH5KDR0gKc0zcktin6KSAwL7+jWKBYceddTc=
-github.com/google/go-tpm-tools v0.3.13-0.20230620182252-4639ecce2aba/go.mod h1:EFYHy8/1y2KfgTAsx7Luu7NGhoxtuVHnNo8jE7FikKc=
+github.com/google/go-tpm-tools v0.4.9 h1:jZEhnE4WRFbomSssBH2gWaIViIHU1gjH1jz76+xC9bI=
+github.com/google/go-tpm-tools v0.4.9/go.mod h1:Omb8zosA8qY9URn1gsrO2i4b6DFqGp29BqNx18V66c4=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gopacket v1.1.19 h1:ves8RnFZPGiFnTS0uPQStjwru6uO6h+nlr9j6fL7kF8=
 github.com/google/gopacket v1.1.19/go.mod h1:iJ8V8n6KS+z2U1A8pUwu8bW5SyEMkXJB8Yo/Vo+TKTo=
@@ -329,10 +329,10 @@ github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
 github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.3.14 h1:yh8ncqsbUY4shRD5dA6RlzjJaT4hi3kII+zYw8wmLb8=
-github.com/googleapis/enterprise-certificate-proxy v0.3.14/go.mod h1:vqVt9yG9480NtzREnTlmGSBmFrA+bzb0yl0TxoBQXOg=
-github.com/googleapis/gax-go/v2 v2.21.0 h1:h45NjjzEO3faG9Lg/cFrBh2PgegVVgzqKzuZl/wMbiI=
-github.com/googleapis/gax-go/v2 v2.21.0/go.mod h1:But/NJU6TnZsrLai/xBAQLLz+Hc7fHZJt/hsCz3Fih4=
+github.com/googleapis/enterprise-certificate-proxy v0.3.20 h1:t/xL64VUoN69MuMRQuJETqYGOw4Z9mSRJK9epIEtwFk=
+github.com/googleapis/enterprise-certificate-proxy v0.3.20/go.mod h1:L3D/IQExI6LqEjBdXcZQ1WluSgigQmSwBboFstVPM4w=
+github.com/googleapis/gax-go/v2 v2.24.1 h1:AtqTN21IXMMWo99LiEVAiBfNNQmO40d8xUfZI640mc0=
+github.com/googleapis/gax-go/v2 v2.24.1/go.mod h1:bWeBei0NVwaNZKb2y1HUBS7gLXIF3/Tu3pq7j8D2Tb0=
 github.com/gopacket/gopacket v1.4.0 h1:cr1OlFpzksCkZHNO0eLjaSSOrMQnpPXg0j6qHIY3y2U=
 github.com/gopacket/gopacket v1.4.0/go.mod h1:EpvsxINeehp5qj4YMKMLf2/dekdhKn2IIAO/ZOifS7o=
 github.com/gopherjs/gopherjs v1.17.2 h1:fQnZVsXk8uxXIStYb0N4bGk7jeyTalG/wsZjQ25dO0g=
@@ -373,8 +373,8 @@ github.com/hashicorp/go-sockaddr v1.0.7/go.mod h1:FZQbEYa1pxkQ7WLpyXJ6cbjpT8q0Yg
 github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/go-version v1.7.0 h1:5tqGy27NaOTB8yJKUZELlFAS/LTKJkrmONwQKeRZfjY=
-github.com/hashicorp/go-version v1.7.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/hashicorp/go-version v1.9.0 h1:CeOIz6k+LoN3qX9Z0tyQrPtiB1DFYRPfCIBtaXPSCnA=
+github.com/hashicorp/go-version v1.9.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/hcl v1.0.1-vault-7 h1:ag5OxFVy3QYTFTJODRzTKVZ6xvdfLLCA1cy/Y6xGI0I=
 github.com/hashicorp/hcl v1.0.1-vault-7/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
@@ -470,11 +470,11 @@ github.com/matryer/is v1.4.1 h1:55ehd8zaGABKLXQUe2awZ99BD/PTc2ls+KV/dXphgEQ=
 github.com/matryer/is v1.4.1/go.mod h1:8I/i5uYgLzgsgEloJE1U6xx5HkBQpAZvepWuujKwMRU=
 github.com/mattermost/xml-roundtrip-validator v0.1.0 h1:RXbVD2UAl7A7nOTR4u7E3ILa4IbtvKBHw64LDsmu9hU=
 github.com/mattermost/xml-roundtrip-validator v0.1.0/go.mod h1:qccnGMcpgwcNaBnxqpJpWWUiPNr5H3O8eDgGV9gT5To=
-github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
-github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY=
+github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.9/go.mod h1:YNRxwqDuOph6SZLI9vUUz6OYw3QyUt7WiY2yME+cCiQ=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/mattn/go-sqlite3 v1.14.42 h1:MigqEP4ZmHw3aIdIT7T+9TLa90Z6smwcthx+Azv4Cgo=
 github.com/mattn/go-sqlite3 v1.14.42/go.mod h1:pjEuOr8IwzLJP2MfGeTb0A35jauH+C2kbHKBr7yXKVQ=
 github.com/mdelapenya/tlscert v0.2.0 h1:7H81W6Z/4weDvZBNOfQte5GpIMo0lGYEeWbkGp5LJHI=
@@ -587,8 +587,8 @@ github.com/pb33f/ordered-map/v2 v2.3.2 h1:wDyaZ2Pv9QLh64X4utCeD5Zoi9nIv2aW3lwv17
 github.com/pb33f/ordered-map/v2 v2.3.2/go.mod h1:1OhFrXu3OYw3kM+FXF+Ug3ugmmZ9LE8z0JfQMLvtV0w=
 github.com/pb33f/testify v0.1.1 h1:mnHe7uxKt8dyNYEGUspow72VjD264DB5rOJq4bz5tJw=
 github.com/pb33f/testify v0.1.1/go.mod h1:keghMqOLECF1ENzESnfM+cwPcKN5uhTOpvbtjgL6aZg=
-github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
-github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/pelletier/go-toml/v2 v2.4.3 h1:GTRvJQutkOSftxIFD5xw9aepkYNuPWmVJpffdDPYVpY=
+github.com/pelletier/go-toml/v2 v2.4.3/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/petermattis/goid v0.0.0-20250303134427-723919f7f203 h1:E7Kmf11E4K7B5hDti2K2NqPb1nlYlGYsu02S1JNd/Bs=
 github.com/petermattis/goid v0.0.0-20250303134427-723919f7f203/go.mod h1:pxMtw7cyUw6B2bRH0ZBANSPg+AoSud1I1iyJHI69jH4=
 github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
@@ -651,8 +651,8 @@ github.com/quic-go/quic-go v0.62.0 h1:ZHDjCk5OacATwGvs8PWE97CTvX7AqZiVoW7++ZOXTf
 github.com/quic-go/quic-go v0.62.0/go.mod h1:RAro2j2yN9a9EiPACLHT9IB2NXCvGQmmo/alT0yYI0w=
 github.com/redis/go-redis/v9 v9.7.3 h1:YpPyAayJV+XErNsatSElgRZZVCwXX9QzkKYNvO7x0wM=
 github.com/redis/go-redis/v9 v9.7.3/go.mod h1:bGUrSggJ9X9GUmZpZNEOQKaANxSGgOEBRltRTZHSvrA=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/rogpeppe/go-internal v1.16.0 h1:O9DK+vNMDVGLr2BeZqmpLeMjiMNkuXfcqntWbZV6S5g=
+github.com/rogpeppe/go-internal v1.16.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs=
 github.com/rs/cors v1.8.0 h1:P2KMzcFwrPoSjkF1WLRPsp3UMLyql8L4v9hQpVeK5so=
 github.com/rs/cors v1.8.0/go.mod h1:EBwu+T5AvHOcXwvZIkQFjUN6s8Czyqw12GL/Y0tUyRM=
 github.com/rs/xid v1.3.0 h1:6NjYksEUlhurdVehpc7S7dk6DAmcKv8V9gG0FsVN2U4=
@@ -664,8 +664,8 @@ github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkB
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
 github.com/sagikazarmark/locafero v0.11.0 h1:1iurJgmM9G3PA/I+wWYIOw/5SyBtxapeHDcg+AAIFXc=
 github.com/sagikazarmark/locafero v0.11.0/go.mod h1:nVIGvgyzw595SUSUE6tvCp3YYTeHs15MvlmU87WwIik=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
 github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
 github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/shirou/gopsutil/v4 v4.25.8 h1:NnAsw9lN7587WHxjJA9ryDnqhJpFH6A+wagYWTOH970=
@@ -673,8 +673,8 @@ github.com/shirou/gopsutil/v4 v4.25.8/go.mod h1:q9QdMmfAOVIw7a+eF86P7ISEU6ka+NLg
 github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
 github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
-github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
+github.com/sirupsen/logrus v1.10.1 h1:xi4336Zh11WpU14fXR6I67V3yaTPQYwRx2WEtHbRg4Q=
+github.com/sirupsen/logrus v1.10.1/go.mod h1:vsQHnG7xzNsxk3NrwboUiWPnIC3dmbjcGPykD7+tiHk=
 github.com/skeema/knownhosts v1.3.2 h1:EDL9mgf4NzwMXCTfaxSD/o/a5fxDw/xL9nkU28JjdBg=
 github.com/skeema/knownhosts v1.3.2/go.mod h1:bEg3iQAuw+jyiw+484wwFJoKSLwcfd7fqRy+N0QTiow=
 github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 h1:JIAuq3EEf9cgbU6AtGPK4CTG3Zf6CKMNqf0MHTggAUA=
@@ -777,26 +777,30 @@ go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 h1:yI1/OhfEPy7J9eoa6Sj051C7n5dvpj0QX8g4sRchg04=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0/go.mod h1:NoUCKYWK+3ecatC4HjkRktREheMeEtrXoQxrqYFeHSc=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg=
-go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
-go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0/go.mod h1:z9+yiacE0IHRqM4qFfkbt/JYlmYXgss8GY/jXoNuPJI=
+go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=
+go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0 h1:Mne5On7VWdx7omSrSSZvM4Kw7cS7NQkOOmLcgscI51U=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0/go.mod h1:IPtUMKL4O3tH5y+iXVyAXqpAwMuzC1IrxVS81rummfE=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0 h1:IeMeyr1aBvBiPVYihXIaeIZba6b8E1bYp7lbdxK8CQg=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0/go.mod h1:oVdCUtjq9MK9BlS7TtucsQwUcXcymNiEDjgDD2jMtZU=
 go.opentelemetry.io/otel/exporters/prometheus v0.64.0 h1:g0LRDXMX/G1SEZtK8zl8Chm4K6GBwRkjPKE36LxiTYs=
 go.opentelemetry.io/otel/exporters/prometheus v0.64.0/go.mod h1:UrgcjnarfdlBDP3GjDIJWe6HTprwSazNjwsI+Ru6hro=
-go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
-go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
-go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
-go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
-go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
-go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
-go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
-go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
+go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=
+go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=
+go.opentelemetry.io/otel/metric/x v0.66.0 h1:YkCrx1zLOChi9ZcZ6euupOcsgzbVlec7D/xoEU1+cTA=
+go.opentelemetry.io/otel/metric/x v0.66.0/go.mod h1:d1+BDj9t96do0/1LoU1ayfCv79ZgNE41qbhBvnMOBZk=
+go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=
+go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0=
+go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=
+go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
+go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
+go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
 go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lIVU/I=
 go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM=
+go.step.sm/crypto v0.91.0 h1:0mN0DwVOvUuh7VbyTnxABZuAkxwak/Grp8Y/b4YaZDU=
+go.step.sm/crypto v0.91.0/go.mod h1:NxxObRBymdbyXLoTCW5Ea6sLxuy5yI/xr9+hSBlbU/Q=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
@@ -825,8 +829,8 @@ golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1m
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
+golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
@@ -841,8 +845,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.39.0 h1:UF5zwQdCRRUpHfyPwr7d4UrGiVeldIsogtzWVnczL74=
-golang.org/x/mod v0.39.0/go.mod h1:bvIbwjQ0HUFFf5AKukeeYQG4ZBUG9yxQbR9aEweIwYY=
+golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
+golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
@@ -863,8 +867,8 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
-golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
+golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
+golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
@@ -919,8 +923,8 @@ golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -934,8 +938,8 @@ golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
+golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -949,8 +953,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -964,8 +968,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
-golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
+golang.org/x/tools v0.50.0 h1:c2ifzfcuY7L90lZ2aKd8S4K2NpASF08SZx9ZuJkHmSU=
+golang.org/x/tools v0.50.0/go.mod h1:7ulVMw3831Mwi5EZD6RomGyffr4VFjuNYXf2BbCEAV0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -978,17 +982,17 @@ golang.zx2c4.com/wireguard/windows v0.5.3 h1:On6j2Rpn3OEMXqBq00QEDC7bWSZrPIHKIus
 golang.zx2c4.com/wireguard/windows v0.5.3/go.mod h1:9TEe8TJmtwyQebdFwAkEWOPr3prrtqm+REGFifP60hI=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/api v0.276.0 h1:nVArUtfLEihtW+b0DdcqRGK1xoEm2+ltAihyztq7MKY=
-google.golang.org/api v0.276.0/go.mod h1:Fnag/EWUPIcJXuIkP1pjoTgS5vdxlk3eeemL7Do6bvw=
+google.golang.org/api v0.297.0 h1:WktxTsnnx0yZNnsR6j0q6hR21RnnK81FHTOPy/ux4OE=
+google.golang.org/api v0.297.0/go.mod h1:S4m8x0M6OkQpkOzGk1y9JG2sm4fFQrMh6dxzjCTszhE=
 google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 h1:XzmzkmB14QhVhgnawEVsOn6OFsnpyxNPRY9QV01dNB0=
-google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:L43LFes82YgSonw6iTXTxXUX1OlULt4AQtkik4ULL/I=
-google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7 h1:41r6JMbpzBMen0R/4TZeeAmGXSJC7DftGINUodzTkPI=
-google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:EIQZ5bFCfRQDV4MhRle7+OgjNtZ6P1PiZBgAKuxXu/Y=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 h1:m8qni9SQFH0tJc1X0vmnpw/0t+AImlSvp30sEupozUg=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=
-google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
+google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d h1:C9v1o0/4quuhOAfmRXA2j+we0PqZIp8traLdeogF3Ms=
+google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d/go.mod h1:Wz2wFJntZFmLGo7pLDXZ3wYk5hyc0Mb+SkHhDDXT+lU=
+google.golang.org/genproto/googleapis/api v0.0.0-20260715232425-e75dac1f907d h1:QwnJwPte4XXAkhPu26LTDIahnsMSUV0kK8HkxbC+Pc4=
+google.golang.org/genproto/googleapis/api v0.0.0-20260715232425-e75dac1f907d/go.mod h1:WRrQ7/7N19PypuT0fxLOL5Lq0waoiRri4FbtHDEKrGE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 h1:cYNAzI2sUwhmCcoj9TxvihSrqsxt6uIkj3rDRhSDmW4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688/go.mod h1:DjtHYE8FKJLivXcBEjGwndXfIC23G0VpXiXKqG179uA=
+google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
+google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -999,8 +1003,8 @@ google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp0
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
-google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
+google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
diff --git a/integration_tests/management/network_map_db/network_map_data_golden.json b/integration_tests/management/network_map_db/network_map_data_golden.json
index bf194851e..3265e5181 100644
--- a/integration_tests/management/network_map_db/network_map_data_golden.json
+++ b/integration_tests/management/network_map_db/network_map_data_golden.json
@@ -35,6 +35,7 @@
             "ProcessIsRunning": false
           }
         ],
+        "Certificates": null,
         "Capabilities": [
           1,
           2
@@ -90,6 +91,7 @@
             "ProcessIsRunning": false
           }
         ],
+        "Certificates": null,
         "Capabilities": [
           1,
           2
@@ -145,6 +147,7 @@
             "ProcessIsRunning": false
           }
         ],
+        "Certificates": null,
         "Capabilities": [
           1,
           2
@@ -433,7 +436,8 @@
             "192.168.0.1/24"
           ]
         },
-        "ProcessCheck": null
+        "ProcessCheck": null,
+        "CertificateCheck": null
       }
     }
   },
diff --git a/management/cmd/management.go b/management/cmd/management.go
index 434ad8402..a8f9aa321 100644
--- a/management/cmd/management.go
+++ b/management/cmd/management.go
@@ -364,6 +364,9 @@ func LogConfigInfo(cfg *nbconfig.Config) {
 	if cfg.Relay != nil {
 		log.Infof("Relay addresses: %v", cfg.Relay.Addresses)
 	}
+	if cfg.Signal != nil {
+		log.Infof("Signal addresses: %v", cfg.Signal.URI)
+	}
 }
 
 // EnsureEncryptionKey generates and saves a DataStoreEncryptionKey if not set
diff --git a/management/internals/controllers/network_map/nmaptest/legacyaccount.go b/management/internals/controllers/network_map/nmaptest/legacyaccount.go
index d6a653f7a..007eadfdd 100644
--- a/management/internals/controllers/network_map/nmaptest/legacyaccount.go
+++ b/management/internals/controllers/network_map/nmaptest/legacyaccount.go
@@ -426,6 +426,9 @@ func accountPostureChecks(id string, pc *nmdata.PostureChecks, publicID string)
 		}
 		out.Checks.ProcessCheck = &posture.ProcessCheck{Processes: procs}
 	}
+	if def.CertificateCheck != nil {
+		out.Checks.CertificateCheck = &posture.CertificateCheck{CACertificates: def.CertificateCheck.CACertificates}
+	}
 	return out
 }
 
diff --git a/management/internals/network_map_db/pgsql/peer.go b/management/internals/network_map_db/pgsql/peer.go
index 962669f7a..108ad2a5e 100644
--- a/management/internals/network_map_db/pgsql/peer.go
+++ b/management/internals/network_map_db/pgsql/peer.go
@@ -12,7 +12,7 @@ const (
 	GetPeersQuery = `
 	select id, key, ssh_key, dns_label, extra_dns_labels, user_id, ssh_enabled, login_expiration_enabled, last_login, ip, ipv6,
 	peer_status_requires_approval, peer_status_connected, proxy_meta_embedded, proxy_meta_cluster,
-	meta_wt_version, meta_go_os, meta_os_version, meta_kernel_version, meta_network_addresses, meta_files, meta_capabilities, meta_flags, meta_sync_message_version,
+	meta_wt_version, meta_go_os, meta_os_version, meta_kernel_version, meta_network_addresses, meta_files, meta_certificates, meta_capabilities, meta_flags, meta_sync_message_version,
 	location_country_code, location_city_name, location_connection_ip
 	from peers
 	where account_id = $1
diff --git a/management/internals/network_map_db/shared_types.go b/management/internals/network_map_db/shared_types.go
index e468ba36a..dc065073c 100644
--- a/management/internals/network_map_db/shared_types.go
+++ b/management/internals/network_map_db/shared_types.go
@@ -179,6 +179,7 @@ type Peer struct {
 	MetaKernelVersion          sql.NullString `nmap:"skip"`
 	MetaNetworkAddresses       []byte         `nmap:"skip,json"`
 	MetaFiles                  []byte         `nmap:"skip,json"`
+	MetaCertificates           []byte         `nmap:"skip,json"`
 	MetaCapabilities           []byte         `nmap:"skip,json"`
 	MetaFlags                  []byte         `nmap:"skip,json"`
 	MetaSyncMessageVersion     sql.NullInt64  `nmap:"skip"`
@@ -339,6 +340,12 @@ func ConvertToNmdataPeers(peers []Peer) ([]nmdata.Peer, map[string][]*nmdata.Pee
 				return toret, nil, err
 			}
 		}
+		if p.MetaCertificates != nil {
+			err := json.Unmarshal(p.MetaCertificates, &dp.Meta.Certificates)
+			if err != nil {
+				return toret, nil, err
+			}
+		}
 		if p.MetaCapabilities != nil {
 			err := json.Unmarshal(p.MetaCapabilities, &dp.Meta.Capabilities)
 			if err != nil {
diff --git a/management/internals/network_map_db/sqlite/peer.go b/management/internals/network_map_db/sqlite/peer.go
index 12d9e9ab7..c4570658d 100644
--- a/management/internals/network_map_db/sqlite/peer.go
+++ b/management/internals/network_map_db/sqlite/peer.go
@@ -11,7 +11,7 @@ const (
 	GetPeersQuery = `
 	select id, key, ssh_key, dns_label, extra_dns_labels, user_id, ssh_enabled, login_expiration_enabled, last_login, ip, ipv6,
 	peer_status_requires_approval, peer_status_connected, proxy_meta_embedded, proxy_meta_cluster,
-	meta_wt_version, meta_go_os, meta_os_version, meta_kernel_version, meta_network_addresses, meta_files, meta_capabilities, meta_flags, meta_sync_message_version,
+	meta_wt_version, meta_go_os, meta_os_version, meta_kernel_version, meta_network_addresses, meta_files, meta_certificates, meta_capabilities, meta_flags, meta_sync_message_version,
 	location_country_code, location_city_name, location_connection_ip
 	from peers
 	where account_id = ?
diff --git a/management/internals/shared/grpc/certposture.go b/management/internals/shared/grpc/certposture.go
new file mode 100644
index 000000000..a0c2fa675
--- /dev/null
+++ b/management/internals/shared/grpc/certposture.go
@@ -0,0 +1,72 @@
+package grpc
+
+import (
+	"context"
+	"crypto/sha256"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+const certChallengeKeyDomain = "netbird-cert-challenge-key"
+
+// certChallenger derives the nonce secret from the management WireGuard key so every
+// instance sharing that key issues and verifies the same nonces without extra state.
+func certChallenger(serverKey wgtypes.Key) *certposture.Challenger {
+	h := sha256.New()
+	h.Write([]byte(certChallengeKeyDomain))
+	h.Write(serverKey[:])
+	return certposture.NewChallenger(h.Sum(nil))
+}
+
+// stampCertificateChallenges fills the per-peer nonce into every certificate challenge
+// right before the response is encrypted for that peer.
+func stampCertificateChallenges(checks []*proto.Checks, peerKey, serverKey wgtypes.Key) {
+	var nonce []byte
+	for _, check := range checks {
+		challenge := check.GetCertificateChallenge()
+		if challenge == nil {
+			continue
+		}
+		if nonce == nil {
+			nonce = certChallenger(serverKey).Nonce(peerKey[:], time.Now())
+		}
+		challenge.Nonce = nonce
+	}
+}
+
+// verifiedCertificates turns the peer's proofs into PEM chains for its meta. Possession
+// (nonce + signature) is verified here; trust against a check's CAs is evaluated by the
+// posture check itself. Any invalid proof rejects the whole set.
+func (s *Server) verifiedCertificates(ctx context.Context, peerKey wgtypes.Key, proofs []*proto.CertificateProof) []string {
+	if len(proofs) == 0 {
+		return nil
+	}
+	serverKey, err := s.secretsManager.GetWGKey()
+	if err != nil {
+		log.WithContext(ctx).Warnf("skipping certificate proofs of peer %s: %v", peerKey, err)
+		return nil
+	}
+
+	challenger := certChallenger(serverKey)
+	now := time.Now()
+	chains := make([]string, 0, len(proofs))
+	for _, p := range proofs {
+		chain, err := challenger.Verify(certposture.Proof{
+			Nonce:     p.GetNonce(),
+			Chain:     p.GetChain(),
+			SigAlg:    p.GetSigAlg(),
+			Signature: p.GetSignature(),
+		}, peerKey[:], now)
+		if err != nil {
+			log.WithContext(ctx).Warnf("rejecting certificate proofs of peer %s: %v", peerKey, err)
+			return nil
+		}
+		chains = append(chains, certposture.EncodeChainPEM(chain))
+	}
+	return chains
+}
diff --git a/management/internals/shared/grpc/certposture_test.go b/management/internals/shared/grpc/certposture_test.go
new file mode 100644
index 000000000..5239264ba
--- /dev/null
+++ b/management/internals/shared/grpc/certposture_test.go
@@ -0,0 +1,75 @@
+package grpc
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/certposture/certtest"
+	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+func TestCertificateChallenge_StampAndVerifyRoundTrip(t *testing.T) {
+	serverKey := generateKey(t)
+	peerKey := generateKey(t).PublicKey()
+	ca := certtest.NewCA(t, "corp-root")
+	ctx := context.Background()
+
+	checks := toProtocolChecks(ctx, []*nmdata.PostureChecks{{
+		ID:     "cert-check",
+		Checks: nmdata.ChecksDefinition{CertificateCheck: &nmdata.CertificateCheck{CACertificates: []string{ca.PEM}}},
+	}})
+	require.Len(t, checks, 1)
+	require.Equal(t, []string{ca.PEM}, checks[0].GetCertificateChallenge().GetCaCertificates())
+	require.Empty(t, checks[0].GetCertificateChallenge().GetNonce())
+
+	stampCertificateChallenges(checks, peerKey, serverKey)
+	nonce := checks[0].GetCertificateChallenge().GetNonce()
+	require.NotEmpty(t, nonce)
+
+	deviceKey := certtest.ECDSAKey(t)
+	leaf := ca.Issue(t, deviceKey, "device")
+	sigAlg, sig, err := certposture.Sign(deviceKey, nonce, peerKey[:])
+	require.NoError(t, err)
+	proofs := []*proto.CertificateProof{{Nonce: nonce, Chain: [][]byte{leaf.Raw}, SigAlg: sigAlg, Signature: sig}}
+
+	s := &Server{secretsManager: &TimeBasedAuthSecretsManager{wgKey: serverKey}}
+
+	chains := s.verifiedCertificates(ctx, peerKey, proofs)
+	require.Len(t, chains, 1)
+	assert.True(t, certposture.ChainMatchesCAs(chains[0], []string{ca.PEM}, time.Now()))
+
+	t.Run("proof replayed by another peer is rejected", func(t *testing.T) {
+		assert.Nil(t, s.verifiedCertificates(ctx, generateKey(t).PublicKey(), proofs))
+	})
+	t.Run("nonce from another management key is rejected", func(t *testing.T) {
+		other := &Server{secretsManager: &TimeBasedAuthSecretsManager{wgKey: generateKey(t)}}
+		assert.Nil(t, other.verifiedCertificates(ctx, peerKey, proofs))
+	})
+	t.Run("one invalid proof rejects the whole set", func(t *testing.T) {
+		bad := &proto.CertificateProof{Nonce: nonce, Chain: [][]byte{leaf.Raw}, SigAlg: sigAlg, Signature: []byte("junk")}
+		assert.Nil(t, s.verifiedCertificates(ctx, peerKey, append(proofs, bad)))
+	})
+	t.Run("no proofs yields no certificates", func(t *testing.T) {
+		assert.Nil(t, s.verifiedCertificates(ctx, peerKey, nil))
+	})
+}
+
+func TestStampCertificateChallenges_SkipsFileOnlyChecks(t *testing.T) {
+	checks := []*proto.Checks{{Files: []string{"/bin/agent"}}}
+	stampCertificateChallenges(checks, generateKey(t).PublicKey(), generateKey(t))
+	assert.Nil(t, checks[0].GetCertificateChallenge())
+}
+
+func generateKey(t *testing.T) wgtypes.Key {
+	t.Helper()
+	key, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err)
+	return key
+}
diff --git a/management/internals/shared/grpc/peer_update_handler.go b/management/internals/shared/grpc/peer_update_handler.go
index d2f403841..d3ff9b6af 100644
--- a/management/internals/shared/grpc/peer_update_handler.go
+++ b/management/internals/shared/grpc/peer_update_handler.go
@@ -117,6 +117,7 @@ func (pu *PeerUpdateHandler) SendUpdate(ctx context.Context, update *network_map
 		return status.Errorf(codes.Internal, "failed processing update message")
 	}
 
+	stampCertificateChallenges(update.Update.GetChecks(), pu.peerKey, key)
 	encryptedResp, err := pu.encrypter.EncryptMessage(pu.peerKey, key, update.Update)
 	if err != nil {
 		pu.cleanupFunc()
diff --git a/management/internals/shared/grpc/server.go b/management/internals/shared/grpc/server.go
index 529e3d379..32fa11bc2 100644
--- a/management/internals/shared/grpc/server.go
+++ b/management/internals/shared/grpc/server.go
@@ -246,6 +246,7 @@ func (s *Server) Sync(req *proto.EncryptedMessage, srv proto.ManagementService_S
 	realIP := getRealIP(ctx)
 	sRealIP := realIP.String()
 	peerMeta := extractPeerMeta(ctx, syncReq.GetMeta())
+	peerMeta.Certificates = s.verifiedCertificates(ctx, peerKey, syncReq.GetMeta().GetCertificateProofs())
 
 	metahashed := metaHash(peerMeta)
 	if !s.loginFilter.allowLogin(peerKey.String(), metahashed) {
@@ -649,6 +650,7 @@ func (s *Server) Login(ctx context.Context, req *proto.EncryptedMessage) (*proto
 	}
 
 	peerMeta := extractPeerMeta(ctx, loginReq.GetMeta())
+	peerMeta.Certificates = s.verifiedCertificates(ctx, peerKey, loginReq.GetMeta().GetCertificateProofs())
 	metahashed := metaHash(peerMeta)
 	if !s.loginFilter.allowLogin(peerKey.String(), metahashed) {
 		if s.logBlockedPeers {
@@ -725,6 +727,7 @@ func (s *Server) Login(ctx context.Context, req *proto.EncryptedMessage) (*proto
 		return nil, status.Errorf(codes.Internal, "failed logging in peer")
 	}
 
+	stampCertificateChallenges(loginResp.Checks, peerKey, key)
 	encryptedResp, err := encryption.EncryptMessage(peerKey, key, loginResp)
 	if err != nil {
 		log.WithContext(ctx).Warnf("failed encrypting peer %s message", peer.ID)
@@ -976,6 +979,7 @@ func (s *Server) sendInitialSync(ctx context.Context, peerKey wgtypes.Key, peer
 		return status.Errorf(codes.Internal, "failed getting server key")
 	}
 
+	stampCertificateChallenges(plainResp.Checks, peerKey, key)
 	encryptedResp, err := encryption.EncryptMessage(peerKey, key, plainResp)
 	if err != nil {
 		return status.Errorf(codes.Internal, "error handling request")
@@ -1205,7 +1209,9 @@ func (s *Server) SyncMeta(ctx context.Context, req *proto.EncryptedMessage) (*pr
 		return nil, msg
 	}
 
-	err = s.accountManager.SyncPeerMeta(ctx, peerKey.String(), extractPeerMeta(ctx, syncMetaReq.GetMeta()), realIP)
+	peerMeta := extractPeerMeta(ctx, syncMetaReq.GetMeta())
+	peerMeta.Certificates = s.verifiedCertificates(ctx, peerKey, syncMetaReq.GetMeta().GetCertificateProofs())
+	err = s.accountManager.SyncPeerMeta(ctx, peerKey.String(), peerMeta, realIP)
 	if err != nil {
 		return nil, mapError(ctx, err)
 	}
@@ -1281,7 +1287,11 @@ func toProtocolCheck(postureCheck *nmdata.PostureChecks) *proto.Checks {
 		}
 	}
 
-	if len(protoCheck.Files) == 0 {
+	if check := postureCheck.Checks.CertificateCheck; check != nil {
+		protoCheck.CertificateChallenge = &proto.CertificateChallenge{CaCertificates: check.CACertificates}
+	}
+
+	if len(protoCheck.Files) == 0 && protoCheck.CertificateChallenge == nil {
 		return nil
 	}
 
diff --git a/management/server/peer/peer.go b/management/server/peer/peer.go
index 2d3cc8abb..5ed19f239 100644
--- a/management/server/peer/peer.go
+++ b/management/server/peer/peer.go
@@ -174,6 +174,7 @@ type PeerSystemMeta struct { //nolint:revive
 	Environment        Environment `gorm:"serializer:json"`
 	Flags              Flags       `gorm:"serializer:json"`
 	Files              []File      `gorm:"serializer:json"`
+	Certificates       []string    `gorm:"serializer:json"`
 	Capabilities       []int32     `gorm:"serializer:json"`
 	SyncMessageVersion int
 }
@@ -199,7 +200,8 @@ func (p PeerSystemMeta) isEmpty() bool {
 		p.SystemManufacturer == "" &&
 		p.Environment.Cloud == "" &&
 		p.Environment.Platform == "" &&
-		len(p.Files) == 0
+		len(p.Files) == 0 &&
+		len(p.Certificates) == 0
 }
 
 // AddedWithSSOLogin indicates whether this peer has been added with an SSO login by a user.
@@ -418,6 +420,9 @@ func diffMeta(oldMeta, newMeta PeerSystemMeta, oldLocation, newLocation Location
 	if !sameMultiset(oldMeta.Files, newMeta.Files) {
 		add("files", fmt.Sprintf("%v", oldMeta.Files), fmt.Sprintf("%v", newMeta.Files))
 	}
+	if !sameMultiset(oldMeta.Certificates, newMeta.Certificates) {
+		add("certificates", len(oldMeta.Certificates), len(newMeta.Certificates))
+	}
 	if oldMeta.SyncMessageVersion != newMeta.SyncMessageVersion {
 		add("sync_meta_version", fmt.Sprintf("%d", oldMeta.SyncMessageVersion), fmt.Sprintf("%d", newMeta.SyncMessageVersion))
 	}
diff --git a/management/server/posture/certificate.go b/management/server/posture/certificate.go
new file mode 100644
index 000000000..cae1e8a56
--- /dev/null
+++ b/management/server/posture/certificate.go
@@ -0,0 +1,36 @@
+package posture
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/shared/management/certposture"
+)
+
+// CertificateCheck passes when the peer holds a certificate, proven at meta ingestion,
+// that chains to one of the configured PEM encoded CA certificates.
+type CertificateCheck struct {
+	CACertificates []string
+}
+
+var _ Check = (*CertificateCheck)(nil)
+
+func (c *CertificateCheck) Check(_ context.Context, peer nbpeer.Peer) (bool, error) {
+	return certposture.AnyChainMatchesCAs(peer.Meta.Certificates, c.CACertificates, time.Now()), nil
+}
+
+func (c *CertificateCheck) Name() string {
+	return CertificateCheckName
+}
+
+func (c *CertificateCheck) Validate() error {
+	if len(c.CACertificates) == 0 {
+		return fmt.Errorf("%s ca certificates shouldn't be empty", c.Name())
+	}
+	if _, err := certposture.ParseCAs(c.CACertificates); err != nil {
+		return fmt.Errorf("%s: %w", c.Name(), err)
+	}
+	return nil
+}
diff --git a/management/server/posture/certificate_test.go b/management/server/posture/certificate_test.go
new file mode 100644
index 000000000..8d79fac82
--- /dev/null
+++ b/management/server/posture/certificate_test.go
@@ -0,0 +1,68 @@
+package posture
+
+import (
+	"context"
+	"crypto/x509"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/certposture/certtest"
+)
+
+func TestCertificateCheck_Check(t *testing.T) {
+	ca := certtest.NewCA(t, "corp-root")
+	otherCA := certtest.NewCA(t, "other-root")
+	chain := certposture.EncodeChainPEM([]*x509.Certificate{ca.Issue(t, certtest.ECDSAKey(t), "device")})
+
+	tests := []struct {
+		name         string
+		certificates []string
+		cas          []string
+		want         bool
+	}{
+		{"chains to configured CA", []string{chain}, []string{ca.PEM}, true},
+		{"one of several CAs matches", []string{chain}, []string{otherCA.PEM, ca.PEM}, true},
+		{"unrelated CA", []string{chain}, []string{otherCA.PEM}, false},
+		{"no certificates proven", nil, []string{ca.PEM}, false},
+		{"garbage entry does not hide a valid one", []string{"garbage", chain}, []string{ca.PEM}, true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			check := CertificateCheck{CACertificates: tt.cas}
+			got, err := check.Check(context.Background(), peer.Peer{Meta: peer.PeerSystemMeta{Certificates: tt.certificates}})
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func TestCertificateCheck_Validate(t *testing.T) {
+	ca := certtest.NewCA(t, "corp-root")
+
+	assert.Error(t, (&CertificateCheck{}).Validate())
+	assert.Error(t, (&CertificateCheck{CACertificates: []string{"not a pem"}}).Validate())
+	assert.NoError(t, (&CertificateCheck{CACertificates: []string{ca.PEM}}).Validate())
+}
+
+func TestChecks_CertificateCheckRegistered(t *testing.T) {
+	ca := certtest.NewCA(t, "corp-root")
+	checks := &Checks{Name: "cert", Checks: ChecksDefinition{CertificateCheck: &CertificateCheck{CACertificates: []string{ca.PEM}}}}
+
+	require.NoError(t, checks.Validate())
+	require.Len(t, checks.GetChecks(), 1)
+	assert.Equal(t, CertificateCheckName, checks.GetChecks()[0].Name())
+
+	copied := checks.Copy()
+	checks.Checks.CertificateCheck.CACertificates[0] = "mutated"
+	assert.Equal(t, ca.PEM, copied.Checks.CertificateCheck.CACertificates[0])
+
+	api := checks.ToAPIResponse()
+	require.NotNil(t, api.Checks.CertificateCheck)
+	roundTrip, err := NewChecksFromAPIPostureCheck(*api)
+	require.NoError(t, err)
+	assert.Equal(t, checks.Checks.CertificateCheck.CACertificates, roundTrip.Checks.CertificateCheck.CACertificates)
+}
diff --git a/management/server/posture/checks.go b/management/server/posture/checks.go
index c38136d1c..b8b1b6f60 100644
--- a/management/server/posture/checks.go
+++ b/management/server/posture/checks.go
@@ -19,6 +19,7 @@ const (
 	GeoLocationCheckName      = "GeoLocationCheck"
 	PeerNetworkRangeCheckName = "PeerNetworkRangeCheck"
 	ProcessCheckName          = "ProcessCheck"
+	CertificateCheckName      = "CertificateCheck"
 
 	CheckActionAllow string = "allow"
 	CheckActionDeny  string = "deny"
@@ -61,6 +62,7 @@ type ChecksDefinition struct {
 	GeoLocationCheck      *GeoLocationCheck      `json:",omitempty"`
 	PeerNetworkRangeCheck *PeerNetworkRangeCheck `json:",omitempty"`
 	ProcessCheck          *ProcessCheck          `json:",omitempty"`
+	CertificateCheck      *CertificateCheck      `json:",omitempty"`
 }
 
 // Copy returns a copy of a checks definition.
@@ -113,6 +115,12 @@ func (cd ChecksDefinition) Copy() ChecksDefinition {
 		}
 		copy(cdCopy.ProcessCheck.Processes, processCheck.Processes)
 	}
+	if cd.CertificateCheck != nil {
+		cdCopy.CertificateCheck = &CertificateCheck{
+			CACertificates: make([]string, len(cd.CertificateCheck.CACertificates)),
+		}
+		copy(cdCopy.CertificateCheck.CACertificates, cd.CertificateCheck.CACertificates)
+	}
 	return cdCopy
 }
 
@@ -157,6 +165,9 @@ func (pc *Checks) GetChecks() []Check {
 	if pc.Checks.ProcessCheck != nil {
 		checks = append(checks, pc.Checks.ProcessCheck)
 	}
+	if pc.Checks.CertificateCheck != nil {
+		checks = append(checks, pc.Checks.CertificateCheck)
+	}
 	return checks
 }
 
@@ -212,6 +223,10 @@ func buildPostureCheck(postureChecksID string, name string, description string,
 		postureChecks.Checks.ProcessCheck = toProcessCheck(processCheck)
 	}
 
+	if certificateCheck := checks.CertificateCheck; certificateCheck != nil {
+		postureChecks.Checks.CertificateCheck = &CertificateCheck{CACertificates: certificateCheck.CaCertificates}
+	}
+
 	return &postureChecks, nil
 }
 
@@ -246,6 +261,10 @@ func (pc *Checks) ToAPIResponse() *api.PostureCheck {
 		checks.ProcessCheck = toProcessCheckResponse(pc.Checks.ProcessCheck)
 	}
 
+	if pc.Checks.CertificateCheck != nil {
+		checks.CertificateCheck = &api.CertificateCheck{CaCertificates: pc.Checks.CertificateCheck.CACertificates}
+	}
+
 	return &api.PostureCheck{
 		Id:          pc.ID,
 		Name:        pc.Name,
diff --git a/management/server/store/sql_store_peer.go b/management/server/store/sql_store_peer.go
index 1b0e23cec..9950069fd 100644
--- a/management/server/store/sql_store_peer.go
+++ b/management/server/store/sql_store_peer.go
@@ -186,7 +186,7 @@ func (s *SqlStore) getPeers(ctx context.Context, accountID string) ([]nbpeer.Pee
 	inactivity_expiration_enabled, last_login, created_at, ephemeral, extra_dns_labels, allow_extra_dns_labels, meta_hostname,
 	meta_go_os, meta_kernel, meta_core, meta_platform, meta_os, meta_os_version, meta_wt_version, meta_ui_version,
 	meta_kernel_version, meta_network_addresses, meta_system_serial_number, meta_system_product_name, meta_system_manufacturer,
-	meta_environment, meta_flags, meta_files, meta_capabilities, peer_status_last_seen, peer_status_session_started_at,
+	meta_environment, meta_flags, meta_files, meta_certificates, meta_capabilities, peer_status_last_seen, peer_status_session_started_at,
 	peer_status_connected, peer_status_login_expired, peer_status_requires_approval, location_connection_ip,
 	location_country_code, location_city_name, location_geo_name_id, proxy_meta_embedded, proxy_meta_cluster, ipv6, meta_sync_message_version
 	FROM peers WHERE account_id = $1`
@@ -204,7 +204,7 @@ func (s *SqlStore) getPeers(ctx context.Context, accountID string) ([]nbpeer.Pee
 			peerStatusLastSeen                                                                              sql.NullTime
 			peerStatusSessionStartedAt                                                                      sql.NullInt64
 			peerStatusConnected, peerStatusLoginExpired, peerStatusRequiresApproval, proxyEmbedded          sql.NullBool
-			ip, extraDNS, netAddr, env, flags, files, capabilities, connIP, ipv6                            []byte
+			ip, extraDNS, netAddr, env, flags, files, certificates, capabilities, connIP, ipv6              []byte
 			metaHostname, metaGoOS, metaKernel, metaCore, metaPlatform                                      sql.NullString
 			metaOS, metaOSVersion, metaWtVersion, metaUIVersion, metaKernelVersion                          sql.NullString
 			metaSystemSerialNumber, metaSystemProductName, metaSystemManufacturer                           sql.NullString
@@ -217,7 +217,7 @@ func (s *SqlStore) getPeers(ctx context.Context, accountID string) ([]nbpeer.Pee
 			&loginExpirationEnabled, &inactivityExpirationEnabled, &lastLogin, &createdAt, &ephemeral, &extraDNS,
 			&allowExtraDNSLabels, &metaHostname, &metaGoOS, &metaKernel, &metaCore, &metaPlatform,
 			&metaOS, &metaOSVersion, &metaWtVersion, &metaUIVersion, &metaKernelVersion, &netAddr,
-			&metaSystemSerialNumber, &metaSystemProductName, &metaSystemManufacturer, &env, &flags, &files, &capabilities,
+			&metaSystemSerialNumber, &metaSystemProductName, &metaSystemManufacturer, &env, &flags, &files, &certificates, &capabilities,
 			&peerStatusLastSeen, &peerStatusSessionStartedAt, &peerStatusConnected, &peerStatusLoginExpired,
 			&peerStatusRequiresApproval, &connIP, &locationCountryCode, &locationCityName, &locationGeoNameID,
 			&proxyEmbedded, &proxyCluster, &ipv6, &metaSyncMessageVersion)
@@ -334,6 +334,9 @@ func (s *SqlStore) getPeers(ctx context.Context, accountID string) ([]nbpeer.Pee
 			if files != nil {
 				_ = json.Unmarshal(files, &p.Meta.Files)
 			}
+			if certificates != nil {
+				_ = json.Unmarshal(certificates, &p.Meta.Certificates)
+			}
 			if capabilities != nil {
 				_ = json.Unmarshal(capabilities, &p.Meta.Capabilities)
 			}
diff --git a/management/server/types/account_networkmapdata.go b/management/server/types/account_networkmapdata.go
index 4ebd23f95..a1f04bc67 100644
--- a/management/server/types/account_networkmapdata.go
+++ b/management/server/types/account_networkmapdata.go
@@ -198,6 +198,7 @@ func twinPeer(p *nbpeer.Peer) *nmdata.Peer {
 			KernelVersion:      p.Meta.KernelVersion,
 			NetworkAddresses:   networkAddresses,
 			Files:              files,
+			Certificates:       p.Meta.Certificates,
 			Capabilities:       p.Meta.Capabilities,
 			SyncMessageVersion: p.Meta.SyncMessageVersion,
 			Flags: nmdata.Flags{
@@ -452,6 +453,9 @@ func TwinPostureChecks(pc *posture.Checks) *nmdata.PostureChecks {
 		}
 		out.Checks.ProcessCheck = &nmdata.ProcessCheck{Processes: procs}
 	}
+	if def.CertificateCheck != nil {
+		out.Checks.CertificateCheck = &nmdata.CertificateCheck{CACertificates: def.CertificateCheck.CACertificates}
+	}
 	return out
 }
 
diff --git a/shared/management/certposture/certposture_test.go b/shared/management/certposture/certposture_test.go
new file mode 100644
index 000000000..7073332ff
--- /dev/null
+++ b/shared/management/certposture/certposture_test.go
@@ -0,0 +1,182 @@
+package certposture
+
+import (
+	"crypto"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"crypto/x509"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/management/certposture/certtest"
+)
+
+var (
+	secret   = []byte("test-secret")
+	peerKey  = []byte("peer-public-key-aaaaaaaaaaaaaaaa")
+	otherKey = []byte("peer-public-key-bbbbbbbbbbbbbbbb")
+	now      = time.Now().Truncate(Window)
+)
+
+func TestChallenger_NonceIsStableWithinWindowAndPerPeer(t *testing.T) {
+	c := NewChallenger(secret)
+
+	assert.Equal(t, c.Nonce(peerKey, now), c.Nonce(peerKey, now.Add(time.Minute)))
+	assert.NotEqual(t, c.Nonce(peerKey, now), c.Nonce(peerKey, now.Add(Window)))
+	assert.NotEqual(t, c.Nonce(peerKey, now), c.Nonce(otherKey, now))
+	assert.NotEqual(t, c.Nonce(peerKey, now), NewChallenger([]byte("other")).Nonce(peerKey, now))
+}
+
+func TestChallenger_VerifyNonce(t *testing.T) {
+	c := NewChallenger(secret)
+	nonce := c.Nonce(peerKey, now)
+
+	tests := []struct {
+		name    string
+		nonce   []byte
+		peerKey []byte
+		at      time.Time
+		wantErr error
+	}{
+		{"current window", nonce, peerKey, now, nil},
+		{"previous window still accepted", nonce, peerKey, now.Add(Window), nil},
+		{"two windows later expired", nonce, peerKey, now.Add(2 * Window), ErrNonceExpired},
+		{"issued in the future rejected", c.Nonce(peerKey, now.Add(Window)), peerKey, now, ErrNonceExpired},
+		{"other peer", nonce, otherKey, now, ErrNonceMismatch},
+		{"tampered mac", tamper(nonce, len(nonce)-1), peerKey, now, ErrNonceMismatch},
+		{"malformed", nonce[:10], peerKey, now, ErrNonceMalformed},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := c.verifyNonce(tt.nonce, tt.peerKey, tt.at)
+			assert.ErrorIs(t, err, tt.wantErr)
+		})
+	}
+}
+
+func TestSignVerify_RoundTripPerKeyType(t *testing.T) {
+	ca := certtest.NewCA(t, "root")
+	keys := map[string]crypto.Signer{
+		SigAlgECDSASHA256:  certtest.ECDSAKey(t),
+		SigAlgRSAPSSSHA256: certtest.RSAKey(t),
+		SigAlgEd25519:      certtest.Ed25519Key(t),
+	}
+	for wantAlg, key := range keys {
+		t.Run(wantAlg, func(t *testing.T) {
+			c := NewChallenger(secret)
+			proof := signedProof(t, c, ca, key)
+			assert.Equal(t, wantAlg, proof.SigAlg)
+
+			chain, err := c.Verify(proof, peerKey, now)
+			require.NoError(t, err)
+			require.Len(t, chain, 1)
+			assert.NoError(t, VerifyChain(chain, mustPool(t, ca.PEM), now))
+		})
+	}
+}
+
+func TestVerify_Rejections(t *testing.T) {
+	ca := certtest.NewCA(t, "root")
+	c := NewChallenger(secret)
+	good := signedProof(t, c, ca, certtest.ECDSAKey(t))
+
+	tests := []struct {
+		name    string
+		mutate  func(p Proof) Proof
+		peerKey []byte
+		wantErr error
+	}{
+		{"replayed for other peer", identity, otherKey, ErrNonceMismatch},
+		{"signature tampered", func(p Proof) Proof { p.Signature = tamper(p.Signature, 5); return p }, peerKey, ErrSignatureInvalid},
+		{"nonce swapped after signing", func(p Proof) Proof { p.Nonce = c.Nonce(peerKey, now.Add(-Window)); return p }, peerKey, ErrSignatureInvalid},
+		{"foreign leaf presented", func(p Proof) Proof {
+			p.Chain = [][]byte{ca.Issue(t, certtest.ECDSAKey(t), "other").Raw}
+			return p
+		}, peerKey, ErrSignatureInvalid},
+		{"alg mismatch", func(p Proof) Proof { p.SigAlg = SigAlgEd25519; return p }, peerKey, ErrSigAlgMismatch},
+		{"empty chain", func(p Proof) Proof { p.Chain = nil; return p }, peerKey, ErrEmptyChain},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := c.Verify(tt.mutate(good), tt.peerKey, now)
+			assert.ErrorIs(t, err, tt.wantErr)
+		})
+	}
+}
+
+func TestVerify_SecretMismatchAcrossChallengers(t *testing.T) {
+	ca := certtest.NewCA(t, "root")
+	proof := signedProof(t, NewChallenger(secret), ca, certtest.ECDSAKey(t))
+
+	_, err := NewChallenger([]byte("other-instance-secret")).Verify(proof, peerKey, now)
+	assert.ErrorIs(t, err, ErrNonceMismatch)
+}
+
+func TestChainMatchesCAs(t *testing.T) {
+	ca := certtest.NewCA(t, "root")
+	otherCA := certtest.NewCA(t, "other-root")
+	leaf := ca.Issue(t, certtest.ECDSAKey(t), "device")
+	chainPEM := EncodeChainPEM([]*x509.Certificate{leaf})
+
+	assert.True(t, ChainMatchesCAs(chainPEM, []string{ca.PEM}, now))
+	assert.True(t, ChainMatchesCAs(chainPEM, []string{otherCA.PEM, ca.PEM}, now))
+	assert.False(t, ChainMatchesCAs(chainPEM, []string{otherCA.PEM}, now))
+	assert.False(t, ChainMatchesCAs(chainPEM, []string{ca.PEM}, now.Add(30*24*time.Hour)))
+	assert.False(t, ChainMatchesCAs(chainPEM, []string{"not a pem"}, now))
+	assert.False(t, ChainMatchesCAs("not a pem", []string{ca.PEM}, now))
+}
+
+func TestChainPEM_RoundTrip(t *testing.T) {
+	ca := certtest.NewCA(t, "root")
+	leaf := ca.Issue(t, certtest.ECDSAKey(t), "device")
+
+	chain, err := ParseChainPEM(EncodeChainPEM([]*x509.Certificate{leaf, ca.Cert}))
+	require.NoError(t, err)
+	require.Len(t, chain, 2)
+	assert.Equal(t, leaf.Raw, chain[0].Raw)
+	assert.Equal(t, ca.Cert.Raw, chain[1].Raw)
+}
+
+func TestVerify_AcceptsMaximumPSSSalt(t *testing.T) {
+	// A TPM chooses the PSS salt itself and older firmware uses the largest salt that
+	// fits, so a proof from such a key carries more salt than Sign asks a software key for.
+	ca := certtest.NewCA(t, "root")
+	key := certtest.RSAKey(t).(*rsa.PrivateKey)
+	leaf := ca.Issue(t, key, "device")
+	c := NewChallenger(secret)
+	nonce := c.Nonce(peerKey, now)
+	digest := sha256.Sum256(proofMessage(nonce, peerKey))
+	sig, err := rsa.SignPSS(rand.Reader, key, crypto.SHA256, digest[:], &rsa.PSSOptions{SaltLength: rsa.PSSSaltLengthAuto})
+	require.NoError(t, err)
+
+	_, err = c.Verify(Proof{Nonce: nonce, Chain: [][]byte{leaf.Raw}, SigAlg: SigAlgRSAPSSSHA256, Signature: sig}, peerKey, now)
+	assert.NoError(t, err, "a valid PSS signature must verify regardless of salt length")
+}
+
+func signedProof(t *testing.T, c *Challenger, ca *certtest.CA, key crypto.Signer) Proof {
+	t.Helper()
+	leaf := ca.Issue(t, key, "device")
+	nonce := c.Nonce(peerKey, now)
+	sigAlg, sig, err := Sign(key, nonce, peerKey)
+	require.NoError(t, err)
+	return Proof{Nonce: nonce, Chain: [][]byte{leaf.Raw}, SigAlg: sigAlg, Signature: sig}
+}
+
+func mustPool(t *testing.T, pems ...string) *x509.CertPool {
+	t.Helper()
+	pool, err := ParseCAs(pems)
+	require.NoError(t, err)
+	return pool
+}
+
+func identity(p Proof) Proof { return p }
+
+func tamper(b []byte, i int) []byte {
+	out := append([]byte(nil), b...)
+	out[i] ^= 0xff
+	return out
+}
diff --git a/shared/management/certposture/certtest/certtest.go b/shared/management/certposture/certtest/certtest.go
new file mode 100644
index 000000000..8b810a193
--- /dev/null
+++ b/shared/management/certposture/certtest/certtest.go
@@ -0,0 +1,109 @@
+// Package certtest builds throwaway CAs and leaf certificates for certificate posture tests.
+package certtest
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/ed25519"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+type CA struct {
+	Cert *x509.Certificate
+	Key  crypto.Signer
+	PEM  string
+}
+
+func NewCA(t *testing.T, name string) *CA {
+	t.Helper()
+	return newCA(t, name, nil)
+}
+
+// NewIntermediate creates a CA signed by parent.
+func NewIntermediate(t *testing.T, parent *CA, name string) *CA {
+	t.Helper()
+	return newCA(t, name, parent)
+}
+
+func newCA(t *testing.T, name string, parent *CA) *CA {
+	t.Helper()
+	key := ECDSAKey(t)
+	tmpl := &x509.Certificate{
+		SerialNumber:          big.NewInt(time.Now().UnixNano()),
+		Subject:               pkix.Name{CommonName: name},
+		NotBefore:             time.Now().Add(-24 * time.Hour),
+		NotAfter:              time.Now().Add(48 * time.Hour),
+		IsCA:                  true,
+		BasicConstraintsValid: true,
+		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageDigitalSignature,
+	}
+	issuer, issuerKey := tmpl, key
+	if parent != nil {
+		issuer, issuerKey = parent.Cert, parent.Key
+	}
+	der, err := x509.CreateCertificate(rand.Reader, tmpl, issuer, key.Public(), issuerKey)
+	require.NoError(t, err)
+	cert, err := x509.ParseCertificate(der)
+	require.NoError(t, err)
+	return &CA{Cert: cert, Key: key, PEM: CertPEM(cert)}
+}
+
+// Issue signs a leaf certificate for key with the CA.
+func (ca *CA) Issue(t *testing.T, key crypto.Signer, cn string) *x509.Certificate {
+	t.Helper()
+	tmpl := &x509.Certificate{
+		SerialNumber: big.NewInt(time.Now().UnixNano()),
+		Subject:      pkix.Name{CommonName: cn},
+		NotBefore:    time.Now().Add(-24 * time.Hour),
+		NotAfter:     time.Now().Add(48 * time.Hour),
+		KeyUsage:     x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
+	}
+	der, err := x509.CreateCertificate(rand.Reader, tmpl, ca.Cert, key.Public(), ca.Key)
+	require.NoError(t, err)
+	cert, err := x509.ParseCertificate(der)
+	require.NoError(t, err)
+	return cert
+}
+
+func ECDSAKey(t *testing.T) crypto.Signer {
+	t.Helper()
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+	return key
+}
+
+func RSAKey(t *testing.T) crypto.Signer {
+	t.Helper()
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	require.NoError(t, err)
+	return key
+}
+
+func Ed25519Key(t *testing.T) crypto.Signer {
+	t.Helper()
+	_, key, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+	return key
+}
+
+func CertPEM(cert *x509.Certificate) string {
+	return string(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: cert.Raw}))
+}
+
+func KeyPEM(t *testing.T, key crypto.Signer) string {
+	t.Helper()
+	der, err := x509.MarshalPKCS8PrivateKey(key)
+	require.NoError(t, err)
+	return string(pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: der}))
+}
diff --git a/shared/management/certposture/chain.go b/shared/management/certposture/chain.go
new file mode 100644
index 000000000..d0e4bc27d
--- /dev/null
+++ b/shared/management/certposture/chain.go
@@ -0,0 +1,106 @@
+package certposture
+
+import (
+	"crypto/x509"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+)
+
+var ErrNoCertificateInPEM = errors.New("no certificate found in PEM data")
+
+// ParseCAs builds a root pool from PEM encoded CA certificates.
+func ParseCAs(pems []string) (*x509.CertPool, error) {
+	roots := x509.NewCertPool()
+	for _, p := range pems {
+		if !roots.AppendCertsFromPEM([]byte(p)) {
+			return nil, ErrNoCertificateInPEM
+		}
+	}
+	return roots, nil
+}
+
+// VerifyChain reports whether the leaf (chain[0]) chains to one of roots using the
+// remaining certificates as intermediates.
+func VerifyChain(chain []*x509.Certificate, roots *x509.CertPool, now time.Time) error {
+	if len(chain) == 0 {
+		return ErrEmptyChain
+	}
+	intermediates := x509.NewCertPool()
+	for _, cert := range chain[1:] {
+		intermediates.AddCert(cert)
+	}
+	_, err := chain[0].Verify(x509.VerifyOptions{
+		Roots:         roots,
+		Intermediates: intermediates,
+		CurrentTime:   now,
+		KeyUsages:     []x509.ExtKeyUsage{x509.ExtKeyUsageAny},
+	})
+	return err
+}
+
+// ChainMatchesCAs is VerifyChain over the PEM forms stored in peer meta and check config.
+func ChainMatchesCAs(chainPEM string, caPEMs []string, now time.Time) bool {
+	roots, err := ParseCAs(caPEMs)
+	if err != nil {
+		return false
+	}
+	return chainMatchesPool(chainPEM, roots, now)
+}
+
+// AnyChainMatchesCAs reports whether at least one of the peer's verified chains
+// is anchored in one of the configured CAs.
+func AnyChainMatchesCAs(chainPEMs, caPEMs []string, now time.Time) bool {
+	roots, err := ParseCAs(caPEMs)
+	if err != nil {
+		return false
+	}
+	for _, chainPEM := range chainPEMs {
+		if chainMatchesPool(chainPEM, roots, now) {
+			return true
+		}
+	}
+	return false
+}
+
+func chainMatchesPool(chainPEM string, roots *x509.CertPool, now time.Time) bool {
+	chain, err := ParseChainPEM(chainPEM)
+	if err != nil {
+		return false
+	}
+	return VerifyChain(chain, roots, now) == nil
+}
+
+func EncodeChainPEM(chain []*x509.Certificate) string {
+	var b strings.Builder
+	for _, cert := range chain {
+		_ = pem.Encode(&b, &pem.Block{Type: "CERTIFICATE", Bytes: cert.Raw})
+	}
+	return b.String()
+}
+
+func ParseChainPEM(chainPEM string) ([]*x509.Certificate, error) {
+	var chain []*x509.Certificate
+	rest := []byte(chainPEM)
+	for {
+		var block *pem.Block
+		block, rest = pem.Decode(rest)
+		if block == nil {
+			break
+		}
+		if block.Type != "CERTIFICATE" {
+			continue
+		}
+		cert, err := x509.ParseCertificate(block.Bytes)
+		if err != nil {
+			return nil, fmt.Errorf("parse certificate: %w", err)
+		}
+		chain = append(chain, cert)
+	}
+	if len(chain) == 0 {
+		return nil, ErrNoCertificateInPEM
+	}
+	return chain, nil
+}
diff --git a/shared/management/certposture/challenge.go b/shared/management/certposture/challenge.go
new file mode 100644
index 000000000..584d2f30e
--- /dev/null
+++ b/shared/management/certposture/challenge.go
@@ -0,0 +1,68 @@
+package certposture
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/binary"
+	"errors"
+	"time"
+)
+
+const (
+	Window = 12 * time.Hour
+
+	challengeDomain = "netbird-cert-challenge-v1"
+	windowLen       = 8
+	nonceLen        = windowLen + sha256.Size
+)
+
+var (
+	ErrNonceMalformed = errors.New("certificate challenge nonce is malformed")
+	ErrNonceExpired   = errors.New("certificate challenge nonce is expired")
+	ErrNonceMismatch  = errors.New("certificate challenge nonce was not issued to this peer")
+)
+
+// Challenger issues and verifies stateless per-peer nonces. A nonce is bound to the
+// peer and to a time window, so any instance sharing the secret can verify it.
+type Challenger struct {
+	secret []byte
+	window time.Duration
+}
+
+func NewChallenger(secret []byte) *Challenger {
+	return &Challenger{secret: secret, window: Window}
+}
+
+func (c *Challenger) Nonce(peerKey []byte, now time.Time) []byte {
+	return c.nonceForWindow(peerKey, c.windowOf(now))
+}
+
+func (c *Challenger) verifyNonce(nonce, peerKey []byte, now time.Time) error {
+	if len(nonce) != nonceLen {
+		return ErrNonceMalformed
+	}
+	window := binary.BigEndian.Uint64(nonce[:windowLen])
+	current := c.windowOf(now)
+	if window != current && window+1 != current {
+		return ErrNonceExpired
+	}
+	if !hmac.Equal(nonce, c.nonceForWindow(peerKey, window)) {
+		return ErrNonceMismatch
+	}
+	return nil
+}
+
+func (c *Challenger) windowOf(now time.Time) uint64 {
+	return uint64(now.Unix() / int64(c.window.Seconds()))
+}
+
+func (c *Challenger) nonceForWindow(peerKey []byte, window uint64) []byte {
+	nonce := make([]byte, windowLen, nonceLen)
+	binary.BigEndian.PutUint64(nonce, window)
+
+	mac := hmac.New(sha256.New, c.secret)
+	mac.Write([]byte(challengeDomain))
+	mac.Write(peerKey)
+	mac.Write(nonce[:windowLen])
+	return mac.Sum(nonce)
+}
diff --git a/shared/management/certposture/proof.go b/shared/management/certposture/proof.go
new file mode 100644
index 000000000..2c2df2132
--- /dev/null
+++ b/shared/management/certposture/proof.go
@@ -0,0 +1,154 @@
+package certposture
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/ed25519"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"crypto/sha512"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"time"
+)
+
+const (
+	SigAlgECDSASHA256  = "ecdsa-sha256"
+	SigAlgECDSASHA384  = "ecdsa-sha384"
+	SigAlgRSAPSSSHA256 = "rsa-pss-sha256"
+	SigAlgEd25519      = "ed25519"
+
+	proofDomain = "netbird-posture-cert-v1"
+	minRSABits  = 2048
+)
+
+var (
+	ErrUnsupportedKey   = errors.New("unsupported certificate key")
+	ErrEmptyChain       = errors.New("certificate chain is empty")
+	ErrSignatureInvalid = errors.New("certificate proof signature is invalid")
+	ErrSigAlgMismatch   = errors.New("signature algorithm does not match the certificate key")
+)
+
+// Proof is a client's demonstration that it holds the private key of the leaf
+// certificate in Chain, made by signing the challenge nonce bound to its peer key.
+type Proof struct {
+	Nonce     []byte
+	Chain     [][]byte
+	SigAlg    string
+	Signature []byte
+}
+
+// Sign produces the proof signature for a nonce using the leaf's private key. The key
+// never leaves the signer, which may be backed by a file, a TPM or an OS keystore.
+func Sign(signer crypto.Signer, nonce, peerKey []byte) (string, []byte, error) {
+	sigAlg, err := sigAlgFor(signer.Public())
+	if err != nil {
+		return "", nil, err
+	}
+
+	msg := proofMessage(nonce, peerKey)
+	var sig []byte
+	switch sigAlg {
+	case SigAlgECDSASHA256:
+		d := sha256.Sum256(msg)
+		sig, err = signer.Sign(rand.Reader, d[:], crypto.SHA256)
+	case SigAlgECDSASHA384:
+		d := sha512.Sum384(msg)
+		sig, err = signer.Sign(rand.Reader, d[:], crypto.SHA384)
+	case SigAlgRSAPSSSHA256:
+		d := sha256.Sum256(msg)
+		sig, err = signer.Sign(rand.Reader, d[:], &rsa.PSSOptions{SaltLength: rsa.PSSSaltLengthEqualsHash, Hash: crypto.SHA256})
+	case SigAlgEd25519:
+		sig, err = signer.Sign(rand.Reader, msg, crypto.Hash(0))
+	}
+	if err != nil {
+		return "", nil, fmt.Errorf("sign certificate proof: %w", err)
+	}
+	return sigAlg, sig, nil
+}
+
+// Verify checks that the proof's nonce was issued by this challenger to peerKey and is
+// still fresh, and that the signature validates against the leaf's public key. It
+// returns the parsed chain on success. Chain trust is deliberately not evaluated here.
+func (c *Challenger) Verify(proof Proof, peerKey []byte, now time.Time) ([]*x509.Certificate, error) {
+	if err := c.verifyNonce(proof.Nonce, peerKey, now); err != nil {
+		return nil, err
+	}
+	chain, err := parseChain(proof.Chain)
+	if err != nil {
+		return nil, err
+	}
+	leaf := chain[0]
+	sigAlg, err := sigAlgFor(leaf.PublicKey)
+	if err != nil {
+		return nil, err
+	}
+	if sigAlg != proof.SigAlg {
+		return nil, ErrSigAlgMismatch
+	}
+	if !verifySignature(leaf.PublicKey, sigAlg, proofMessage(proof.Nonce, peerKey), proof.Signature) {
+		return nil, ErrSignatureInvalid
+	}
+	return chain, nil
+}
+
+func proofMessage(nonce, peerKey []byte) []byte {
+	msg := make([]byte, 0, len(proofDomain)+len(nonce)+len(peerKey))
+	msg = append(msg, proofDomain...)
+	msg = append(msg, nonce...)
+	return append(msg, peerKey...)
+}
+
+func sigAlgFor(pub crypto.PublicKey) (string, error) {
+	switch k := pub.(type) {
+	case *ecdsa.PublicKey:
+		switch k.Curve {
+		case elliptic.P256():
+			return SigAlgECDSASHA256, nil
+		case elliptic.P384():
+			return SigAlgECDSASHA384, nil
+		}
+	case *rsa.PublicKey:
+		if k.N.BitLen() >= minRSABits {
+			return SigAlgRSAPSSSHA256, nil
+		}
+	case ed25519.PublicKey:
+		return SigAlgEd25519, nil
+	}
+	return "", ErrUnsupportedKey
+}
+
+func verifySignature(pub crypto.PublicKey, sigAlg string, msg, sig []byte) bool {
+	switch sigAlg {
+	case SigAlgECDSASHA256:
+		d := sha256.Sum256(msg)
+		return ecdsa.VerifyASN1(pub.(*ecdsa.PublicKey), d[:], sig)
+	case SigAlgECDSASHA384:
+		d := sha512.Sum384(msg)
+		return ecdsa.VerifyASN1(pub.(*ecdsa.PublicKey), d[:], sig)
+	case SigAlgRSAPSSSHA256:
+		d := sha256.Sum256(msg)
+		return rsa.VerifyPSS(pub.(*rsa.PublicKey), crypto.SHA256, d[:], sig, &rsa.PSSOptions{SaltLength: rsa.PSSSaltLengthAuto}) == nil
+	case SigAlgEd25519:
+		return ed25519.Verify(pub.(ed25519.PublicKey), msg, sig)
+	}
+	return false
+}
+
+func parseChain(der [][]byte) ([]*x509.Certificate, error) {
+	if len(der) == 0 {
+		return nil, ErrEmptyChain
+	}
+	chain := make([]*x509.Certificate, 0, len(der))
+	for _, raw := range der {
+		cert, err := x509.ParseCertificate(raw)
+		if err != nil {
+			return nil, fmt.Errorf("parse certificate: %w", err)
+		}
+		chain = append(chain, cert)
+	}
+	return chain, nil
+}
diff --git a/shared/management/client/grpc.go b/shared/management/client/grpc.go
index f7c7f2dc3..aaa80f447 100644
--- a/shared/management/client/grpc.go
+++ b/shared/management/client/grpc.go
@@ -1018,6 +1018,19 @@ func infoToMetaData(info *system.Info) *proto.PeerSystemMeta {
 		})
 	}
 
+	proofs := make([]*proto.CertificateProof, 0, len(info.CertificateProofs))
+	for _, p := range info.CertificateProofs {
+		proofs = append(proofs, &proto.CertificateProof{
+			Nonce:     p.Nonce,
+			Chain:     p.Chain,
+			SigAlg:    p.SigAlg,
+			Signature: p.Signature,
+		})
+	}
+	if len(proofs) > 0 {
+		log.Infof("peer meta carries %d certificate posture proofs", len(proofs))
+	}
+
 	return &proto.PeerSystemMeta{
 		Hostname:         info.Hostname,
 		GoOS:             info.GoOS,
@@ -1037,7 +1050,8 @@ func infoToMetaData(info *system.Info) *proto.PeerSystemMeta {
 			Cloud:    info.Environment.Cloud,
 			Platform: info.Environment.Platform,
 		},
-		Files: files,
+		Files:             files,
+		CertificateProofs: proofs,
 
 		Flags: &proto.Flags{
 			RosenpassEnabled:    info.RosenpassEnabled,
diff --git a/shared/management/http/api/openapi.yml b/shared/management/http/api/openapi.yml
index a8e0a7a56..7060aee4e 100644
--- a/shared/management/http/api/openapi.yml
+++ b/shared/management/http/api/openapi.yml
@@ -1691,6 +1691,8 @@ components:
           $ref: '#/components/schemas/PeerNetworkRangeCheck'
         process_check:
           $ref: '#/components/schemas/ProcessCheck'
+        certificate_check:
+          $ref: '#/components/schemas/CertificateCheck'
     NBVersionCheck:
       description: Posture check for the version of NetBird
       type: object
@@ -1808,6 +1810,18 @@ components:
           description: Path to the process executable file in a Windows operating system
           type: string
           example: "C:\ProgramData\NetBird\netbird.exe"
+    CertificateCheck:
+      description: Posture check for a certificate held by the peer that chains to one of the given CA certificates. Not supported on mobile devices (iOS and Android), which always fail this check and are denied access
+      type: object
+      properties:
+        ca_certificates:
+          description: PEM encoded CA certificates the peer's certificate must chain to
+          type: array
+          items:
+            type: string
+          example: ["-----BEGIN CERTIFICATE-----\nMIIB...\n-----END CERTIFICATE-----"]
+      required:
+        - ca_certificates
     Location:
       description: Describe geographical location information
       type: object
diff --git a/shared/management/http/api/types.gen.go b/shared/management/http/api/types.gen.go
index 9be676a91..dea9f4a14 100644
--- a/shared/management/http/api/types.gen.go
+++ b/shared/management/http/api/types.gen.go
@@ -2632,6 +2632,12 @@ type BypassResponse struct {
 	PeerId string `json:"peer_id"`
 }
 
+// CertificateCheck Posture check for a certificate held by the peer that chains to one of the given CA certificates. Not supported on mobile devices (iOS and Android), which always fail this check and are denied access
+type CertificateCheck struct {
+	// CaCertificates PEM encoded CA certificates the peer's certificate must chain to
+	CaCertificates []string `json:"ca_certificates"`
+}
+
 // CheckoutResponse defines model for CheckoutResponse.
 type CheckoutResponse struct {
 	// SessionId The unique identifier for the checkout session.
@@ -2643,6 +2649,9 @@ type CheckoutResponse struct {
 
 // Checks List of objects that perform the actual checks
 type Checks struct {
+	// CertificateCheck Posture check for a certificate held by the peer that chains to one of the given CA certificates. Not supported on mobile devices (iOS and Android), which always fail this check and are denied access
+	CertificateCheck *CertificateCheck `json:"certificate_check,omitempty"`
+
 	// GeoLocationCheck Posture check for geo location
 	GeoLocationCheck *GeoLocationCheck `json:"geo_location_check,omitempty"`
 
diff --git a/shared/management/networkmap/nmdata/peer.go b/shared/management/networkmap/nmdata/peer.go
index 78df77b64..7c606a02c 100644
--- a/shared/management/networkmap/nmdata/peer.go
+++ b/shared/management/networkmap/nmdata/peer.go
@@ -56,6 +56,7 @@ type PeerSystemMeta struct {
 	KernelVersion      string
 	NetworkAddresses   []NetworkAddress
 	Files              []File
+	Certificates       []string
 	Capabilities       []int32
 	Flags              Flags
 	SyncMessageVersion int
diff --git a/shared/management/networkmap/nmdata/posture.go b/shared/management/networkmap/nmdata/posture.go
index 6a6b028c7..e7c37976b 100644
--- a/shared/management/networkmap/nmdata/posture.go
+++ b/shared/management/networkmap/nmdata/posture.go
@@ -18,6 +18,7 @@ type ChecksDefinition struct {
 	GeoLocationCheck      *GeoLocationCheck
 	PeerNetworkRangeCheck *PeerNetworkRangeCheck
 	ProcessCheck          *ProcessCheck
+	CertificateCheck      *CertificateCheck
 }
 
 // Check is the slim twin of posture.Check. It is sealed: only the check types
@@ -79,5 +80,8 @@ func (pc *PostureChecks) GetChecks() []Check {
 	if pc.Checks.ProcessCheck != nil {
 		checks = append(checks, pc.Checks.ProcessCheck)
 	}
+	if pc.Checks.CertificateCheck != nil {
+		checks = append(checks, pc.Checks.CertificateCheck)
+	}
 	return checks
 }
diff --git a/shared/management/networkmap/nmdata/posture_certificate.go b/shared/management/networkmap/nmdata/posture_certificate.go
new file mode 100644
index 000000000..37cfd4b5b
--- /dev/null
+++ b/shared/management/networkmap/nmdata/posture_certificate.go
@@ -0,0 +1,16 @@
+package nmdata
+
+import (
+	"time"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+)
+
+// CertificateCheck is the slim twin of posture.CertificateCheck.
+type CertificateCheck struct {
+	CACertificates []string
+}
+
+func (c *CertificateCheck) check(peer *Peer) (bool, error) {
+	return certposture.AnyChainMatchesCAs(peer.Meta.Certificates, c.CACertificates, time.Now()), nil
+}
diff --git a/shared/management/networkmap/nmdata/posture_certificate_test.go b/shared/management/networkmap/nmdata/posture_certificate_test.go
new file mode 100644
index 000000000..aa67dab77
--- /dev/null
+++ b/shared/management/networkmap/nmdata/posture_certificate_test.go
@@ -0,0 +1,28 @@
+package nmdata
+
+import (
+	"crypto/x509"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/certposture/certtest"
+)
+
+func TestCertificateCheck_Check(t *testing.T) {
+	ca := certtest.NewCA(t, "corp-root")
+	otherCA := certtest.NewCA(t, "other-root")
+	chain := certposture.EncodeChainPEM([]*x509.Certificate{ca.Issue(t, certtest.ECDSAKey(t), "device")})
+
+	c := bundle(ChecksDefinition{CertificateCheck: &CertificateCheck{CACertificates: []string{ca.PEM}}})
+	without := &Peer{}
+	with := &Peer{Meta: PeerSystemMeta{Certificates: []string{chain}}}
+
+	assert.False(t, c[0].Passes(without))
+	assert.True(t, c[0].Passes(with))
+	assert.True(t, PostureVerdictChanged(c, without, with))
+
+	otherOnly := bundle(ChecksDefinition{CertificateCheck: &CertificateCheck{CACertificates: []string{otherCA.PEM}}})
+	assert.False(t, otherOnly[0].Passes(with))
+}
diff --git a/shared/management/proto/management.pb.go b/shared/management/proto/management.pb.go
index 13e3552f5..a055b0b1e 100644
--- a/shared/management/proto/management.pb.go
+++ b/shared/management/proto/management.pb.go
@@ -1541,25 +1541,26 @@ type PeerSystemMeta struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Hostname           string            `protobuf:"bytes,1,opt,name=hostname,proto3" json:"hostname,omitempty"`
-	GoOS               string            `protobuf:"bytes,2,opt,name=goOS,proto3" json:"goOS,omitempty"`
-	Kernel             string            `protobuf:"bytes,3,opt,name=kernel,proto3" json:"kernel,omitempty"`
-	Core               string            `protobuf:"bytes,4,opt,name=core,proto3" json:"core,omitempty"`
-	Platform           string            `protobuf:"bytes,5,opt,name=platform,proto3" json:"platform,omitempty"`
-	OS                 string            `protobuf:"bytes,6,opt,name=OS,proto3" json:"OS,omitempty"`
-	NetbirdVersion     string            `protobuf:"bytes,7,opt,name=netbirdVersion,proto3" json:"netbirdVersion,omitempty"`
-	UiVersion          string            `protobuf:"bytes,8,opt,name=uiVersion,proto3" json:"uiVersion,omitempty"`
-	KernelVersion      string            `protobuf:"bytes,9,opt,name=kernelVersion,proto3" json:"kernelVersion,omitempty"`
-	OSVersion          string            `protobuf:"bytes,10,opt,name=OSVersion,proto3" json:"OSVersion,omitempty"`
-	NetworkAddresses   []*NetworkAddress `protobuf:"bytes,11,rep,name=networkAddresses,proto3" json:"networkAddresses,omitempty"`
-	SysSerialNumber    string            `protobuf:"bytes,12,opt,name=sysSerialNumber,proto3" json:"sysSerialNumber,omitempty"`
-	SysProductName     string            `protobuf:"bytes,13,opt,name=sysProductName,proto3" json:"sysProductName,omitempty"`
-	SysManufacturer    string            `protobuf:"bytes,14,opt,name=sysManufacturer,proto3" json:"sysManufacturer,omitempty"`
-	Environment        *Environment      `protobuf:"bytes,15,opt,name=environment,proto3" json:"environment,omitempty"`
-	Files              []*File           `protobuf:"bytes,16,rep,name=files,proto3" json:"files,omitempty"`
-	Flags              *Flags            `protobuf:"bytes,17,opt,name=flags,proto3" json:"flags,omitempty"`
-	Capabilities       []PeerCapability  `protobuf:"varint,18,rep,packed,name=capabilities,proto3,enum=management.PeerCapability" json:"capabilities,omitempty"`
-	SyncMessageVersion int32             `protobuf:"varint,19,opt,name=syncMessageVersion,proto3" json:"syncMessageVersion,omitempty"`
+	Hostname           string              `protobuf:"bytes,1,opt,name=hostname,proto3" json:"hostname,omitempty"`
+	GoOS               string              `protobuf:"bytes,2,opt,name=goOS,proto3" json:"goOS,omitempty"`
+	Kernel             string              `protobuf:"bytes,3,opt,name=kernel,proto3" json:"kernel,omitempty"`
+	Core               string              `protobuf:"bytes,4,opt,name=core,proto3" json:"core,omitempty"`
+	Platform           string              `protobuf:"bytes,5,opt,name=platform,proto3" json:"platform,omitempty"`
+	OS                 string              `protobuf:"bytes,6,opt,name=OS,proto3" json:"OS,omitempty"`
+	NetbirdVersion     string              `protobuf:"bytes,7,opt,name=netbirdVersion,proto3" json:"netbirdVersion,omitempty"`
+	UiVersion          string              `protobuf:"bytes,8,opt,name=uiVersion,proto3" json:"uiVersion,omitempty"`
+	KernelVersion      string              `protobuf:"bytes,9,opt,name=kernelVersion,proto3" json:"kernelVersion,omitempty"`
+	OSVersion          string              `protobuf:"bytes,10,opt,name=OSVersion,proto3" json:"OSVersion,omitempty"`
+	NetworkAddresses   []*NetworkAddress   `protobuf:"bytes,11,rep,name=networkAddresses,proto3" json:"networkAddresses,omitempty"`
+	SysSerialNumber    string              `protobuf:"bytes,12,opt,name=sysSerialNumber,proto3" json:"sysSerialNumber,omitempty"`
+	SysProductName     string              `protobuf:"bytes,13,opt,name=sysProductName,proto3" json:"sysProductName,omitempty"`
+	SysManufacturer    string              `protobuf:"bytes,14,opt,name=sysManufacturer,proto3" json:"sysManufacturer,omitempty"`
+	Environment        *Environment        `protobuf:"bytes,15,opt,name=environment,proto3" json:"environment,omitempty"`
+	Files              []*File             `protobuf:"bytes,16,rep,name=files,proto3" json:"files,omitempty"`
+	Flags              *Flags              `protobuf:"bytes,17,opt,name=flags,proto3" json:"flags,omitempty"`
+	Capabilities       []PeerCapability    `protobuf:"varint,18,rep,packed,name=capabilities,proto3,enum=management.PeerCapability" json:"capabilities,omitempty"`
+	SyncMessageVersion int32               `protobuf:"varint,19,opt,name=syncMessageVersion,proto3" json:"syncMessageVersion,omitempty"`
+	CertificateProofs  []*CertificateProof `protobuf:"bytes,20,rep,name=certificateProofs,proto3" json:"certificateProofs,omitempty"`
 }
 
 func (x *PeerSystemMeta) Reset() {
@@ -1727,6 +1728,13 @@ func (x *PeerSystemMeta) GetSyncMessageVersion() int32 {
 	return 0
 }
 
+func (x *PeerSystemMeta) GetCertificateProofs() []*CertificateProof {
+	if x != nil {
+		return x.CertificateProofs
+	}
+	return nil
+}
+
 type LoginResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -4170,6 +4178,8 @@ type Checks struct {
 	unknownFields protoimpl.UnknownFields
 
 	Files []string `protobuf:"bytes,1,rep,name=Files,proto3" json:"Files,omitempty"`
+	// certificateChallenge asks the peer to prove possession of a certificate chaining to caCertificates.
+	CertificateChallenge *CertificateChallenge `protobuf:"bytes,2,opt,name=certificateChallenge,proto3" json:"certificateChallenge,omitempty"`
 }
 
 func (x *Checks) Reset() {
@@ -4211,6 +4221,143 @@ func (x *Checks) GetFiles() []string {
 	return nil
 }
 
+func (x *Checks) GetCertificateChallenge() *CertificateChallenge {
+	if x != nil {
+		return x.CertificateChallenge
+	}
+	return nil
+}
+
+type CertificateChallenge struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// nonce is issued by management, bound to the peer and a time window; the peer signs it.
+	Nonce []byte `protobuf:"bytes,1,opt,name=nonce,proto3" json:"nonce,omitempty"`
+	// caCertificates are PEM encoded trust anchors the presented certificate must chain to.
+	CaCertificates []string `protobuf:"bytes,2,rep,name=caCertificates,proto3" json:"caCertificates,omitempty"`
+}
+
+func (x *CertificateChallenge) Reset() {
+	*x = CertificateChallenge{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_management_proto_msgTypes[47]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CertificateChallenge) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CertificateChallenge) ProtoMessage() {}
+
+func (x *CertificateChallenge) ProtoReflect() protoreflect.Message {
+	mi := &file_management_proto_msgTypes[47]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CertificateChallenge.ProtoReflect.Descriptor instead.
+func (*CertificateChallenge) Descriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{47}
+}
+
+func (x *CertificateChallenge) GetNonce() []byte {
+	if x != nil {
+		return x.Nonce
+	}
+	return nil
+}
+
+func (x *CertificateChallenge) GetCaCertificates() []string {
+	if x != nil {
+		return x.CaCertificates
+	}
+	return nil
+}
+
+// CertificateProof demonstrates possession of the private key of chain[0] by signing the challenge nonce.
+type CertificateProof struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Nonce []byte `protobuf:"bytes,1,opt,name=nonce,proto3" json:"nonce,omitempty"`
+	// chain is DER encoded, leaf first.
+	Chain     [][]byte `protobuf:"bytes,2,rep,name=chain,proto3" json:"chain,omitempty"`
+	SigAlg    string   `protobuf:"bytes,3,opt,name=sigAlg,proto3" json:"sigAlg,omitempty"`
+	Signature []byte   `protobuf:"bytes,4,opt,name=signature,proto3" json:"signature,omitempty"`
+}
+
+func (x *CertificateProof) Reset() {
+	*x = CertificateProof{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_management_proto_msgTypes[48]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CertificateProof) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CertificateProof) ProtoMessage() {}
+
+func (x *CertificateProof) ProtoReflect() protoreflect.Message {
+	mi := &file_management_proto_msgTypes[48]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CertificateProof.ProtoReflect.Descriptor instead.
+func (*CertificateProof) Descriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{48}
+}
+
+func (x *CertificateProof) GetNonce() []byte {
+	if x != nil {
+		return x.Nonce
+	}
+	return nil
+}
+
+func (x *CertificateProof) GetChain() [][]byte {
+	if x != nil {
+		return x.Chain
+	}
+	return nil
+}
+
+func (x *CertificateProof) GetSigAlg() string {
+	if x != nil {
+		return x.SigAlg
+	}
+	return ""
+}
+
+func (x *CertificateProof) GetSignature() []byte {
+	if x != nil {
+		return x.Signature
+	}
+	return nil
+}
+
 type PortInfo struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -4226,7 +4373,7 @@ type PortInfo struct {
 func (x *PortInfo) Reset() {
 	*x = PortInfo{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[47]
+		mi := &file_management_proto_msgTypes[49]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4239,7 +4386,7 @@ func (x *PortInfo) String() string {
 func (*PortInfo) ProtoMessage() {}
 
 func (x *PortInfo) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[47]
+	mi := &file_management_proto_msgTypes[49]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4252,7 +4399,7 @@ func (x *PortInfo) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PortInfo.ProtoReflect.Descriptor instead.
 func (*PortInfo) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{47}
+	return file_management_proto_rawDescGZIP(), []int{49}
 }
 
 func (m *PortInfo) GetPortSelection() isPortInfo_PortSelection {
@@ -4323,7 +4470,7 @@ type RouteFirewallRule struct {
 func (x *RouteFirewallRule) Reset() {
 	*x = RouteFirewallRule{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[48]
+		mi := &file_management_proto_msgTypes[50]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4336,7 +4483,7 @@ func (x *RouteFirewallRule) String() string {
 func (*RouteFirewallRule) ProtoMessage() {}
 
 func (x *RouteFirewallRule) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[48]
+	mi := &file_management_proto_msgTypes[50]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4349,7 +4496,7 @@ func (x *RouteFirewallRule) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RouteFirewallRule.ProtoReflect.Descriptor instead.
 func (*RouteFirewallRule) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{48}
+	return file_management_proto_rawDescGZIP(), []int{50}
 }
 
 func (x *RouteFirewallRule) GetSourceRanges() []string {
@@ -4439,7 +4586,7 @@ type ForwardingRule struct {
 func (x *ForwardingRule) Reset() {
 	*x = ForwardingRule{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[49]
+		mi := &file_management_proto_msgTypes[51]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4452,7 +4599,7 @@ func (x *ForwardingRule) String() string {
 func (*ForwardingRule) ProtoMessage() {}
 
 func (x *ForwardingRule) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[49]
+	mi := &file_management_proto_msgTypes[51]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4465,7 +4612,7 @@ func (x *ForwardingRule) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ForwardingRule.ProtoReflect.Descriptor instead.
 func (*ForwardingRule) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{49}
+	return file_management_proto_rawDescGZIP(), []int{51}
 }
 
 func (x *ForwardingRule) GetProtocol() RuleProtocol {
@@ -4514,7 +4661,7 @@ type ExposeServiceRequest struct {
 func (x *ExposeServiceRequest) Reset() {
 	*x = ExposeServiceRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[50]
+		mi := &file_management_proto_msgTypes[52]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4527,7 +4674,7 @@ func (x *ExposeServiceRequest) String() string {
 func (*ExposeServiceRequest) ProtoMessage() {}
 
 func (x *ExposeServiceRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[50]
+	mi := &file_management_proto_msgTypes[52]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4540,7 +4687,7 @@ func (x *ExposeServiceRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ExposeServiceRequest.ProtoReflect.Descriptor instead.
 func (*ExposeServiceRequest) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{50}
+	return file_management_proto_rawDescGZIP(), []int{52}
 }
 
 func (x *ExposeServiceRequest) GetPort() uint32 {
@@ -4613,7 +4760,7 @@ type ExposeServiceResponse struct {
 func (x *ExposeServiceResponse) Reset() {
 	*x = ExposeServiceResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[51]
+		mi := &file_management_proto_msgTypes[53]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4626,7 +4773,7 @@ func (x *ExposeServiceResponse) String() string {
 func (*ExposeServiceResponse) ProtoMessage() {}
 
 func (x *ExposeServiceResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[51]
+	mi := &file_management_proto_msgTypes[53]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4639,7 +4786,7 @@ func (x *ExposeServiceResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ExposeServiceResponse.ProtoReflect.Descriptor instead.
 func (*ExposeServiceResponse) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{51}
+	return file_management_proto_rawDescGZIP(), []int{53}
 }
 
 func (x *ExposeServiceResponse) GetServiceName() string {
@@ -4681,7 +4828,7 @@ type RenewExposeRequest struct {
 func (x *RenewExposeRequest) Reset() {
 	*x = RenewExposeRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[52]
+		mi := &file_management_proto_msgTypes[54]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4694,7 +4841,7 @@ func (x *RenewExposeRequest) String() string {
 func (*RenewExposeRequest) ProtoMessage() {}
 
 func (x *RenewExposeRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[52]
+	mi := &file_management_proto_msgTypes[54]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4707,7 +4854,7 @@ func (x *RenewExposeRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RenewExposeRequest.ProtoReflect.Descriptor instead.
 func (*RenewExposeRequest) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{52}
+	return file_management_proto_rawDescGZIP(), []int{54}
 }
 
 func (x *RenewExposeRequest) GetDomain() string {
@@ -4726,7 +4873,7 @@ type RenewExposeResponse struct {
 func (x *RenewExposeResponse) Reset() {
 	*x = RenewExposeResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[53]
+		mi := &file_management_proto_msgTypes[55]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4739,7 +4886,7 @@ func (x *RenewExposeResponse) String() string {
 func (*RenewExposeResponse) ProtoMessage() {}
 
 func (x *RenewExposeResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[53]
+	mi := &file_management_proto_msgTypes[55]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4752,7 +4899,7 @@ func (x *RenewExposeResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RenewExposeResponse.ProtoReflect.Descriptor instead.
 func (*RenewExposeResponse) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{53}
+	return file_management_proto_rawDescGZIP(), []int{55}
 }
 
 type StopExposeRequest struct {
@@ -4766,7 +4913,7 @@ type StopExposeRequest struct {
 func (x *StopExposeRequest) Reset() {
 	*x = StopExposeRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[54]
+		mi := &file_management_proto_msgTypes[56]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4779,7 +4926,7 @@ func (x *StopExposeRequest) String() string {
 func (*StopExposeRequest) ProtoMessage() {}
 
 func (x *StopExposeRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[54]
+	mi := &file_management_proto_msgTypes[56]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4792,7 +4939,7 @@ func (x *StopExposeRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StopExposeRequest.ProtoReflect.Descriptor instead.
 func (*StopExposeRequest) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{54}
+	return file_management_proto_rawDescGZIP(), []int{56}
 }
 
 func (x *StopExposeRequest) GetDomain() string {
@@ -4811,7 +4958,7 @@ type StopExposeResponse struct {
 func (x *StopExposeResponse) Reset() {
 	*x = StopExposeResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[55]
+		mi := &file_management_proto_msgTypes[57]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4824,7 +4971,7 @@ func (x *StopExposeResponse) String() string {
 func (*StopExposeResponse) ProtoMessage() {}
 
 func (x *StopExposeResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[55]
+	mi := &file_management_proto_msgTypes[57]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4837,7 +4984,7 @@ func (x *StopExposeResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StopExposeResponse.ProtoReflect.Descriptor instead.
 func (*StopExposeResponse) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{55}
+	return file_management_proto_rawDescGZIP(), []int{57}
 }
 
 // NetworkMapEnvelope wraps either a full snapshot or a delta. Only Full is
@@ -4857,7 +5004,7 @@ type NetworkMapEnvelope struct {
 func (x *NetworkMapEnvelope) Reset() {
 	*x = NetworkMapEnvelope{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[56]
+		mi := &file_management_proto_msgTypes[58]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4870,7 +5017,7 @@ func (x *NetworkMapEnvelope) String() string {
 func (*NetworkMapEnvelope) ProtoMessage() {}
 
 func (x *NetworkMapEnvelope) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[56]
+	mi := &file_management_proto_msgTypes[58]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4883,7 +5030,7 @@ func (x *NetworkMapEnvelope) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use NetworkMapEnvelope.ProtoReflect.Descriptor instead.
 func (*NetworkMapEnvelope) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{56}
+	return file_management_proto_rawDescGZIP(), []int{58}
 }
 
 func (m *NetworkMapEnvelope) GetPayload() isNetworkMapEnvelope_Payload {
@@ -5007,7 +5154,7 @@ type NetworkMapComponentsFull struct {
 func (x *NetworkMapComponentsFull) Reset() {
 	*x = NetworkMapComponentsFull{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[57]
+		mi := &file_management_proto_msgTypes[59]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -5020,7 +5167,7 @@ func (x *NetworkMapComponentsFull) String() string {
 func (*NetworkMapComponentsFull) ProtoMessage() {}
 
 func (x *NetworkMapComponentsFull) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[57]
+	mi := &file_management_proto_msgTypes[59]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5033,7 +5180,7 @@ func (x *NetworkMapComponentsFull) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use NetworkMapComponentsFull.ProtoReflect.Descriptor instead.
 func (*NetworkMapComponentsFull) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{57}
+	return file_management_proto_rawDescGZIP(), []int{59}
 }
 
 func (x *NetworkMapComponentsFull) GetSerial() uint64 {
@@ -5231,7 +5378,7 @@ type ProxyPatch struct {
 func (x *ProxyPatch) Reset() {
 	*x = ProxyPatch{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[58]
+		mi := &file_management_proto_msgTypes[60]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -5244,7 +5391,7 @@ func (x *ProxyPatch) String() string {
 func (*ProxyPatch) ProtoMessage() {}
 
 func (x *ProxyPatch) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[58]
+	mi := &file_management_proto_msgTypes[60]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5257,7 +5404,7 @@ func (x *ProxyPatch) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ProxyPatch.ProtoReflect.Descriptor instead.
 func (*ProxyPatch) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{58}
+	return file_management_proto_rawDescGZIP(), []int{60}
 }
 
 func (x *ProxyPatch) GetPeers() []*RemotePeerConfig {
@@ -5320,7 +5467,7 @@ type AccountSettingsCompact struct {
 func (x *AccountSettingsCompact) Reset() {
 	*x = AccountSettingsCompact{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[59]
+		mi := &file_management_proto_msgTypes[61]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -5333,7 +5480,7 @@ func (x *AccountSettingsCompact) String() string {
 func (*AccountSettingsCompact) ProtoMessage() {}
 
 func (x *AccountSettingsCompact) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[59]
+	mi := &file_management_proto_msgTypes[61]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5346,7 +5493,7 @@ func (x *AccountSettingsCompact) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AccountSettingsCompact.ProtoReflect.Descriptor instead.
 func (*AccountSettingsCompact) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{59}
+	return file_management_proto_rawDescGZIP(), []int{61}
 }
 
 func (x *AccountSettingsCompact) GetPeerLoginExpirationEnabled() bool {
@@ -5383,7 +5530,7 @@ type AccountNetwork struct {
 func (x *AccountNetwork) Reset() {
 	*x = AccountNetwork{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[60]
+		mi := &file_management_proto_msgTypes[62]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -5396,7 +5543,7 @@ func (x *AccountNetwork) String() string {
 func (*AccountNetwork) ProtoMessage() {}
 
 func (x *AccountNetwork) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[60]
+	mi := &file_management_proto_msgTypes[62]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5409,7 +5556,7 @@ func (x *AccountNetwork) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AccountNetwork.ProtoReflect.Descriptor instead.
 func (*AccountNetwork) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{60}
+	return file_management_proto_rawDescGZIP(), []int{62}
 }
 
 func (x *AccountNetwork) GetIdentifier() string {
@@ -5459,7 +5606,7 @@ type NetworkMapComponentsDelta struct {
 func (x *NetworkMapComponentsDelta) Reset() {
 	*x = NetworkMapComponentsDelta{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[61]
+		mi := &file_management_proto_msgTypes[63]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -5472,7 +5619,7 @@ func (x *NetworkMapComponentsDelta) String() string {
 func (*NetworkMapComponentsDelta) ProtoMessage() {}
 
 func (x *NetworkMapComponentsDelta) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[61]
+	mi := &file_management_proto_msgTypes[63]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5485,7 +5632,7 @@ func (x *NetworkMapComponentsDelta) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use NetworkMapComponentsDelta.ProtoReflect.Descriptor instead.
 func (*NetworkMapComponentsDelta) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{61}
+	return file_management_proto_rawDescGZIP(), []int{63}
 }
 
 // PeerCompact is the wire-shape of a remote peer used by the component
@@ -5555,7 +5702,7 @@ type PeerCompact struct {
 func (x *PeerCompact) Reset() {
 	*x = PeerCompact{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[62]
+		mi := &file_management_proto_msgTypes[64]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -5568,7 +5715,7 @@ func (x *PeerCompact) String() string {
 func (*PeerCompact) ProtoMessage() {}
 
 func (x *PeerCompact) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[62]
+	mi := &file_management_proto_msgTypes[64]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5581,7 +5728,7 @@ func (x *PeerCompact) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PeerCompact.ProtoReflect.Descriptor instead.
 func (*PeerCompact) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{62}
+	return file_management_proto_rawDescGZIP(), []int{64}
 }
 
 func (x *PeerCompact) GetWgPubKey() []byte {
@@ -5734,7 +5881,7 @@ type PolicyCompact struct {
 func (x *PolicyCompact) Reset() {
 	*x = PolicyCompact{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[63]
+		mi := &file_management_proto_msgTypes[65]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -5747,7 +5894,7 @@ func (x *PolicyCompact) String() string {
 func (*PolicyCompact) ProtoMessage() {}
 
 func (x *PolicyCompact) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[63]
+	mi := &file_management_proto_msgTypes[65]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5760,7 +5907,7 @@ func (x *PolicyCompact) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PolicyCompact.ProtoReflect.Descriptor instead.
 func (*PolicyCompact) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{63}
+	return file_management_proto_rawDescGZIP(), []int{65}
 }
 
 func (x *PolicyCompact) GetId() string {
@@ -5871,7 +6018,7 @@ type ResourceCompact struct {
 func (x *ResourceCompact) Reset() {
 	*x = ResourceCompact{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[64]
+		mi := &file_management_proto_msgTypes[66]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -5884,7 +6031,7 @@ func (x *ResourceCompact) String() string {
 func (*ResourceCompact) ProtoMessage() {}
 
 func (x *ResourceCompact) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[64]
+	mi := &file_management_proto_msgTypes[66]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5897,7 +6044,7 @@ func (x *ResourceCompact) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ResourceCompact.ProtoReflect.Descriptor instead.
 func (*ResourceCompact) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{64}
+	return file_management_proto_rawDescGZIP(), []int{66}
 }
 
 func (x *ResourceCompact) GetType() string {
@@ -5941,7 +6088,7 @@ type UserNameList struct {
 func (x *UserNameList) Reset() {
 	*x = UserNameList{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[65]
+		mi := &file_management_proto_msgTypes[67]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -5954,7 +6101,7 @@ func (x *UserNameList) String() string {
 func (*UserNameList) ProtoMessage() {}
 
 func (x *UserNameList) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[65]
+	mi := &file_management_proto_msgTypes[67]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5967,7 +6114,7 @@ func (x *UserNameList) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UserNameList.ProtoReflect.Descriptor instead.
 func (*UserNameList) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{65}
+	return file_management_proto_rawDescGZIP(), []int{67}
 }
 
 func (x *UserNameList) GetNames() []string {
@@ -6000,7 +6147,7 @@ type GroupCompact struct {
 func (x *GroupCompact) Reset() {
 	*x = GroupCompact{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[66]
+		mi := &file_management_proto_msgTypes[68]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -6013,7 +6160,7 @@ func (x *GroupCompact) String() string {
 func (*GroupCompact) ProtoMessage() {}
 
 func (x *GroupCompact) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[66]
+	mi := &file_management_proto_msgTypes[68]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6026,7 +6173,7 @@ func (x *GroupCompact) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GroupCompact.ProtoReflect.Descriptor instead.
 func (*GroupCompact) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{66}
+	return file_management_proto_rawDescGZIP(), []int{68}
 }
 
 func (x *GroupCompact) GetId() string {
@@ -6070,7 +6217,7 @@ type DNSSettingsCompact struct {
 func (x *DNSSettingsCompact) Reset() {
 	*x = DNSSettingsCompact{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[67]
+		mi := &file_management_proto_msgTypes[69]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -6083,7 +6230,7 @@ func (x *DNSSettingsCompact) String() string {
 func (*DNSSettingsCompact) ProtoMessage() {}
 
 func (x *DNSSettingsCompact) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[67]
+	mi := &file_management_proto_msgTypes[69]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6096,7 +6243,7 @@ func (x *DNSSettingsCompact) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DNSSettingsCompact.ProtoReflect.Descriptor instead.
 func (*DNSSettingsCompact) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{67}
+	return file_management_proto_rawDescGZIP(), []int{69}
 }
 
 func (x *DNSSettingsCompact) GetDisabledManagementGroupIds() []string {
@@ -6147,7 +6294,7 @@ type RouteRaw struct {
 func (x *RouteRaw) Reset() {
 	*x = RouteRaw{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[68]
+		mi := &file_management_proto_msgTypes[70]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -6160,7 +6307,7 @@ func (x *RouteRaw) String() string {
 func (*RouteRaw) ProtoMessage() {}
 
 func (x *RouteRaw) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[68]
+	mi := &file_management_proto_msgTypes[70]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6173,7 +6320,7 @@ func (x *RouteRaw) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RouteRaw.ProtoReflect.Descriptor instead.
 func (*RouteRaw) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{68}
+	return file_management_proto_rawDescGZIP(), []int{70}
 }
 
 func (x *RouteRaw) GetId() string {
@@ -6310,7 +6457,7 @@ type NameServerGroupRaw struct {
 func (x *NameServerGroupRaw) Reset() {
 	*x = NameServerGroupRaw{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[69]
+		mi := &file_management_proto_msgTypes[71]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -6323,7 +6470,7 @@ func (x *NameServerGroupRaw) String() string {
 func (*NameServerGroupRaw) ProtoMessage() {}
 
 func (x *NameServerGroupRaw) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[69]
+	mi := &file_management_proto_msgTypes[71]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6336,7 +6483,7 @@ func (x *NameServerGroupRaw) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use NameServerGroupRaw.ProtoReflect.Descriptor instead.
 func (*NameServerGroupRaw) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{69}
+	return file_management_proto_rawDescGZIP(), []int{71}
 }
 
 func (x *NameServerGroupRaw) GetId() string {
@@ -6409,7 +6556,7 @@ type NetworkResourceRaw struct {
 func (x *NetworkResourceRaw) Reset() {
 	*x = NetworkResourceRaw{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[70]
+		mi := &file_management_proto_msgTypes[72]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -6422,7 +6569,7 @@ func (x *NetworkResourceRaw) String() string {
 func (*NetworkResourceRaw) ProtoMessage() {}
 
 func (x *NetworkResourceRaw) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[70]
+	mi := &file_management_proto_msgTypes[72]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6435,7 +6582,7 @@ func (x *NetworkResourceRaw) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use NetworkResourceRaw.ProtoReflect.Descriptor instead.
 func (*NetworkResourceRaw) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{70}
+	return file_management_proto_rawDescGZIP(), []int{72}
 }
 
 func (x *NetworkResourceRaw) GetId() string {
@@ -6514,7 +6661,7 @@ type NetworkRouterList struct {
 func (x *NetworkRouterList) Reset() {
 	*x = NetworkRouterList{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[71]
+		mi := &file_management_proto_msgTypes[73]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -6527,7 +6674,7 @@ func (x *NetworkRouterList) String() string {
 func (*NetworkRouterList) ProtoMessage() {}
 
 func (x *NetworkRouterList) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[71]
+	mi := &file_management_proto_msgTypes[73]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6540,7 +6687,7 @@ func (x *NetworkRouterList) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use NetworkRouterList.ProtoReflect.Descriptor instead.
 func (*NetworkRouterList) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{71}
+	return file_management_proto_rawDescGZIP(), []int{73}
 }
 
 func (x *NetworkRouterList) GetEntries() []*NetworkRouterEntry {
@@ -6569,7 +6716,7 @@ type NetworkRouterEntry struct {
 func (x *NetworkRouterEntry) Reset() {
 	*x = NetworkRouterEntry{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[72]
+		mi := &file_management_proto_msgTypes[74]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -6582,7 +6729,7 @@ func (x *NetworkRouterEntry) String() string {
 func (*NetworkRouterEntry) ProtoMessage() {}
 
 func (x *NetworkRouterEntry) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[72]
+	mi := &file_management_proto_msgTypes[74]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6595,7 +6742,7 @@ func (x *NetworkRouterEntry) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use NetworkRouterEntry.ProtoReflect.Descriptor instead.
 func (*NetworkRouterEntry) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{72}
+	return file_management_proto_rawDescGZIP(), []int{74}
 }
 
 func (x *NetworkRouterEntry) GetId() string {
@@ -6658,7 +6805,7 @@ type PolicyIds struct {
 func (x *PolicyIds) Reset() {
 	*x = PolicyIds{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[73]
+		mi := &file_management_proto_msgTypes[75]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -6671,7 +6818,7 @@ func (x *PolicyIds) String() string {
 func (*PolicyIds) ProtoMessage() {}
 
 func (x *PolicyIds) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[73]
+	mi := &file_management_proto_msgTypes[75]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6684,7 +6831,7 @@ func (x *PolicyIds) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PolicyIds.ProtoReflect.Descriptor instead.
 func (*PolicyIds) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{73}
+	return file_management_proto_rawDescGZIP(), []int{75}
 }
 
 func (x *PolicyIds) GetIds() []string {
@@ -6707,7 +6854,7 @@ type UserIDList struct {
 func (x *UserIDList) Reset() {
 	*x = UserIDList{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[74]
+		mi := &file_management_proto_msgTypes[76]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -6720,7 +6867,7 @@ func (x *UserIDList) String() string {
 func (*UserIDList) ProtoMessage() {}
 
 func (x *UserIDList) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[74]
+	mi := &file_management_proto_msgTypes[76]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6733,7 +6880,7 @@ func (x *UserIDList) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UserIDList.ProtoReflect.Descriptor instead.
 func (*UserIDList) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{74}
+	return file_management_proto_rawDescGZIP(), []int{76}
 }
 
 func (x *UserIDList) GetUserIds() []string {
@@ -6756,7 +6903,7 @@ type PeerIndexSet struct {
 func (x *PeerIndexSet) Reset() {
 	*x = PeerIndexSet{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[75]
+		mi := &file_management_proto_msgTypes[77]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -6769,7 +6916,7 @@ func (x *PeerIndexSet) String() string {
 func (*PeerIndexSet) ProtoMessage() {}
 
 func (x *PeerIndexSet) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[75]
+	mi := &file_management_proto_msgTypes[77]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6782,7 +6929,7 @@ func (x *PeerIndexSet) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PeerIndexSet.ProtoReflect.Descriptor instead.
 func (*PeerIndexSet) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{75}
+	return file_management_proto_rawDescGZIP(), []int{77}
 }
 
 func (x *PeerIndexSet) GetPeerIndexes() []uint32 {
@@ -6804,7 +6951,7 @@ type PortInfo_Range struct {
 func (x *PortInfo_Range) Reset() {
 	*x = PortInfo_Range{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[77]
+		mi := &file_management_proto_msgTypes[79]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -6817,7 +6964,7 @@ func (x *PortInfo_Range) String() string {
 func (*PortInfo_Range) ProtoMessage() {}
 
 func (x *PortInfo_Range) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[77]
+	mi := &file_management_proto_msgTypes[79]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6830,7 +6977,7 @@ func (x *PortInfo_Range) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PortInfo_Range.ProtoReflect.Descriptor instead.
 func (*PortInfo_Range) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{47, 0}
+	return file_management_proto_rawDescGZIP(), []int{49, 0}
 }
 
 func (x *PortInfo_Range) GetStart() uint32 {
@@ -7014,7 +7161,7 @@ var file_management_proto_rawDesc = []byte{
 	0x49, 0x50, 0x76, 0x36, 0x12, 0x2c, 0x0a, 0x11, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x4a, 0x6f,
 	0x62, 0x73, 0x41, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x18, 0x11, 0x20, 0x01, 0x28, 0x08, 0x52,
 	0x11, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x4a, 0x6f, 0x62, 0x73, 0x41, 0x6c, 0x6c, 0x6f, 0x77,
-	0x65, 0x64, 0x22, 0xe2, 0x05, 0x0a, 0x0e, 0x50, 0x65, 0x65, 0x72, 0x53, 0x79, 0x73, 0x74, 0x65,
+	0x65, 0x64, 0x22, 0xae, 0x06, 0x0a, 0x0e, 0x50, 0x65, 0x65, 0x72, 0x53, 0x79, 0x73, 0x74, 0x65,
 	0x6d, 0x4d, 0x65, 0x74, 0x61, 0x12, 0x1a, 0x0a, 0x08, 0x68, 0x6f, 0x73, 0x74, 0x6e, 0x61, 0x6d,
 	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x68, 0x6f, 0x73, 0x74, 0x6e, 0x61, 0x6d,
 	0x65, 0x12, 0x12, 0x0a, 0x04, 0x67, 0x6f, 0x4f, 0x53, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
@@ -7060,947 +7207,970 @@ var file_management_proto_rawDesc = []byte{
 	0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x12, 0x2e, 0x0a, 0x12, 0x73, 0x79, 0x6e, 0x63, 0x4d,
 	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x13, 0x20,
 	0x01, 0x28, 0x05, 0x52, 0x12, 0x73, 0x79, 0x6e, 0x63, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,
-	0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0xfc, 0x01, 0x0a, 0x0d, 0x4c, 0x6f, 0x67, 0x69,
-	0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3f, 0x0a, 0x0d, 0x6e, 0x65, 0x74,
-	0x62, 0x69, 0x72, 0x64, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x19, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65,
-	0x74, 0x62, 0x69, 0x72, 0x64, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0d, 0x6e, 0x65, 0x74,
-	0x62, 0x69, 0x72, 0x64, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x36, 0x0a, 0x0a, 0x70, 0x65,
-	0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72,
-	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0a, 0x70, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66,
-	0x69, 0x67, 0x12, 0x2a, 0x0a, 0x06, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x73, 0x18, 0x03, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x12, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x43, 0x68, 0x65, 0x63, 0x6b, 0x73, 0x52, 0x06, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x73, 0x12, 0x46,
-	0x0a, 0x10, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73,
-	0x41, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73,
-	0x74, 0x61, 0x6d, 0x70, 0x52, 0x10, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x45, 0x78, 0x70,
-	0x69, 0x72, 0x65, 0x73, 0x41, 0x74, 0x22, 0x66, 0x0a, 0x18, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x64,
-	0x41, 0x75, 0x74, 0x68, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x6a, 0x77, 0x74, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6a, 0x77, 0x74, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x2e,
-	0x0a, 0x04, 0x6d, 0x65, 0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x53, 0x79,
-	0x73, 0x74, 0x65, 0x6d, 0x4d, 0x65, 0x74, 0x61, 0x52, 0x04, 0x6d, 0x65, 0x74, 0x61, 0x22, 0x63,
-	0x0a, 0x19, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x64, 0x41, 0x75, 0x74, 0x68, 0x53, 0x65, 0x73, 0x73,
-	0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x46, 0x0a, 0x10, 0x73,
-	0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x41, 0x74, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d,
-	0x70, 0x52, 0x10, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65,
-	0x73, 0x41, 0x74, 0x22, 0x79, 0x0a, 0x11, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x4b, 0x65, 0x79,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x38, 0x0a, 0x09, 0x65, 0x78,
-	0x70, 0x69, 0x72, 0x65, 0x73, 0x41, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e,
-	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
-	0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x65, 0x78, 0x70, 0x69, 0x72,
-	0x65, 0x73, 0x41, 0x74, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x07,
-	0x0a, 0x05, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0xb4, 0x02, 0x0a, 0x0d, 0x4e, 0x65, 0x74, 0x62,
-	0x69, 0x72, 0x64, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x2c, 0x0a, 0x05, 0x73, 0x74, 0x75,
-	0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x48, 0x6f, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x52, 0x05, 0x73, 0x74, 0x75, 0x6e, 0x73, 0x12, 0x35, 0x0a, 0x05, 0x74, 0x75, 0x72, 0x6e, 0x73,
-	0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x74, 0x65, 0x63, 0x74, 0x65, 0x64, 0x48, 0x6f, 0x73,
-	0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x05, 0x74, 0x75, 0x72, 0x6e, 0x73, 0x12, 0x2e,
-	0x0a, 0x06, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x48, 0x6f, 0x73, 0x74,
-	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x06, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x12, 0x2d,
-	0x0a, 0x05, 0x72, 0x65, 0x6c, 0x61, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x6c, 0x61, 0x79,
-	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x05, 0x72, 0x65, 0x6c, 0x61, 0x79, 0x12, 0x2a, 0x0a,
-	0x04, 0x66, 0x6c, 0x6f, 0x77, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x46, 0x6c, 0x6f, 0x77, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x52, 0x04, 0x66, 0x6c, 0x6f, 0x77, 0x12, 0x33, 0x0a, 0x07, 0x6d, 0x65, 0x74,
-	0x72, 0x69, 0x63, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x73, 0x43,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x07, 0x6d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x73, 0x22, 0x98,
-	0x01, 0x0a, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x10, 0x0a,
-	0x03, 0x75, 0x72, 0x69, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x69, 0x12,
-	0x3b, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x0e, 0x32, 0x1f, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x48,
-	0x6f, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63,
-	0x6f, 0x6c, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x22, 0x3b, 0x0a, 0x08,
-	0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x07, 0x0a, 0x03, 0x55, 0x44, 0x50, 0x10,
-	0x00, 0x12, 0x07, 0x0a, 0x03, 0x54, 0x43, 0x50, 0x10, 0x01, 0x12, 0x08, 0x0a, 0x04, 0x48, 0x54,
-	0x54, 0x50, 0x10, 0x02, 0x12, 0x09, 0x0a, 0x05, 0x48, 0x54, 0x54, 0x50, 0x53, 0x10, 0x03, 0x12,
-	0x08, 0x0a, 0x04, 0x44, 0x54, 0x4c, 0x53, 0x10, 0x04, 0x22, 0x6d, 0x0a, 0x0b, 0x52, 0x65, 0x6c,
-	0x61, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x75, 0x72, 0x6c, 0x73,
-	0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x04, 0x75, 0x72, 0x6c, 0x73, 0x12, 0x22, 0x0a, 0x0c,
-	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x0c, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64,
-	0x12, 0x26, 0x0a, 0x0e, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75,
-	0x72, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x53,
-	0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x22, 0xad, 0x02, 0x0a, 0x0a, 0x46, 0x6c, 0x6f,
-	0x77, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x12, 0x22, 0x0a, 0x0c, 0x74, 0x6f, 0x6b,
-	0x65, 0x6e, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x0c, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x26, 0x0a,
-	0x0e, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x53, 0x69, 0x67, 0x6e,
-	0x61, 0x74, 0x75, 0x72, 0x65, 0x12, 0x35, 0x0a, 0x08, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61,
-	0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x52, 0x08, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x12, 0x18, 0x0a, 0x07,
-	0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65,
-	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x65,
-	0x72, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x65,
-	0x72, 0x73, 0x12, 0x2e, 0x0a, 0x12, 0x65, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x43, 0x6f,
-	0x6c, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12,
-	0x65, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x12, 0x24, 0x0a, 0x0d, 0x64, 0x6e, 0x73, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x64, 0x6e, 0x73, 0x43, 0x6f,
-	0x6c, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x29, 0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x72,
-	0x69, 0x63, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61,
-	0x62, 0x6c, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62,
-	0x6c, 0x65, 0x64, 0x22, 0xa3, 0x01, 0x0a, 0x09, 0x4a, 0x57, 0x54, 0x43, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x12, 0x16, 0x0a, 0x06, 0x69, 0x73, 0x73, 0x75, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x06, 0x69, 0x73, 0x73, 0x75, 0x65, 0x72, 0x12, 0x1a, 0x0a, 0x08, 0x61, 0x75, 0x64,
-	0x69, 0x65, 0x6e, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x61, 0x75, 0x64,
-	0x69, 0x65, 0x6e, 0x63, 0x65, 0x12, 0x22, 0x0a, 0x0c, 0x6b, 0x65, 0x79, 0x73, 0x4c, 0x6f, 0x63,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x6b, 0x65, 0x79,
-	0x73, 0x4c, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x20, 0x0a, 0x0b, 0x6d, 0x61, 0x78,
-	0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x41, 0x67, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0b,
-	0x6d, 0x61, 0x78, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x41, 0x67, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x61,
-	0x75, 0x64, 0x69, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x09,
-	0x61, 0x75, 0x64, 0x69, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x22, 0x7d, 0x0a, 0x13, 0x50, 0x72, 0x6f,
-	0x74, 0x65, 0x63, 0x74, 0x65, 0x64, 0x48, 0x6f, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x12, 0x36, 0x0a, 0x0a, 0x68, 0x6f, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
-	0x74, 0x2e, 0x48, 0x6f, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0a, 0x68, 0x6f,
-	0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x75, 0x73, 0x65, 0x72,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x75, 0x73, 0x65, 0x72, 0x12, 0x1a, 0x0a, 0x08,
-	0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
-	0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x22, 0xf2, 0x02, 0x0a, 0x0a, 0x50, 0x65, 0x65,
-	0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x18, 0x0a, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65,
-	0x73, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73,
-	0x73, 0x12, 0x10, 0x0a, 0x03, 0x64, 0x6e, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03,
-	0x64, 0x6e, 0x73, 0x12, 0x33, 0x0a, 0x09, 0x73, 0x73, 0x68, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x53, 0x53, 0x48, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x09, 0x73,
-	0x73, 0x68, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x66, 0x71, 0x64, 0x6e,
-	0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x66, 0x71, 0x64, 0x6e, 0x12, 0x48, 0x0a, 0x1f,
-	0x52, 0x6f, 0x75, 0x74, 0x69, 0x6e, 0x67, 0x50, 0x65, 0x65, 0x72, 0x44, 0x6e, 0x73, 0x52, 0x65,
-	0x73, 0x6f, 0x6c, 0x75, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18,
-	0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x1f, 0x52, 0x6f, 0x75, 0x74, 0x69, 0x6e, 0x67, 0x50, 0x65,
-	0x65, 0x72, 0x44, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x6f, 0x6c, 0x75, 0x74, 0x69, 0x6f, 0x6e, 0x45,
-	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x34, 0x0a, 0x15, 0x4c, 0x61, 0x7a, 0x79, 0x43, 0x6f,
-	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18,
-	0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x15, 0x4c, 0x61, 0x7a, 0x79, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x10, 0x0a, 0x03,
-	0x6d, 0x74, 0x75, 0x18, 0x07, 0x20, 0x01, 0x28, 0x05, 0x52, 0x03, 0x6d, 0x74, 0x75, 0x12, 0x3e,
-	0x0a, 0x0a, 0x61, 0x75, 0x74, 0x6f, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x18, 0x08, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x41, 0x75, 0x74, 0x6f, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e,
-	0x67, 0x73, 0x52, 0x0a, 0x61, 0x75, 0x74, 0x6f, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x12, 0x1d,
-	0x0a, 0x0a, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x5f, 0x76, 0x36, 0x18, 0x09, 0x20, 0x01,
-	0x28, 0x0c, 0x52, 0x09, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x56, 0x36, 0x22, 0x52, 0x0a,
-	0x12, 0x41, 0x75, 0x74, 0x6f, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x74, 0x74, 0x69,
-	0x6e, 0x67, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x22, 0x0a,
-	0x0c, 0x61, 0x6c, 0x77, 0x61, 0x79, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x08, 0x52, 0x0c, 0x61, 0x6c, 0x77, 0x61, 0x79, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74,
-	0x65, 0x22, 0xec, 0x05, 0x0a, 0x0a, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70,
-	0x12, 0x16, 0x0a, 0x06, 0x53, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04,
-	0x52, 0x06, 0x53, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x12, 0x36, 0x0a, 0x0a, 0x70, 0x65, 0x65, 0x72,
-	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x52, 0x0a, 0x70, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x12, 0x3e, 0x0a, 0x0b, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73, 0x18,
-	0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x52, 0x0b, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73,
-	0x12, 0x2e, 0x0a, 0x12, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73, 0x49,
-	0x73, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12, 0x72, 0x65,
-	0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73, 0x49, 0x73, 0x45, 0x6d, 0x70, 0x74, 0x79,
-	0x12, 0x29, 0x0a, 0x06, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b,
-	0x32, 0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x6f,
-	0x75, 0x74, 0x65, 0x52, 0x06, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x33, 0x0a, 0x09, 0x44,
-	0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x44, 0x4e, 0x53, 0x43,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x09, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x12, 0x40, 0x0a, 0x0c, 0x6f, 0x66, 0x66, 0x6c, 0x69, 0x6e, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73,
-	0x18, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x52, 0x0c, 0x6f, 0x66, 0x66, 0x6c, 0x69, 0x6e, 0x65, 0x50, 0x65, 0x65,
-	0x72, 0x73, 0x12, 0x3e, 0x0a, 0x0d, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75,
-	0x6c, 0x65, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52,
-	0x75, 0x6c, 0x65, 0x52, 0x0d, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c,
-	0x65, 0x73, 0x12, 0x32, 0x0a, 0x14, 0x66, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75,
-	0x6c, 0x65, 0x73, 0x49, 0x73, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x18, 0x09, 0x20, 0x01, 0x28, 0x08,
-	0x52, 0x14, 0x66, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x49,
-	0x73, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x4f, 0x0a, 0x13, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73,
-	0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x18, 0x0a, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75,
-	0x6c, 0x65, 0x52, 0x13, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61,
-	0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x12, 0x3e, 0x0a, 0x1a, 0x72, 0x6f, 0x75, 0x74, 0x65,
-	0x73, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x49, 0x73,
-	0x45, 0x6d, 0x70, 0x74, 0x79, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x52, 0x1a, 0x72, 0x6f, 0x75,
-	0x74, 0x65, 0x73, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73,
-	0x49, 0x73, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x48, 0x0a, 0x0f, 0x66, 0x6f, 0x72, 0x77, 0x61,
-	0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x18, 0x0c, 0x20, 0x03, 0x28, 0x0b,
-	0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x46, 0x6f,
-	0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x42, 0x02, 0x18, 0x01,
-	0x52, 0x0f, 0x66, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65,
-	0x73, 0x12, 0x2d, 0x0a, 0x07, 0x73, 0x73, 0x68, 0x41, 0x75, 0x74, 0x68, 0x18, 0x0d, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x13, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x53, 0x53, 0x48, 0x41, 0x75, 0x74, 0x68, 0x52, 0x07, 0x73, 0x73, 0x68, 0x41, 0x75, 0x74, 0x68,
-	0x22, 0x82, 0x02, 0x0a, 0x07, 0x53, 0x53, 0x48, 0x41, 0x75, 0x74, 0x68, 0x12, 0x20, 0x0a, 0x0b,
-	0x55, 0x73, 0x65, 0x72, 0x49, 0x44, 0x43, 0x6c, 0x61, 0x69, 0x6d, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x0b, 0x55, 0x73, 0x65, 0x72, 0x49, 0x44, 0x43, 0x6c, 0x61, 0x69, 0x6d, 0x12, 0x28,
-	0x0a, 0x0f, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x55, 0x73, 0x65, 0x72,
-	0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0c, 0x52, 0x0f, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
-	0x7a, 0x65, 0x64, 0x55, 0x73, 0x65, 0x72, 0x73, 0x12, 0x4a, 0x0a, 0x0d, 0x6d, 0x61, 0x63, 0x68,
-	0x69, 0x6e, 0x65, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32,
-	0x25, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x53, 0x48,
-	0x41, 0x75, 0x74, 0x68, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x55, 0x73, 0x65, 0x72,
-	0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0c, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x55,
-	0x73, 0x65, 0x72, 0x73, 0x1a, 0x5f, 0x0a, 0x11, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x55,
-	0x73, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x34, 0x0a, 0x05, 0x76,
-	0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x55,
-	0x73, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75,
-	0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x2e, 0x0a, 0x12, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
-	0x55, 0x73, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x69,
-	0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0d, 0x52, 0x07, 0x69, 0x6e,
-	0x64, 0x65, 0x78, 0x65, 0x73, 0x22, 0xf0, 0x01, 0x0a, 0x10, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65,
-	0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x1a, 0x0a, 0x08, 0x77, 0x67,
-	0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x77, 0x67,
-	0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x12, 0x1e, 0x0a, 0x0a, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65,
-	0x64, 0x49, 0x70, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0a, 0x61, 0x6c, 0x6c, 0x6f,
-	0x77, 0x65, 0x64, 0x49, 0x70, 0x73, 0x12, 0x33, 0x0a, 0x09, 0x73, 0x73, 0x68, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x53, 0x48, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x52, 0x09, 0x73, 0x73, 0x68, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x66,
-	0x71, 0x64, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x66, 0x71, 0x64, 0x6e, 0x12,
-	0x22, 0x0a, 0x0c, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18,
-	0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72, 0x73,
-	0x69, 0x6f, 0x6e, 0x12, 0x33, 0x0a, 0x09, 0x6c, 0x61, 0x7a, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65,
-	0x18, 0x06, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x4c, 0x61, 0x7a, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x09, 0x6c,
-	0x61, 0x7a, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x22, 0x7e, 0x0a, 0x09, 0x53, 0x53, 0x48, 0x43,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x1e, 0x0a, 0x0a, 0x73, 0x73, 0x68, 0x45, 0x6e, 0x61, 0x62,
-	0x6c, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x73, 0x73, 0x68, 0x45, 0x6e,
-	0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x1c, 0x0a, 0x09, 0x73, 0x73, 0x68, 0x50, 0x75, 0x62, 0x4b,
-	0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x73, 0x73, 0x68, 0x50, 0x75, 0x62,
-	0x4b, 0x65, 0x79, 0x12, 0x33, 0x0a, 0x09, 0x6a, 0x77, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x4a, 0x57, 0x54, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x09, 0x6a,
-	0x77, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0x20, 0x0a, 0x1e, 0x44, 0x65, 0x76, 0x69,
-	0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46,
-	0x6c, 0x6f, 0x77, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0xbf, 0x01, 0x0a, 0x17, 0x44,
-	0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x12, 0x48, 0x0a, 0x08, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64,
-	0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68,
-	0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x2e, 0x70, 0x72,
-	0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x52, 0x08, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72,
-	0x12, 0x42, 0x0a, 0x0e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66,
-	0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x52, 0x0e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x22, 0x16, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72,
-	0x12, 0x0a, 0x0a, 0x06, 0x48, 0x4f, 0x53, 0x54, 0x45, 0x44, 0x10, 0x00, 0x22, 0x44, 0x0a, 0x1c,
-	0x50, 0x4b, 0x43, 0x45, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f,
-	0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x24, 0x0a, 0x0d,
-	0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x64, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x08, 0x52, 0x0d, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x45, 0x78, 0x74, 0x65,
-	0x6e, 0x64, 0x22, 0x5b, 0x0a, 0x15, 0x50, 0x4b, 0x43, 0x45, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72,
-	0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x12, 0x42, 0x0a, 0x0e, 0x50,
-	0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x2e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52,
-	0x0e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22,
-	0xbc, 0x03, 0x0a, 0x0e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66,
-	0x69, 0x67, 0x12, 0x1a, 0x0a, 0x08, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49, 0x44, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49, 0x44, 0x12, 0x26,
-	0x0a, 0x0c, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x09, 0x42, 0x02, 0x18, 0x01, 0x52, 0x0c, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74,
-	0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x1a,
-	0x0a, 0x08, 0x41, 0x75, 0x64, 0x69, 0x65, 0x6e, 0x63, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x08, 0x41, 0x75, 0x64, 0x69, 0x65, 0x6e, 0x63, 0x65, 0x12, 0x2e, 0x0a, 0x12, 0x44, 0x65,
-	0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74,
-	0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75,
-	0x74, 0x68, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x24, 0x0a, 0x0d, 0x54, 0x6f,
-	0x6b, 0x65, 0x6e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x0d, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74,
-	0x12, 0x14, 0x0a, 0x05, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x05, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x12, 0x1e, 0x0a, 0x0a, 0x55, 0x73, 0x65, 0x49, 0x44, 0x54,
-	0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x55, 0x73, 0x65, 0x49,
-	0x44, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x34, 0x0a, 0x15, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72,
-	0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18,
-	0x09, 0x20, 0x01, 0x28, 0x09, 0x52, 0x15, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61,
-	0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x22, 0x0a, 0x0c,
-	0x52, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x55, 0x52, 0x4c, 0x73, 0x18, 0x0a, 0x20, 0x03,
-	0x28, 0x09, 0x52, 0x0c, 0x52, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x55, 0x52, 0x4c, 0x73,
-	0x12, 0x2e, 0x0a, 0x12, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x6d, 0x70,
-	0x74, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12, 0x44, 0x69,
-	0x73, 0x61, 0x62, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x4c, 0x6f, 0x67, 0x69, 0x6e,
-	0x12, 0x1c, 0x0a, 0x09, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x46, 0x6c, 0x61, 0x67, 0x18, 0x0c, 0x20,
-	0x01, 0x28, 0x0d, 0x52, 0x09, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x46, 0x6c, 0x61, 0x67, 0x22, 0x93,
-	0x02, 0x0a, 0x05, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x49, 0x44, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x49, 0x44, 0x12, 0x18, 0x0a, 0x07, 0x4e, 0x65, 0x74, 0x77,
-	0x6f, 0x72, 0x6b, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x4e, 0x65, 0x74, 0x77, 0x6f,
-	0x72, 0x6b, 0x12, 0x20, 0x0a, 0x0b, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x54, 0x79, 0x70,
-	0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0b, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
-	0x54, 0x79, 0x70, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x50, 0x65, 0x65, 0x72, 0x18, 0x04, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x04, 0x50, 0x65, 0x65, 0x72, 0x12, 0x16, 0x0a, 0x06, 0x4d, 0x65, 0x74, 0x72,
-	0x69, 0x63, 0x18, 0x05, 0x20, 0x01, 0x28, 0x03, 0x52, 0x06, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63,
-	0x12, 0x1e, 0x0a, 0x0a, 0x4d, 0x61, 0x73, 0x71, 0x75, 0x65, 0x72, 0x61, 0x64, 0x65, 0x18, 0x06,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x4d, 0x61, 0x73, 0x71, 0x75, 0x65, 0x72, 0x61, 0x64, 0x65,
-	0x12, 0x14, 0x0a, 0x05, 0x4e, 0x65, 0x74, 0x49, 0x44, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x05, 0x4e, 0x65, 0x74, 0x49, 0x44, 0x12, 0x18, 0x0a, 0x07, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
-	0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73,
-	0x12, 0x1c, 0x0a, 0x09, 0x6b, 0x65, 0x65, 0x70, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x18, 0x09, 0x20,
-	0x01, 0x28, 0x08, 0x52, 0x09, 0x6b, 0x65, 0x65, 0x70, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x12, 0x24,
-	0x0a, 0x0d, 0x73, 0x6b, 0x69, 0x70, 0x41, 0x75, 0x74, 0x6f, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x18,
-	0x0a, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x73, 0x6b, 0x69, 0x70, 0x41, 0x75, 0x74, 0x6f, 0x41,
-	0x70, 0x70, 0x6c, 0x79, 0x22, 0xde, 0x01, 0x0a, 0x09, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66,
-	0x69, 0x67, 0x12, 0x24, 0x0a, 0x0d, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x45, 0x6e, 0x61,
-	0x62, 0x6c, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x53, 0x65, 0x72, 0x76, 0x69,
-	0x63, 0x65, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x12, 0x47, 0x0a, 0x10, 0x4e, 0x61, 0x6d, 0x65,
-	0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x02, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x52,
-	0x10, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70,
-	0x73, 0x12, 0x38, 0x0a, 0x0b, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x73,
-	0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x52, 0x0b,
-	0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x73, 0x12, 0x28, 0x0a, 0x0d, 0x46,
-	0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x04, 0x20, 0x01,
-	0x28, 0x03, 0x42, 0x02, 0x18, 0x01, 0x52, 0x0d, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65,
-	0x72, 0x50, 0x6f, 0x72, 0x74, 0x22, 0xb8, 0x01, 0x0a, 0x0a, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d,
-	0x5a, 0x6f, 0x6e, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x32, 0x0a, 0x07,
-	0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x69, 0x6d, 0x70, 0x6c,
-	0x65, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x52, 0x07, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73,
-	0x12, 0x32, 0x0a, 0x14, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
-	0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x14,
+	0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x4a, 0x0a, 0x11, 0x63, 0x65, 0x72, 0x74, 0x69,
+	0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x6f, 0x66, 0x73, 0x18, 0x14, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x6f, 0x66,
+	0x52, 0x11, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f,
+	0x6f, 0x66, 0x73, 0x22, 0xfc, 0x01, 0x0a, 0x0d, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3f, 0x0a, 0x0d, 0x6e, 0x65, 0x74, 0x62, 0x69, 0x72, 0x64,
+	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x62, 0x69, 0x72,
+	0x64, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0d, 0x6e, 0x65, 0x74, 0x62, 0x69, 0x72, 0x64,
+	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x36, 0x0a, 0x0a, 0x70, 0x65, 0x65, 0x72, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x52, 0x0a, 0x70, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x2a,
+	0x0a, 0x06, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x12,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x68, 0x65, 0x63,
+	0x6b, 0x73, 0x52, 0x06, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x73, 0x12, 0x46, 0x0a, 0x10, 0x73, 0x65,
+	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x41, 0x74, 0x18, 0x04,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70,
+	0x52, 0x10, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73,
+	0x41, 0x74, 0x22, 0x66, 0x0a, 0x18, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x64, 0x41, 0x75, 0x74, 0x68,
+	0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a,
+	0x0a, 0x08, 0x6a, 0x77, 0x74, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x08, 0x6a, 0x77, 0x74, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x2e, 0x0a, 0x04, 0x6d, 0x65,
+	0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x53, 0x79, 0x73, 0x74, 0x65, 0x6d,
+	0x4d, 0x65, 0x74, 0x61, 0x52, 0x04, 0x6d, 0x65, 0x74, 0x61, 0x22, 0x63, 0x0a, 0x19, 0x45, 0x78,
+	0x74, 0x65, 0x6e, 0x64, 0x41, 0x75, 0x74, 0x68, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x46, 0x0a, 0x10, 0x73, 0x65, 0x73, 0x73, 0x69,
+	0x6f, 0x6e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x41, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x10, 0x73,
+	0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x41, 0x74, 0x22,
+	0x79, 0x0a, 0x11, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x38, 0x0a, 0x09, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65,
+	0x73, 0x41, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65,
+	0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x41, 0x74,
+	0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x05, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x07, 0x0a, 0x05, 0x45, 0x6d,
+	0x70, 0x74, 0x79, 0x22, 0xb4, 0x02, 0x0a, 0x0d, 0x4e, 0x65, 0x74, 0x62, 0x69, 0x72, 0x64, 0x43,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x2c, 0x0a, 0x05, 0x73, 0x74, 0x75, 0x6e, 0x73, 0x18, 0x01,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x48, 0x6f, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x05, 0x73, 0x74,
+	0x75, 0x6e, 0x73, 0x12, 0x35, 0x0a, 0x05, 0x74, 0x75, 0x72, 0x6e, 0x73, 0x18, 0x02, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x50, 0x72, 0x6f, 0x74, 0x65, 0x63, 0x74, 0x65, 0x64, 0x48, 0x6f, 0x73, 0x74, 0x43, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x52, 0x05, 0x74, 0x75, 0x72, 0x6e, 0x73, 0x12, 0x2e, 0x0a, 0x06, 0x73, 0x69,
+	0x67, 0x6e, 0x61, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x48, 0x6f, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x52, 0x06, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x12, 0x2d, 0x0a, 0x05, 0x72, 0x65,
+	0x6c, 0x61, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x6c, 0x61, 0x79, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x52, 0x05, 0x72, 0x65, 0x6c, 0x61, 0x79, 0x12, 0x2a, 0x0a, 0x04, 0x66, 0x6c, 0x6f,
+	0x77, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x46, 0x6c, 0x6f, 0x77, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52,
+	0x04, 0x66, 0x6c, 0x6f, 0x77, 0x12, 0x33, 0x0a, 0x07, 0x6d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x73,
+	0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x52, 0x07, 0x6d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x73, 0x22, 0x98, 0x01, 0x0a, 0x0a, 0x48,
+	0x6f, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x69,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x69, 0x12, 0x3b, 0x0a, 0x08, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1f, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x48, 0x6f, 0x73, 0x74, 0x43,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x22, 0x3b, 0x0a, 0x08, 0x50, 0x72, 0x6f, 0x74,
+	0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x07, 0x0a, 0x03, 0x55, 0x44, 0x50, 0x10, 0x00, 0x12, 0x07, 0x0a,
+	0x03, 0x54, 0x43, 0x50, 0x10, 0x01, 0x12, 0x08, 0x0a, 0x04, 0x48, 0x54, 0x54, 0x50, 0x10, 0x02,
+	0x12, 0x09, 0x0a, 0x05, 0x48, 0x54, 0x54, 0x50, 0x53, 0x10, 0x03, 0x12, 0x08, 0x0a, 0x04, 0x44,
+	0x54, 0x4c, 0x53, 0x10, 0x04, 0x22, 0x6d, 0x0a, 0x0b, 0x52, 0x65, 0x6c, 0x61, 0x79, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x75, 0x72, 0x6c, 0x73, 0x18, 0x01, 0x20, 0x03,
+	0x28, 0x09, 0x52, 0x04, 0x75, 0x72, 0x6c, 0x73, 0x12, 0x22, 0x0a, 0x0c, 0x74, 0x6f, 0x6b, 0x65,
+	0x6e, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c,
+	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x26, 0x0a, 0x0e,
+	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x53, 0x69, 0x67, 0x6e, 0x61,
+	0x74, 0x75, 0x72, 0x65, 0x22, 0xad, 0x02, 0x0a, 0x0a, 0x46, 0x6c, 0x6f, 0x77, 0x43, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x03, 0x75, 0x72, 0x6c, 0x12, 0x22, 0x0a, 0x0c, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x50, 0x61,
+	0x79, 0x6c, 0x6f, 0x61, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x74, 0x6f, 0x6b,
+	0x65, 0x6e, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x26, 0x0a, 0x0e, 0x74, 0x6f, 0x6b,
+	0x65, 0x6e, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0e, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72,
+	0x65, 0x12, 0x35, 0x0a, 0x08, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x08,
+	0x69, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62,
+	0x6c, 0x65, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c,
+	0x65, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x65, 0x72, 0x73, 0x18, 0x06,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x65, 0x72, 0x73, 0x12, 0x2e,
+	0x0a, 0x12, 0x65, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12, 0x65, 0x78, 0x69, 0x74,
+	0x4e, 0x6f, 0x64, 0x65, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x24,
+	0x0a, 0x0d, 0x64, 0x6e, 0x73, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18,
+	0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x64, 0x6e, 0x73, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x22, 0x29, 0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x73, 0x43,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x22,
+	0xa3, 0x01, 0x0a, 0x09, 0x4a, 0x57, 0x54, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x16, 0x0a,
+	0x06, 0x69, 0x73, 0x73, 0x75, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x69,
+	0x73, 0x73, 0x75, 0x65, 0x72, 0x12, 0x1a, 0x0a, 0x08, 0x61, 0x75, 0x64, 0x69, 0x65, 0x6e, 0x63,
+	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x61, 0x75, 0x64, 0x69, 0x65, 0x6e, 0x63,
+	0x65, 0x12, 0x22, 0x0a, 0x0c, 0x6b, 0x65, 0x79, 0x73, 0x4c, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x6b, 0x65, 0x79, 0x73, 0x4c, 0x6f, 0x63,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x20, 0x0a, 0x0b, 0x6d, 0x61, 0x78, 0x54, 0x6f, 0x6b, 0x65,
+	0x6e, 0x41, 0x67, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0b, 0x6d, 0x61, 0x78, 0x54,
+	0x6f, 0x6b, 0x65, 0x6e, 0x41, 0x67, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x61, 0x75, 0x64, 0x69, 0x65,
+	0x6e, 0x63, 0x65, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x09, 0x61, 0x75, 0x64, 0x69,
+	0x65, 0x6e, 0x63, 0x65, 0x73, 0x22, 0x7d, 0x0a, 0x13, 0x50, 0x72, 0x6f, 0x74, 0x65, 0x63, 0x74,
+	0x65, 0x64, 0x48, 0x6f, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x36, 0x0a, 0x0a,
+	0x68, 0x6f, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x48, 0x6f,
+	0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0a, 0x68, 0x6f, 0x73, 0x74, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x75, 0x73, 0x65, 0x72, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x04, 0x75, 0x73, 0x65, 0x72, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73,
+	0x77, 0x6f, 0x72, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73,
+	0x77, 0x6f, 0x72, 0x64, 0x22, 0xf2, 0x02, 0x0a, 0x0a, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x12, 0x18, 0x0a, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x10, 0x0a,
+	0x03, 0x64, 0x6e, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x64, 0x6e, 0x73, 0x12,
+	0x33, 0x0a, 0x09, 0x73, 0x73, 0x68, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x53, 0x53, 0x48, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x09, 0x73, 0x73, 0x68, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x66, 0x71, 0x64, 0x6e, 0x18, 0x04, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x04, 0x66, 0x71, 0x64, 0x6e, 0x12, 0x48, 0x0a, 0x1f, 0x52, 0x6f, 0x75, 0x74,
+	0x69, 0x6e, 0x67, 0x50, 0x65, 0x65, 0x72, 0x44, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x6f, 0x6c, 0x75,
+	0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x1f, 0x52, 0x6f, 0x75, 0x74, 0x69, 0x6e, 0x67, 0x50, 0x65, 0x65, 0x72, 0x44, 0x6e,
+	0x73, 0x52, 0x65, 0x73, 0x6f, 0x6c, 0x75, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x61, 0x62, 0x6c,
+	0x65, 0x64, 0x12, 0x34, 0x0a, 0x15, 0x4c, 0x61, 0x7a, 0x79, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x15, 0x4c, 0x61, 0x7a, 0x79, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x10, 0x0a, 0x03, 0x6d, 0x74, 0x75, 0x18,
+	0x07, 0x20, 0x01, 0x28, 0x05, 0x52, 0x03, 0x6d, 0x74, 0x75, 0x12, 0x3e, 0x0a, 0x0a, 0x61, 0x75,
+	0x74, 0x6f, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x75, 0x74, 0x6f,
+	0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x0a,
+	0x61, 0x75, 0x74, 0x6f, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x64,
+	0x64, 0x72, 0x65, 0x73, 0x73, 0x5f, 0x76, 0x36, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09,
+	0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x56, 0x36, 0x22, 0x52, 0x0a, 0x12, 0x41, 0x75, 0x74,
+	0x6f, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x12,
+	0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x22, 0x0a, 0x0c, 0x61, 0x6c, 0x77,
+	0x61, 0x79, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x0c, 0x61, 0x6c, 0x77, 0x61, 0x79, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x22, 0xec, 0x05,
+	0x0a, 0x0a, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x12, 0x16, 0x0a, 0x06,
+	0x53, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x06, 0x53, 0x65,
+	0x72, 0x69, 0x61, 0x6c, 0x12, 0x36, 0x0a, 0x0a, 0x70, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x52, 0x0a, 0x70, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x3e, 0x0a, 0x0b,
+	0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52,
+	0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52,
+	0x0b, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73, 0x12, 0x2e, 0x0a, 0x12,
+	0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73, 0x49, 0x73, 0x45, 0x6d, 0x70,
+	0x74, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65,
+	0x50, 0x65, 0x65, 0x72, 0x73, 0x49, 0x73, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x29, 0x0a, 0x06,
+	0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52,
+	0x06, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x33, 0x0a, 0x09, 0x44, 0x4e, 0x53, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x52, 0x09, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x40, 0x0a, 0x0c,
+	0x6f, 0x66, 0x66, 0x6c, 0x69, 0x6e, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73, 0x18, 0x07, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x52, 0x0c, 0x6f, 0x66, 0x66, 0x6c, 0x69, 0x6e, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73, 0x12, 0x3e,
+	0x0a, 0x0d, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x18,
+	0x08, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x52,
+	0x0d, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x12, 0x32,
+	0x0a, 0x14, 0x66, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x49,
+	0x73, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x18, 0x09, 0x20, 0x01, 0x28, 0x08, 0x52, 0x14, 0x66, 0x69,
+	0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x49, 0x73, 0x45, 0x6d, 0x70,
+	0x74, 0x79, 0x12, 0x4f, 0x0a, 0x13, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x46, 0x69, 0x72, 0x65,
+	0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x6f, 0x75,
+	0x74, 0x65, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x52, 0x13,
+	0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75,
+	0x6c, 0x65, 0x73, 0x12, 0x3e, 0x0a, 0x1a, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x46, 0x69, 0x72,
+	0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x49, 0x73, 0x45, 0x6d, 0x70, 0x74,
+	0x79, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x52, 0x1a, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x46,
+	0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x49, 0x73, 0x45, 0x6d,
+	0x70, 0x74, 0x79, 0x12, 0x48, 0x0a, 0x0f, 0x66, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e,
+	0x67, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x18, 0x0c, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72,
+	0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x42, 0x02, 0x18, 0x01, 0x52, 0x0f, 0x66, 0x6f,
+	0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x12, 0x2d, 0x0a,
+	0x07, 0x73, 0x73, 0x68, 0x41, 0x75, 0x74, 0x68, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x13,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x53, 0x48, 0x41,
+	0x75, 0x74, 0x68, 0x52, 0x07, 0x73, 0x73, 0x68, 0x41, 0x75, 0x74, 0x68, 0x22, 0x82, 0x02, 0x0a,
+	0x07, 0x53, 0x53, 0x48, 0x41, 0x75, 0x74, 0x68, 0x12, 0x20, 0x0a, 0x0b, 0x55, 0x73, 0x65, 0x72,
+	0x49, 0x44, 0x43, 0x6c, 0x61, 0x69, 0x6d, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x55,
+	0x73, 0x65, 0x72, 0x49, 0x44, 0x43, 0x6c, 0x61, 0x69, 0x6d, 0x12, 0x28, 0x0a, 0x0f, 0x41, 0x75,
+	0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x55, 0x73, 0x65, 0x72, 0x73, 0x18, 0x02, 0x20,
+	0x03, 0x28, 0x0c, 0x52, 0x0f, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x55,
+	0x73, 0x65, 0x72, 0x73, 0x12, 0x4a, 0x0a, 0x0d, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f,
+	0x75, 0x73, 0x65, 0x72, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x6d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x53, 0x48, 0x41, 0x75, 0x74, 0x68,
+	0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x55, 0x73, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74,
+	0x72, 0x79, 0x52, 0x0c, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x55, 0x73, 0x65, 0x72, 0x73,
+	0x1a, 0x5f, 0x0a, 0x11, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x55, 0x73, 0x65, 0x72, 0x73,
+	0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x34, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x55, 0x73, 0x65, 0x72, 0x49,
+	0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38,
+	0x01, 0x22, 0x2e, 0x0a, 0x12, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x55, 0x73, 0x65, 0x72,
+	0x49, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x69, 0x6e, 0x64, 0x65, 0x78,
+	0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0d, 0x52, 0x07, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x65,
+	0x73, 0x22, 0xf0, 0x01, 0x0a, 0x10, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72,
+	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x1a, 0x0a, 0x08, 0x77, 0x67, 0x50, 0x75, 0x62, 0x4b,
+	0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x77, 0x67, 0x50, 0x75, 0x62, 0x4b,
+	0x65, 0x79, 0x12, 0x1e, 0x0a, 0x0a, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x49, 0x70, 0x73,
+	0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0a, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x49,
+	0x70, 0x73, 0x12, 0x33, 0x0a, 0x09, 0x73, 0x73, 0x68, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x53, 0x53, 0x48, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x09, 0x73, 0x73,
+	0x68, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x66, 0x71, 0x64, 0x6e, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x66, 0x71, 0x64, 0x6e, 0x12, 0x22, 0x0a, 0x0c, 0x61,
+	0x67, 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0c, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12,
+	0x33, 0x0a, 0x09, 0x6c, 0x61, 0x7a, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x18, 0x06, 0x20, 0x01,
+	0x28, 0x0e, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x4c, 0x61, 0x7a, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x09, 0x6c, 0x61, 0x7a, 0x79, 0x53,
+	0x74, 0x61, 0x74, 0x65, 0x22, 0x7e, 0x0a, 0x09, 0x53, 0x53, 0x48, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x12, 0x1e, 0x0a, 0x0a, 0x73, 0x73, 0x68, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x73, 0x73, 0x68, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65,
+	0x64, 0x12, 0x1c, 0x0a, 0x09, 0x73, 0x73, 0x68, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x73, 0x73, 0x68, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x12,
+	0x33, 0x0a, 0x09, 0x6a, 0x77, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x4a, 0x57, 0x54, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x09, 0x6a, 0x77, 0x74, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x22, 0x20, 0x0a, 0x1e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75,
+	0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0xbf, 0x01, 0x0a, 0x17, 0x44, 0x65, 0x76, 0x69, 0x63,
+	0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c,
+	0x6f, 0x77, 0x12, 0x48, 0x0a, 0x08, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x0e, 0x32, 0x2c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64,
+	0x65, 0x72, 0x52, 0x08, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x12, 0x42, 0x0a, 0x0e,
+	0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x52, 0x0e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x22, 0x16, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x12, 0x0a, 0x0a, 0x06,
+	0x48, 0x4f, 0x53, 0x54, 0x45, 0x44, 0x10, 0x00, 0x22, 0x44, 0x0a, 0x1c, 0x50, 0x4b, 0x43, 0x45,
+	0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f,
+	0x77, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x24, 0x0a, 0x0d, 0x53, 0x65, 0x73, 0x73,
+	0x69, 0x6f, 0x6e, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x0d, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x64, 0x22, 0x5b,
+	0x0a, 0x15, 0x50, 0x4b, 0x43, 0x45, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x12, 0x42, 0x0a, 0x0e, 0x50, 0x72, 0x6f, 0x76, 0x69,
+	0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f,
+	0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0e, 0x50, 0x72, 0x6f,
+	0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0xbc, 0x03, 0x0a, 0x0e,
+	0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x1a,
+	0x0a, 0x08, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49, 0x44, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x08, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49, 0x44, 0x12, 0x26, 0x0a, 0x0c, 0x43, 0x6c,
+	0x69, 0x65, 0x6e, 0x74, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x42, 0x02, 0x18, 0x01, 0x52, 0x0c, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x53, 0x65, 0x63, 0x72,
+	0x65, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x41, 0x75,
+	0x64, 0x69, 0x65, 0x6e, 0x63, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x41, 0x75,
+	0x64, 0x69, 0x65, 0x6e, 0x63, 0x65, 0x12, 0x2e, 0x0a, 0x12, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65,
+	0x41, 0x75, 0x74, 0x68, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x05, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x12, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x45, 0x6e,
+	0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x24, 0x0a, 0x0d, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x45,
+	0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x54,
+	0x6f, 0x6b, 0x65, 0x6e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x14, 0x0a, 0x05,
+	0x53, 0x63, 0x6f, 0x70, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x53, 0x63, 0x6f,
+	0x70, 0x65, 0x12, 0x1e, 0x0a, 0x0a, 0x55, 0x73, 0x65, 0x49, 0x44, 0x54, 0x6f, 0x6b, 0x65, 0x6e,
+	0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x55, 0x73, 0x65, 0x49, 0x44, 0x54, 0x6f, 0x6b,
+	0x65, 0x6e, 0x12, 0x34, 0x0a, 0x15, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x09, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x15, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x22, 0x0a, 0x0c, 0x52, 0x65, 0x64, 0x69,
+	0x72, 0x65, 0x63, 0x74, 0x55, 0x52, 0x4c, 0x73, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c,
+	0x52, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x55, 0x52, 0x4c, 0x73, 0x12, 0x2e, 0x0a, 0x12,
+	0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x4c, 0x6f, 0x67,
+	0x69, 0x6e, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c,
+	0x65, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x1c, 0x0a, 0x09,
+	0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x46, 0x6c, 0x61, 0x67, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0d, 0x52,
+	0x09, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x46, 0x6c, 0x61, 0x67, 0x22, 0x93, 0x02, 0x0a, 0x05, 0x52,
+	0x6f, 0x75, 0x74, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x49, 0x44, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x02, 0x49, 0x44, 0x12, 0x18, 0x0a, 0x07, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x12, 0x20,
+	0x0a, 0x0b, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x54, 0x79, 0x70, 0x65, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x03, 0x52, 0x0b, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x54, 0x79, 0x70, 0x65,
+	0x12, 0x12, 0x0a, 0x04, 0x50, 0x65, 0x65, 0x72, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
+	0x50, 0x65, 0x65, 0x72, 0x12, 0x16, 0x0a, 0x06, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x18, 0x05,
+	0x20, 0x01, 0x28, 0x03, 0x52, 0x06, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x12, 0x1e, 0x0a, 0x0a,
+	0x4d, 0x61, 0x73, 0x71, 0x75, 0x65, 0x72, 0x61, 0x64, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x0a, 0x4d, 0x61, 0x73, 0x71, 0x75, 0x65, 0x72, 0x61, 0x64, 0x65, 0x12, 0x14, 0x0a, 0x05,
+	0x4e, 0x65, 0x74, 0x49, 0x44, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x4e, 0x65, 0x74,
+	0x49, 0x44, 0x12, 0x18, 0x0a, 0x07, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x08, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x07, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x1c, 0x0a, 0x09,
+	0x6b, 0x65, 0x65, 0x70, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x18, 0x09, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x09, 0x6b, 0x65, 0x65, 0x70, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x12, 0x24, 0x0a, 0x0d, 0x73, 0x6b,
+	0x69, 0x70, 0x41, 0x75, 0x74, 0x6f, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x18, 0x0a, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x0d, 0x73, 0x6b, 0x69, 0x70, 0x41, 0x75, 0x74, 0x6f, 0x41, 0x70, 0x70, 0x6c, 0x79,
+	0x22, 0xde, 0x01, 0x0a, 0x09, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x24,
+	0x0a, 0x0d, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x45, 0x6e,
+	0x61, 0x62, 0x6c, 0x65, 0x12, 0x47, 0x0a, 0x10, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76,
+	0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1b,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x61, 0x6d, 0x65,
+	0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x52, 0x10, 0x4e, 0x61, 0x6d,
+	0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x38, 0x0a,
+	0x0b, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x52, 0x0b, 0x43, 0x75, 0x73, 0x74,
+	0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x73, 0x12, 0x28, 0x0a, 0x0d, 0x46, 0x6f, 0x72, 0x77, 0x61,
+	0x72, 0x64, 0x65, 0x72, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x42, 0x02,
+	0x18, 0x01, 0x52, 0x0d, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x50, 0x6f, 0x72,
+	0x74, 0x22, 0xb8, 0x01, 0x0a, 0x0a, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65,
+	0x12, 0x16, 0x0a, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x32, 0x0a, 0x07, 0x52, 0x65, 0x63, 0x6f,
+	0x72, 0x64, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x69, 0x6d, 0x70, 0x6c, 0x65, 0x52, 0x65, 0x63,
+	0x6f, 0x72, 0x64, 0x52, 0x07, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x12, 0x32, 0x0a, 0x14,
 	0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x44, 0x69, 0x73, 0x61,
-	0x62, 0x6c, 0x65, 0x64, 0x12, 0x2a, 0x0a, 0x10, 0x4e, 0x6f, 0x6e, 0x41, 0x75, 0x74, 0x68, 0x6f,
-	0x72, 0x69, 0x74, 0x61, 0x74, 0x69, 0x76, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10,
-	0x4e, 0x6f, 0x6e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x61, 0x74, 0x69, 0x76, 0x65,
-	0x22, 0x74, 0x0a, 0x0c, 0x53, 0x69, 0x6d, 0x70, 0x6c, 0x65, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64,
-	0x12, 0x12, 0x0a, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
-	0x4e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x54, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x03, 0x52, 0x04, 0x54, 0x79, 0x70, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x43, 0x6c, 0x61, 0x73,
-	0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x12, 0x10,
-	0x0a, 0x03, 0x54, 0x54, 0x4c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x03, 0x54, 0x54, 0x4c,
-	0x12, 0x14, 0x0a, 0x05, 0x52, 0x44, 0x61, 0x74, 0x61, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x05, 0x52, 0x44, 0x61, 0x74, 0x61, 0x22, 0xb3, 0x01, 0x0a, 0x0f, 0x4e, 0x61, 0x6d, 0x65, 0x53,
-	0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x38, 0x0a, 0x0b, 0x4e, 0x61,
-	0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
-	0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x61, 0x6d,
-	0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x0b, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72,
-	0x76, 0x65, 0x72, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x50, 0x72, 0x69, 0x6d, 0x61, 0x72, 0x79, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x50, 0x72, 0x69, 0x6d, 0x61, 0x72, 0x79, 0x12, 0x18,
-	0x0a, 0x07, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52,
-	0x07, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x32, 0x0a, 0x14, 0x53, 0x65, 0x61, 0x72,
-	0x63, 0x68, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64,
-	0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x14, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x44, 0x6f,
-	0x6d, 0x61, 0x69, 0x6e, 0x73, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x22, 0x48, 0x0a, 0x0a,
-	0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x12, 0x0e, 0x0a, 0x02, 0x49, 0x50,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x49, 0x50, 0x12, 0x16, 0x0a, 0x06, 0x4e, 0x53,
-	0x54, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x06, 0x4e, 0x53, 0x54, 0x79,
-	0x70, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03,
-	0x52, 0x04, 0x50, 0x6f, 0x72, 0x74, 0x22, 0xfb, 0x02, 0x0a, 0x0c, 0x46, 0x69, 0x72, 0x65, 0x77,
-	0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x12, 0x1a, 0x0a, 0x06, 0x50, 0x65, 0x65, 0x72, 0x49,
-	0x50, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x02, 0x18, 0x01, 0x52, 0x06, 0x50, 0x65, 0x65,
-	0x72, 0x49, 0x50, 0x12, 0x37, 0x0a, 0x09, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x19, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x52, 0x09, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x2e, 0x0a, 0x06,
-	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x16, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x41, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x34, 0x0a, 0x08,
-	0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x18,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65,
-	0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63,
-	0x6f, 0x6c, 0x12, 0x12, 0x0a, 0x04, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x04, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x30, 0x0a, 0x08, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e,
-	0x66, 0x6f, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x08,
-	0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x1a, 0x0a, 0x08, 0x50, 0x6f, 0x6c, 0x69,
-	0x63, 0x79, 0x49, 0x44, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x50, 0x6f, 0x6c, 0x69,
-	0x63, 0x79, 0x49, 0x44, 0x12, 0x26, 0x0a, 0x0e, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x50, 0x72,
-	0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0e, 0x63, 0x75,
-	0x73, 0x74, 0x6f, 0x6d, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x26, 0x0a, 0x0e,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x65, 0x73, 0x18, 0x09,
-	0x20, 0x03, 0x28, 0x0c, 0x52, 0x0e, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x72, 0x65, 0x66,
-	0x69, 0x78, 0x65, 0x73, 0x22, 0x38, 0x0a, 0x0e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x41,
-	0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x14, 0x0a, 0x05, 0x6e, 0x65, 0x74, 0x49, 0x50, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6e, 0x65, 0x74, 0x49, 0x50, 0x12, 0x10, 0x0a, 0x03,
-	0x6d, 0x61, 0x63, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6d, 0x61, 0x63, 0x22, 0x1e,
-	0x0a, 0x06, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x73, 0x12, 0x14, 0x0a, 0x05, 0x46, 0x69, 0x6c, 0x65,
-	0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x05, 0x46, 0x69, 0x6c, 0x65, 0x73, 0x22, 0x96,
-	0x01, 0x0a, 0x08, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x14, 0x0a, 0x04, 0x70,
-	0x6f, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x48, 0x00, 0x52, 0x04, 0x70, 0x6f, 0x72,
-	0x74, 0x12, 0x32, 0x0a, 0x05, 0x72, 0x61, 0x6e, 0x67, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f,
-	0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x2e, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x48, 0x00, 0x52, 0x05,
-	0x72, 0x61, 0x6e, 0x67, 0x65, 0x1a, 0x2f, 0x0a, 0x05, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x14,
-	0x0a, 0x05, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x05, 0x73,
-	0x74, 0x61, 0x72, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x0d, 0x52, 0x03, 0x65, 0x6e, 0x64, 0x42, 0x0f, 0x0a, 0x0d, 0x70, 0x6f, 0x72, 0x74, 0x53, 0x65,
-	0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x87, 0x03, 0x0a, 0x11, 0x52, 0x6f, 0x75, 0x74,
-	0x65, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x12, 0x22, 0x0a,
-	0x0c, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x18, 0x01, 0x20,
-	0x03, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x61, 0x6e, 0x67, 0x65,
-	0x73, 0x12, 0x2e, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x0e, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52,
-	0x75, 0x6c, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74,
-	0x69, 0x6f, 0x6e, 0x12, 0x34, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18,
-	0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52,
-	0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x30, 0x0a, 0x08, 0x70, 0x6f, 0x72,
-	0x74, 0x49, 0x6e, 0x66, 0x6f, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66,
-	0x6f, 0x52, 0x08, 0x70, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x1c, 0x0a, 0x09, 0x69,
-	0x73, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09,
-	0x69, 0x73, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x12, 0x18, 0x0a, 0x07, 0x64, 0x6f, 0x6d,
-	0x61, 0x69, 0x6e, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x64, 0x6f, 0x6d, 0x61,
-	0x69, 0x6e, 0x73, 0x12, 0x26, 0x0a, 0x0e, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x50, 0x72, 0x6f,
-	0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0e, 0x63, 0x75, 0x73,
-	0x74, 0x6f, 0x6d, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x1a, 0x0a, 0x08, 0x50,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x44, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x50,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x44, 0x12, 0x18, 0x0a, 0x07, 0x52, 0x6f, 0x75, 0x74, 0x65,
-	0x49, 0x44, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x49,
-	0x44, 0x22, 0xf6, 0x01, 0x0a, 0x0e, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67,
-	0x52, 0x75, 0x6c, 0x65, 0x12, 0x34, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c,
-	0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x3e, 0x0a, 0x0f, 0x64, 0x65,
-	0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x0f, 0x64, 0x65, 0x73, 0x74, 0x69,
-	0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x2c, 0x0a, 0x11, 0x74, 0x72,
-	0x61, 0x6e, 0x73, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x11, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x6c, 0x61, 0x74, 0x65,
-	0x64, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x3c, 0x0a, 0x0e, 0x74, 0x72, 0x61, 0x6e,
-	0x73, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f,
-	0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x0e, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x6c, 0x61, 0x74,
-	0x65, 0x64, 0x50, 0x6f, 0x72, 0x74, 0x3a, 0x02, 0x18, 0x01, 0x22, 0x8b, 0x02, 0x0a, 0x14, 0x45,
-	0x78, 0x70, 0x6f, 0x73, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x0d, 0x52, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x36, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x63, 0x6f, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x50, 0x72, 0x6f,
-	0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12,
-	0x10, 0x0a, 0x03, 0x70, 0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x70, 0x69,
-	0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x04, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x1f, 0x0a,
-	0x0b, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x05, 0x20, 0x03,
-	0x28, 0x09, 0x52, 0x0a, 0x75, 0x73, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x16,
-	0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06,
-	0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x1f, 0x0a, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x70,
-	0x72, 0x65, 0x66, 0x69, 0x78, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6e, 0x61, 0x6d,
-	0x65, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x12, 0x1f, 0x0a, 0x0b, 0x6c, 0x69, 0x73, 0x74, 0x65,
-	0x6e, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0a, 0x6c, 0x69,
-	0x73, 0x74, 0x65, 0x6e, 0x50, 0x6f, 0x72, 0x74, 0x22, 0xa1, 0x01, 0x0a, 0x15, 0x45, 0x78, 0x70,
-	0x6f, 0x73, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x6e, 0x61,
-	0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63,
-	0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
-	0x5f, 0x75, 0x72, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x73, 0x65, 0x72, 0x76,
-	0x69, 0x63, 0x65, 0x55, 0x72, 0x6c, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x2c,
-	0x0a, 0x12, 0x70, 0x6f, 0x72, 0x74, 0x5f, 0x61, 0x75, 0x74, 0x6f, 0x5f, 0x61, 0x73, 0x73, 0x69,
-	0x67, 0x6e, 0x65, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x70, 0x6f, 0x72, 0x74,
-	0x41, 0x75, 0x74, 0x6f, 0x41, 0x73, 0x73, 0x69, 0x67, 0x6e, 0x65, 0x64, 0x22, 0x2c, 0x0a, 0x12,
-	0x52, 0x65, 0x6e, 0x65, 0x77, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x22, 0x15, 0x0a, 0x13, 0x52, 0x65,
-	0x6e, 0x65, 0x77, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x22, 0x2b, 0x0a, 0x11, 0x53, 0x74, 0x6f, 0x70, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x22, 0x14,
-	0x0a, 0x12, 0x53, 0x74, 0x6f, 0x70, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x9a, 0x01, 0x0a, 0x12, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
-	0x4d, 0x61, 0x70, 0x45, 0x6e, 0x76, 0x65, 0x6c, 0x6f, 0x70, 0x65, 0x12, 0x3a, 0x0a, 0x04, 0x66,
-	0x75, 0x6c, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61,
-	0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x48,
-	0x00, 0x52, 0x04, 0x66, 0x75, 0x6c, 0x6c, 0x12, 0x3d, 0x0a, 0x05, 0x64, 0x65, 0x6c, 0x74, 0x61,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f,
-	0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x44, 0x65, 0x6c, 0x74, 0x61, 0x48, 0x00, 0x52,
-	0x05, 0x64, 0x65, 0x6c, 0x74, 0x61, 0x42, 0x09, 0x0a, 0x07, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61,
-	0x64, 0x22, 0x96, 0x0f, 0x0a, 0x18, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70,
-	0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x12, 0x16,
-	0x0a, 0x06, 0x73, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x06,
-	0x73, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x12, 0x37, 0x0a, 0x0b, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x63,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x52, 0x0a, 0x70, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12,
-	0x34, 0x0a, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63,
-	0x63, 0x6f, 0x75, 0x6e, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x07, 0x6e, 0x65,
-	0x74, 0x77, 0x6f, 0x72, 0x6b, 0x12, 0x4d, 0x0a, 0x10, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74,
-	0x5f, 0x73, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63,
-	0x6f, 0x75, 0x6e, 0x74, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x43, 0x6f, 0x6d, 0x70,
-	0x61, 0x63, 0x74, 0x52, 0x0f, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x53, 0x65, 0x74, 0x74,
-	0x69, 0x6e, 0x67, 0x73, 0x12, 0x41, 0x0a, 0x0c, 0x64, 0x6e, 0x73, 0x5f, 0x73, 0x65, 0x74, 0x74,
-	0x69, 0x6e, 0x67, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x44, 0x4e, 0x53, 0x53, 0x65, 0x74, 0x74, 0x69,
-	0x6e, 0x67, 0x73, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x0b, 0x64, 0x6e, 0x73, 0x53,
-	0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x64, 0x6e, 0x73, 0x5f, 0x64,
-	0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x64, 0x6e, 0x73,
-	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x2c, 0x0a, 0x12, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d,
-	0x5f, 0x7a, 0x6f, 0x6e, 0x65, 0x5f, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x07, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x10, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x44, 0x6f,
-	0x6d, 0x61, 0x69, 0x6e, 0x12, 0x25, 0x0a, 0x0e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x5f, 0x76, 0x65,
-	0x72, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0d, 0x61, 0x67,
-	0x65, 0x6e, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x2d, 0x0a, 0x05, 0x70,
-	0x65, 0x65, 0x72, 0x73, 0x18, 0x09, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6d, 0x70,
-	0x61, 0x63, 0x74, 0x52, 0x05, 0x70, 0x65, 0x65, 0x72, 0x73, 0x12, 0x2e, 0x0a, 0x13, 0x72, 0x6f,
-	0x75, 0x74, 0x65, 0x72, 0x5f, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x65,
-	0x73, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x0d, 0x52, 0x11, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x50,
-	0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x12, 0x35, 0x0a, 0x08, 0x70, 0x6f,
-	0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x18, 0x0b, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x08, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65,
-	0x73, 0x12, 0x30, 0x0a, 0x06, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x0c, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x47,
-	0x72, 0x6f, 0x75, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x06, 0x67, 0x72, 0x6f,
-	0x75, 0x70, 0x73, 0x12, 0x2c, 0x0a, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x0d, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x61, 0x77, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65,
-	0x73, 0x12, 0x4b, 0x0a, 0x11, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f,
-	0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x0e, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65,
-	0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x52, 0x61, 0x77, 0x52, 0x10, 0x6e, 0x61,
-	0x6d, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x40,
-	0x0a, 0x0f, 0x61, 0x6c, 0x6c, 0x5f, 0x64, 0x6e, 0x73, 0x5f, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64,
-	0x73, 0x18, 0x0f, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x69, 0x6d, 0x70, 0x6c, 0x65, 0x52, 0x65, 0x63, 0x6f, 0x72,
-	0x64, 0x52, 0x0d, 0x61, 0x6c, 0x6c, 0x44, 0x6e, 0x73, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73,
-	0x12, 0x3b, 0x0a, 0x0d, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x7a, 0x6f, 0x6e, 0x65,
-	0x73, 0x18, 0x10, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x52,
-	0x0c, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5a, 0x6f, 0x6e, 0x65, 0x73, 0x12, 0x4b, 0x0a,
-	0x11, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x73, 0x18, 0x11, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x61, 0x77, 0x52, 0x10, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72,
-	0x6b, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x55, 0x0a, 0x0b, 0x72, 0x6f,
-	0x75, 0x74, 0x65, 0x72, 0x73, 0x5f, 0x6d, 0x61, 0x70, 0x18, 0x12, 0x20, 0x03, 0x28, 0x0b, 0x32,
-	0x34, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74,
-	0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74,
-	0x73, 0x46, 0x75, 0x6c, 0x6c, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x73, 0x4d, 0x61, 0x70,
-	0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0a, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x73, 0x4d, 0x61,
-	0x70, 0x12, 0x71, 0x0a, 0x15, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x70, 0x6f,
-	0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x5f, 0x6d, 0x61, 0x70, 0x18, 0x13, 0x20, 0x03, 0x28, 0x0b,
-	0x32, 0x3d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65,
-	0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e,
-	0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50,
-	0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52,
-	0x13, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65,
-	0x73, 0x4d, 0x61, 0x70, 0x12, 0x6a, 0x0a, 0x14, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64,
-	0x5f, 0x74, 0x6f, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x14, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x3a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e,
-	0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x2e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64,
-	0x54, 0x6f, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x10,
-	0x67, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x54, 0x6f, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x73,
-	0x12, 0x28, 0x0a, 0x10, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x5f, 0x75, 0x73, 0x65, 0x72,
-	0x5f, 0x69, 0x64, 0x73, 0x18, 0x15, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x61, 0x6c, 0x6c, 0x6f,
-	0x77, 0x65, 0x64, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x73, 0x12, 0x6e, 0x0a, 0x14, 0x70, 0x6f,
-	0x73, 0x74, 0x75, 0x72, 0x65, 0x5f, 0x66, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x5f, 0x70, 0x65, 0x65,
-	0x72, 0x73, 0x18, 0x16, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x3c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70,
-	0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x2e, 0x50,
-	0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x46, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72,
-	0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x12, 0x70, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x46,
-	0x61, 0x69, 0x6c, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x73, 0x12, 0x2c, 0x0a, 0x12, 0x64, 0x6e,
-	0x73, 0x5f, 0x66, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x5f, 0x70, 0x6f, 0x72, 0x74,
-	0x18, 0x17, 0x20, 0x01, 0x28, 0x03, 0x52, 0x10, 0x64, 0x6e, 0x73, 0x46, 0x6f, 0x72, 0x77, 0x61,
-	0x72, 0x64, 0x65, 0x72, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x3b, 0x0a, 0x0b, 0x70, 0x72, 0x6f, 0x78,
-	0x79, 0x5f, 0x70, 0x61, 0x74, 0x63, 0x68, 0x18, 0x18, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79,
-	0x50, 0x61, 0x74, 0x63, 0x68, 0x42, 0x02, 0x18, 0x01, 0x52, 0x0a, 0x70, 0x72, 0x6f, 0x78, 0x79,
-	0x50, 0x61, 0x74, 0x63, 0x68, 0x12, 0x22, 0x0a, 0x0d, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64,
-	0x5f, 0x63, 0x6c, 0x61, 0x69, 0x6d, 0x18, 0x19, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x75, 0x73,
-	0x65, 0x72, 0x49, 0x64, 0x43, 0x6c, 0x61, 0x69, 0x6d, 0x1a, 0x5c, 0x0a, 0x0f, 0x52, 0x6f, 0x75,
-	0x74, 0x65, 0x72, 0x73, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03,
-	0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x33,
-	0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f,
-	0x72, 0x6b, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x05, 0x76, 0x61,
-	0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x5d, 0x0a, 0x18, 0x52, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x4d, 0x61, 0x70, 0x45, 0x6e,
-	0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x2b, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
-	0x74, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x64, 0x73, 0x52, 0x05, 0x76, 0x61, 0x6c,
-	0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x5b, 0x0a, 0x15, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49,
-	0x64, 0x54, 0x6f, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12,
-	0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65,
-	0x79, 0x12, 0x2c, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x55, 0x73,
-	0x65, 0x72, 0x49, 0x44, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a,
-	0x02, 0x38, 0x01, 0x1a, 0x5f, 0x0a, 0x17, 0x50, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x46, 0x61,
-	0x69, 0x6c, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10,
-	0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79,
-	0x12, 0x2e, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65,
-	0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x53, 0x65, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
-	0x3a, 0x02, 0x38, 0x01, 0x4a, 0x04, 0x08, 0x1a, 0x10, 0x33, 0x22, 0x8b, 0x03, 0x0a, 0x0a, 0x50,
-	0x72, 0x6f, 0x78, 0x79, 0x50, 0x61, 0x74, 0x63, 0x68, 0x12, 0x32, 0x0a, 0x05, 0x70, 0x65, 0x65,
-	0x72, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72,
-	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x05, 0x70, 0x65, 0x65, 0x72, 0x73, 0x12, 0x41, 0x0a,
-	0x0d, 0x6f, 0x66, 0x66, 0x6c, 0x69, 0x6e, 0x65, 0x5f, 0x70, 0x65, 0x65, 0x72, 0x73, 0x18, 0x02,
-	0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
-	0x74, 0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66,
-	0x69, 0x67, 0x52, 0x0c, 0x6f, 0x66, 0x66, 0x6c, 0x69, 0x6e, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73,
-	0x12, 0x3f, 0x0a, 0x0e, 0x66, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x5f, 0x72, 0x75, 0x6c,
-	0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75,
-	0x6c, 0x65, 0x52, 0x0d, 0x66, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65,
-	0x73, 0x12, 0x29, 0x0a, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52,
-	0x6f, 0x75, 0x74, 0x65, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x4f, 0x0a, 0x14,
-	0x72, 0x6f, 0x75, 0x74, 0x65, 0x5f, 0x66, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x5f, 0x72,
-	0x75, 0x6c, 0x65, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x46, 0x69, 0x72,
-	0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x52, 0x12, 0x72, 0x6f, 0x75, 0x74, 0x65,
-	0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x12, 0x45, 0x0a,
-	0x10, 0x66, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x5f, 0x72, 0x75, 0x6c, 0x65,
-	0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52,
-	0x75, 0x6c, 0x65, 0x52, 0x0f, 0x66, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52,
-	0x75, 0x6c, 0x65, 0x73, 0x3a, 0x02, 0x18, 0x01, 0x22, 0x94, 0x01, 0x0a, 0x16, 0x41, 0x63, 0x63,
-	0x6f, 0x75, 0x6e, 0x74, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x43, 0x6f, 0x6d, 0x70,
-	0x61, 0x63, 0x74, 0x12, 0x41, 0x0a, 0x1d, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x6c, 0x6f, 0x67, 0x69,
-	0x6e, 0x5f, 0x65, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x6e, 0x61,
-	0x62, 0x6c, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x1a, 0x70, 0x65, 0x65, 0x72,
-	0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45,
-	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x37, 0x0a, 0x18, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x6c,
-	0x6f, 0x67, 0x69, 0x6e, 0x5f, 0x65, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f,
-	0x6e, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x15, 0x70, 0x65, 0x65, 0x72, 0x4c, 0x6f,
-	0x67, 0x69, 0x6e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4e, 0x73, 0x22,
-	0x95, 0x01, 0x0a, 0x0e, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f,
-	0x72, 0x6b, 0x12, 0x1e, 0x0a, 0x0a, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69,
-	0x65, 0x72, 0x12, 0x19, 0x0a, 0x08, 0x6e, 0x65, 0x74, 0x5f, 0x63, 0x69, 0x64, 0x72, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6e, 0x65, 0x74, 0x43, 0x69, 0x64, 0x72, 0x12, 0x1e, 0x0a,
-	0x0b, 0x6e, 0x65, 0x74, 0x5f, 0x76, 0x36, 0x5f, 0x63, 0x69, 0x64, 0x72, 0x18, 0x03, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x09, 0x6e, 0x65, 0x74, 0x56, 0x36, 0x43, 0x69, 0x64, 0x72, 0x12, 0x10, 0x0a,
-	0x03, 0x64, 0x6e, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x64, 0x6e, 0x73, 0x12,
-	0x16, 0x0a, 0x06, 0x73, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x04, 0x52,
-	0x06, 0x73, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x22, 0x21, 0x0a, 0x19, 0x4e, 0x65, 0x74, 0x77, 0x6f,
-	0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x44,
-	0x65, 0x6c, 0x74, 0x61, 0x4a, 0x04, 0x08, 0x01, 0x10, 0x65, 0x22, 0xa2, 0x04, 0x0a, 0x0b, 0x50,
-	0x65, 0x65, 0x72, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x12, 0x1c, 0x0a, 0x0a, 0x77, 0x67,
-	0x5f, 0x70, 0x75, 0x62, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08,
-	0x77, 0x67, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x70, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x0c, 0x52, 0x02, 0x69, 0x70, 0x12, 0x12, 0x0a, 0x04, 0x69, 0x70, 0x76, 0x36,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x69, 0x70, 0x76, 0x36, 0x12, 0x1e, 0x0a, 0x0b,
-	0x73, 0x73, 0x68, 0x5f, 0x70, 0x75, 0x62, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28,
-	0x0c, 0x52, 0x09, 0x73, 0x73, 0x68, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x12, 0x1b, 0x0a, 0x09,
-	0x64, 0x6e, 0x73, 0x5f, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x08, 0x64, 0x6e, 0x73, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x12, 0x23, 0x0a, 0x0d, 0x61, 0x67, 0x65,
-	0x6e, 0x74, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x0c, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x2f,
-	0x0a, 0x14, 0x61, 0x64, 0x64, 0x65, 0x64, 0x5f, 0x77, 0x69, 0x74, 0x68, 0x5f, 0x73, 0x73, 0x6f,
-	0x5f, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x11, 0x61, 0x64,
-	0x64, 0x65, 0x64, 0x57, 0x69, 0x74, 0x68, 0x53, 0x73, 0x6f, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x12,
-	0x38, 0x0a, 0x18, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x5f, 0x65, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74,
-	0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x08, 0x20, 0x01, 0x28,
-	0x08, 0x52, 0x16, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x2f, 0x0a, 0x14, 0x6c, 0x61, 0x73,
-	0x74, 0x5f, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x5f, 0x75, 0x6e, 0x69, 0x78, 0x5f, 0x6e, 0x61, 0x6e,
-	0x6f, 0x18, 0x09, 0x20, 0x01, 0x28, 0x03, 0x52, 0x11, 0x6c, 0x61, 0x73, 0x74, 0x4c, 0x6f, 0x67,
-	0x69, 0x6e, 0x55, 0x6e, 0x69, 0x78, 0x4e, 0x61, 0x6e, 0x6f, 0x12, 0x1f, 0x0a, 0x0b, 0x73, 0x73,
-	0x68, 0x5f, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x0a, 0x73, 0x73, 0x68, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x23, 0x0a, 0x0d, 0x73,
-	0x75, 0x70, 0x70, 0x6f, 0x72, 0x74, 0x73, 0x5f, 0x69, 0x70, 0x76, 0x36, 0x18, 0x0b, 0x20, 0x01,
-	0x28, 0x08, 0x52, 0x0c, 0x73, 0x75, 0x70, 0x70, 0x6f, 0x72, 0x74, 0x73, 0x49, 0x70, 0x76, 0x36,
-	0x12, 0x38, 0x0a, 0x18, 0x73, 0x75, 0x70, 0x70, 0x6f, 0x72, 0x74, 0x73, 0x5f, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x5f, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x65, 0x73, 0x18, 0x0c, 0x20, 0x01,
-	0x28, 0x08, 0x52, 0x16, 0x73, 0x75, 0x70, 0x70, 0x6f, 0x72, 0x74, 0x73, 0x53, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x65, 0x73, 0x12, 0x2c, 0x0a, 0x12, 0x73, 0x65,
-	0x72, 0x76, 0x65, 0x72, 0x5f, 0x73, 0x73, 0x68, 0x5f, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64,
-	0x18, 0x0d, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x53, 0x73,
-	0x68, 0x41, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x12, 0x25, 0x0a, 0x0e, 0x70, 0x72, 0x6f, 0x78,
-	0x79, 0x5f, 0x65, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x65, 0x64, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x08,
-	0x52, 0x0d, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x45, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x65, 0x64, 0x22,
-	0x91, 0x06, 0x0a, 0x0d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63,
-	0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69,
-	0x64, 0x12, 0x2e, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x0e, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52,
-	0x75, 0x6c, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x12, 0x34, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x03, 0x20,
+	0x62, 0x6c, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x14, 0x53, 0x65, 0x61, 0x72,
+	0x63, 0x68, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x64,
+	0x12, 0x2a, 0x0a, 0x10, 0x4e, 0x6f, 0x6e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x61,
+	0x74, 0x69, 0x76, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x4e, 0x6f, 0x6e, 0x41,
+	0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x61, 0x74, 0x69, 0x76, 0x65, 0x22, 0x74, 0x0a, 0x0c,
+	0x53, 0x69, 0x6d, 0x70, 0x6c, 0x65, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x12, 0x12, 0x0a, 0x04,
+	0x4e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x4e, 0x61, 0x6d, 0x65,
+	0x12, 0x12, 0x0a, 0x04, 0x54, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x04,
+	0x54, 0x79, 0x70, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x05, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x12, 0x10, 0x0a, 0x03, 0x54, 0x54,
+	0x4c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x03, 0x54, 0x54, 0x4c, 0x12, 0x14, 0x0a, 0x05,
+	0x52, 0x44, 0x61, 0x74, 0x61, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x52, 0x44, 0x61,
+	0x74, 0x61, 0x22, 0xb3, 0x01, 0x0a, 0x0f, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65,
+	0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x38, 0x0a, 0x0b, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72,
+	0x76, 0x65, 0x72, 0x52, 0x0b, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73,
+	0x12, 0x18, 0x0a, 0x07, 0x50, 0x72, 0x69, 0x6d, 0x61, 0x72, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x07, 0x50, 0x72, 0x69, 0x6d, 0x61, 0x72, 0x79, 0x12, 0x18, 0x0a, 0x07, 0x44, 0x6f,
+	0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x44, 0x6f, 0x6d,
+	0x61, 0x69, 0x6e, 0x73, 0x12, 0x32, 0x0a, 0x14, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x44, 0x6f,
+	0x6d, 0x61, 0x69, 0x6e, 0x73, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x04, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x14, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
+	0x73, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x22, 0x48, 0x0a, 0x0a, 0x4e, 0x61, 0x6d, 0x65,
+	0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x12, 0x0e, 0x0a, 0x02, 0x49, 0x50, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x02, 0x49, 0x50, 0x12, 0x16, 0x0a, 0x06, 0x4e, 0x53, 0x54, 0x79, 0x70, 0x65,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x06, 0x4e, 0x53, 0x54, 0x79, 0x70, 0x65, 0x12, 0x12,
+	0x0a, 0x04, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52, 0x04, 0x50, 0x6f,
+	0x72, 0x74, 0x22, 0xfb, 0x02, 0x0a, 0x0c, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52,
+	0x75, 0x6c, 0x65, 0x12, 0x1a, 0x0a, 0x06, 0x50, 0x65, 0x65, 0x72, 0x49, 0x50, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x42, 0x02, 0x18, 0x01, 0x52, 0x06, 0x50, 0x65, 0x65, 0x72, 0x49, 0x50, 0x12,
+	0x37, 0x0a, 0x09, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x0e, 0x32, 0x19, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x52, 0x75, 0x6c, 0x65, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x09, 0x44,
+	0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x2e, 0x0a, 0x06, 0x41, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x52, 0x06, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x34, 0x0a, 0x08, 0x50, 0x72, 0x6f, 0x74,
+	0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74,
+	0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x12,
+	0x0a, 0x04, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x50, 0x6f,
+	0x72, 0x74, 0x12, 0x30, 0x0a, 0x08, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x18, 0x06,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x08, 0x50, 0x6f, 0x72, 0x74,
+	0x49, 0x6e, 0x66, 0x6f, 0x12, 0x1a, 0x0a, 0x08, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x44,
+	0x18, 0x07, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x44,
+	0x12, 0x26, 0x0a, 0x0e, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63,
+	0x6f, 0x6c, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0e, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d,
+	0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x26, 0x0a, 0x0e, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x65, 0x73, 0x18, 0x09, 0x20, 0x03, 0x28, 0x0c,
+	0x52, 0x0e, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x65, 0x73,
+	0x22, 0x38, 0x0a, 0x0e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x41, 0x64, 0x64, 0x72, 0x65,
+	0x73, 0x73, 0x12, 0x14, 0x0a, 0x05, 0x6e, 0x65, 0x74, 0x49, 0x50, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x05, 0x6e, 0x65, 0x74, 0x49, 0x50, 0x12, 0x10, 0x0a, 0x03, 0x6d, 0x61, 0x63, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6d, 0x61, 0x63, 0x22, 0x74, 0x0a, 0x06, 0x43, 0x68,
+	0x65, 0x63, 0x6b, 0x73, 0x12, 0x14, 0x0a, 0x05, 0x46, 0x69, 0x6c, 0x65, 0x73, 0x18, 0x01, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x05, 0x46, 0x69, 0x6c, 0x65, 0x73, 0x12, 0x54, 0x0a, 0x14, 0x63, 0x65,
+	0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e,
+	0x67, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74,
+	0x65, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x52, 0x14, 0x63, 0x65, 0x72, 0x74,
+	0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65,
+	0x22, 0x54, 0x0a, 0x14, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x43,
+	0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x6e, 0x6f, 0x6e, 0x63,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x6e, 0x6f, 0x6e, 0x63, 0x65, 0x12, 0x26,
+	0x0a, 0x0e, 0x63, 0x61, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73,
+	0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x63, 0x61, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66,
+	0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x22, 0x74, 0x0a, 0x10, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66,
+	0x69, 0x63, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x6f, 0x66, 0x12, 0x14, 0x0a, 0x05, 0x6e, 0x6f,
+	0x6e, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x6e, 0x6f, 0x6e, 0x63, 0x65,
+	0x12, 0x14, 0x0a, 0x05, 0x63, 0x68, 0x61, 0x69, 0x6e, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0c, 0x52,
+	0x05, 0x63, 0x68, 0x61, 0x69, 0x6e, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x69, 0x67, 0x41, 0x6c, 0x67,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x69, 0x67, 0x41, 0x6c, 0x67, 0x12, 0x1c,
+	0x0a, 0x09, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x0c, 0x52, 0x09, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x22, 0x96, 0x01, 0x0a,
+	0x08, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x14, 0x0a, 0x04, 0x70, 0x6f, 0x72,
+	0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x48, 0x00, 0x52, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x12,
+	0x32, 0x0a, 0x05, 0x72, 0x61, 0x6e, 0x67, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74,
+	0x49, 0x6e, 0x66, 0x6f, 0x2e, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x48, 0x00, 0x52, 0x05, 0x72, 0x61,
+	0x6e, 0x67, 0x65, 0x1a, 0x2f, 0x0a, 0x05, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x14, 0x0a, 0x05,
+	0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x05, 0x73, 0x74, 0x61,
+	0x72, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52,
+	0x03, 0x65, 0x6e, 0x64, 0x42, 0x0f, 0x0a, 0x0d, 0x70, 0x6f, 0x72, 0x74, 0x53, 0x65, 0x6c, 0x65,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x87, 0x03, 0x0a, 0x11, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x46,
+	0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x12, 0x22, 0x0a, 0x0c, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28,
+	0x09, 0x52, 0x0c, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x12,
+	0x2e, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32,
+	0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c,
+	0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12,
+	0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x12, 0x34, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x04, 0x20,
 	0x01, 0x28, 0x0e, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
 	0x2e, 0x52, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x24, 0x0a, 0x0d, 0x62, 0x69, 0x64, 0x69, 0x72,
-	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d,
-	0x62, 0x69, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x12, 0x14, 0x0a,
-	0x05, 0x70, 0x6f, 0x72, 0x74, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0d, 0x52, 0x05, 0x70, 0x6f,
-	0x72, 0x74, 0x73, 0x12, 0x3b, 0x0a, 0x0b, 0x70, 0x6f, 0x72, 0x74, 0x5f, 0x72, 0x61, 0x6e, 0x67,
-	0x65, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x2e, 0x52,
-	0x61, 0x6e, 0x67, 0x65, 0x52, 0x0a, 0x70, 0x6f, 0x72, 0x74, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73,
-	0x12, 0x28, 0x0a, 0x10, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70,
-	0x5f, 0x69, 0x64, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x32, 0x0a, 0x15, 0x64, 0x65,
-	0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f,
-	0x69, 0x64, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x13, 0x64, 0x65, 0x73, 0x74, 0x69,
-	0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x5c,
-	0x0a, 0x11, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x5f, 0x67, 0x72, 0x6f,
-	0x75, 0x70, 0x73, 0x18, 0x09, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x43, 0x6f, 0x6d,
-	0x70, 0x61, 0x63, 0x74, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x47,
-	0x72, 0x6f, 0x75, 0x70, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x10, 0x61, 0x75, 0x74, 0x68,
-	0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x27, 0x0a, 0x0f,
-	0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x18,
-	0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65,
-	0x64, 0x55, 0x73, 0x65, 0x72, 0x12, 0x44, 0x0a, 0x0f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f,
-	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x0e, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x4e, 0x0a, 0x14, 0x64,
-	0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43,
-	0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x13, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74,
-	0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x37, 0x0a, 0x18, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x70, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x5f, 0x63, 0x68,
-	0x65, 0x63, 0x6b, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x0d, 0x20, 0x03, 0x28, 0x09, 0x52, 0x15, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x43, 0x68, 0x65, 0x63,
-	0x6b, 0x49, 0x64, 0x73, 0x1a, 0x5d, 0x0a, 0x15, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a,
-	0x65, 0x64, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a,
+	0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x30, 0x0a, 0x08, 0x70, 0x6f, 0x72, 0x74, 0x49,
+	0x6e, 0x66, 0x6f, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52,
+	0x08, 0x70, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x1c, 0x0a, 0x09, 0x69, 0x73, 0x44,
+	0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x69, 0x73,
+	0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x12, 0x18, 0x0a, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69,
+	0x6e, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
+	0x73, 0x12, 0x26, 0x0a, 0x0e, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x50, 0x72, 0x6f, 0x74, 0x6f,
+	0x63, 0x6f, 0x6c, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0e, 0x63, 0x75, 0x73, 0x74, 0x6f,
+	0x6d, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x1a, 0x0a, 0x08, 0x50, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x49, 0x44, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x50, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x49, 0x44, 0x12, 0x18, 0x0a, 0x07, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x49, 0x44,
+	0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x49, 0x44, 0x22,
+	0xf6, 0x01, 0x0a, 0x0e, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75,
+	0x6c, 0x65, 0x12, 0x34, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x0e, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x3e, 0x0a, 0x0f, 0x64, 0x65, 0x73, 0x74,
+	0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50,
+	0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x0f, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x2c, 0x0a, 0x11, 0x74, 0x72, 0x61, 0x6e,
+	0x73, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x0c, 0x52, 0x11, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x41,
+	0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x3c, 0x0a, 0x0e, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x6c,
+	0x61, 0x74, 0x65, 0x64, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74,
+	0x49, 0x6e, 0x66, 0x6f, 0x52, 0x0e, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x6c, 0x61, 0x74, 0x65, 0x64,
+	0x50, 0x6f, 0x72, 0x74, 0x3a, 0x02, 0x18, 0x01, 0x22, 0x8b, 0x02, 0x0a, 0x14, 0x45, 0x78, 0x70,
+	0x6f, 0x73, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52,
+	0x04, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x36, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f,
+	0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f,
+	0x63, 0x6f, 0x6c, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x10, 0x0a,
+	0x03, 0x70, 0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x70, 0x69, 0x6e, 0x12,
+	0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x1f, 0x0a, 0x0b, 0x75,
+	0x73, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09,
+	0x52, 0x0a, 0x75, 0x73, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x16, 0x0a, 0x06,
+	0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f,
+	0x6d, 0x61, 0x69, 0x6e, 0x12, 0x1f, 0x0a, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x70, 0x72, 0x65,
+	0x66, 0x69, 0x78, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6e, 0x61, 0x6d, 0x65, 0x50,
+	0x72, 0x65, 0x66, 0x69, 0x78, 0x12, 0x1f, 0x0a, 0x0b, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x5f,
+	0x70, 0x6f, 0x72, 0x74, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0a, 0x6c, 0x69, 0x73, 0x74,
+	0x65, 0x6e, 0x50, 0x6f, 0x72, 0x74, 0x22, 0xa1, 0x01, 0x0a, 0x15, 0x45, 0x78, 0x70, 0x6f, 0x73,
+	0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4e,
+	0x61, 0x6d, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x75,
+	0x72, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x55, 0x72, 0x6c, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x2c, 0x0a, 0x12,
+	0x70, 0x6f, 0x72, 0x74, 0x5f, 0x61, 0x75, 0x74, 0x6f, 0x5f, 0x61, 0x73, 0x73, 0x69, 0x67, 0x6e,
+	0x65, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x70, 0x6f, 0x72, 0x74, 0x41, 0x75,
+	0x74, 0x6f, 0x41, 0x73, 0x73, 0x69, 0x67, 0x6e, 0x65, 0x64, 0x22, 0x2c, 0x0a, 0x12, 0x52, 0x65,
+	0x6e, 0x65, 0x77, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x22, 0x15, 0x0a, 0x13, 0x52, 0x65, 0x6e, 0x65,
+	0x77, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
+	0x2b, 0x0a, 0x11, 0x53, 0x74, 0x6f, 0x70, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x22, 0x14, 0x0a, 0x12,
+	0x53, 0x74, 0x6f, 0x70, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x22, 0x9a, 0x01, 0x0a, 0x12, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61,
+	0x70, 0x45, 0x6e, 0x76, 0x65, 0x6c, 0x6f, 0x70, 0x65, 0x12, 0x3a, 0x0a, 0x04, 0x66, 0x75, 0x6c,
+	0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43,
+	0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x48, 0x00, 0x52,
+	0x04, 0x66, 0x75, 0x6c, 0x6c, 0x12, 0x3d, 0x0a, 0x05, 0x64, 0x65, 0x6c, 0x74, 0x61, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70,
+	0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x44, 0x65, 0x6c, 0x74, 0x61, 0x48, 0x00, 0x52, 0x05, 0x64,
+	0x65, 0x6c, 0x74, 0x61, 0x42, 0x09, 0x0a, 0x07, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x22,
+	0x96, 0x0f, 0x0a, 0x18, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f,
+	0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x12, 0x16, 0x0a, 0x06,
+	0x73, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x06, 0x73, 0x65,
+	0x72, 0x69, 0x61, 0x6c, 0x12, 0x37, 0x0a, 0x0b, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x63, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x52, 0x0a, 0x70, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x34, 0x0a,
+	0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x6f,
+	0x75, 0x6e, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x07, 0x6e, 0x65, 0x74, 0x77,
+	0x6f, 0x72, 0x6b, 0x12, 0x4d, 0x0a, 0x10, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x73,
+	0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x6f, 0x75,
+	0x6e, 0x74, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63,
+	0x74, 0x52, 0x0f, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e,
+	0x67, 0x73, 0x12, 0x41, 0x0a, 0x0c, 0x64, 0x6e, 0x73, 0x5f, 0x73, 0x65, 0x74, 0x74, 0x69, 0x6e,
+	0x67, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x44, 0x4e, 0x53, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67,
+	0x73, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x0b, 0x64, 0x6e, 0x73, 0x53, 0x65, 0x74,
+	0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x64, 0x6e, 0x73, 0x5f, 0x64, 0x6f, 0x6d,
+	0x61, 0x69, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x64, 0x6e, 0x73, 0x44, 0x6f,
+	0x6d, 0x61, 0x69, 0x6e, 0x12, 0x2c, 0x0a, 0x12, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5f, 0x7a,
+	0x6f, 0x6e, 0x65, 0x5f, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x10, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x44, 0x6f, 0x6d, 0x61,
+	0x69, 0x6e, 0x12, 0x25, 0x0a, 0x0e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x5f, 0x76, 0x65, 0x72, 0x73,
+	0x69, 0x6f, 0x6e, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0d, 0x61, 0x67, 0x65, 0x6e,
+	0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x2d, 0x0a, 0x05, 0x70, 0x65, 0x65,
+	0x72, 0x73, 0x18, 0x09, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63,
+	0x74, 0x52, 0x05, 0x70, 0x65, 0x65, 0x72, 0x73, 0x12, 0x2e, 0x0a, 0x13, 0x72, 0x6f, 0x75, 0x74,
+	0x65, 0x72, 0x5f, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x18,
+	0x0a, 0x20, 0x03, 0x28, 0x0d, 0x52, 0x11, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x50, 0x65, 0x65,
+	0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x12, 0x35, 0x0a, 0x08, 0x70, 0x6f, 0x6c, 0x69,
+	0x63, 0x69, 0x65, 0x73, 0x18, 0x0b, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x43, 0x6f,
+	0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x08, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x12,
+	0x30, 0x0a, 0x06, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x0c, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x47, 0x72, 0x6f,
+	0x75, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x06, 0x67, 0x72, 0x6f, 0x75, 0x70,
+	0x73, 0x12, 0x2c, 0x0a, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x0d, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52,
+	0x6f, 0x75, 0x74, 0x65, 0x52, 0x61, 0x77, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12,
+	0x4b, 0x0a, 0x11, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x67, 0x72,
+	0x6f, 0x75, 0x70, 0x73, 0x18, 0x0e, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76,
+	0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x52, 0x61, 0x77, 0x52, 0x10, 0x6e, 0x61, 0x6d, 0x65,
+	0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x40, 0x0a, 0x0f,
+	0x61, 0x6c, 0x6c, 0x5f, 0x64, 0x6e, 0x73, 0x5f, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x18,
+	0x0f, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x53, 0x69, 0x6d, 0x70, 0x6c, 0x65, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x52,
+	0x0d, 0x61, 0x6c, 0x6c, 0x44, 0x6e, 0x73, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x12, 0x3b,
+	0x0a, 0x0d, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x7a, 0x6f, 0x6e, 0x65, 0x73, 0x18,
+	0x10, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x52, 0x0c, 0x61,
+	0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5a, 0x6f, 0x6e, 0x65, 0x73, 0x12, 0x4b, 0x0a, 0x11, 0x6e,
+	0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73,
+	0x18, 0x11, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x52, 0x61, 0x77, 0x52, 0x10, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x55, 0x0a, 0x0b, 0x72, 0x6f, 0x75, 0x74,
+	0x65, 0x72, 0x73, 0x5f, 0x6d, 0x61, 0x70, 0x18, 0x12, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x34, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f,
+	0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46,
+	0x75, 0x6c, 0x6c, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x73, 0x4d, 0x61, 0x70, 0x45, 0x6e,
+	0x74, 0x72, 0x79, 0x52, 0x0a, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x73, 0x4d, 0x61, 0x70, 0x12,
+	0x71, 0x0a, 0x15, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x70, 0x6f, 0x6c, 0x69,
+	0x63, 0x69, 0x65, 0x73, 0x5f, 0x6d, 0x61, 0x70, 0x18, 0x13, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x3d,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77,
+	0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73,
+	0x46, 0x75, 0x6c, 0x6c, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x6f, 0x6c,
+	0x69, 0x63, 0x69, 0x65, 0x73, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x13, 0x72,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x4d,
+	0x61, 0x70, 0x12, 0x6a, 0x0a, 0x14, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x5f, 0x74,
+	0x6f, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x14, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x3a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65,
+	0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e,
+	0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x2e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x54, 0x6f,
+	0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x10, 0x67, 0x72,
+	0x6f, 0x75, 0x70, 0x49, 0x64, 0x54, 0x6f, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x73, 0x12, 0x28,
+	0x0a, 0x10, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69,
+	0x64, 0x73, 0x18, 0x15, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65,
+	0x64, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x73, 0x12, 0x6e, 0x0a, 0x14, 0x70, 0x6f, 0x73, 0x74,
+	0x75, 0x72, 0x65, 0x5f, 0x66, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x5f, 0x70, 0x65, 0x65, 0x72, 0x73,
+	0x18, 0x16, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x3c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f,
+	0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x2e, 0x50, 0x6f, 0x73,
+	0x74, 0x75, 0x72, 0x65, 0x46, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x73, 0x45,
+	0x6e, 0x74, 0x72, 0x79, 0x52, 0x12, 0x70, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x46, 0x61, 0x69,
+	0x6c, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x73, 0x12, 0x2c, 0x0a, 0x12, 0x64, 0x6e, 0x73, 0x5f,
+	0x66, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x17,
+	0x20, 0x01, 0x28, 0x03, 0x52, 0x10, 0x64, 0x6e, 0x73, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64,
+	0x65, 0x72, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x3b, 0x0a, 0x0b, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x5f,
+	0x70, 0x61, 0x74, 0x63, 0x68, 0x18, 0x18, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x61,
+	0x74, 0x63, 0x68, 0x42, 0x02, 0x18, 0x01, 0x52, 0x0a, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x61,
+	0x74, 0x63, 0x68, 0x12, 0x22, 0x0a, 0x0d, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x5f, 0x63,
+	0x6c, 0x61, 0x69, 0x6d, 0x18, 0x19, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x75, 0x73, 0x65, 0x72,
+	0x49, 0x64, 0x43, 0x6c, 0x61, 0x69, 0x6d, 0x1a, 0x5c, 0x0a, 0x0f, 0x52, 0x6f, 0x75, 0x74, 0x65,
+	0x72, 0x73, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65,
+	0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x33, 0x0a, 0x05,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
+	0x52, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x5d, 0x0a, 0x18, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x74, 0x72,
+	0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03,
+	0x6b, 0x65, 0x79, 0x12, 0x2b, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x64, 0x73, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
+	0x3a, 0x02, 0x38, 0x01, 0x1a, 0x5b, 0x0a, 0x15, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x54,
+	0x6f, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a,
 	0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12,
-	0x2e, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x18,
+	0x2c, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16,
 	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x55, 0x73, 0x65, 0x72,
-	0x4e, 0x61, 0x6d, 0x65, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a,
-	0x02, 0x38, 0x01, 0x22, 0x80, 0x01, 0x0a, 0x0f, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x24, 0x0a, 0x0e, 0x70,
-	0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x5f, 0x73, 0x65, 0x74, 0x18, 0x02, 0x20,
+	0x49, 0x44, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38,
+	0x01, 0x1a, 0x5f, 0x0a, 0x17, 0x50, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x46, 0x61, 0x69, 0x6c,
+	0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03,
+	0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x2e,
+	0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x18, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x49,
+	0x6e, 0x64, 0x65, 0x78, 0x53, 0x65, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02,
+	0x38, 0x01, 0x4a, 0x04, 0x08, 0x1a, 0x10, 0x33, 0x22, 0x8b, 0x03, 0x0a, 0x0a, 0x50, 0x72, 0x6f,
+	0x78, 0x79, 0x50, 0x61, 0x74, 0x63, 0x68, 0x12, 0x32, 0x0a, 0x05, 0x70, 0x65, 0x65, 0x72, 0x73,
+	0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x52, 0x05, 0x70, 0x65, 0x65, 0x72, 0x73, 0x12, 0x41, 0x0a, 0x0d, 0x6f,
+	0x66, 0x66, 0x6c, 0x69, 0x6e, 0x65, 0x5f, 0x70, 0x65, 0x65, 0x72, 0x73, 0x18, 0x02, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x52, 0x0c, 0x6f, 0x66, 0x66, 0x6c, 0x69, 0x6e, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73, 0x12, 0x3f,
+	0x0a, 0x0e, 0x66, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x5f, 0x72, 0x75, 0x6c, 0x65, 0x73,
+	0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65,
+	0x52, 0x0d, 0x66, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x12,
+	0x29, 0x0a, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x6f, 0x75,
+	0x74, 0x65, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x4f, 0x0a, 0x14, 0x72, 0x6f,
+	0x75, 0x74, 0x65, 0x5f, 0x66, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x5f, 0x72, 0x75, 0x6c,
+	0x65, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x46, 0x69, 0x72, 0x65, 0x77,
+	0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x52, 0x12, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x46, 0x69,
+	0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x12, 0x45, 0x0a, 0x10, 0x66,
+	0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x5f, 0x72, 0x75, 0x6c, 0x65, 0x73, 0x18,
+	0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c,
+	0x65, 0x52, 0x0f, 0x66, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c,
+	0x65, 0x73, 0x3a, 0x02, 0x18, 0x01, 0x22, 0x94, 0x01, 0x0a, 0x16, 0x41, 0x63, 0x63, 0x6f, 0x75,
+	0x6e, 0x74, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63,
+	0x74, 0x12, 0x41, 0x0a, 0x1d, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x5f,
+	0x65, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x6e, 0x61, 0x62, 0x6c,
+	0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x1a, 0x70, 0x65, 0x65, 0x72, 0x4c, 0x6f,
+	0x67, 0x69, 0x6e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x61,
+	0x62, 0x6c, 0x65, 0x64, 0x12, 0x37, 0x0a, 0x18, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x6c, 0x6f, 0x67,
+	0x69, 0x6e, 0x5f, 0x65, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x73,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x15, 0x70, 0x65, 0x65, 0x72, 0x4c, 0x6f, 0x67, 0x69,
+	0x6e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4e, 0x73, 0x22, 0x95, 0x01,
+	0x0a, 0x0e, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
+	0x12, 0x1e, 0x0a, 0x0a, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72,
+	0x12, 0x19, 0x0a, 0x08, 0x6e, 0x65, 0x74, 0x5f, 0x63, 0x69, 0x64, 0x72, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x07, 0x6e, 0x65, 0x74, 0x43, 0x69, 0x64, 0x72, 0x12, 0x1e, 0x0a, 0x0b, 0x6e,
+	0x65, 0x74, 0x5f, 0x76, 0x36, 0x5f, 0x63, 0x69, 0x64, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x09, 0x6e, 0x65, 0x74, 0x56, 0x36, 0x43, 0x69, 0x64, 0x72, 0x12, 0x10, 0x0a, 0x03, 0x64,
+	0x6e, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x64, 0x6e, 0x73, 0x12, 0x16, 0x0a,
+	0x06, 0x73, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x04, 0x52, 0x06, 0x73,
+	0x65, 0x72, 0x69, 0x61, 0x6c, 0x22, 0x21, 0x0a, 0x19, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
+	0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x44, 0x65, 0x6c,
+	0x74, 0x61, 0x4a, 0x04, 0x08, 0x01, 0x10, 0x65, 0x22, 0xa2, 0x04, 0x0a, 0x0b, 0x50, 0x65, 0x65,
+	0x72, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x12, 0x1c, 0x0a, 0x0a, 0x77, 0x67, 0x5f, 0x70,
+	0x75, 0x62, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x77, 0x67,
+	0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x70, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x0c, 0x52, 0x02, 0x69, 0x70, 0x12, 0x12, 0x0a, 0x04, 0x69, 0x70, 0x76, 0x36, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x69, 0x70, 0x76, 0x36, 0x12, 0x1e, 0x0a, 0x0b, 0x73, 0x73,
+	0x68, 0x5f, 0x70, 0x75, 0x62, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x52,
+	0x09, 0x73, 0x73, 0x68, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x12, 0x1b, 0x0a, 0x09, 0x64, 0x6e,
+	0x73, 0x5f, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x64,
+	0x6e, 0x73, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x12, 0x23, 0x0a, 0x0d, 0x61, 0x67, 0x65, 0x6e, 0x74,
+	0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c,
+	0x61, 0x67, 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x2f, 0x0a, 0x14,
+	0x61, 0x64, 0x64, 0x65, 0x64, 0x5f, 0x77, 0x69, 0x74, 0x68, 0x5f, 0x73, 0x73, 0x6f, 0x5f, 0x6c,
+	0x6f, 0x67, 0x69, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x11, 0x61, 0x64, 0x64, 0x65,
+	0x64, 0x57, 0x69, 0x74, 0x68, 0x53, 0x73, 0x6f, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x38, 0x0a,
+	0x18, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x5f, 0x65, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x5f, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x16, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x2f, 0x0a, 0x14, 0x6c, 0x61, 0x73, 0x74, 0x5f,
+	0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x5f, 0x75, 0x6e, 0x69, 0x78, 0x5f, 0x6e, 0x61, 0x6e, 0x6f, 0x18,
+	0x09, 0x20, 0x01, 0x28, 0x03, 0x52, 0x11, 0x6c, 0x61, 0x73, 0x74, 0x4c, 0x6f, 0x67, 0x69, 0x6e,
+	0x55, 0x6e, 0x69, 0x78, 0x4e, 0x61, 0x6e, 0x6f, 0x12, 0x1f, 0x0a, 0x0b, 0x73, 0x73, 0x68, 0x5f,
+	0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x73,
+	0x73, 0x68, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x23, 0x0a, 0x0d, 0x73, 0x75, 0x70,
+	0x70, 0x6f, 0x72, 0x74, 0x73, 0x5f, 0x69, 0x70, 0x76, 0x36, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x0c, 0x73, 0x75, 0x70, 0x70, 0x6f, 0x72, 0x74, 0x73, 0x49, 0x70, 0x76, 0x36, 0x12, 0x38,
+	0x0a, 0x18, 0x73, 0x75, 0x70, 0x70, 0x6f, 0x72, 0x74, 0x73, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x5f, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x65, 0x73, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x16, 0x73, 0x75, 0x70, 0x70, 0x6f, 0x72, 0x74, 0x73, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x65, 0x73, 0x12, 0x2c, 0x0a, 0x12, 0x73, 0x65, 0x72, 0x76,
+	0x65, 0x72, 0x5f, 0x73, 0x73, 0x68, 0x5f, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x18, 0x0d,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x53, 0x73, 0x68, 0x41,
+	0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x12, 0x25, 0x0a, 0x0e, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x5f,
+	0x65, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x65, 0x64, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d,
+	0x70, 0x72, 0x6f, 0x78, 0x79, 0x45, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x65, 0x64, 0x22, 0x91, 0x06,
+	0x0a, 0x0d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x12,
+	0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12,
+	0x2e, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32,
+	0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c,
+	0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12,
+	0x34, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x0e, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52,
+	0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x24, 0x0a, 0x0d, 0x62, 0x69, 0x64, 0x69, 0x72, 0x65, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x62, 0x69,
+	0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x12, 0x14, 0x0a, 0x05, 0x70,
+	0x6f, 0x72, 0x74, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0d, 0x52, 0x05, 0x70, 0x6f, 0x72, 0x74,
+	0x73, 0x12, 0x3b, 0x0a, 0x0b, 0x70, 0x6f, 0x72, 0x74, 0x5f, 0x72, 0x61, 0x6e, 0x67, 0x65, 0x73,
+	0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x2e, 0x52, 0x61, 0x6e,
+	0x67, 0x65, 0x52, 0x0a, 0x70, 0x6f, 0x72, 0x74, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x12, 0x28,
+	0x0a, 0x10, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69,
+	0x64, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x32, 0x0a, 0x15, 0x64, 0x65, 0x73, 0x74,
+	0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64,
+	0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x13, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x5c, 0x0a, 0x11,
+	0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70,
+	0x73, 0x18, 0x09, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x43, 0x6f, 0x6d, 0x70, 0x61,
+	0x63, 0x74, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x47, 0x72, 0x6f,
+	0x75, 0x70, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x10, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72,
+	0x69, 0x7a, 0x65, 0x64, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x27, 0x0a, 0x0f, 0x61, 0x75,
+	0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x18, 0x0a, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x55,
+	0x73, 0x65, 0x72, 0x12, 0x44, 0x0a, 0x0f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x72, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x0e, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x4e, 0x0a, 0x14, 0x64, 0x65, 0x73,
+	0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f, 0x6d,
+	0x70, 0x61, 0x63, 0x74, 0x52, 0x13, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x37, 0x0a, 0x18, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x5f, 0x70, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x5f, 0x63, 0x68, 0x65, 0x63,
+	0x6b, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x0d, 0x20, 0x03, 0x28, 0x09, 0x52, 0x15, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x50, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x49,
+	0x64, 0x73, 0x1a, 0x5d, 0x0a, 0x15, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64,
+	0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b,
+	0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x2e, 0x0a,
+	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x4e, 0x61,
+	0x6d, 0x65, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38,
+	0x01, 0x22, 0x80, 0x01, 0x0a, 0x0f, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f,
+	0x6d, 0x70, 0x61, 0x63, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x24, 0x0a, 0x0e, 0x70, 0x65, 0x65,
+	0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x5f, 0x73, 0x65, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x53, 0x65, 0x74, 0x12,
+	0x1d, 0x0a, 0x0a, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x0d, 0x52, 0x09, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x12, 0x0e,
+	0x0a, 0x02, 0x69, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x4a, 0x04,
+	0x08, 0x04, 0x10, 0x05, 0x22, 0x24, 0x0a, 0x0c, 0x55, 0x73, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65,
+	0x4c, 0x69, 0x73, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x18, 0x01, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x05, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x22, 0x93, 0x01, 0x0a, 0x0c, 0x47,
+	0x72, 0x6f, 0x75, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x21, 0x0a, 0x0c, 0x70,
+	0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28,
+	0x0d, 0x52, 0x0b, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x12, 0x15,
+	0x0a, 0x06, 0x69, 0x73, 0x5f, 0x61, 0x6c, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x05,
+	0x69, 0x73, 0x41, 0x6c, 0x6c, 0x12, 0x39, 0x0a, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f,
+	0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73,
+	0x22, 0x57, 0x0a, 0x12, 0x44, 0x4e, 0x53, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x43,
+	0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x12, 0x41, 0x0a, 0x1d, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c,
+	0x65, 0x64, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x5f, 0x67, 0x72,
+	0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x1a, 0x64,
+	0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x22, 0x8d, 0x04, 0x0a, 0x08, 0x52, 0x6f,
+	0x75, 0x74, 0x65, 0x52, 0x61, 0x77, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x15, 0x0a, 0x06, 0x6e, 0x65, 0x74, 0x5f, 0x69, 0x64,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6e, 0x65, 0x74, 0x49, 0x64, 0x12, 0x20, 0x0a,
+	0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12,
+	0x21, 0x0a, 0x0c, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x5f, 0x63, 0x69, 0x64, 0x72, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x43, 0x69,
+	0x64, 0x72, 0x12, 0x18, 0x0a, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x05, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x1d, 0x0a, 0x0a,
+	0x6b, 0x65, 0x65, 0x70, 0x5f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x09, 0x6b, 0x65, 0x65, 0x70, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x12, 0x24, 0x0a, 0x0e, 0x70,
+	0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x5f, 0x73, 0x65, 0x74, 0x18, 0x07, 0x20,
 	0x01, 0x28, 0x08, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x53, 0x65,
 	0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x09, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78,
-	0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64,
-	0x4a, 0x04, 0x08, 0x04, 0x10, 0x05, 0x22, 0x24, 0x0a, 0x0c, 0x55, 0x73, 0x65, 0x72, 0x4e, 0x61,
-	0x6d, 0x65, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x18,
-	0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x05, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x22, 0x93, 0x01, 0x0a,
-	0x0c, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x12, 0x0e, 0x0a,
-	0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x21, 0x0a,
-	0x0c, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x18, 0x02, 0x20,
-	0x03, 0x28, 0x0d, 0x52, 0x0b, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73,
-	0x12, 0x15, 0x0a, 0x06, 0x69, 0x73, 0x5f, 0x61, 0x6c, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08,
-	0x52, 0x05, 0x69, 0x73, 0x41, 0x6c, 0x6c, 0x12, 0x39, 0x0a, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x73, 0x22, 0x57, 0x0a, 0x12, 0x44, 0x4e, 0x53, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67,
-	0x73, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x12, 0x41, 0x0a, 0x1d, 0x64, 0x69, 0x73, 0x61,
-	0x62, 0x6c, 0x65, 0x64, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x5f,
-	0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52,
-	0x1a, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x22, 0x8d, 0x04, 0x0a, 0x08,
-	0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x61, 0x77, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x15, 0x0a, 0x06, 0x6e, 0x65, 0x74, 0x5f,
-	0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6e, 0x65, 0x74, 0x49, 0x64, 0x12,
-	0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f,
-	0x6e, 0x12, 0x21, 0x0a, 0x0c, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x5f, 0x63, 0x69, 0x64,
-	0x72, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
-	0x43, 0x69, 0x64, 0x72, 0x12, 0x18, 0x0a, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18,
-	0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x1d,
-	0x0a, 0x0a, 0x6b, 0x65, 0x65, 0x70, 0x5f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x18, 0x06, 0x20, 0x01,
-	0x28, 0x08, 0x52, 0x09, 0x6b, 0x65, 0x65, 0x70, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x12, 0x24, 0x0a,
-	0x0e, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x5f, 0x73, 0x65, 0x74, 0x18,
-	0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78,
-	0x53, 0x65, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65,
-	0x78, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x09, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64,
-	0x65, 0x78, 0x12, 0x24, 0x0a, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70,
-	0x5f, 0x69, 0x64, 0x73, 0x18, 0x09, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72,
-	0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x6e, 0x65, 0x74, 0x77,
-	0x6f, 0x72, 0x6b, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0b,
-	0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x54, 0x79, 0x70, 0x65, 0x12, 0x1e, 0x0a, 0x0a, 0x6d,
-	0x61, 0x73, 0x71, 0x75, 0x65, 0x72, 0x61, 0x64, 0x65, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x0a, 0x6d, 0x61, 0x73, 0x71, 0x75, 0x65, 0x72, 0x61, 0x64, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x6d,
-	0x65, 0x74, 0x72, 0x69, 0x63, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x05, 0x52, 0x06, 0x6d, 0x65, 0x74,
-	0x72, 0x69, 0x63, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x0d,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x1b, 0x0a,
-	0x09, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x0e, 0x20, 0x03, 0x28, 0x09,
-	0x52, 0x08, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x37, 0x0a, 0x18, 0x61, 0x63,
-	0x63, 0x65, 0x73, 0x73, 0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x5f, 0x67, 0x72, 0x6f,
-	0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x0f, 0x20, 0x03, 0x28, 0x09, 0x52, 0x15, 0x61, 0x63,
-	0x63, 0x65, 0x73, 0x73, 0x43, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x47, 0x72, 0x6f, 0x75, 0x70,
-	0x49, 0x64, 0x73, 0x12, 0x26, 0x0a, 0x0f, 0x73, 0x6b, 0x69, 0x70, 0x5f, 0x61, 0x75, 0x74, 0x6f,
-	0x5f, 0x61, 0x70, 0x70, 0x6c, 0x79, 0x18, 0x10, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x73, 0x6b,
-	0x69, 0x70, 0x41, 0x75, 0x74, 0x6f, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x22, 0xff, 0x01, 0x0a, 0x12,
-	0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x52,
+	0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x09, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78,
+	0x12, 0x24, 0x0a, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69,
+	0x64, 0x73, 0x18, 0x09, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x47, 0x72,
+	0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72,
+	0x6b, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0b, 0x6e, 0x65,
+	0x74, 0x77, 0x6f, 0x72, 0x6b, 0x54, 0x79, 0x70, 0x65, 0x12, 0x1e, 0x0a, 0x0a, 0x6d, 0x61, 0x73,
+	0x71, 0x75, 0x65, 0x72, 0x61, 0x64, 0x65, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x6d,
+	0x61, 0x73, 0x71, 0x75, 0x65, 0x72, 0x61, 0x64, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x6d, 0x65, 0x74,
+	0x72, 0x69, 0x63, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x05, 0x52, 0x06, 0x6d, 0x65, 0x74, 0x72, 0x69,
+	0x63, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x0d, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x67,
+	0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x0e, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08,
+	0x67, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x37, 0x0a, 0x18, 0x61, 0x63, 0x63, 0x65,
+	0x73, 0x73, 0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70,
+	0x5f, 0x69, 0x64, 0x73, 0x18, 0x0f, 0x20, 0x03, 0x28, 0x09, 0x52, 0x15, 0x61, 0x63, 0x63, 0x65,
+	0x73, 0x73, 0x43, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64,
+	0x73, 0x12, 0x26, 0x0a, 0x0f, 0x73, 0x6b, 0x69, 0x70, 0x5f, 0x61, 0x75, 0x74, 0x6f, 0x5f, 0x61,
+	0x70, 0x70, 0x6c, 0x79, 0x18, 0x10, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x73, 0x6b, 0x69, 0x70,
+	0x41, 0x75, 0x74, 0x6f, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x22, 0xff, 0x01, 0x0a, 0x12, 0x4e, 0x61,
+	0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x52, 0x61, 0x77,
+	0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64,
+	0x12, 0x38, 0x0a, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x18,
+	0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x0b, 0x6e,
+	0x61, 0x6d, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x1b, 0x0a, 0x09, 0x67, 0x72,
+	0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x67,
+	0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x70, 0x72, 0x69, 0x6d, 0x61,
+	0x72, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x70, 0x72, 0x69, 0x6d, 0x61, 0x72,
+	0x79, 0x12, 0x18, 0x0a, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x05, 0x20, 0x03,
+	0x28, 0x09, 0x52, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x65,
+	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e,
+	0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x34, 0x0a, 0x16, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x5f,
+	0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x5f, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18,
+	0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x14, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x44, 0x6f, 0x6d,
+	0x61, 0x69, 0x6e, 0x73, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x22, 0x87, 0x02, 0x0a, 0x12,
+	0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52,
 	0x61, 0x77, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02,
-	0x69, 0x64, 0x12, 0x38, 0x0a, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72,
-	0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52,
-	0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x1b, 0x0a, 0x09,
-	0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52,
-	0x08, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x70, 0x72, 0x69,
-	0x6d, 0x61, 0x72, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x70, 0x72, 0x69, 0x6d,
-	0x61, 0x72, 0x79, 0x12, 0x18, 0x0a, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x05,
-	0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x18, 0x0a,
-	0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07,
-	0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x34, 0x0a, 0x16, 0x73, 0x65, 0x61, 0x72, 0x63,
-	0x68, 0x5f, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x5f, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65,
-	0x64, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x14, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x44,
-	0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x22, 0x87, 0x02,
-	0x0a, 0x12, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x52, 0x61, 0x77, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x02, 0x69, 0x64, 0x12, 0x1f, 0x0a, 0x0b, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x5f,
-	0x73, 0x65, 0x71, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6e, 0x65, 0x74, 0x77, 0x6f,
-	0x72, 0x6b, 0x53, 0x65, 0x71, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73,
-	0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b,
-	0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x74,
-	0x79, 0x70, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12,
-	0x18, 0x0a, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x64, 0x6f, 0x6d,
-	0x61, 0x69, 0x6e, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x0b, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x1f, 0x0a, 0x0b,
-	0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x5f, 0x63, 0x69, 0x64, 0x72, 0x18, 0x08, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x0a, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x43, 0x69, 0x64, 0x72, 0x12, 0x18, 0x0a,
-	0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x09, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07,
-	0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x22, 0x4d, 0x0a, 0x11, 0x4e, 0x65, 0x74, 0x77, 0x6f,
-	0x72, 0x6b, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x38, 0x0a, 0x07,
-	0x65, 0x6e, 0x74, 0x72, 0x69, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f,
-	0x72, 0x6b, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x07, 0x65,
-	0x6e, 0x74, 0x72, 0x69, 0x65, 0x73, 0x22, 0xe1, 0x01, 0x0a, 0x12, 0x4e, 0x65, 0x74, 0x77, 0x6f,
-	0x72, 0x6b, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x0e, 0x0a,
-	0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x1d, 0x0a,
-	0x0a, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x0d, 0x52, 0x09, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x12, 0x24, 0x0a, 0x0e,
-	0x70, 0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x5f, 0x73, 0x65, 0x74, 0x18, 0x03,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x53,
-	0x65, 0x74, 0x12, 0x24, 0x0a, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70,
-	0x5f, 0x69, 0x64, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72,
-	0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x1e, 0x0a, 0x0a, 0x6d, 0x61, 0x73, 0x71,
-	0x75, 0x65, 0x72, 0x61, 0x64, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x6d, 0x61,
-	0x73, 0x71, 0x75, 0x65, 0x72, 0x61, 0x64, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x6d, 0x65, 0x74, 0x72,
-	0x69, 0x63, 0x18, 0x06, 0x20, 0x01, 0x28, 0x05, 0x52, 0x06, 0x6d, 0x65, 0x74, 0x72, 0x69, 0x63,
-	0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x07, 0x20, 0x01, 0x28,
-	0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x22, 0x1d, 0x0a, 0x09, 0x50, 0x6f,
-	0x6c, 0x69, 0x63, 0x79, 0x49, 0x64, 0x73, 0x12, 0x10, 0x0a, 0x03, 0x69, 0x64, 0x73, 0x18, 0x01,
-	0x20, 0x03, 0x28, 0x09, 0x52, 0x03, 0x69, 0x64, 0x73, 0x22, 0x27, 0x0a, 0x0a, 0x55, 0x73, 0x65,
-	0x72, 0x49, 0x44, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x5f,
-	0x69, 0x64, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x75, 0x73, 0x65, 0x72, 0x49,
-	0x64, 0x73, 0x22, 0x31, 0x0a, 0x0c, 0x50, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x53,
-	0x65, 0x74, 0x12, 0x21, 0x0a, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78,
-	0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0d, 0x52, 0x0b, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e,
-	0x64, 0x65, 0x78, 0x65, 0x73, 0x2a, 0x3a, 0x0a, 0x09, 0x4a, 0x6f, 0x62, 0x53, 0x74, 0x61, 0x74,
-	0x75, 0x73, 0x12, 0x12, 0x0a, 0x0e, 0x75, 0x6e, 0x6b, 0x6e, 0x6f, 0x77, 0x6e, 0x5f, 0x73, 0x74,
-	0x61, 0x74, 0x75, 0x73, 0x10, 0x00, 0x12, 0x0d, 0x0a, 0x09, 0x73, 0x75, 0x63, 0x63, 0x65, 0x65,
-	0x64, 0x65, 0x64, 0x10, 0x01, 0x12, 0x0a, 0x0a, 0x06, 0x66, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x10,
-	0x02, 0x2a, 0x93, 0x01, 0x0a, 0x0e, 0x50, 0x65, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69,
-	0x6c, 0x69, 0x74, 0x79, 0x12, 0x19, 0x0a, 0x15, 0x50, 0x65, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61,
-	0x62, 0x69, 0x6c, 0x69, 0x74, 0x79, 0x55, 0x6e, 0x6b, 0x6e, 0x6f, 0x77, 0x6e, 0x10, 0x00, 0x12,
-	0x20, 0x0a, 0x1c, 0x50, 0x65, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74,
-	0x79, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x65, 0x73, 0x10,
-	0x01, 0x12, 0x1d, 0x0a, 0x19, 0x50, 0x65, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c,
-	0x69, 0x74, 0x79, 0x49, 0x50, 0x76, 0x36, 0x4f, 0x76, 0x65, 0x72, 0x6c, 0x61, 0x79, 0x10, 0x02,
-	0x12, 0x25, 0x0a, 0x21, 0x50, 0x65, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69,
-	0x74, 0x79, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f,
-	0x72, 0x6b, 0x4d, 0x61, 0x70, 0x10, 0x03, 0x2a, 0x48, 0x0a, 0x09, 0x4c, 0x61, 0x7a, 0x79, 0x53,
-	0x74, 0x61, 0x74, 0x65, 0x12, 0x14, 0x0a, 0x10, 0x4c, 0x61, 0x7a, 0x79, 0x53, 0x74, 0x61, 0x74,
-	0x65, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x10, 0x00, 0x12, 0x11, 0x0a, 0x0d, 0x4c, 0x61,
-	0x7a, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x4c, 0x61, 0x7a, 0x79, 0x10, 0x01, 0x12, 0x12, 0x0a,
-	0x0e, 0x4c, 0x61, 0x7a, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x45, 0x61, 0x67, 0x65, 0x72, 0x10,
-	0x02, 0x2a, 0x5d, 0x0a, 0x0c, 0x52, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f,
-	0x6c, 0x12, 0x0b, 0x0a, 0x07, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x07,
-	0x0a, 0x03, 0x41, 0x4c, 0x4c, 0x10, 0x01, 0x12, 0x07, 0x0a, 0x03, 0x54, 0x43, 0x50, 0x10, 0x02,
-	0x12, 0x07, 0x0a, 0x03, 0x55, 0x44, 0x50, 0x10, 0x03, 0x12, 0x08, 0x0a, 0x04, 0x49, 0x43, 0x4d,
-	0x50, 0x10, 0x04, 0x12, 0x0a, 0x0a, 0x06, 0x43, 0x55, 0x53, 0x54, 0x4f, 0x4d, 0x10, 0x05, 0x12,
-	0x0f, 0x0a, 0x0b, 0x4e, 0x45, 0x54, 0x42, 0x49, 0x52, 0x44, 0x5f, 0x53, 0x53, 0x48, 0x10, 0x06,
-	0x2a, 0x20, 0x0a, 0x0d, 0x52, 0x75, 0x6c, 0x65, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x12, 0x06, 0x0a, 0x02, 0x49, 0x4e, 0x10, 0x00, 0x12, 0x07, 0x0a, 0x03, 0x4f, 0x55, 0x54,
-	0x10, 0x01, 0x2a, 0x22, 0x0a, 0x0a, 0x52, 0x75, 0x6c, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x12, 0x0a, 0x0a, 0x06, 0x41, 0x43, 0x43, 0x45, 0x50, 0x54, 0x10, 0x00, 0x12, 0x08, 0x0a, 0x04,
-	0x44, 0x52, 0x4f, 0x50, 0x10, 0x01, 0x2a, 0x63, 0x0a, 0x0e, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65,
-	0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x0f, 0x0a, 0x0b, 0x45, 0x58, 0x50, 0x4f,
-	0x53, 0x45, 0x5f, 0x48, 0x54, 0x54, 0x50, 0x10, 0x00, 0x12, 0x10, 0x0a, 0x0c, 0x45, 0x58, 0x50,
-	0x4f, 0x53, 0x45, 0x5f, 0x48, 0x54, 0x54, 0x50, 0x53, 0x10, 0x01, 0x12, 0x0e, 0x0a, 0x0a, 0x45,
-	0x58, 0x50, 0x4f, 0x53, 0x45, 0x5f, 0x54, 0x43, 0x50, 0x10, 0x02, 0x12, 0x0e, 0x0a, 0x0a, 0x45,
-	0x58, 0x50, 0x4f, 0x53, 0x45, 0x5f, 0x55, 0x44, 0x50, 0x10, 0x03, 0x12, 0x0e, 0x0a, 0x0a, 0x45,
-	0x58, 0x50, 0x4f, 0x53, 0x45, 0x5f, 0x54, 0x4c, 0x53, 0x10, 0x04, 0x32, 0xd0, 0x07, 0x0a, 0x11,
-	0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
-	0x65, 0x12, 0x45, 0x0a, 0x05, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65,
-	0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x69, 0x64, 0x12, 0x1f, 0x0a, 0x0b, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x5f, 0x73, 0x65,
+	0x71, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
+	0x53, 0x65, 0x71, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72,
+	0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65,
+	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70,
+	0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x18, 0x0a,
+	0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07,
+	0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x64, 0x6f, 0x6d, 0x61, 0x69,
+	0x6e, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64,
+	0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x70, 0x72,
+	0x65, 0x66, 0x69, 0x78, 0x5f, 0x63, 0x69, 0x64, 0x72, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x0a, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x43, 0x69, 0x64, 0x72, 0x12, 0x18, 0x0a, 0x07, 0x65,
+	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x09, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e,
+	0x61, 0x62, 0x6c, 0x65, 0x64, 0x22, 0x4d, 0x0a, 0x11, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
+	0x52, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x38, 0x0a, 0x07, 0x65, 0x6e,
+	0x74, 0x72, 0x69, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
+	0x52, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x07, 0x65, 0x6e, 0x74,
+	0x72, 0x69, 0x65, 0x73, 0x22, 0xe1, 0x01, 0x0a, 0x12, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
+	0x52, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x0e, 0x0a, 0x02, 0x69,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x70,
+	0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52,
+	0x09, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x12, 0x24, 0x0a, 0x0e, 0x70, 0x65,
+	0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x5f, 0x73, 0x65, 0x74, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x53, 0x65, 0x74,
+	0x12, 0x24, 0x0a, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69,
+	0x64, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x47, 0x72,
+	0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x1e, 0x0a, 0x0a, 0x6d, 0x61, 0x73, 0x71, 0x75, 0x65,
+	0x72, 0x61, 0x64, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x6d, 0x61, 0x73, 0x71,
+	0x75, 0x65, 0x72, 0x61, 0x64, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x6d, 0x65, 0x74, 0x72, 0x69, 0x63,
+	0x18, 0x06, 0x20, 0x01, 0x28, 0x05, 0x52, 0x06, 0x6d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x12, 0x18,
+	0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x22, 0x1d, 0x0a, 0x09, 0x50, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x49, 0x64, 0x73, 0x12, 0x10, 0x0a, 0x03, 0x69, 0x64, 0x73, 0x18, 0x01, 0x20, 0x03,
+	0x28, 0x09, 0x52, 0x03, 0x69, 0x64, 0x73, 0x22, 0x27, 0x0a, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x49,
+	0x44, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64,
+	0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x73,
+	0x22, 0x31, 0x0a, 0x0c, 0x50, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x53, 0x65, 0x74,
+	0x12, 0x21, 0x0a, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73,
+	0x18, 0x01, 0x20, 0x03, 0x28, 0x0d, 0x52, 0x0b, 0x70, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65,
+	0x78, 0x65, 0x73, 0x2a, 0x3a, 0x0a, 0x09, 0x4a, 0x6f, 0x62, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
+	0x12, 0x12, 0x0a, 0x0e, 0x75, 0x6e, 0x6b, 0x6e, 0x6f, 0x77, 0x6e, 0x5f, 0x73, 0x74, 0x61, 0x74,
+	0x75, 0x73, 0x10, 0x00, 0x12, 0x0d, 0x0a, 0x09, 0x73, 0x75, 0x63, 0x63, 0x65, 0x65, 0x64, 0x65,
+	0x64, 0x10, 0x01, 0x12, 0x0a, 0x0a, 0x06, 0x66, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x10, 0x02, 0x2a,
+	0x93, 0x01, 0x0a, 0x0e, 0x50, 0x65, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69,
+	0x74, 0x79, 0x12, 0x19, 0x0a, 0x15, 0x50, 0x65, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69,
+	0x6c, 0x69, 0x74, 0x79, 0x55, 0x6e, 0x6b, 0x6e, 0x6f, 0x77, 0x6e, 0x10, 0x00, 0x12, 0x20, 0x0a,
+	0x1c, 0x50, 0x65, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x79, 0x53,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x65, 0x73, 0x10, 0x01, 0x12,
+	0x1d, 0x0a, 0x19, 0x50, 0x65, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74,
+	0x79, 0x49, 0x50, 0x76, 0x36, 0x4f, 0x76, 0x65, 0x72, 0x6c, 0x61, 0x79, 0x10, 0x02, 0x12, 0x25,
+	0x0a, 0x21, 0x50, 0x65, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x79,
+	0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
+	0x4d, 0x61, 0x70, 0x10, 0x03, 0x2a, 0x48, 0x0a, 0x09, 0x4c, 0x61, 0x7a, 0x79, 0x53, 0x74, 0x61,
+	0x74, 0x65, 0x12, 0x14, 0x0a, 0x10, 0x4c, 0x61, 0x7a, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x44,
+	0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x10, 0x00, 0x12, 0x11, 0x0a, 0x0d, 0x4c, 0x61, 0x7a, 0x79,
+	0x53, 0x74, 0x61, 0x74, 0x65, 0x4c, 0x61, 0x7a, 0x79, 0x10, 0x01, 0x12, 0x12, 0x0a, 0x0e, 0x4c,
+	0x61, 0x7a, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x45, 0x61, 0x67, 0x65, 0x72, 0x10, 0x02, 0x2a,
+	0x5d, 0x0a, 0x0c, 0x52, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12,
+	0x0b, 0x0a, 0x07, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x07, 0x0a, 0x03,
+	0x41, 0x4c, 0x4c, 0x10, 0x01, 0x12, 0x07, 0x0a, 0x03, 0x54, 0x43, 0x50, 0x10, 0x02, 0x12, 0x07,
+	0x0a, 0x03, 0x55, 0x44, 0x50, 0x10, 0x03, 0x12, 0x08, 0x0a, 0x04, 0x49, 0x43, 0x4d, 0x50, 0x10,
+	0x04, 0x12, 0x0a, 0x0a, 0x06, 0x43, 0x55, 0x53, 0x54, 0x4f, 0x4d, 0x10, 0x05, 0x12, 0x0f, 0x0a,
+	0x0b, 0x4e, 0x45, 0x54, 0x42, 0x49, 0x52, 0x44, 0x5f, 0x53, 0x53, 0x48, 0x10, 0x06, 0x2a, 0x20,
+	0x0a, 0x0d, 0x52, 0x75, 0x6c, 0x65, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12,
+	0x06, 0x0a, 0x02, 0x49, 0x4e, 0x10, 0x00, 0x12, 0x07, 0x0a, 0x03, 0x4f, 0x55, 0x54, 0x10, 0x01,
+	0x2a, 0x22, 0x0a, 0x0a, 0x52, 0x75, 0x6c, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x0a,
+	0x0a, 0x06, 0x41, 0x43, 0x43, 0x45, 0x50, 0x54, 0x10, 0x00, 0x12, 0x08, 0x0a, 0x04, 0x44, 0x52,
+	0x4f, 0x50, 0x10, 0x01, 0x2a, 0x63, 0x0a, 0x0e, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x50, 0x72,
+	0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x0f, 0x0a, 0x0b, 0x45, 0x58, 0x50, 0x4f, 0x53, 0x45,
+	0x5f, 0x48, 0x54, 0x54, 0x50, 0x10, 0x00, 0x12, 0x10, 0x0a, 0x0c, 0x45, 0x58, 0x50, 0x4f, 0x53,
+	0x45, 0x5f, 0x48, 0x54, 0x54, 0x50, 0x53, 0x10, 0x01, 0x12, 0x0e, 0x0a, 0x0a, 0x45, 0x58, 0x50,
+	0x4f, 0x53, 0x45, 0x5f, 0x54, 0x43, 0x50, 0x10, 0x02, 0x12, 0x0e, 0x0a, 0x0a, 0x45, 0x58, 0x50,
+	0x4f, 0x53, 0x45, 0x5f, 0x55, 0x44, 0x50, 0x10, 0x03, 0x12, 0x0e, 0x0a, 0x0a, 0x45, 0x58, 0x50,
+	0x4f, 0x53, 0x45, 0x5f, 0x54, 0x4c, 0x53, 0x10, 0x04, 0x32, 0xd0, 0x07, 0x0a, 0x11, 0x4d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12,
+	0x45, 0x0a, 0x05, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
 	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d,
-	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x46, 0x0a, 0x04, 0x53, 0x79, 0x6e, 0x63,
+	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73,
+	0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x46, 0x0a, 0x04, 0x53, 0x79, 0x6e, 0x63, 0x12, 0x1c,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72,
+	0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70,
+	0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x30, 0x01, 0x12, 0x42,
+	0x0a, 0x0c, 0x47, 0x65, 0x74, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x4b, 0x65, 0x79, 0x12, 0x11,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6d, 0x70, 0x74,
+	0x79, 0x1a, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53,
+	0x65, 0x72, 0x76, 0x65, 0x72, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x22, 0x00, 0x12, 0x33, 0x0a, 0x09, 0x69, 0x73, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x79, 0x12,
+	0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6d, 0x70,
+	0x74, 0x79, 0x1a, 0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x00, 0x12, 0x5a, 0x0a, 0x1a, 0x47, 0x65, 0x74, 0x44, 0x65,
+	0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73,
+	0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+	0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67,
+	0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x18, 0x47, 0x65, 0x74, 0x50, 0x4b, 0x43, 0x45, 0x41, 0x75,
+	0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x12,
+	0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63,
+	0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79,
+	0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x3d, 0x0a,
+	0x08, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x65, 0x74, 0x61, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64,
+	0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x00, 0x12, 0x3b, 0x0a, 0x06,
+	0x4c, 0x6f, 0x67, 0x6f, 0x75, 0x74, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73,
+	0x73, 0x61, 0x67, 0x65, 0x1a, 0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x00, 0x12, 0x47, 0x0a, 0x03, 0x4a, 0x6f, 0x62,
 	0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e,
 	0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c,
 	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72,
-	0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x30, 0x01,
-	0x12, 0x42, 0x0a, 0x0c, 0x47, 0x65, 0x74, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x4b, 0x65, 0x79,
-	0x12, 0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6d,
-	0x70, 0x74, 0x79, 0x1a, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x2e, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x22, 0x00, 0x12, 0x33, 0x0a, 0x09, 0x69, 0x73, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68,
-	0x79, 0x12, 0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45,
-	0x6d, 0x70, 0x74, 0x79, 0x1a, 0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
-	0x74, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x00, 0x12, 0x5a, 0x0a, 0x1a, 0x47, 0x65, 0x74,
-	0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74,
-	0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x28, 0x01,
+	0x30, 0x01, 0x12, 0x51, 0x0a, 0x11, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x64, 0x41, 0x75, 0x74, 0x68,
+	0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
 	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65,
 	0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
 	0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73,
-	0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x18, 0x47, 0x65, 0x74, 0x50, 0x4b, 0x43, 0x45,
-	0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f,
-	0x77, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45,
-	0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a,
-	0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63,
-	0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x12,
-	0x3d, 0x0a, 0x08, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x65, 0x74, 0x61, 0x12, 0x1c, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74,
-	0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x00, 0x12, 0x3b,
-	0x0a, 0x06, 0x4c, 0x6f, 0x67, 0x6f, 0x75, 0x74, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d,
-	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x00, 0x12, 0x47, 0x0a, 0x03, 0x4a,
-	0x6f, 0x62, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x4c, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x45,
+	0x78, 0x70, 0x6f, 0x73, 0x65, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73,
+	0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+	0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67,
+	0x65, 0x22, 0x00, 0x12, 0x4b, 0x0a, 0x0b, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x45, 0x78, 0x70, 0x6f,
+	0x73, 0x65, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
 	0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,
 	0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e,
 	0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00,
-	0x28, 0x01, 0x30, 0x01, 0x12, 0x51, 0x0a, 0x11, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x64, 0x41, 0x75,
-	0x74, 0x68, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64,
-	0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65,
-	0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x4c, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74,
-	0x65, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65,
-	0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73,
-	0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x4b, 0x0a, 0x0b, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x45, 0x78,
-	0x70, 0x6f, 0x73, 0x65, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
-	0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61,
-	0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,
-	0x22, 0x00, 0x12, 0x4a, 0x0a, 0x0a, 0x53, 0x74, 0x6f, 0x70, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65,
-	0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e,
-	0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c,
+	0x12, 0x4a, 0x0a, 0x0a, 0x53, 0x74, 0x6f, 0x70, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x12, 0x1c,
 	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72,
-	0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x42, 0x08,
-	0x5a, 0x06, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70,
+	0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x42, 0x08, 0x5a, 0x06,
+	0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -8016,7 +8186,7 @@ func file_management_proto_rawDescGZIP() []byte {
 }
 
 var file_management_proto_enumTypes = make([]protoimpl.EnumInfo, 9)
-var file_management_proto_msgTypes = make([]protoimpl.MessageInfo, 83)
+var file_management_proto_msgTypes = make([]protoimpl.MessageInfo, 85)
 var file_management_proto_goTypes = []interface{}{
 	(JobStatus)(0),                         // 0: management.JobStatus
 	(PeerCapability)(0),                    // 1: management.PeerCapability
@@ -8074,44 +8244,46 @@ var file_management_proto_goTypes = []interface{}{
 	(*FirewallRule)(nil),                   // 53: management.FirewallRule
 	(*NetworkAddress)(nil),                 // 54: management.NetworkAddress
 	(*Checks)(nil),                         // 55: management.Checks
-	(*PortInfo)(nil),                       // 56: management.PortInfo
-	(*RouteFirewallRule)(nil),              // 57: management.RouteFirewallRule
-	(*ForwardingRule)(nil),                 // 58: management.ForwardingRule
-	(*ExposeServiceRequest)(nil),           // 59: management.ExposeServiceRequest
-	(*ExposeServiceResponse)(nil),          // 60: management.ExposeServiceResponse
-	(*RenewExposeRequest)(nil),             // 61: management.RenewExposeRequest
-	(*RenewExposeResponse)(nil),            // 62: management.RenewExposeResponse
-	(*StopExposeRequest)(nil),              // 63: management.StopExposeRequest
-	(*StopExposeResponse)(nil),             // 64: management.StopExposeResponse
-	(*NetworkMapEnvelope)(nil),             // 65: management.NetworkMapEnvelope
-	(*NetworkMapComponentsFull)(nil),       // 66: management.NetworkMapComponentsFull
-	(*ProxyPatch)(nil),                     // 67: management.ProxyPatch
-	(*AccountSettingsCompact)(nil),         // 68: management.AccountSettingsCompact
-	(*AccountNetwork)(nil),                 // 69: management.AccountNetwork
-	(*NetworkMapComponentsDelta)(nil),      // 70: management.NetworkMapComponentsDelta
-	(*PeerCompact)(nil),                    // 71: management.PeerCompact
-	(*PolicyCompact)(nil),                  // 72: management.PolicyCompact
-	(*ResourceCompact)(nil),                // 73: management.ResourceCompact
-	(*UserNameList)(nil),                   // 74: management.UserNameList
-	(*GroupCompact)(nil),                   // 75: management.GroupCompact
-	(*DNSSettingsCompact)(nil),             // 76: management.DNSSettingsCompact
-	(*RouteRaw)(nil),                       // 77: management.RouteRaw
-	(*NameServerGroupRaw)(nil),             // 78: management.NameServerGroupRaw
-	(*NetworkResourceRaw)(nil),             // 79: management.NetworkResourceRaw
-	(*NetworkRouterList)(nil),              // 80: management.NetworkRouterList
-	(*NetworkRouterEntry)(nil),             // 81: management.NetworkRouterEntry
-	(*PolicyIds)(nil),                      // 82: management.PolicyIds
-	(*UserIDList)(nil),                     // 83: management.UserIDList
-	(*PeerIndexSet)(nil),                   // 84: management.PeerIndexSet
-	nil,                                    // 85: management.SSHAuth.MachineUsersEntry
-	(*PortInfo_Range)(nil),                 // 86: management.PortInfo.Range
-	nil,                                    // 87: management.NetworkMapComponentsFull.RoutersMapEntry
-	nil,                                    // 88: management.NetworkMapComponentsFull.ResourcePoliciesMapEntry
-	nil,                                    // 89: management.NetworkMapComponentsFull.GroupIdToUserIdsEntry
-	nil,                                    // 90: management.NetworkMapComponentsFull.PostureFailedPeersEntry
-	nil,                                    // 91: management.PolicyCompact.AuthorizedGroupsEntry
-	(*timestamppb.Timestamp)(nil),          // 92: google.protobuf.Timestamp
-	(*durationpb.Duration)(nil),            // 93: google.protobuf.Duration
+	(*CertificateChallenge)(nil),           // 56: management.CertificateChallenge
+	(*CertificateProof)(nil),               // 57: management.CertificateProof
+	(*PortInfo)(nil),                       // 58: management.PortInfo
+	(*RouteFirewallRule)(nil),              // 59: management.RouteFirewallRule
+	(*ForwardingRule)(nil),                 // 60: management.ForwardingRule
+	(*ExposeServiceRequest)(nil),           // 61: management.ExposeServiceRequest
+	(*ExposeServiceResponse)(nil),          // 62: management.ExposeServiceResponse
+	(*RenewExposeRequest)(nil),             // 63: management.RenewExposeRequest
+	(*RenewExposeResponse)(nil),            // 64: management.RenewExposeResponse
+	(*StopExposeRequest)(nil),              // 65: management.StopExposeRequest
+	(*StopExposeResponse)(nil),             // 66: management.StopExposeResponse
+	(*NetworkMapEnvelope)(nil),             // 67: management.NetworkMapEnvelope
+	(*NetworkMapComponentsFull)(nil),       // 68: management.NetworkMapComponentsFull
+	(*ProxyPatch)(nil),                     // 69: management.ProxyPatch
+	(*AccountSettingsCompact)(nil),         // 70: management.AccountSettingsCompact
+	(*AccountNetwork)(nil),                 // 71: management.AccountNetwork
+	(*NetworkMapComponentsDelta)(nil),      // 72: management.NetworkMapComponentsDelta
+	(*PeerCompact)(nil),                    // 73: management.PeerCompact
+	(*PolicyCompact)(nil),                  // 74: management.PolicyCompact
+	(*ResourceCompact)(nil),                // 75: management.ResourceCompact
+	(*UserNameList)(nil),                   // 76: management.UserNameList
+	(*GroupCompact)(nil),                   // 77: management.GroupCompact
+	(*DNSSettingsCompact)(nil),             // 78: management.DNSSettingsCompact
+	(*RouteRaw)(nil),                       // 79: management.RouteRaw
+	(*NameServerGroupRaw)(nil),             // 80: management.NameServerGroupRaw
+	(*NetworkResourceRaw)(nil),             // 81: management.NetworkResourceRaw
+	(*NetworkRouterList)(nil),              // 82: management.NetworkRouterList
+	(*NetworkRouterEntry)(nil),             // 83: management.NetworkRouterEntry
+	(*PolicyIds)(nil),                      // 84: management.PolicyIds
+	(*UserIDList)(nil),                     // 85: management.UserIDList
+	(*PeerIndexSet)(nil),                   // 86: management.PeerIndexSet
+	nil,                                    // 87: management.SSHAuth.MachineUsersEntry
+	(*PortInfo_Range)(nil),                 // 88: management.PortInfo.Range
+	nil,                                    // 89: management.NetworkMapComponentsFull.RoutersMapEntry
+	nil,                                    // 90: management.NetworkMapComponentsFull.ResourcePoliciesMapEntry
+	nil,                                    // 91: management.NetworkMapComponentsFull.GroupIdToUserIdsEntry
+	nil,                                    // 92: management.NetworkMapComponentsFull.PostureFailedPeersEntry
+	nil,                                    // 93: management.PolicyCompact.AuthorizedGroupsEntry
+	(*timestamppb.Timestamp)(nil),          // 94: google.protobuf.Timestamp
+	(*durationpb.Duration)(nil),            // 95: google.protobuf.Duration
 }
 var file_management_proto_depIdxs = []int32{
 	12,  // 0: management.JobRequest.bundle:type_name -> management.BundleParameters
@@ -8123,8 +8295,8 @@ var file_management_proto_depIdxs = []int32{
 	40,  // 6: management.SyncResponse.remotePeers:type_name -> management.RemotePeerConfig
 	37,  // 7: management.SyncResponse.NetworkMap:type_name -> management.NetworkMap
 	55,  // 8: management.SyncResponse.Checks:type_name -> management.Checks
-	92,  // 9: management.SyncResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
-	65,  // 10: management.SyncResponse.NetworkMapEnvelope:type_name -> management.NetworkMapEnvelope
+	94,  // 9: management.SyncResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
+	67,  // 10: management.SyncResponse.NetworkMapEnvelope:type_name -> management.NetworkMapEnvelope
 	22,  // 11: management.SyncMetaRequest.meta:type_name -> management.PeerSystemMeta
 	22,  // 12: management.LoginRequest.meta:type_name -> management.PeerSystemMeta
 	18,  // 13: management.LoginRequest.peerKeys:type_name -> management.PeerKeys
@@ -8133,127 +8305,129 @@ var file_management_proto_depIdxs = []int32{
 	20,  // 16: management.PeerSystemMeta.files:type_name -> management.File
 	21,  // 17: management.PeerSystemMeta.flags:type_name -> management.Flags
 	1,   // 18: management.PeerSystemMeta.capabilities:type_name -> management.PeerCapability
-	28,  // 19: management.LoginResponse.netbirdConfig:type_name -> management.NetbirdConfig
-	35,  // 20: management.LoginResponse.peerConfig:type_name -> management.PeerConfig
-	55,  // 21: management.LoginResponse.Checks:type_name -> management.Checks
-	92,  // 22: management.LoginResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
-	22,  // 23: management.ExtendAuthSessionRequest.meta:type_name -> management.PeerSystemMeta
-	92,  // 24: management.ExtendAuthSessionResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
-	92,  // 25: management.ServerKeyResponse.expiresAt:type_name -> google.protobuf.Timestamp
-	29,  // 26: management.NetbirdConfig.stuns:type_name -> management.HostConfig
-	34,  // 27: management.NetbirdConfig.turns:type_name -> management.ProtectedHostConfig
-	29,  // 28: management.NetbirdConfig.signal:type_name -> management.HostConfig
-	30,  // 29: management.NetbirdConfig.relay:type_name -> management.RelayConfig
-	31,  // 30: management.NetbirdConfig.flow:type_name -> management.FlowConfig
-	32,  // 31: management.NetbirdConfig.metrics:type_name -> management.MetricsConfig
-	7,   // 32: management.HostConfig.protocol:type_name -> management.HostConfig.Protocol
-	93,  // 33: management.FlowConfig.interval:type_name -> google.protobuf.Duration
-	29,  // 34: management.ProtectedHostConfig.hostConfig:type_name -> management.HostConfig
-	41,  // 35: management.PeerConfig.sshConfig:type_name -> management.SSHConfig
-	36,  // 36: management.PeerConfig.autoUpdate:type_name -> management.AutoUpdateSettings
-	35,  // 37: management.NetworkMap.peerConfig:type_name -> management.PeerConfig
-	40,  // 38: management.NetworkMap.remotePeers:type_name -> management.RemotePeerConfig
-	47,  // 39: management.NetworkMap.Routes:type_name -> management.Route
-	48,  // 40: management.NetworkMap.DNSConfig:type_name -> management.DNSConfig
-	40,  // 41: management.NetworkMap.offlinePeers:type_name -> management.RemotePeerConfig
-	53,  // 42: management.NetworkMap.FirewallRules:type_name -> management.FirewallRule
-	57,  // 43: management.NetworkMap.routesFirewallRules:type_name -> management.RouteFirewallRule
-	58,  // 44: management.NetworkMap.forwardingRules:type_name -> management.ForwardingRule
-	38,  // 45: management.NetworkMap.sshAuth:type_name -> management.SSHAuth
-	85,  // 46: management.SSHAuth.machine_users:type_name -> management.SSHAuth.MachineUsersEntry
-	41,  // 47: management.RemotePeerConfig.sshConfig:type_name -> management.SSHConfig
-	2,   // 48: management.RemotePeerConfig.lazyState:type_name -> management.LazyState
-	33,  // 49: management.SSHConfig.jwtConfig:type_name -> management.JWTConfig
-	8,   // 50: management.DeviceAuthorizationFlow.Provider:type_name -> management.DeviceAuthorizationFlow.provider
-	46,  // 51: management.DeviceAuthorizationFlow.ProviderConfig:type_name -> management.ProviderConfig
-	46,  // 52: management.PKCEAuthorizationFlow.ProviderConfig:type_name -> management.ProviderConfig
-	51,  // 53: management.DNSConfig.NameServerGroups:type_name -> management.NameServerGroup
-	49,  // 54: management.DNSConfig.CustomZones:type_name -> management.CustomZone
-	50,  // 55: management.CustomZone.Records:type_name -> management.SimpleRecord
-	52,  // 56: management.NameServerGroup.NameServers:type_name -> management.NameServer
-	4,   // 57: management.FirewallRule.Direction:type_name -> management.RuleDirection
-	5,   // 58: management.FirewallRule.Action:type_name -> management.RuleAction
-	3,   // 59: management.FirewallRule.Protocol:type_name -> management.RuleProtocol
-	56,  // 60: management.FirewallRule.PortInfo:type_name -> management.PortInfo
-	86,  // 61: management.PortInfo.range:type_name -> management.PortInfo.Range
-	5,   // 62: management.RouteFirewallRule.action:type_name -> management.RuleAction
-	3,   // 63: management.RouteFirewallRule.protocol:type_name -> management.RuleProtocol
-	56,  // 64: management.RouteFirewallRule.portInfo:type_name -> management.PortInfo
-	3,   // 65: management.ForwardingRule.protocol:type_name -> management.RuleProtocol
-	56,  // 66: management.ForwardingRule.destinationPort:type_name -> management.PortInfo
-	56,  // 67: management.ForwardingRule.translatedPort:type_name -> management.PortInfo
-	6,   // 68: management.ExposeServiceRequest.protocol:type_name -> management.ExposeProtocol
-	66,  // 69: management.NetworkMapEnvelope.full:type_name -> management.NetworkMapComponentsFull
-	70,  // 70: management.NetworkMapEnvelope.delta:type_name -> management.NetworkMapComponentsDelta
-	35,  // 71: management.NetworkMapComponentsFull.peer_config:type_name -> management.PeerConfig
-	69,  // 72: management.NetworkMapComponentsFull.network:type_name -> management.AccountNetwork
-	68,  // 73: management.NetworkMapComponentsFull.account_settings:type_name -> management.AccountSettingsCompact
-	76,  // 74: management.NetworkMapComponentsFull.dns_settings:type_name -> management.DNSSettingsCompact
-	71,  // 75: management.NetworkMapComponentsFull.peers:type_name -> management.PeerCompact
-	72,  // 76: management.NetworkMapComponentsFull.policies:type_name -> management.PolicyCompact
-	75,  // 77: management.NetworkMapComponentsFull.groups:type_name -> management.GroupCompact
-	77,  // 78: management.NetworkMapComponentsFull.routes:type_name -> management.RouteRaw
-	78,  // 79: management.NetworkMapComponentsFull.nameserver_groups:type_name -> management.NameServerGroupRaw
-	50,  // 80: management.NetworkMapComponentsFull.all_dns_records:type_name -> management.SimpleRecord
-	49,  // 81: management.NetworkMapComponentsFull.account_zones:type_name -> management.CustomZone
-	79,  // 82: management.NetworkMapComponentsFull.network_resources:type_name -> management.NetworkResourceRaw
-	87,  // 83: management.NetworkMapComponentsFull.routers_map:type_name -> management.NetworkMapComponentsFull.RoutersMapEntry
-	88,  // 84: management.NetworkMapComponentsFull.resource_policies_map:type_name -> management.NetworkMapComponentsFull.ResourcePoliciesMapEntry
-	89,  // 85: management.NetworkMapComponentsFull.group_id_to_user_ids:type_name -> management.NetworkMapComponentsFull.GroupIdToUserIdsEntry
-	90,  // 86: management.NetworkMapComponentsFull.posture_failed_peers:type_name -> management.NetworkMapComponentsFull.PostureFailedPeersEntry
-	67,  // 87: management.NetworkMapComponentsFull.proxy_patch:type_name -> management.ProxyPatch
-	40,  // 88: management.ProxyPatch.peers:type_name -> management.RemotePeerConfig
-	40,  // 89: management.ProxyPatch.offline_peers:type_name -> management.RemotePeerConfig
-	53,  // 90: management.ProxyPatch.firewall_rules:type_name -> management.FirewallRule
-	47,  // 91: management.ProxyPatch.routes:type_name -> management.Route
-	57,  // 92: management.ProxyPatch.route_firewall_rules:type_name -> management.RouteFirewallRule
-	58,  // 93: management.ProxyPatch.forwarding_rules:type_name -> management.ForwardingRule
-	5,   // 94: management.PolicyCompact.action:type_name -> management.RuleAction
-	3,   // 95: management.PolicyCompact.protocol:type_name -> management.RuleProtocol
-	86,  // 96: management.PolicyCompact.port_ranges:type_name -> management.PortInfo.Range
-	91,  // 97: management.PolicyCompact.authorized_groups:type_name -> management.PolicyCompact.AuthorizedGroupsEntry
-	73,  // 98: management.PolicyCompact.source_resource:type_name -> management.ResourceCompact
-	73,  // 99: management.PolicyCompact.destination_resource:type_name -> management.ResourceCompact
-	73,  // 100: management.GroupCompact.resources:type_name -> management.ResourceCompact
-	52,  // 101: management.NameServerGroupRaw.nameservers:type_name -> management.NameServer
-	81,  // 102: management.NetworkRouterList.entries:type_name -> management.NetworkRouterEntry
-	39,  // 103: management.SSHAuth.MachineUsersEntry.value:type_name -> management.MachineUserIndexes
-	80,  // 104: management.NetworkMapComponentsFull.RoutersMapEntry.value:type_name -> management.NetworkRouterList
-	82,  // 105: management.NetworkMapComponentsFull.ResourcePoliciesMapEntry.value:type_name -> management.PolicyIds
-	83,  // 106: management.NetworkMapComponentsFull.GroupIdToUserIdsEntry.value:type_name -> management.UserIDList
-	84,  // 107: management.NetworkMapComponentsFull.PostureFailedPeersEntry.value:type_name -> management.PeerIndexSet
-	74,  // 108: management.PolicyCompact.AuthorizedGroupsEntry.value:type_name -> management.UserNameList
-	9,   // 109: management.ManagementService.Login:input_type -> management.EncryptedMessage
-	9,   // 110: management.ManagementService.Sync:input_type -> management.EncryptedMessage
-	27,  // 111: management.ManagementService.GetServerKey:input_type -> management.Empty
-	27,  // 112: management.ManagementService.isHealthy:input_type -> management.Empty
-	9,   // 113: management.ManagementService.GetDeviceAuthorizationFlow:input_type -> management.EncryptedMessage
-	9,   // 114: management.ManagementService.GetPKCEAuthorizationFlow:input_type -> management.EncryptedMessage
-	9,   // 115: management.ManagementService.SyncMeta:input_type -> management.EncryptedMessage
-	9,   // 116: management.ManagementService.Logout:input_type -> management.EncryptedMessage
-	9,   // 117: management.ManagementService.Job:input_type -> management.EncryptedMessage
-	9,   // 118: management.ManagementService.ExtendAuthSession:input_type -> management.EncryptedMessage
-	9,   // 119: management.ManagementService.CreateExpose:input_type -> management.EncryptedMessage
-	9,   // 120: management.ManagementService.RenewExpose:input_type -> management.EncryptedMessage
-	9,   // 121: management.ManagementService.StopExpose:input_type -> management.EncryptedMessage
-	9,   // 122: management.ManagementService.Login:output_type -> management.EncryptedMessage
-	9,   // 123: management.ManagementService.Sync:output_type -> management.EncryptedMessage
-	26,  // 124: management.ManagementService.GetServerKey:output_type -> management.ServerKeyResponse
-	27,  // 125: management.ManagementService.isHealthy:output_type -> management.Empty
-	9,   // 126: management.ManagementService.GetDeviceAuthorizationFlow:output_type -> management.EncryptedMessage
-	9,   // 127: management.ManagementService.GetPKCEAuthorizationFlow:output_type -> management.EncryptedMessage
-	27,  // 128: management.ManagementService.SyncMeta:output_type -> management.Empty
-	27,  // 129: management.ManagementService.Logout:output_type -> management.Empty
-	9,   // 130: management.ManagementService.Job:output_type -> management.EncryptedMessage
-	9,   // 131: management.ManagementService.ExtendAuthSession:output_type -> management.EncryptedMessage
-	9,   // 132: management.ManagementService.CreateExpose:output_type -> management.EncryptedMessage
-	9,   // 133: management.ManagementService.RenewExpose:output_type -> management.EncryptedMessage
-	9,   // 134: management.ManagementService.StopExpose:output_type -> management.EncryptedMessage
-	122, // [122:135] is the sub-list for method output_type
-	109, // [109:122] is the sub-list for method input_type
-	109, // [109:109] is the sub-list for extension type_name
-	109, // [109:109] is the sub-list for extension extendee
-	0,   // [0:109] is the sub-list for field type_name
+	57,  // 19: management.PeerSystemMeta.certificateProofs:type_name -> management.CertificateProof
+	28,  // 20: management.LoginResponse.netbirdConfig:type_name -> management.NetbirdConfig
+	35,  // 21: management.LoginResponse.peerConfig:type_name -> management.PeerConfig
+	55,  // 22: management.LoginResponse.Checks:type_name -> management.Checks
+	94,  // 23: management.LoginResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
+	22,  // 24: management.ExtendAuthSessionRequest.meta:type_name -> management.PeerSystemMeta
+	94,  // 25: management.ExtendAuthSessionResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
+	94,  // 26: management.ServerKeyResponse.expiresAt:type_name -> google.protobuf.Timestamp
+	29,  // 27: management.NetbirdConfig.stuns:type_name -> management.HostConfig
+	34,  // 28: management.NetbirdConfig.turns:type_name -> management.ProtectedHostConfig
+	29,  // 29: management.NetbirdConfig.signal:type_name -> management.HostConfig
+	30,  // 30: management.NetbirdConfig.relay:type_name -> management.RelayConfig
+	31,  // 31: management.NetbirdConfig.flow:type_name -> management.FlowConfig
+	32,  // 32: management.NetbirdConfig.metrics:type_name -> management.MetricsConfig
+	7,   // 33: management.HostConfig.protocol:type_name -> management.HostConfig.Protocol
+	95,  // 34: management.FlowConfig.interval:type_name -> google.protobuf.Duration
+	29,  // 35: management.ProtectedHostConfig.hostConfig:type_name -> management.HostConfig
+	41,  // 36: management.PeerConfig.sshConfig:type_name -> management.SSHConfig
+	36,  // 37: management.PeerConfig.autoUpdate:type_name -> management.AutoUpdateSettings
+	35,  // 38: management.NetworkMap.peerConfig:type_name -> management.PeerConfig
+	40,  // 39: management.NetworkMap.remotePeers:type_name -> management.RemotePeerConfig
+	47,  // 40: management.NetworkMap.Routes:type_name -> management.Route
+	48,  // 41: management.NetworkMap.DNSConfig:type_name -> management.DNSConfig
+	40,  // 42: management.NetworkMap.offlinePeers:type_name -> management.RemotePeerConfig
+	53,  // 43: management.NetworkMap.FirewallRules:type_name -> management.FirewallRule
+	59,  // 44: management.NetworkMap.routesFirewallRules:type_name -> management.RouteFirewallRule
+	60,  // 45: management.NetworkMap.forwardingRules:type_name -> management.ForwardingRule
+	38,  // 46: management.NetworkMap.sshAuth:type_name -> management.SSHAuth
+	87,  // 47: management.SSHAuth.machine_users:type_name -> management.SSHAuth.MachineUsersEntry
+	41,  // 48: management.RemotePeerConfig.sshConfig:type_name -> management.SSHConfig
+	2,   // 49: management.RemotePeerConfig.lazyState:type_name -> management.LazyState
+	33,  // 50: management.SSHConfig.jwtConfig:type_name -> management.JWTConfig
+	8,   // 51: management.DeviceAuthorizationFlow.Provider:type_name -> management.DeviceAuthorizationFlow.provider
+	46,  // 52: management.DeviceAuthorizationFlow.ProviderConfig:type_name -> management.ProviderConfig
+	46,  // 53: management.PKCEAuthorizationFlow.ProviderConfig:type_name -> management.ProviderConfig
+	51,  // 54: management.DNSConfig.NameServerGroups:type_name -> management.NameServerGroup
+	49,  // 55: management.DNSConfig.CustomZones:type_name -> management.CustomZone
+	50,  // 56: management.CustomZone.Records:type_name -> management.SimpleRecord
+	52,  // 57: management.NameServerGroup.NameServers:type_name -> management.NameServer
+	4,   // 58: management.FirewallRule.Direction:type_name -> management.RuleDirection
+	5,   // 59: management.FirewallRule.Action:type_name -> management.RuleAction
+	3,   // 60: management.FirewallRule.Protocol:type_name -> management.RuleProtocol
+	58,  // 61: management.FirewallRule.PortInfo:type_name -> management.PortInfo
+	56,  // 62: management.Checks.certificateChallenge:type_name -> management.CertificateChallenge
+	88,  // 63: management.PortInfo.range:type_name -> management.PortInfo.Range
+	5,   // 64: management.RouteFirewallRule.action:type_name -> management.RuleAction
+	3,   // 65: management.RouteFirewallRule.protocol:type_name -> management.RuleProtocol
+	58,  // 66: management.RouteFirewallRule.portInfo:type_name -> management.PortInfo
+	3,   // 67: management.ForwardingRule.protocol:type_name -> management.RuleProtocol
+	58,  // 68: management.ForwardingRule.destinationPort:type_name -> management.PortInfo
+	58,  // 69: management.ForwardingRule.translatedPort:type_name -> management.PortInfo
+	6,   // 70: management.ExposeServiceRequest.protocol:type_name -> management.ExposeProtocol
+	68,  // 71: management.NetworkMapEnvelope.full:type_name -> management.NetworkMapComponentsFull
+	72,  // 72: management.NetworkMapEnvelope.delta:type_name -> management.NetworkMapComponentsDelta
+	35,  // 73: management.NetworkMapComponentsFull.peer_config:type_name -> management.PeerConfig
+	71,  // 74: management.NetworkMapComponentsFull.network:type_name -> management.AccountNetwork
+	70,  // 75: management.NetworkMapComponentsFull.account_settings:type_name -> management.AccountSettingsCompact
+	78,  // 76: management.NetworkMapComponentsFull.dns_settings:type_name -> management.DNSSettingsCompact
+	73,  // 77: management.NetworkMapComponentsFull.peers:type_name -> management.PeerCompact
+	74,  // 78: management.NetworkMapComponentsFull.policies:type_name -> management.PolicyCompact
+	77,  // 79: management.NetworkMapComponentsFull.groups:type_name -> management.GroupCompact
+	79,  // 80: management.NetworkMapComponentsFull.routes:type_name -> management.RouteRaw
+	80,  // 81: management.NetworkMapComponentsFull.nameserver_groups:type_name -> management.NameServerGroupRaw
+	50,  // 82: management.NetworkMapComponentsFull.all_dns_records:type_name -> management.SimpleRecord
+	49,  // 83: management.NetworkMapComponentsFull.account_zones:type_name -> management.CustomZone
+	81,  // 84: management.NetworkMapComponentsFull.network_resources:type_name -> management.NetworkResourceRaw
+	89,  // 85: management.NetworkMapComponentsFull.routers_map:type_name -> management.NetworkMapComponentsFull.RoutersMapEntry
+	90,  // 86: management.NetworkMapComponentsFull.resource_policies_map:type_name -> management.NetworkMapComponentsFull.ResourcePoliciesMapEntry
+	91,  // 87: management.NetworkMapComponentsFull.group_id_to_user_ids:type_name -> management.NetworkMapComponentsFull.GroupIdToUserIdsEntry
+	92,  // 88: management.NetworkMapComponentsFull.posture_failed_peers:type_name -> management.NetworkMapComponentsFull.PostureFailedPeersEntry
+	69,  // 89: management.NetworkMapComponentsFull.proxy_patch:type_name -> management.ProxyPatch
+	40,  // 90: management.ProxyPatch.peers:type_name -> management.RemotePeerConfig
+	40,  // 91: management.ProxyPatch.offline_peers:type_name -> management.RemotePeerConfig
+	53,  // 92: management.ProxyPatch.firewall_rules:type_name -> management.FirewallRule
+	47,  // 93: management.ProxyPatch.routes:type_name -> management.Route
+	59,  // 94: management.ProxyPatch.route_firewall_rules:type_name -> management.RouteFirewallRule
+	60,  // 95: management.ProxyPatch.forwarding_rules:type_name -> management.ForwardingRule
+	5,   // 96: management.PolicyCompact.action:type_name -> management.RuleAction
+	3,   // 97: management.PolicyCompact.protocol:type_name -> management.RuleProtocol
+	88,  // 98: management.PolicyCompact.port_ranges:type_name -> management.PortInfo.Range
+	93,  // 99: management.PolicyCompact.authorized_groups:type_name -> management.PolicyCompact.AuthorizedGroupsEntry
+	75,  // 100: management.PolicyCompact.source_resource:type_name -> management.ResourceCompact
+	75,  // 101: management.PolicyCompact.destination_resource:type_name -> management.ResourceCompact
+	75,  // 102: management.GroupCompact.resources:type_name -> management.ResourceCompact
+	52,  // 103: management.NameServerGroupRaw.nameservers:type_name -> management.NameServer
+	83,  // 104: management.NetworkRouterList.entries:type_name -> management.NetworkRouterEntry
+	39,  // 105: management.SSHAuth.MachineUsersEntry.value:type_name -> management.MachineUserIndexes
+	82,  // 106: management.NetworkMapComponentsFull.RoutersMapEntry.value:type_name -> management.NetworkRouterList
+	84,  // 107: management.NetworkMapComponentsFull.ResourcePoliciesMapEntry.value:type_name -> management.PolicyIds
+	85,  // 108: management.NetworkMapComponentsFull.GroupIdToUserIdsEntry.value:type_name -> management.UserIDList
+	86,  // 109: management.NetworkMapComponentsFull.PostureFailedPeersEntry.value:type_name -> management.PeerIndexSet
+	76,  // 110: management.PolicyCompact.AuthorizedGroupsEntry.value:type_name -> management.UserNameList
+	9,   // 111: management.ManagementService.Login:input_type -> management.EncryptedMessage
+	9,   // 112: management.ManagementService.Sync:input_type -> management.EncryptedMessage
+	27,  // 113: management.ManagementService.GetServerKey:input_type -> management.Empty
+	27,  // 114: management.ManagementService.isHealthy:input_type -> management.Empty
+	9,   // 115: management.ManagementService.GetDeviceAuthorizationFlow:input_type -> management.EncryptedMessage
+	9,   // 116: management.ManagementService.GetPKCEAuthorizationFlow:input_type -> management.EncryptedMessage
+	9,   // 117: management.ManagementService.SyncMeta:input_type -> management.EncryptedMessage
+	9,   // 118: management.ManagementService.Logout:input_type -> management.EncryptedMessage
+	9,   // 119: management.ManagementService.Job:input_type -> management.EncryptedMessage
+	9,   // 120: management.ManagementService.ExtendAuthSession:input_type -> management.EncryptedMessage
+	9,   // 121: management.ManagementService.CreateExpose:input_type -> management.EncryptedMessage
+	9,   // 122: management.ManagementService.RenewExpose:input_type -> management.EncryptedMessage
+	9,   // 123: management.ManagementService.StopExpose:input_type -> management.EncryptedMessage
+	9,   // 124: management.ManagementService.Login:output_type -> management.EncryptedMessage
+	9,   // 125: management.ManagementService.Sync:output_type -> management.EncryptedMessage
+	26,  // 126: management.ManagementService.GetServerKey:output_type -> management.ServerKeyResponse
+	27,  // 127: management.ManagementService.isHealthy:output_type -> management.Empty
+	9,   // 128: management.ManagementService.GetDeviceAuthorizationFlow:output_type -> management.EncryptedMessage
+	9,   // 129: management.ManagementService.GetPKCEAuthorizationFlow:output_type -> management.EncryptedMessage
+	27,  // 130: management.ManagementService.SyncMeta:output_type -> management.Empty
+	27,  // 131: management.ManagementService.Logout:output_type -> management.Empty
+	9,   // 132: management.ManagementService.Job:output_type -> management.EncryptedMessage
+	9,   // 133: management.ManagementService.ExtendAuthSession:output_type -> management.EncryptedMessage
+	9,   // 134: management.ManagementService.CreateExpose:output_type -> management.EncryptedMessage
+	9,   // 135: management.ManagementService.RenewExpose:output_type -> management.EncryptedMessage
+	9,   // 136: management.ManagementService.StopExpose:output_type -> management.EncryptedMessage
+	124, // [124:137] is the sub-list for method output_type
+	111, // [111:124] is the sub-list for method input_type
+	111, // [111:111] is the sub-list for extension type_name
+	111, // [111:111] is the sub-list for extension extendee
+	0,   // [0:111] is the sub-list for field type_name
 }
 
 func init() { file_management_proto_init() }
@@ -8827,7 +9001,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[47].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PortInfo); i {
+			switch v := v.(*CertificateChallenge); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -8839,7 +9013,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[48].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RouteFirewallRule); i {
+			switch v := v.(*CertificateProof); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -8851,7 +9025,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[49].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ForwardingRule); i {
+			switch v := v.(*PortInfo); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -8863,7 +9037,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[50].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ExposeServiceRequest); i {
+			switch v := v.(*RouteFirewallRule); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -8875,7 +9049,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[51].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ExposeServiceResponse); i {
+			switch v := v.(*ForwardingRule); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -8887,7 +9061,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[52].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RenewExposeRequest); i {
+			switch v := v.(*ExposeServiceRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -8899,7 +9073,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[53].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RenewExposeResponse); i {
+			switch v := v.(*ExposeServiceResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -8911,7 +9085,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[54].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*StopExposeRequest); i {
+			switch v := v.(*RenewExposeRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -8923,7 +9097,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[55].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*StopExposeResponse); i {
+			switch v := v.(*RenewExposeResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -8935,7 +9109,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[56].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*NetworkMapEnvelope); i {
+			switch v := v.(*StopExposeRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -8947,7 +9121,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[57].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*NetworkMapComponentsFull); i {
+			switch v := v.(*StopExposeResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -8959,7 +9133,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[58].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ProxyPatch); i {
+			switch v := v.(*NetworkMapEnvelope); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -8971,7 +9145,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[59].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*AccountSettingsCompact); i {
+			switch v := v.(*NetworkMapComponentsFull); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -8983,7 +9157,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[60].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*AccountNetwork); i {
+			switch v := v.(*ProxyPatch); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -8995,7 +9169,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[61].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*NetworkMapComponentsDelta); i {
+			switch v := v.(*AccountSettingsCompact); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -9007,7 +9181,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[62].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PeerCompact); i {
+			switch v := v.(*AccountNetwork); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -9019,7 +9193,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[63].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PolicyCompact); i {
+			switch v := v.(*NetworkMapComponentsDelta); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -9031,7 +9205,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[64].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ResourceCompact); i {
+			switch v := v.(*PeerCompact); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -9043,7 +9217,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[65].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UserNameList); i {
+			switch v := v.(*PolicyCompact); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -9055,7 +9229,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[66].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GroupCompact); i {
+			switch v := v.(*ResourceCompact); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -9067,7 +9241,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[67].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DNSSettingsCompact); i {
+			switch v := v.(*UserNameList); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -9079,7 +9253,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[68].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RouteRaw); i {
+			switch v := v.(*GroupCompact); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -9091,7 +9265,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[69].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*NameServerGroupRaw); i {
+			switch v := v.(*DNSSettingsCompact); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -9103,7 +9277,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[70].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*NetworkResourceRaw); i {
+			switch v := v.(*RouteRaw); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -9115,7 +9289,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[71].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*NetworkRouterList); i {
+			switch v := v.(*NameServerGroupRaw); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -9127,7 +9301,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[72].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*NetworkRouterEntry); i {
+			switch v := v.(*NetworkResourceRaw); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -9139,7 +9313,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[73].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PolicyIds); i {
+			switch v := v.(*NetworkRouterList); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -9151,7 +9325,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[74].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UserIDList); i {
+			switch v := v.(*NetworkRouterEntry); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -9163,7 +9337,19 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[75].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PeerIndexSet); i {
+			switch v := v.(*PolicyIds); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_management_proto_msgTypes[76].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UserIDList); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -9175,6 +9361,18 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[77].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PeerIndexSet); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_management_proto_msgTypes[79].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*PortInfo_Range); i {
 			case 0:
 				return &v.state
@@ -9193,11 +9391,11 @@ func file_management_proto_init() {
 	file_management_proto_msgTypes[2].OneofWrappers = []interface{}{
 		(*JobResponse_Bundle)(nil),
 	}
-	file_management_proto_msgTypes[47].OneofWrappers = []interface{}{
+	file_management_proto_msgTypes[49].OneofWrappers = []interface{}{
 		(*PortInfo_Port)(nil),
 		(*PortInfo_Range_)(nil),
 	}
-	file_management_proto_msgTypes[56].OneofWrappers = []interface{}{
+	file_management_proto_msgTypes[58].OneofWrappers = []interface{}{
 		(*NetworkMapEnvelope_Full)(nil),
 		(*NetworkMapEnvelope_Delta)(nil),
 	}
@@ -9207,7 +9405,7 @@ func file_management_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_management_proto_rawDesc,
 			NumEnums:      9,
-			NumMessages:   83,
+			NumMessages:   85,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/shared/management/proto/management.proto b/shared/management/proto/management.proto
index a85d0cd06..22c53d4e2 100644
--- a/shared/management/proto/management.proto
+++ b/shared/management/proto/management.proto
@@ -275,6 +275,7 @@ message PeerSystemMeta {
 
   repeated PeerCapability capabilities = 18;
   int32 syncMessageVersion = 19;
+  repeated CertificateProof certificateProofs = 20;
 }
 
 message LoginResponse {
@@ -715,6 +716,24 @@ message NetworkAddress {
 
 message Checks {
   repeated string Files = 1;
+  // certificateChallenge asks the peer to prove possession of a certificate chaining to caCertificates.
+  CertificateChallenge certificateChallenge = 2;
+}
+
+message CertificateChallenge {
+  // nonce is issued by management, bound to the peer and a time window; the peer signs it.
+  bytes nonce = 1;
+  // caCertificates are PEM encoded trust anchors the presented certificate must chain to.
+  repeated string caCertificates = 2;
+}
+
+// CertificateProof demonstrates possession of the private key of chain[0] by signing the challenge nonce.
+message CertificateProof {
+  bytes nonce = 1;
+  // chain is DER encoded, leaf first.
+  repeated bytes chain = 2;
+  string sigAlg = 3;
+  bytes signature = 4;
 }
 
 

From f0a40e439548ac77ddeccb6f3687420b33b16a03 Mon Sep 17 00:00:00 2001
From: Viktor Liu <17948409+lixmal@users.noreply.github.com>
Date: Fri, 9 Oct 2026 22:42:18 +0900
Subject: [PATCH 34/70] [client, management] Harden the certificate posture
 client and keep challenge nonces fresh (#8052)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* implement certificate posture check

* log signal address

* add keychain and cert store support

* read the console user's keychain through a user session helper

A root daemon cannot reach a login keychain: securityd is per session and a
key ACL needs a session to prompt in, so dropping uid is not enough. The
daemon now answers certificate challenges from the System keychain itself,
where MDM installs device identities, and launches "netbird posture
cert-proof" into the console user's desktop session with launchctl asuser
for the login keychain. Only the signature and the chain cross back, never
the private key.

The console user comes from SCDynamicStoreCopyConsoleUser, bound with purego
like the keychain calls. The login window reports no user, root, or
"loginwindow", and all three are treated as no keychain to read, so a Mac at
the lock screen sends device proofs alone.

Adds info logging across the path: the keychain search list, per class query
status and item counts, the chain built per candidate, and the verification
error for every rejected candidate. A run that sends nothing now says why.

README.md documents the trust model, the console user limitation and how to
read the logs.

* read the signed-in user's certificate store on Windows

A service reads LocalMachine\MY, where AD and Intune enrol device
certificates. CurrentUser\MY lives in the signed-in user's registry hive
with keys protected against their profile, and a service that opens it does
not fail: "current user" resolves to HKU\S-1-5-18, so it silently reads the
service account's own empty store. The service therefore reads the machine
store itself and launches "netbird posture cert-proof" with the session
token for the rest, mirroring the macOS console user helper.

Windows lets a privileged service assume a user identity, so the token goes
straight into the child process and no external tooling is involved.
CREATE_NO_WINDOW keeps a console window from flashing on the desktop every
sync. In-process impersonation would also work but is per OS thread while
goroutines migrate, so the child process avoids that class of bug.

Session selection prefers the physical console and falls back to any active
session, so remote desktop and VDI hosts are covered. WTSQueryUserToken
needs SE_TCB_NAME, so a user-run client skips the helper and reads the
machine store alone.

SystemStore takes a store location, gaining NewUserStore alongside
NewSystemStore and the per candidate logging macOS already had. The request
building and proof merging move to helper_spawn.go, shared by both
platforms, and helperStore picks what the helper reads per platform.

* start TPM support

* split goreleaser to support pkcs11 and exclude on docker

* update goreleaser

* go mod tidy

* add tpm pin to netbird config

* split cert and key location and allow key lookup on tpm

* add unsupported flag for mobile devices

* Isolate the cert proof helper from the service environment and cap its output

* Read the PKCS#11 token PIN from NB_TPM_PIN instead of the profile config

* Bound certificate proof collection so a stuck token or keychain cannot hold the sync loop

* Stop retrying a PKCS#11 PIN the token rejected

* Log certificate posture details at debug level

* Sign only nonces and peer keys of the size management issues

* Skip certificate files whose key belongs to another certificate

* Bound PKCS#11 driver sizes, pin template values, and log out only a login the session owns

* Never pass NULL to CFRelease and skip unreadable keychain identities

* Keep the macOS keychain code out of iOS and the PKCS#11 driver out of Android

* Find a chain to each challenge's CAs through every intermediate the store holds

* Require a token label whenever a PKCS#11 PIN is set

* Read user certificates only from the session of the active profile's owner

* Collect certificate proofs again when the owner's session changes and report lost proofs

* Test the PKCS#11 build against SoftHSM in CI and warn once where the build has no driver

* Document where an inline PKCS#11 PIN is stored and how it is protected

* Refuse PKCS#11 URIs that this client cannot honour instead of widening the match

* Trust certificate and key files only when no other user can write or redirect them

* Explain a Windows certificate whose key only a legacy CryptoAPI provider holds

* Use platform absolute module paths in tests and add a real owner session test for Windows

* Match the Windows profile owner by name instead of resolving it through the domain controller

* Keep the certificate stores and TPM library out of the WebAssembly build

* [client] Read TSS2 key files on go-tpm, checked against the library it replaces

The TSS2 parser was the only reason this repository depended on a crypto suite
whose own build tooling it inherits. The replacement sits on go-tpm, which was
already a direct dependency and is in fact what that suite calls underneath, so
this removes a wrapper rather than porting onto a different library: the load,
the derived storage root key and the signing commands are the same calls.

Swapping a parser on the one path a customer actually runs is not something to
assert, so the two are held side by side for this commit. One test feeds the
replacement bytes the old library wrote and requires the same key type, empty
auth flag, parent handle, blobs and decoded public key; the other feeds both the
fixtures the tests are built on, so those are the shape the format calls for and
not merely the shape the new parser reads. The scaffolding goes away with the
dependency in the commit that follows.

The encoder behind the fixtures is written out separately from the parser under
test, so an encoder bug and a decoder bug cannot cancel each other out.

* [client] Drop go.step.sm/crypto and the repo-wide upgrades it imposed

The TSS2 parser was the only thing in the repository that used this module, and
it brought 302 modules into the graph to do it — 35 of them linters, along with
Google Cloud KMS and IAM, the AWS SDK and a terminal styling library. Those are
the module's own development dependencies, which minimal version selection turns
into floors in ours, and they are the whole reason gRPC, protobuf, the AWS SDK,
OpenTelemetry, logrus and five x/ packages had moved. Management, signal, relay
and proxy inherited every one of them for a feature none of them runs.

Removing the import is not enough, because tidy never downgrades: the raised
floors stay written in go.mod. Each one is pinned back to the version main had,
then tidy is left to raise again whatever something still genuinely needs. It
raised nothing: all 43 are back where they were, and go-tpm was already in the
graph at the same version, so the certificate feature now costs no new module at
all.

The differential tests go with it. They existed to check the swap against the
library while both were present, and there is nothing left to compare against.

* [client] Clear the lint findings only the macOS and Windows runners see

golangci-lint analyses one build at a time, so running it on Linux says nothing
about the two platforms CI also lints. Against those builds the feature's
packages reported eight findings, and the structural one is Config.dir: it is
dead on macOS and Windows because neither reads a directory at all, their
collectors take the configuration and discard it. Moving the method beside its
only callers makes that visible in the layout instead of in a linter, and leaves
the gap itself — no file or token store on those platforms — where it belongs,
as something to decide rather than something to silence.

An absent key file beside a certificate was reported as a nil signer with a nil
error, which the caller then had to recognise by its nilness. It is a sentinel
now, so the meaning is in the error rather than in the absence of one.

The rest follow the standard library: the elliptic coordinates and the private
scalar come from the encoding helpers rather than the deprecated big.Int fields,
and an error string loses its trailing colon.

Lint is clean on linux, darwin and windows; the hardware TPM path was exercised
separately against a real device and passes.

* Accept the TSS2 emptyAuth boolean OpenSSL writes and persistent parents on 32-bit builds

* Count the certificates field in the peer meta store test

* Check the store directory before listing it, refuse group-writable files, and reject a URI with two PIN sources

* Share a PKCS#11 login between sessions and send each PIN at most once at a time

* Collect certificate proofs again when the meta sync carrying them failed

* Use no Windows user store when a domainless owner matches accounts of several domains

* Use no user certificate store when the active profile's owner cannot be read

* Document the PIN sources on CertPKCS11URI and keep the README PIN example off the command line

* Test that the PKCS#11 URI stays out of the debug bundle and run the wrong-PIN test only on a disposable token

* Refuse a TPM PSS signature request for the maximum salt length

* Add the certificate fields to the network map golden data

* Retry posture checks whose meta sync timed out instead of dropping them

* Start no system info gathering while a timed-out one is still running

* Guard the applied posture checks across goroutines and keep refreshing proofs while a pending update times out

* Log what a successful certificate proof helper wrote to stderr

* Send recollected certificate proofs to management only when the proven chains changed

* Explain a macOS keychain key whose access list does not allow netbird

* Kill the whole macOS certificate helper process group when it times out

* End sudo option parsing before the macOS certificate helper binary

* Hold off system info gathering only while a timed-out one is still running

* Collect certificate proofs on the posture watcher instead of under the sync lock

* Read the certificate store directory and PKCS#11 URI from the daemon environment, not the profile config

* Install the RPM sysconfig file readable by root only and show the certificate posture variables

* Move the certificate posture README into the package doc and the docs site

* Name NB_CERT_PKCS11_URI in the PIN-without-token error

* Keep the file check results of the latest-started system info refresh

* Give the full import command for a keychain key netbird may not use, and correct the package doc

* Restrict the service environment file to root on every package install

* Search only the System keychain in the macOS daemon and only the login keychain in the user helper

* Let the certificate proof helper read the PKCS#11 token from the environment on Linux

* Ask a macOS user's keychain again only after an hour when it proved nothing

* Clear the lint findings in certificate posture

* Hold off the keychain helper only after a completed or timed-out run, independent of CA order

* Keep free functions out of the method lists of PKCS11Store, URI and Challenger

* Name the post-install permission helper in snake case and shorten the sysconfig certificate block

* Drop the certificate store directory from certproof.Config, which only NB_CERT_STORE_DIR sets

* [management] Renew certificate challenge nonces on quiet accounts

A certificate challenge nonce is accepted for its own window and the one before
it, and it only reaches a peer attached to a network map. An account where
nothing changes sends no map, so after a day the peer re-sends the nonce it
still holds, verification rejects its whole proof set, and the certificates
stored for it are dropped. It fails the certificate check and loses every policy
gated on it until some unrelated change happens to push a map. The outage
repairs itself in seconds, which is what makes it expensive: it is intermittent,
it only hits stable networks, and it is not reproducible on demand.

Push the account's peers an update often enough that the nonce they hold is
never close to expiring. Only accounts whose posture checks actually ask for a
certificate are tracked, so a deployment without the feature does no extra work.

The refresh runs from one goroutine over a map of accounts rather than a timer
per account: the period is hours, so one pass every few minutes costs nothing
next to it, and there is no timer to re-arm when an account that falls due
sooner appears. Each account's first run is offset by a hash of its ID, because
the challenge window is global and an instance restart would otherwise arm every
account in the same moment.

The push carries no administrative change, so it is counted as a refresh rather
than an update and stays out of the figures that track what was edited.

(cherry picked from commit 7ad4a0df376eecf01dd23e081b5f5a8c98b1a9f5)

* [management] Make the certificate challenge window one knob to turn

Renewal was timed against the window in two different ways: the period derived
from it, the sweep interval did not. Shortening the window to watch a renewal in
an end-to-end run would have left the refresher still looking for due accounts
every quarter of an hour, so nothing would have been renewed in time and the
test would have reported the feature broken.

Derive the sweep from the period, within bounds that keep a very short window
from spinning and a normal one from checking less often than is useful, and
allow the window itself to be set through the environment so a run can take
seconds instead of half a day. A value that cannot be parsed or falls outside
the bounds keeps the default, because a window nobody intended is a security
property nobody chose, and an override is logged at warning level since it sets
how long a device keeps passing the check after its key is gone.

Every instance has to be given the same value: the window is part of the nonce,
so instances that disagree reject each other's.

(cherry picked from commit 0e38fcf409d1f602765e971e597edc23f0c0f844)

* [management] Pin the property that makes per-peer nonce state unnecessary

A nonce carries the window it was minted in, not the instant, and is accepted
for that window and the one before it. So a peer re-stamped at least once per
window can never be left holding one outside the accepted pair, whenever it was
last served and however much life its own nonce had left. That is the whole
reason management tracks nothing per peer, and it was resting on an argument
rather than a test.

The phases are part of the property, not decoration: accounts are deliberately
given a refresh phase of their own, so the guarantee has to hold off the window
boundary too. The negative case shows why that matters — a cadence of exactly
two windows lands inside the grace window when it is aligned to the boundary and
leaves a gap when it is not.

(cherry picked from commit dee68facfd926890c2c404362622b4aeba873844)

* [management] Renew challenges only for the peers that answer one

The refresh pushed an update to every connected peer of the account, while only
the peers a certificate check applies to carry a nonce. On an account where a
handful of peers sit behind the check and the rest do not, everyone was woken
several times a day to be handed a map that changed nothing for them.

Push to the sources of the enabled policies whose posture checks include a
certificate check, which is exactly the set that is sent a challenge.

Resolving the set the other way round than the gRPC layer does is the risk here:
a peer the refresh forgets stops being renewed and falls out of its policies
silently, which is the failure this whole mechanism exists to prevent. So the
selection is held against processPeerPostureChecks, the per-peer rule that
decides who receives a challenge in the first place, by a test that asks both
the same question and requires the same answer.

(cherry picked from commit dc4d0e02742a621edd62f7287d40745c7a3c48ac)

* [management] Derive certificate challenge nonces from the stored encryption key

The nonce secret came from the server's WireGuard key, which is generated afresh
in every process and never persisted. A nonce carries no state, so the only
thing that lets one instance verify what another issued is deriving the same
secret — and that premise, written in the comment above the challenger, was not
met: every instance had its own key.

A peer reconnecting after a restart therefore presented a nonce minted under the
previous secret, verification failed with a mismatch, its whole proof set was
rejected and the certificates stored for it were dropped until it signed again.
Reproduced three times on the lab, each one logging "nonce was not issued to
this peer", which only a changed secret produces. On a single instance it costs
seconds of lost policy access per restart; across instances it is not transient
at all, because every reconnect that lands elsewhere is rejected the same way.

Derive from the data store encryption key instead: it is generated once, written
back to the configuration and read by every instance, so it survives restarts
and is shared. Where none is configured the secret falls back to the WireGuard
key with a warning — degraded but still unpredictable, which is the property
that matters most: a peer able to guess it could mint the nonces of future
windows, sign them while its key is present and keep passing after it is gone.

The challenger is now built once and passed to the two places that need it,
rather than re-derived per message.

(cherry picked from commit 278f2f3807811476d57463999df0349018e45484)

* [management] Register an account for renewal where its nonce is issued

Renewal was armed when a peer connected or when a posture check was saved, both
of which ask the store whether the account has a certificate check. That misses
the case it most needs to catch: the check is created through one instance while
the peers are connected to another, so the instance serving them never learns it
has anything to renew and their nonce expires. It also charged a query to every
peer connect in every account, including the ones that will never use the
feature, which a fleet reconnecting after a restart pays all at once.

Register where the nonce is actually stamped instead. A nonce is verified from a
shared secret and so travels between instances, but the renewal that keeps it
fresh cannot: only the instance holding a peer's stream can push to it. Issuing
and renewing now line up by construction — an instance renews exactly the
accounts it has issued nonces for — and an instance that never issues one has
nothing to renew, so there is no case left to miss.

The registration is a map insert with no store access, which is what lets it sit
on a path taken by every login and every initial sync.

Reported by Viktor Liu, who also proposed registering at the point of issue.

(cherry picked from commit 2d16dd7d7cf54762f2e64c5630ea092f32ef63ab)

* [management] Register for renewal on pushed updates, not only on connect

Registering where the nonce is stamped only covered the login and the initial
sync, which both happen when a peer opens a stream. That left out the path the
mechanism exists for.

On the cloud the network map controller is wrapped so that an update publishes
to an event bus instead of pushing locally: an instance handling a REST change
broadcasts, and every instance holding a peer of that account pushes to its own.
Those pushes stamp a nonce through the update handler, and nothing there
registered, so an instance learned about an account only when one of its peers
happened to reconnect. For a quiet fleet that is the original bug: the check is
created, the peers are told about it, and nobody renews what they were told.

Registering on the pushed update closes it, and is the difference between
stamping and marking a peer connected — one happens on every push, the other
only when a stream opens. Reported by Viktor Liu; the broadcast that makes it
work was pointed out by Pascal Fischer.

(cherry picked from commit 59efe8d93e53bacdf57cb546f4ab2c19dc4eddab)

* [management] Let the challenge refresh loop stop with the manager that owns it

The loop was started on a context explicitly detached from the caller's, so
nothing could ever stop it. Production is unaffected either way, since
BuildManager is called with context.Background(), but a test that builds a
manager leaked a sweeping goroutine for the rest of the run, and a shutdown
path added later would have had no way to reach it.

Take the manager's context as the request buffer built on the line above
already does. The test pins the contract the loop offers, so a detached
context cannot come back inside Start either.

* [management] Bound one account's challenge refresh so it cannot starve the rest

Resolving which peers answer a challenge reads the store three times, and the
refresher sweeps accounts one after another on a single goroutine. A read that
never returns held the sweep for the life of the process, so every other
account on the instance stopped being renewed and its peers fell out of the
policies gated on the check: one account's bad luck became an outage for all
of them.

Give each refresh the sweep interval it is allowed to occupy, capped at 30s so
a 12-hour window does not grant minutes to a query that should take
milliseconds. A refresh that runs out of time keeps its account tracked, since
a deadline says nothing about whether that account still has a certificate
check.

* [management] Send challenge refreshes down the path the rest of management uses

The refresh dispatched through UpdateAffectedPeers, the one variant that takes
no reason, so it was missing from the update counters and coalesced with
nothing. An administrator editing a policy while the sweep ran made the
account's network map twice over, and UpdateOperationRefresh, added for
exactly this caller, was never referenced.

Buffer it with a posture_check/refresh reason instead. The periodic push is
now visible in the metrics as what it is, distinct from an edit, and the send
detaches from the sweep deadline on its own, so that deadline bounds the store
reads it was meant for.

* [management] Keep the certificate challenge comments to what the history does not say

Four of these ran to three and four times the comment budget, the longest at
992 characters. Most of the excess argued against designs that were never
written or explained a bug that no longer exists in the code, which is what
the commit that fixed it is for.

What is left is the part a reader cannot recover from the code: that the
nonce secret has to be persisted and unpredictable, that stamping and
renewing are decided together because only the serving instance can push, and
that the target rule is the inverse of processPeerPostureChecks.

* Keep the newest posture checks pending whatever made their meta sync fail

* Report no lost certificate when the engine stops during a proof collection

* Share the proof collection single-flight across engine restarts

* Close a PKCS#11 module that loads but cannot be used

* Fix the pending checks comments

* Renew certificate challenges only for the peers streamed to this instance

* Ignore a challenge stamp from an older sync stream of the same peer

* Kill the Windows certificate proof helper with its whole process tree

* Expect the challenge untrack in the session ownership test

* Drop an invalid certificate proof without discarding the valid ones

* Start a system info gathering beside one that has been stuck for ten timeouts

---------

Co-authored-by: pascal <pascal@netbird.io>
Co-authored-by: mlsmaycon <mlsmaycon@gmail.com>
Co-authored-by: riccardom <riccardomanfrin@gmail.com>
---
 .github/workflows/golang-test-linux.yml       |  37 ++
 .goreleaser.yaml                              |   3 +
 client/internal/certproof/README.md           | 277 ----------
 client/internal/certproof/collect.go          |  86 ++-
 client/internal/certproof/collect_darwin.go   | 101 ++--
 client/internal/certproof/collect_js.go       |  31 ++
 client/internal/certproof/collect_other.go    |  13 +-
 client/internal/certproof/collect_test.go     | 158 +++++-
 client/internal/certproof/collect_windows.go  |  57 +-
 client/internal/certproof/collector.go        |  85 +++
 client/internal/certproof/collector_test.go   | 126 +++++
 .../internal/certproof/consoleuser_darwin.go  |  18 +-
 .../certproof/consoleuser_darwin_test.go      |  12 +
 .../internal/certproof/desktopuser_windows.go | 112 +++-
 .../certproof/desktopuser_windows_test.go     |  61 +++
 client/internal/certproof/doc.go              |  26 +
 client/internal/certproof/helper.go           |   2 +-
 client/internal/certproof/helper_backoff.go   |  78 +++
 .../internal/certproof/helper_backoff_test.go |  69 +++
 .../internal/certproof/helper_kill_other.go   |  10 +
 client/internal/certproof/helper_kill_unix.go |  35 ++
 .../internal/certproof/helper_kill_windows.go |  77 +++
 .../certproof/helper_kill_windows_test.go     |  29 ++
 client/internal/certproof/helper_run.go       | 126 +++++
 client/internal/certproof/helper_run_test.go  | 119 +++++
 client/internal/certproof/helper_spawn.go     |   6 +-
 .../internal/certproof/helper_spawn_test.go   |   2 +-
 client/internal/certproof/helper_test.go      |   6 +-
 client/internal/certproof/keychain_darwin.go  | 222 ++++++--
 client/internal/certproof/pinlatch.go         |  54 ++
 client/internal/certproof/pinlatch_test.go    |  29 ++
 client/internal/certproof/pkcs11store.go      | 111 ++--
 client/internal/certproof/pkcs11store_test.go |  79 ++-
 client/internal/certproof/store.go            | 119 +++--
 client/internal/certproof/store_other.go      |  22 +-
 client/internal/certproof/store_other_test.go |  36 +-
 client/internal/certproof/store_tpm_test.go   |  10 +-
 client/internal/certproof/store_tss2.go       |  17 +
 client/internal/certproof/store_tss2_js.go    |  16 +
 client/internal/certproof/storefile_other.go  |  34 ++
 client/internal/certproof/storefile_unix.go   | 101 ++++
 .../internal/certproof/storefile_unix_test.go | 136 +++++
 .../internal/certproof/systemstore_windows.go |  27 +-
 .../certproof/systemstore_windows_test.go     |  16 +
 client/internal/connect.go                    |  38 +-
 client/internal/connect_certstore_test.go     |  26 +
 client/internal/debug/debug.go                |   2 +-
 client/internal/debug/debug_test.go           |  10 +
 client/internal/engine.go                     |  96 +++-
 client/internal/engine_authsession.go         |   2 +-
 client/internal/engine_certposture.go         | 358 +++++++++++++
 client/internal/engine_certposture_test.go    | 213 ++++++++
 client/internal/engine_test.go                | 105 ++++
 client/internal/pkcs11/driver_linux.go        |  68 ++-
 client/internal/pkcs11/driver_linux_test.go   |   2 +-
 client/internal/pkcs11/driver_stub.go         |   7 +-
 client/internal/pkcs11/pinrejected_test.go    |  19 +
 client/internal/pkcs11/pkcs11.go              |  85 ++-
 client/internal/pkcs11/publickey.go           |  10 +-
 client/internal/pkcs11/session_test.go        |  72 +++
 client/internal/pkcs11/uri.go                 |  99 ++--
 client/internal/pkcs11/uri_test.go            |  44 +-
 client/internal/profilemanager/config.go      |  20 +-
 client/internal/tpm/signer.go                 | 134 ++++-
 client/internal/tpm/signer_test.go            |  17 +-
 client/internal/tpm/tpmtest/tpmtest.go        |  97 +++-
 client/internal/tpm/tss2.go                   | 133 +++++
 client/internal/tpm/tss2_test.go              |  78 +++
 client/server/server.go                       |  16 +-
 client/system/info.go                         |  20 +-
 client/system/info_source.go                  | 139 ++++-
 client/system/info_source_test.go             | 139 +++++
 go.mod                                        |  92 ++--
 go.sum                                        | 184 ++++---
 .../internals/shared/grpc/certposture.go      |  50 +-
 .../internals/shared/grpc/certposture_test.go |  32 +-
 .../shared/grpc/peer_update_handler.go        |  36 +-
 .../grpc/proxy_connect_authorizer_test.go     |   2 +-
 .../shared/grpc/proxy_snapshot_test.go        |   2 +-
 management/internals/shared/grpc/server.go    |  25 +-
 .../shared/grpc/server_disconnect_test.go     |   3 +
 .../shared/grpc/sync_mappings_test.go         |   2 +-
 .../internals/shared/grpc/token_mgr_test.go   |   2 +-
 management/server/account.go                  |   6 +
 management/server/account/manager.go          |   2 +
 management/server/account/manager_mock.go     |  24 +
 management/server/certificate_challenge.go    | 344 ++++++++++++
 .../server/certificate_challenge_test.go      | 493 ++++++++++++++++++
 management/server/mock_server/account_mock.go |  11 +
 .../server/store/sql_store_peer_test.go       |   2 +-
 management/server/types/update_reason.go      |   3 +
 release_files/netbird.sysconfig               |   5 +
 release_files/post_install.sh                 |  11 +
 .../certposture/certposture_test.go           |  21 +
 shared/management/certposture/chain.go        |  27 +-
 shared/management/certposture/challenge.go    |  63 ++-
 .../management/certposture/challenge_test.go  | 106 ++++
 shared/management/client/grpc.go              |   2 +-
 98 files changed, 5491 insertions(+), 899 deletions(-)
 delete mode 100644 client/internal/certproof/README.md
 create mode 100644 client/internal/certproof/collect_js.go
 create mode 100644 client/internal/certproof/collector.go
 create mode 100644 client/internal/certproof/collector_test.go
 create mode 100644 client/internal/certproof/desktopuser_windows_test.go
 create mode 100644 client/internal/certproof/doc.go
 create mode 100644 client/internal/certproof/helper_backoff.go
 create mode 100644 client/internal/certproof/helper_backoff_test.go
 create mode 100644 client/internal/certproof/helper_kill_other.go
 create mode 100644 client/internal/certproof/helper_kill_unix.go
 create mode 100644 client/internal/certproof/helper_kill_windows.go
 create mode 100644 client/internal/certproof/helper_kill_windows_test.go
 create mode 100644 client/internal/certproof/helper_run.go
 create mode 100644 client/internal/certproof/helper_run_test.go
 create mode 100644 client/internal/certproof/pinlatch.go
 create mode 100644 client/internal/certproof/pinlatch_test.go
 create mode 100644 client/internal/certproof/store_tss2.go
 create mode 100644 client/internal/certproof/store_tss2_js.go
 create mode 100644 client/internal/certproof/storefile_other.go
 create mode 100644 client/internal/certproof/storefile_unix.go
 create mode 100644 client/internal/certproof/storefile_unix_test.go
 create mode 100644 client/internal/certproof/systemstore_windows_test.go
 create mode 100644 client/internal/connect_certstore_test.go
 create mode 100644 client/internal/engine_certposture.go
 create mode 100644 client/internal/engine_certposture_test.go
 create mode 100644 client/internal/pkcs11/pinrejected_test.go
 create mode 100644 client/internal/pkcs11/session_test.go
 create mode 100644 client/internal/tpm/tss2.go
 create mode 100644 client/internal/tpm/tss2_test.go
 create mode 100644 management/server/certificate_challenge.go
 create mode 100644 management/server/certificate_challenge_test.go
 create mode 100644 shared/management/certposture/challenge_test.go

diff --git a/.github/workflows/golang-test-linux.yml b/.github/workflows/golang-test-linux.yml
index dd6b9fe68..880370ede 100644
--- a/.github/workflows/golang-test-linux.yml
+++ b/.github/workflows/golang-test-linux.yml
@@ -207,6 +207,43 @@ jobs:
         # regression test, and need no frontend bundle.
         run: CGO_ENABLED=1 go test -timeout 5m ./client/ui/authsession/... ./client/ui/i18n/... ./client/ui/preferences/... ./client/ui/services/...
 
+  test_client_pkcs11:
+    name: "Client PKCS#11 / Unit"
+    # The deb and rpm packages ship the client built with the pkcs11 tag, which loads
+    # PKCS#11 modules through purego. The other jobs build without the tag, so this one
+    # compiles that driver and signs with a real SoftHSM token, the build release ships.
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Install Go
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        with:
+          go-version-file: "go.mod"
+          cache: false
+
+      - name: Install SoftHSM
+        run: sudo apt update && sudo apt install -y -q softhsm2
+
+      - name: Initialise token
+        run: |
+          mkdir -p "$RUNNER_TEMP/softhsm/tokens"
+          printf 'directories.tokendir = %s\nobjectstore.backend = file\n' "$RUNNER_TEMP/softhsm/tokens" > "$RUNNER_TEMP/softhsm/softhsm2.conf"
+          echo "SOFTHSM2_CONF=$RUNNER_TEMP/softhsm/softhsm2.conf" >> "$GITHUB_ENV"
+          SOFTHSM2_CONF="$RUNNER_TEMP/softhsm/softhsm2.conf" softhsm2-util --init-token --free --label netbird --pin 1234 --so-pin 1234
+
+      - name: Vet
+        run: CGO_ENABLED=0 go vet -tags pkcs11 ./client/internal/pkcs11/... ./client/internal/certproof/...
+
+      - name: Test
+        env:
+          NB_TEST_PKCS11_URI: "pkcs11:token=netbird?module-path=/usr/lib/softhsm/libsofthsm2.so&pin-value=1234"
+          NB_TEST_PKCS11_DISPOSABLE: "1"
+        run: CGO_ENABLED=0 go test -tags pkcs11 -timeout 5m ./client/internal/pkcs11/... ./client/internal/certproof/...
+
   test_client_on_docker:
     name: "Client (Docker) / Unit"
     needs: [build-cache]
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index a16bd8cf5..6bb4e9e8a 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -333,6 +333,9 @@ nfpms:
       - src: release_files/netbird.sysconfig
         dst: /etc/sysconfig/netbird
         type: config|noreplace
+        # May hold the PKCS#11 token PIN (NB_TPM_PIN), so readable by root alone.
+        file_info:
+          mode: 0600
     scripts:
       postinstall: "release_files/post_install.sh"
       preremove: "release_files/pre_remove.sh"
diff --git a/client/internal/certproof/README.md b/client/internal/certproof/README.md
deleted file mode 100644
index 9f7831bc0..000000000
--- a/client/internal/certproof/README.md
+++ /dev/null
@@ -1,277 +0,0 @@
-# Certificate posture proofs
-
-A peer answers a management certificate challenge by signing the challenge nonce with a
-private key it holds, and sending back the certificate chain. Management verifies the
-chain against the CAs configured on the check and verifies the signature, which proves
-the peer holds the key rather than merely a copy of the certificate.
-
-The signature covers `netbird-posture-cert-v1 || nonce || peerKey`, so a proof is bound
-to one WireGuard peer key and cannot be replayed by another peer.
-
-## Where certificates come from
-
-| Platform | Store | Read by |
-| --- | --- | --- |
-| macOS | System keychain | the daemon, directly |
-| macOS | console user's login keychain | a helper in that user's desktop session |
-| Windows | `LocalMachine\MY` | the service, directly |
-| Windows | signed-in user's `CurrentUser\MY` | a helper launched with that session's token |
-| Linux and others | PEM directory: `CertStoreDir` in the profile config, else `NB_CERT_STORE_DIR`, else `/etc/netbird/certs` | the daemon, directly |
-| Linux | a `TSS2 PRIVATE KEY` file in that directory, signed by the TPM | the daemon, through `/dev/tpmrm0` |
-| Linux | a PKCS#11 token, tpm2-pkcs11 for one, enabled by `CertPKCS11PIN` in the profile config | the daemon, through the token's module, in builds with the `pkcs11` tag |
-
-macOS and Windows both keep per-user certificates out of reach of a privileged daemon,
-and both are handled the same way: the daemon reads the machine store itself and
-launches `netbird posture cert-proof` as the signed-in user for the rest. Only the
-signature and the chain come back. The helper, the request and response types and the
-subcommand are shared; only the way the child is launched differs.
-
-## macOS: why the daemon cannot read a login keychain
-
-The daemon runs as root from a LaunchDaemon. Its keychain search list is the System
-keychain, which is where MDM installs device identities, and nothing else. A user's
-login keychain is out of reach for reasons that are not about privilege:
-
-- `login.keychain-db` is unlocked by `securityd` **in the user's session**. The daemon
-  lives in a different Mach bootstrap namespace, so from where it stands the keychain is
-  locked no matter which uid it runs as.
-- Every private key carries an ACL naming the applications allowed to use it. A process
-  that is not listed causes a consent prompt *in the user's session*. A daemon has no
-  session to show one in, so it receives `errSecInteractionNotAllowed (-25308)` instead.
-
-Dropping to the user's uid with `SysProcAttr.Credential` does **not** fix this: uid is
-not what selects the securityd instance, the bootstrap namespace is. The process has to
-enter the user's session, which is what `launchctl asuser` does.
-
-## macOS: the console user helper
-
-When a certificate challenge arrives and the daemon is root, it:
-
-1. Reads the System keychain itself, so MDM device identities are answered with no user
-   session involved.
-2. Resolves the console user with `SCDynamicStoreCopyConsoleUser`.
-3. Launches itself as that user with
-   `launchctl asuser <uid> sudo -u <user> -H netbird posture cert-proof`, writing the
-   challenges to the child's stdin as JSON and reading proofs from its stdout.
-4. Merges both sets of proofs, dropping a leaf that both keychains hold.
-
-The child runs `RunHelper`, which uses the ordinary `KeychainStore` — inside the user's
-session it simply works. **The private key never crosses the boundary; only the
-signature and the certificate chain come back.**
-
-`-H` matters: it sets `HOME`, which is how the login keychain path is resolved.
-
-`netbird posture cert-proof` is hidden and not meant to be run by hand. It writes proofs
-to stdout and every log line to stderr, so stdout stays parseable.
-
-## Windows: the service and the signed-in user
-
-`LocalMachine\MY` is what the service reads, and it is where AD and Intune enrol device
-certificates. `CurrentUser\MY` lives in the signed-in user's registry hive with private
-keys protected by DPAPI against their profile, so it is only readable while running as
-that user.
-
-The failure mode differs from macOS in an important way: a service that opens
-`CURRENT_USER` does **not** get an error. "Current user" resolves to the service
-account's own hive, `HKU\S-1-5-18`, so it silently reads an empty and irrelevant store.
-There is nothing to log. That is why the service only ever opens `LocalMachine` and asks
-a helper for the rest.
-
-Windows does let a privileged service assume a user identity, which macOS does not for
-keychains, so no external tooling is involved:
-
-```go
-windows.WTSQueryUserToken(session, &token)
-cmd.SysProcAttr = &syscall.SysProcAttr{Token: syscall.Token(token), CreationFlags: windows.CREATE_NO_WINDOW}
-```
-
-`CREATE_NO_WINDOW` matters: without it a console window flashes on the user's desktop on
-every sync.
-
-Session selection prefers the physical console, then falls back to any active session,
-so remote desktop and VDI hosts work. `WTSQueryUserToken` needs `SE_TCB_NAME`, which
-LocalSystem holds and an ordinary process does not, so a user-run `netbird up` skips the
-helper and reads the machine store alone.
-
-In-process impersonation would also work, but it is per-OS-thread while goroutines
-migrate freely, so it would need `runtime.LockOSThread` around every key operation. The
-child process avoids that class of bug entirely.
-
-Unlike macOS, the Windows store acquires keys with `CRYPT_ACQUIRE_SILENT_FLAG`, so a key
-that would need a prompt fails immediately instead of blocking. That also means a
-smartcard PIN can never be satisfied this way.
-
-## Linux: keys held by the TPM
-
-Enrollment tooling on Linux keeps a TPM-resident key as a `TSS2 PRIVATE KEY` PEM file,
-the format of draft-bottomley-tpm2-keys that tpm2-openssl, tpm2-tss-engine and
-`tpm2_encodeobject` write. The file holds the key wrapped by its parent; the TPM is the
-only thing that can use it. Drop it next to the certificate as usual:
-
-```
-openssl genpkey -provider tpm2 -algorithm EC -pkeyopt group:P-256 -out /etc/netbird/certs/device.key
-openssl req -provider tpm2 -provider default -new -key /etc/netbird/certs/device.key -subj /CN=device -out device.csr
-```
-
-Sign the CSR with the organisation CA and store the result as `device.pem`. The store
-parses the key file without touching the TPM, so the certificate is listed as a
-candidate like any other, and every signature opens `/dev/tpmrm0`, loads the key under
-its parent, signs, flushes and closes again. `NB_TPM_DEVICE` overrides the device path.
-
-What the key file may look like:
-
-- **Parent.** A persistent handle such as `0x81000001` is used as is. The owner
-  hierarchy, which both tpm2-openssl and tpm2-tss-engine default to, means the key was
-  created under a transient primary from the TCG default ECC P-256 template, and that
-  same primary is derived again before loading.
-- **No authorization value.** A key created with a password needs someone to type it,
-  which the daemon cannot arrange, so the certificate is skipped with a log line rather
-  than blocking on a TPM auth failure.
-- **RSA-2048 or P-256, sometimes P-384.** Those are what the PC Client profile requires
-  of a TPM; P-384 depends on the chip. The TPM chooses the RSA-PSS salt itself, which is
-  why management verifies PSS proofs with `rsa.PSSSaltLengthAuto`.
-
-Windows needs none of this: a certificate enrolled into the TPM sits behind the Microsoft
-Platform Crypto Provider and the CNG path above signs with it unchanged. macOS has no
-TPM; its Secure Enclave keys are reachable only through the keychain path.
-
-To exercise the path without hardware, run a software TPM and point the end-to-end test
-at it:
-
-```
-swtpm socket --tpm2 --server type=unixio,path=/tmp/swtpm.sock --ctrl type=unixio,path=/tmp/swtpm.ctrl --flags not-need-init,startup-clear
-NB_TPM_DEVICE=/tmp/swtpm.sock go test ./client/internal/certproof/ -run TestCollect_TPMKeyEndToEnd -v
-```
-
-## Linux: keys behind a PKCS#11 token
-
-Distributions that follow Red Hat's guidance reach the TPM through tpm2-pkcs11, a PKCS#11
-module whose token holds both the key and, after `tpm2_ptool addcert`, the certificate.
-The store reads that token when the profile config, `/etc/netbird/config.json` by default,
-carries the token's user PIN:
-
-```json
-"CertPKCS11PIN": "1234"
-```
-
-That alone opens the first token the p11-kit proxy exposes, which is tpm2-pkcs11 on a
-stock setup that has registered it. `CertPKCS11URI`, an RFC 7512 URI, narrows that down
-on a host with several tokens or without p11-kit:
-
-```json
-"CertPKCS11URI": "pkcs11:token=netbird?module-path=/usr/lib/x86_64-linux-gnu/libtpm2_pkcs11.so"
-```
-
-`token` selects the token by label, or the first token present when absent. `module-path`
-names the library to load; `module-name=tpm2_pkcs11` resolves to `libtpm2_pkcs11.so` on
-the loader's search path, and with neither the p11-kit proxy is loaded, which exposes every
-module the system has registered. The URI may carry the PIN itself, as `pin-value` inline
-or `pin-source` naming a file, and `CertPKCS11PIN` takes precedence over both. Without any
-PIN no login happens, and tpm2-pkcs11 then shows no private keys at all. Every other
-attribute is ignored.
-
-The certificate may live on the token or in the PEM directory: `CertStoreDir` in the
-profile config, else `NB_CERT_STORE_DIR`, else `/etc/netbird/certs`. On the token,
-certificates and private keys are paired by `CKA_ID`,
-which is what `tpm2_ptool addcert` and `pkcs11-tool` set. In the directory, a certificate
-file without a key of its own is paired with the token key whose public key it carries, so
-`device.pem` alone next to a key that only the TPM holds is enough; the token's public key
-object, which `tpm2_ptool addkey` and `import` create alongside the private one, is what
-the store compares against. Chains are completed from the certificates on the token and in
-the directory together, so intermediates may sit in either place.
-
-Each operation opens a session, logs in, works, logs out and closes, so no token handle
-outlives a call, and the PEM directory keeps working when the token does not: the two are
-queried together and a failing token is logged rather than hiding file certificates.
-
-Two consequences of the PIN are worth knowing. It is a secret on disk, which the profile
-config already is: it holds the WireGuard private key and is written readable by root
-alone, and the debug bundle's config dump leaves `CertPKCS11PIN` out. And a wrong PIN
-counts against the TPM's dictionary-attack lockout, which is shared with everything else
-on the machine that uses the TPM.
-
-The module is loaded at runtime without cgo, through `purego`, which means the binary is
-dynamically linked against libc. The store is therefore compiled in only with `-tags pkcs11`
-on linux/amd64 and linux/arm64: the deb and rpm packages are built that way, since they
-target glibc distributions, while the release tarballs and the Alpine-based container
-images keep the fully static build. Without the tag, setting `CertPKCS11PIN` logs that
-the build lacks the support.
-
-To exercise the path without hardware, initialise a SoftHSM token and run the end-to-end
-test, which imports a key and certificate itself:
-
-```
-softhsm2-util --init-token --free --label netbird --pin 1234 --so-pin 1234
-NB_TEST_PKCS11_URI='pkcs11:token=netbird?module-path=/usr/lib/softhsm/libsofthsm2.so&pin-value=1234' \
-  go test -tags pkcs11 ./client/internal/certproof/ -run PKCS11 -v
-```
-
-## Only the signed-in user can be validated
-
-This is the central limitation of the design, and it is deliberate.
-
-A proof from a user store can only ever be produced for **the user whose session is
-currently open**. Consequences worth designing around:
-
-- **At the sign-in screen there is no user proof.** macOS reports no console user or
-  attributes the console to root, and `CurrentConsoleUser` returns false for both.
-  Windows reports no active session with a token. Only machine proofs are sent, so a
-  posture check that demands a user certificate fails on a machine nobody has signed
-  into yet.
-- **Signing out changes the answer.** Posture can flip between compliant and
-  non-compliant across a sign-out, so management should treat "no proof" as its own
-  state rather than as a failed check, or users get disconnected at the sign-in screen.
-- **One session is asked, not all of them.** macOS asks the console user, so other
-  fast-user-switched accounts are skipped even though their keychains are unlocked.
-  Windows prefers the console and otherwise takes the first active session. If you ever
-  need every signed-in user, both platforms would have to enumerate sessions and ask
-  each one.
-- **A locked keychain still blocks signing.** A user can be logged in with their
-  keychain locked (locked on sleep, or manually). The helper then needs an unlock prompt
-  and may block, which is why the spawn has a 30s timeout and a failure is reported as
-  "no proof" rather than an error.
-- **The first signature prompts.** The user sees "netbird wants to use your confidential
-  information stored in ...". Choosing *Always Allow* records the helper's designated
-  requirement in the key's ACL, so it persists across restarts and updates while the
-  signing identity is stable. Unsigned or ad-hoc development builds re-prompt every run.
-
-## What a user proof does and does not attest
-
-It attests: *some process in that user's session had ACL permission to use a private key
-whose certificate chains to CA X, and signed a nonce bound to this peer key*.
-
-It does not attest that the daemon controls the key, that the key is hardware-bound, or
-that a particular binary produced the signature. Any code running in that user's session
-with an existing ACL grant can produce the same signature by calling
-`SecKeyCreateSignature` directly — the proof format is not a secret. The helper does not
-create that capability, it only packages it.
-
-If you need a stronger guarantee, use a device identity that never involves a user
-session (MDM into the System keychain, which the daemon reads directly), or a key that
-requires user presence for each signature (Secure Enclave or a PIV token).
-
-## Reading the logs
-
-Everything in this path logs at info. A healthy macOS run shows, in order:
-
-```
-certificate posture: answering N certificate challenges from store *certproof.KeychainStore
-macOS Security framework loaded for certificate posture, running as uid=0 euid=0
-keychain search list contains 2 keychains
-keychain search list[0]: /Library/Keychains/System.keychain
-keychain identity query returned N items
-certificate posture: asking the desktop session of "user" (uid 501) to answer N challenges
-certificate posture: desktop session of "user" returned N proofs
-peer meta carries N certificate posture proofs
-```
-
-Common outcomes and what they mean:
-
-| Log line | Meaning |
-| --- | --- |
-| `keychain identity query returned errSecItemNotFound (-25300)` | The keychain is readable and holds no identity of that class. Any other OSStatus is a real access failure. |
-| `holds no identities usable for certificate posture, but N readable certificates` | Reading works; the certificate is present without its private key, or is not there at all. |
-| `no console user is logged in` | Login window. Device proofs only. |
-| `has no issuer in the keychain` | The chain ships leaf-only and verifies only if the challenge supplies that exact root. |
-| `challenge N rejected "..." : x509: unhandled critical extension` | The chain is fine but Go refuses an extension in it, which is common for Apple-issued certificates. |
-| `challenge N matched none of the M candidates` | Every candidate was rejected; the preceding lines give the reason for each. |
diff --git a/client/internal/certproof/collect.go b/client/internal/certproof/collect.go
index d2b5d87b0..65affca71 100644
--- a/client/internal/certproof/collect.go
+++ b/client/internal/certproof/collect.go
@@ -2,10 +2,13 @@ package certproof
 
 import (
 	"context"
+	"crypto"
 	"crypto/sha256"
+	"crypto/x509"
 	"time"
 
 	log "github.com/sirupsen/logrus"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
 	"github.com/netbirdio/netbird/shared/management/certposture"
 	"github.com/netbirdio/netbird/shared/management/proto"
@@ -25,14 +28,24 @@ func Collect(ctx context.Context, store Store, checks []*proto.Checks, peerKey [
 
 func logNoChallenges(checks []*proto.Checks) {
 	if len(checks) > 0 {
-		log.Infof("certificate posture: %d posture checks received, none carries a certificate challenge", len(checks))
+		log.Debugf("certificate posture: %d posture checks received, none carries a certificate challenge", len(checks))
 	}
 }
 
 // CollectChallenges answers challenges already extracted from the posture checks, so a
 // caller that ships them across a process boundary reuses the same matching and signing.
+// Only nonces of the size management issues are signed, for a peer key of the size of
+// ours, so the keys behind the store never sign arbitrary caller-chosen data.
 func CollectChallenges(ctx context.Context, store Store, challenges []*proto.CertificateChallenge, peerKey []byte) []certposture.Proof {
-	log.Infof("certificate posture: answering %d certificate challenges from store %T", len(challenges), store)
+	if len(peerKey) != wgtypes.KeyLen {
+		log.Warnf("certificate posture: refusing to sign for a %d byte peer key", len(peerKey))
+		return nil
+	}
+	challenges = wellFormed(challenges)
+	if len(challenges) == 0 {
+		return nil
+	}
+	log.Debugf("certificate posture: answering %d certificate challenges from store %T", len(challenges), store)
 
 	candidates, err := store.Candidates(ctx)
 	if err != nil {
@@ -40,10 +53,10 @@ func CollectChallenges(ctx context.Context, store Store, challenges []*proto.Cer
 		return nil
 	}
 	if len(candidates) == 0 {
-		log.Info("certificate posture: certificate store holds no candidates, no proof will be sent")
+		log.Debug("certificate posture: certificate store holds no candidates, no proof will be sent")
 		return nil
 	}
-	log.Infof("certificate posture: store holds %d candidate certificates", len(candidates))
+	log.Debugf("certificate posture: store holds %d candidate certificates", len(candidates))
 
 	now := time.Now()
 	proven := make(map[[sha256.Size]byte]struct{})
@@ -54,7 +67,7 @@ func CollectChallenges(ctx context.Context, store Store, challenges []*proto.Cer
 			log.Warnf("skipping certificate challenge with invalid CA certificates: %v", err)
 			continue
 		}
-		log.Infof("certificate posture: challenge %d accepts %d CA certificates, nonce is %d bytes", i, len(challenge.GetCaCertificates()), len(challenge.GetNonce()))
+		log.Debugf("certificate posture: challenge %d accepts %d CA certificates, nonce is %d bytes", i, len(challenge.GetCaCertificates()), len(challenge.GetNonce()))
 
 		matched := false
 		for _, candidate := range candidates {
@@ -62,53 +75,84 @@ func CollectChallenges(ctx context.Context, store Store, challenges []*proto.Cer
 				continue
 			}
 			leaf := candidate.Chain[0]
-			if err := certposture.VerifyChain(candidate.Chain, roots, now); err != nil {
-				log.Infof("certificate posture: challenge %d rejected %q issued by %q, chain of %d: %v", i, leaf.Subject, leaf.Issuer, len(candidate.Chain), err)
+			chain, err := certposture.VerifiedChain(leaf, candidate.issuers(), roots, now)
+			if err != nil {
+				log.Debugf("certificate posture: challenge %d rejected %q issued by %q: %v", i, leaf.Subject, leaf.Issuer, err)
 				continue
 			}
 			matched = true
 
-			fingerprint := sha256.Sum256(leaf.Raw)
+			// The same leaf can chain to different CAs for different challenges, and
+			// management checks each chain against each check's CAs, so a proof is
+			// deduplicated by its whole chain rather than by its leaf.
+			fingerprint := chainFingerprint(chain)
 			if _, done := proven[fingerprint]; done {
-				log.Infof("certificate posture: challenge %d matched %q, already proven for an earlier challenge", i, leaf.Subject)
+				log.Debugf("certificate posture: challenge %d matched %q, already proven for an earlier challenge", i, leaf.Subject)
 				break
 			}
-			proof, err := prove(candidate, challenge.GetNonce(), peerKey)
+			proof, err := prove(candidate.Signer, chain, challenge.GetNonce(), peerKey)
 			if err != nil {
 				log.Warnf("failed signing certificate proof for %s: %v", leaf.Subject, err)
 				continue
 			}
-			log.Infof("certificate posture: challenge %d proven by %q with %s, signature %d bytes, chain of %d", i, leaf.Subject, proof.SigAlg, len(proof.Signature), len(proof.Chain))
+			log.Debugf("certificate posture: challenge %d proven by %q with %s, signature %d bytes, chain of %d", i, leaf.Subject, proof.SigAlg, len(proof.Signature), len(proof.Chain))
 			proven[fingerprint] = struct{}{}
 			proofs = append(proofs, proof)
 			break
 		}
 		if !matched {
-			log.Infof("certificate posture: challenge %d matched none of the %d candidates", i, len(candidates))
+			log.Debugf("certificate posture: challenge %d matched none of the %d candidates", i, len(candidates))
 		}
 	}
-	log.Infof("certificate posture: %d challenges produced %d proofs", len(challenges), len(proofs))
+	log.Debugf("certificate posture: %d challenges produced %d proofs", len(challenges), len(proofs))
 	return proofs
 }
 
+// HasChallenges reports whether any of checks asks for a certificate proof.
+func HasChallenges(checks []*proto.Checks) bool {
+	return len(certificateChallenges(checks)) > 0
+}
+
 func certificateChallenges(checks []*proto.Checks) []*proto.CertificateChallenge {
 	var challenges []*proto.CertificateChallenge
 	for _, check := range checks {
-		if challenge := check.GetCertificateChallenge(); challenge != nil && len(challenge.GetNonce()) > 0 {
+		if challenge := check.GetCertificateChallenge(); challenge != nil {
 			challenges = append(challenges, challenge)
 		}
 	}
-	return challenges
+	return wellFormed(challenges)
 }
 
-func prove(candidate Candidate, nonce, peerKey []byte) (certposture.Proof, error) {
-	sigAlg, sig, err := certposture.Sign(candidate.Signer, nonce, peerKey)
+// wellFormed drops challenges whose nonce is not one management could have issued.
+func wellFormed(challenges []*proto.CertificateChallenge) []*proto.CertificateChallenge {
+	var kept []*proto.CertificateChallenge
+	for _, challenge := range challenges {
+		if len(challenge.GetNonce()) != certposture.NonceSize {
+			log.Debugf("certificate posture: skipping challenge with a %d byte nonce", len(challenge.GetNonce()))
+			continue
+		}
+		kept = append(kept, challenge)
+	}
+	return kept
+}
+
+func prove(signer crypto.Signer, chain []*x509.Certificate, nonce, peerKey []byte) (certposture.Proof, error) {
+	sigAlg, sig, err := certposture.Sign(signer, nonce, peerKey)
 	if err != nil {
 		return certposture.Proof{}, err
 	}
-	chain := make([][]byte, 0, len(candidate.Chain))
-	for _, cert := range candidate.Chain {
-		chain = append(chain, cert.Raw)
+	der := make([][]byte, 0, len(chain))
+	for _, cert := range chain {
+		der = append(der, cert.Raw)
 	}
-	return certposture.Proof{Nonce: nonce, Chain: chain, SigAlg: sigAlg, Signature: sig}, nil
+	return certposture.Proof{Nonce: nonce, Chain: der, SigAlg: sigAlg, Signature: sig}, nil
+}
+
+func chainFingerprint(chain []*x509.Certificate) [sha256.Size]byte {
+	buf := make([]byte, 0, len(chain)*sha256.Size)
+	for _, cert := range chain {
+		certHash := sha256.Sum256(cert.Raw)
+		buf = append(buf, certHash[:]...)
+	}
+	return sha256.Sum256(buf)
 }
diff --git a/client/internal/certproof/collect_darwin.go b/client/internal/certproof/collect_darwin.go
index b52f00e50..92f0471e7 100644
--- a/client/internal/certproof/collect_darwin.go
+++ b/client/internal/certproof/collect_darwin.go
@@ -1,14 +1,15 @@
+//go:build !ios
+
 package certproof
 
 import (
-	"bytes"
 	"context"
-	"encoding/json"
+	"errors"
 	"fmt"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"strconv"
-	"strings"
 	"time"
 
 	log "github.com/sirupsen/logrus"
@@ -19,12 +20,15 @@ import (
 
 const helperTimeout = 30 * time.Second
 
+// userHelperBackoff holds off asking a user's keychain again after it proved nothing.
+var userHelperBackoff = newHelperBackoff()
+
 // CollectProofs answers the certificate challenges in checks from every store this Mac
 // can reach. The root daemon reads the System keychain itself, which is where MDM
 // installs device identities, and reaches the console user's login keychain only by
 // launching a helper into that user's session. A Mac sitting at the login window
 // therefore yields device proofs alone.
-func CollectProofs(ctx context.Context, checks []*proto.Checks, peerKey []byte, _ Config) []certposture.Proof {
+func CollectProofs(ctx context.Context, checks []*proto.Checks, peerKey []byte, cfg Config) []certposture.Proof {
 	challenges := certificateChallenges(checks)
 	if len(challenges) == 0 {
 		logNoChallenges(checks)
@@ -38,59 +42,96 @@ func CollectProofs(ctx context.Context, checks []*proto.Checks, peerKey []byte,
 	}
 
 	proofs := CollectChallenges(ctx, DefaultStore(), challenges, peerKey)
+	if cfg.OwnerUnknown {
+		return proofs
+	}
 
-	userProofs, err := collectAsConsoleUser(ctx, challenges, peerKey)
+	userProofs, err := collectAsConsoleUser(ctx, cfg.ProfileOwner, challenges, peerKey)
 	if err != nil {
-		log.Infof("certificate posture: console user keychain unavailable: %v", err)
+		log.Debugf("certificate posture: console user keychain unavailable: %v", err)
 	}
 	return mergeProofs(proofs, userProofs)
 }
 
+// UserContext identifies the user whose keychain a collection would include: the console
+// user when it owns the active profile, or empty when no user keychain would be asked. A
+// change means a collection made earlier no longer reflects what this Mac can prove.
+func UserContext(cfg Config) string {
+	if os.Geteuid() != 0 || cfg.OwnerUnknown {
+		return ""
+	}
+	user, ok := CurrentConsoleUser()
+	if !ok || !user.isOwner(cfg.ProfileOwner) {
+		return ""
+	}
+	return strconv.FormatUint(uint64(user.UID), 10) + ":" + user.Name
+}
+
 // collectAsConsoleUser runs the helper inside the desktop session of the logged-in
 // user. Dropping to their uid is not enough: keychain access is an XPC call to a
 // per-session securityd, so the helper has to enter their Mach bootstrap namespace,
 // which is what launchctl asuser does.
-func collectAsConsoleUser(ctx context.Context, challenges []*proto.CertificateChallenge, peerKey []byte) ([]certposture.Proof, error) {
+func collectAsConsoleUser(ctx context.Context, owner string, challenges []*proto.CertificateChallenge, peerKey []byte) ([]certposture.Proof, error) {
 	user, ok := CurrentConsoleUser()
 	if !ok {
 		return nil, nil
 	}
+	if !user.isOwner(owner) {
+		log.Debugf("certificate posture: console user %s does not own the active profile, no user keychain is asked", user.Name)
+		return nil, nil
+	}
+
+	uid := strconv.FormatUint(uint64(user.UID), 10)
+	backoffKey := helperBackoffKey(uid, challenges)
+	if !userHelperBackoff.allow(backoffKey, time.Now()) {
+		log.Debugf("certificate posture: the keychain of uid %s proved nothing recently, not asking again yet", uid)
+		return nil, nil
+	}
 
 	binary, err := os.Executable()
 	if err != nil {
 		return nil, fmt.Errorf("resolve own binary: %w", err)
 	}
 
-	payload, err := json.Marshal(helperRequest(challenges, peerKey))
-	if err != nil {
-		return nil, fmt.Errorf("encode helper request: %w", err)
-	}
-
+	parent := ctx
 	ctx, cancel := context.WithTimeout(ctx, helperTimeout)
 	defer cancel()
 
-	uid := strconv.FormatUint(uint64(user.UID), 10)
-	cmd := exec.CommandContext(ctx, "launchctl", "asuser", uid, "sudo", "-u", user.Name, "-H", binary, "posture", "cert-proof")
-	cmd.Stdin = bytes.NewReader(payload)
-	var stdout, stderr bytes.Buffer
-	cmd.Stdout = &stdout
-	cmd.Stderr = &stderr
+	// Absolute paths, because the daemon's PATH is configurable through the service
+	// environment, and sudo selects the user by uid so the name never has to round-trip.
+	cmd := exec.CommandContext(ctx, "/bin/launchctl", "asuser", uid, "/usr/bin/sudo", "-u", "#"+uid, "-H", "--", binary, "posture", "cert-proof")
+	killHelperGroupOnCancel(cmd)
 
-	log.Infof("certificate posture: asking the desktop session of %q (uid %s) to answer %d challenges", user.Name, uid, len(challenges))
-	if err := cmd.Run(); err != nil {
-		return nil, fmt.Errorf("run helper as %s: %w: %s", user.Name, err, strings.TrimSpace(stderr.String()))
+	log.Debugf("certificate posture: asking the desktop session of uid %s to answer %d challenges", uid, len(challenges))
+	proofs, err := runHelperCmd(cmd, helperRequest(challenges, peerKey))
+	// A run that completed, or ran into the timeout waiting on a prompt nobody answered,
+	// tells whether the keychain proves anything. A launch or output failure, or a run the
+	// caller cut short, says nothing about it and must not hold off the next one.
+	timedOut := errors.Is(ctx.Err(), context.DeadlineExceeded) && parent.Err() == nil
+	if err == nil || timedOut {
+		userHelperBackoff.record(backoffKey, err == nil && len(proofs) > 0, time.Now())
 	}
-
-	var resp HelperResponse
-	if err := json.Unmarshal(stdout.Bytes(), &resp); err != nil {
-		return nil, fmt.Errorf("decode helper response: %w", err)
+	if err != nil {
+		return nil, fmt.Errorf("run helper as uid %s: %w", uid, err)
 	}
-	log.Infof("certificate posture: desktop session of %q returned %d proofs", user.Name, len(resp.Proofs))
-	return resp.Proofs, nil
+	log.Debugf("certificate posture: desktop session of uid %s returned %d proofs", uid, len(proofs))
+	return proofs, nil
 }
 
-// helperStore is the store the helper reads. On macOS the keychain search list of the
-// user's own session already is that user's keychain, so the platform default is right.
+// helperStore is the store the helper reads: the user's login keychain alone. The
+// session's search list also holds the System keychain, which the daemon reads itself,
+// and using a System keychain key from the user's session would ask for an
+// administrator's approval.
 func helperStore() Store {
-	return DefaultStore()
+	home, err := os.UserHomeDir()
+	if err != nil {
+		log.Debugf("certificate posture: no home directory, searching the default keychain list: %v", err)
+		return NewKeychainStore()
+	}
+	login := filepath.Join(home, "Library", "Keychains", "login.keychain-db")
+	if _, err := os.Stat(login); err != nil {
+		// Keychains created before macOS 10.12 keep the old file name.
+		login = filepath.Join(home, "Library", "Keychains", "login.keychain")
+	}
+	return NewKeychainStore(login)
 }
diff --git a/client/internal/certproof/collect_js.go b/client/internal/certproof/collect_js.go
new file mode 100644
index 000000000..fd7c4c690
--- /dev/null
+++ b/client/internal/certproof/collect_js.go
@@ -0,0 +1,31 @@
+//go:build js
+
+package certproof
+
+import (
+	"context"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// CollectProofs proves nothing in a browser: it has no TPM, certificate store or file
+// store to sign with, so the stores stay out of the WebAssembly build.
+func CollectProofs(context.Context, []*proto.Checks, []byte, Config) []certposture.Proof {
+	return nil
+}
+
+// UserContext identifies the user whose certificates a collection would include. A
+// browser has no per-user store, so it never changes.
+func UserContext(Config) string {
+	return ""
+}
+
+// DefaultStore is empty in a browser.
+func DefaultStore() Store {
+	return Stores{}
+}
+
+func helperStore() Store {
+	return DefaultStore()
+}
diff --git a/client/internal/certproof/collect_other.go b/client/internal/certproof/collect_other.go
index d9c49c807..785d3db65 100644
--- a/client/internal/certproof/collect_other.go
+++ b/client/internal/certproof/collect_other.go
@@ -1,4 +1,4 @@
-//go:build !darwin && !windows
+//go:build ((!darwin && !windows) || ios) && !js
 
 package certproof
 
@@ -17,8 +17,15 @@ func CollectProofs(ctx context.Context, checks []*proto.Checks, peerKey []byte,
 	return Collect(ctx, storeWithToken(cfg), checks, peerKey)
 }
 
+// UserContext identifies the user whose certificates a collection would include. These
+// platforms have no per-user store, so it never changes.
+func UserContext(Config) string {
+	return ""
+}
+
 // helperStore is the store the helper reads. Nothing launches a helper on these
-// platforms, so it is the platform default.
+// platforms, so it is the store the daemon reads, configured from the same environment,
+// which lets an administrator check a setup by running the helper by hand.
 func helperStore() Store {
-	return DefaultStore()
+	return storeWithToken(Config{PKCS11: PKCS11FromEnv()})
 }
diff --git a/client/internal/certproof/collect_test.go b/client/internal/certproof/collect_test.go
index 16768b974..e16ee3668 100644
--- a/client/internal/certproof/collect_test.go
+++ b/client/internal/certproof/collect_test.go
@@ -2,6 +2,9 @@ package certproof
 
 import (
 	"context"
+	"crypto/rand"
+	"crypto/x509"
+	"math/big"
 	"os"
 	"path/filepath"
 	"testing"
@@ -22,7 +25,7 @@ func TestCollect_ProvesOneMatchingCertificatePerChallenge(t *testing.T) {
 	otherCA := certtest.NewCA(t, "other-root")
 	unrelatedCA := certtest.NewCA(t, "unrelated-root")
 
-	dir := t.TempDir()
+	dir := storeDir(t)
 	deviceKey := certtest.ECDSAKey(t)
 	device := corpCA.Issue(t, deviceKey, "device")
 	writeFile(t, dir, "device.pem", certtest.CertPEM(device)+certtest.KeyPEM(t, deviceKey))
@@ -61,7 +64,7 @@ func TestCollect_ProvesOneMatchingCertificatePerChallenge(t *testing.T) {
 }
 
 func TestCollect_NothingToProve(t *testing.T) {
-	dir := t.TempDir()
+	dir := storeDir(t)
 	key := certtest.ECDSAKey(t)
 	ca := certtest.NewCA(t, "root")
 	writeFile(t, dir, "device.pem", certtest.CertPEM(ca.Issue(t, key, "device"))+certtest.KeyPEM(t, key))
@@ -74,7 +77,7 @@ func TestCollect_NothingToProve(t *testing.T) {
 		{"no checks", NewFileStore(dir), nil},
 		{"files only", NewFileStore(dir), []*proto.Checks{{Files: []string{"/bin/x"}}}},
 		{"challenge without nonce", NewFileStore(dir), []*proto.Checks{{CertificateChallenge: &proto.CertificateChallenge{CaCertificates: []string{ca.PEM}}}}},
-		{"missing store dir", NewFileStore(filepath.Join(dir, "missing")), []*proto.Checks{{CertificateChallenge: &proto.CertificateChallenge{Nonce: []byte{1}, CaCertificates: []string{ca.PEM}}}}},
+		{"missing store dir", NewFileStore(filepath.Join(dir, "missing")), []*proto.Checks{{CertificateChallenge: &proto.CertificateChallenge{Nonce: make([]byte, certposture.NonceSize), CaCertificates: []string{ca.PEM}}}}},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -89,7 +92,7 @@ func TestFileStore_ChainWithIntermediate(t *testing.T) {
 	key := certtest.ECDSAKey(t)
 	leaf := intermediate.Issue(t, key, "device")
 
-	dir := t.TempDir()
+	dir := storeDir(t)
 	writeFile(t, dir, "device.pem", certtest.CertPEM(leaf)+certtest.CertPEM(intermediate.Cert)+certtest.KeyPEM(t, key))
 
 	candidates, err := NewFileStore(dir).Candidates(context.Background())
@@ -102,7 +105,154 @@ func TestFileStore_ChainWithIntermediate(t *testing.T) {
 	assert.NoError(t, certposture.VerifyChain(candidates[0].Chain, roots, time.Now()))
 }
 
+// storeDir is a PEM directory the store accepts: t.TempDir follows the umask, which
+// leaves the directory group-writable on systems with a user-private group umask.
+func storeDir(t *testing.T) string {
+	t.Helper()
+	dir := t.TempDir()
+	require.NoError(t, os.Chmod(dir, 0o700))
+	return dir
+}
+
 func writeFile(t *testing.T, dir, name, content string) {
 	t.Helper()
 	require.NoError(t, os.WriteFile(filepath.Join(dir, name), []byte(content), 0o600))
 }
+
+func TestCollectChallenges_RefusesMalformedInput(t *testing.T) {
+	ca := certtest.NewCA(t, "corp-root")
+	dir := storeDir(t)
+	key := certtest.ECDSAKey(t)
+	writeFile(t, dir, "device.pem", certtest.CertPEM(ca.Issue(t, key, "device"))+certtest.KeyPEM(t, key))
+	store := NewFileStore(dir)
+	nonce := certposture.NewChallenger([]byte("secret")).Nonce(peerKey, time.Now())
+
+	tests := []struct {
+		name    string
+		nonce   []byte
+		peerKey []byte
+		want    int
+	}{
+		{"issued nonce and peer key are signed", nonce, peerKey, 1},
+		{"short nonce is not signed", nonce[:8], peerKey, 0},
+		{"oversized nonce is not signed", append(append([]byte{}, nonce...), 0), peerKey, 0},
+		{"short peer key is not signed", nonce, peerKey[:16], 0},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			challenges := []*proto.CertificateChallenge{{Nonce: tt.nonce, CaCertificates: []string{ca.PEM}}}
+			assert.Len(t, CollectChallenges(context.Background(), store, challenges, tt.peerKey), tt.want,
+				"the device key signs only what management could have issued")
+		})
+	}
+}
+
+func TestFileStore_SkipsKeyOfAnotherCertificate(t *testing.T) {
+	ca := certtest.NewCA(t, "corp-root")
+	dir := storeDir(t)
+
+	// A stale key next to a renewed certificate, sorted before the good pair, must not
+	// produce a proof that management rejects and stop the search there.
+	writeFile(t, dir, "a-renewed.crt", certtest.CertPEM(ca.Issue(t, certtest.ECDSAKey(t), "renewed")))
+	writeFile(t, dir, "a-renewed.key", certtest.KeyPEM(t, certtest.ECDSAKey(t)))
+	goodKey := certtest.ECDSAKey(t)
+	good := ca.Issue(t, goodKey, "good")
+	writeFile(t, dir, "b-good.pem", certtest.CertPEM(good)+certtest.KeyPEM(t, goodKey))
+
+	candidates, err := NewFileStore(dir).Candidates(context.Background())
+	require.NoError(t, err)
+	require.Len(t, candidates, 1, "only the certificate whose key matches is a candidate")
+	assert.True(t, good.Equal(candidates[0].Chain[0]), "the matching pair is kept")
+
+	challenger := certposture.NewChallenger([]byte("secret"))
+	now := time.Now()
+	nonce := challenger.Nonce(peerKey, now)
+	proofs := CollectChallenges(context.Background(), NewFileStore(dir), []*proto.CertificateChallenge{{Nonce: nonce, CaCertificates: []string{ca.PEM}}}, peerKey)
+	require.Len(t, proofs, 1)
+	_, err = challenger.Verify(proofs[0], peerKey, now)
+	assert.NoError(t, err, "the proof sent is one management accepts")
+}
+
+// staticStore hands out fixed candidates, for scenarios no on-disk layout can express.
+type staticStore []Candidate
+
+func (s staticStore) Candidates(context.Context) ([]Candidate, error) { return s, nil }
+
+func TestCollectChallenges_RoutesAroundExpiredCopyOfRenewedIntermediate(t *testing.T) {
+	root := certtest.NewCA(t, "root")
+	intermediate := certtest.NewIntermediate(t, root, "issuing-ca")
+
+	// Renewing a CA with the same key pair leaves two certificates with the same
+	// subject and key in the store. The expired one sorts first here.
+	expiredTmpl := *intermediate.Cert
+	expiredTmpl.SerialNumber = big.NewInt(1)
+	expiredTmpl.NotBefore = time.Now().Add(-72 * time.Hour)
+	expiredTmpl.NotAfter = time.Now().Add(-48 * time.Hour)
+	der, err := x509.CreateCertificate(rand.Reader, &expiredTmpl, root.Cert, intermediate.Key.Public(), root.Key)
+	require.NoError(t, err)
+	expired, err := x509.ParseCertificate(der)
+	require.NoError(t, err)
+
+	key := certtest.ECDSAKey(t)
+	leaf := intermediate.Issue(t, key, "device")
+	pool := []*x509.Certificate{expired, intermediate.Cert}
+
+	chain := buildChain(leaf, pool)
+	require.Len(t, chain, 2)
+	require.True(t, expired.Equal(chain[1]), "precondition: the first-match chain runs through the expired copy")
+
+	challenger := certposture.NewChallenger([]byte("secret"))
+	now := time.Now()
+	nonce := challenger.Nonce(peerKey, now)
+	store := staticStore{{Chain: chain, Signer: key, Intermediates: pool}}
+
+	proofs := CollectChallenges(context.Background(), store, []*proto.CertificateChallenge{{Nonce: nonce, CaCertificates: []string{root.PEM}}}, peerKey)
+
+	require.Len(t, proofs, 1, "a valid path through the renewed intermediate exists, so the challenge is answered")
+	verified, err := challenger.Verify(proofs[0], peerKey, now)
+	require.NoError(t, err)
+	assert.True(t, intermediate.Cert.Equal(verified[1]), "the proof carries the valid intermediate, not the expired copy")
+	assert.True(t, certposture.ChainMatchesCAs(certposture.EncodeChainPEM(verified), []string{root.PEM}, now),
+		"management's own check accepts the chain the proof carries")
+}
+
+func TestCollectChallenges_ProvesALeafOncePerDistinctChain(t *testing.T) {
+	rootA := certtest.NewCA(t, "root-a")
+	rootB := certtest.NewCA(t, "root-b")
+	issuer := certtest.NewIntermediate(t, rootA, "issuing-ca")
+
+	// The same issuing CA cross-signed by a second root: one leaf, two valid paths.
+	crossTmpl := *issuer.Cert
+	crossTmpl.SerialNumber = big.NewInt(2)
+	der, err := x509.CreateCertificate(rand.Reader, &crossTmpl, rootB.Cert, issuer.Key.Public(), rootB.Key)
+	require.NoError(t, err)
+	cross, err := x509.ParseCertificate(der)
+	require.NoError(t, err)
+
+	key := certtest.ECDSAKey(t)
+	leaf := issuer.Issue(t, key, "device")
+	pool := []*x509.Certificate{issuer.Cert, cross}
+	store := staticStore{{Chain: buildChain(leaf, pool), Signer: key, Intermediates: pool}}
+
+	challenger := certposture.NewChallenger([]byte("secret"))
+	now := time.Now()
+	nonce := challenger.Nonce(peerKey, now)
+	challenges := []*proto.CertificateChallenge{
+		{Nonce: nonce, CaCertificates: []string{rootA.PEM}},
+		{Nonce: nonce, CaCertificates: []string{rootB.PEM}},
+		{Nonce: nonce, CaCertificates: []string{rootA.PEM}},
+	}
+
+	proofs := CollectChallenges(context.Background(), store, challenges, peerKey)
+
+	require.Len(t, proofs, 2, "one proof per distinct chain, the repeated root-a challenge reuses the first")
+	for _, root := range []*certtest.CA{rootA, rootB} {
+		matched := false
+		for _, p := range proofs {
+			chain, err := challenger.Verify(p, peerKey, now)
+			require.NoError(t, err)
+			matched = matched || certposture.ChainMatchesCAs(certposture.EncodeChainPEM(chain), []string{root.PEM}, now)
+		}
+		assert.True(t, matched, "management can match a chain for the check that trusts %s", root.Cert.Subject.CommonName)
+	}
+}
diff --git a/client/internal/certproof/collect_windows.go b/client/internal/certproof/collect_windows.go
index 074662fdb..8e5695539 100644
--- a/client/internal/certproof/collect_windows.go
+++ b/client/internal/certproof/collect_windows.go
@@ -1,13 +1,10 @@
 package certproof
 
 import (
-	"bytes"
 	"context"
-	"encoding/json"
 	"fmt"
 	"os"
 	"os/exec"
-	"strings"
 	"syscall"
 	"time"
 
@@ -25,7 +22,7 @@ const helperTimeout = 30 * time.Second
 // Intune enrol device certificates, and reaches the signed-in user's store by launching
 // a helper with that session's token. A machine at the sign-in screen therefore proves
 // device certificates alone.
-func CollectProofs(ctx context.Context, checks []*proto.Checks, peerKey []byte, _ Config) []certposture.Proof {
+func CollectProofs(ctx context.Context, checks []*proto.Checks, peerKey []byte, cfg Config) []certposture.Proof {
 	challenges := certificateChallenges(checks)
 	if len(challenges) == 0 {
 		logNoChallenges(checks)
@@ -36,17 +33,32 @@ func CollectProofs(ctx context.Context, checks []*proto.Checks, peerKey []byte,
 
 	// The helper already runs as the signed-in user, and an ordinary process has no
 	// right to a session token, so only the service goes looking for one.
-	if !runningAsLocalSystem() {
+	if !runningAsLocalSystem() || cfg.OwnerUnknown {
 		return proofs
 	}
 
-	userProofs, err := collectAsDesktopUser(ctx, challenges, peerKey)
+	userProofs, err := collectAsDesktopUser(ctx, cfg.ProfileOwner, challenges, peerKey)
 	if err != nil {
-		log.Infof("certificate posture: user certificate store unavailable: %v", err)
+		log.Debugf("certificate posture: user certificate store unavailable: %v", err)
 	}
 	return mergeProofs(proofs, userProofs)
 }
 
+// UserContext identifies the session whose store a collection would include: a session
+// of the profile owner, or empty when no user store would be asked. A change means a
+// collection made earlier no longer reflects what this machine can prove.
+func UserContext(cfg Config) string {
+	if !runningAsLocalSystem() || cfg.OwnerUnknown {
+		return ""
+	}
+	user, ok := CurrentDesktopUser(cfg.ProfileOwner)
+	if !ok {
+		return ""
+	}
+	defer user.Close()
+	return fmt.Sprintf("%d:%s", user.Session, user.Name)
+}
+
 // helperStore is the store the helper reads. It runs as the signed-in user, so it wants
 // that user's store rather than the machine store the service already read.
 func helperStore() Store {
@@ -56,8 +68,8 @@ func helperStore() Store {
 // collectAsDesktopUser runs the helper inside the interactive session of the signed-in
 // user. Unlike a keychain on macOS, a Windows service can assume a user identity
 // directly, so the session token goes straight into the child process.
-func collectAsDesktopUser(ctx context.Context, challenges []*proto.CertificateChallenge, peerKey []byte) ([]certposture.Proof, error) {
-	user, ok := CurrentDesktopUser()
+func collectAsDesktopUser(ctx context.Context, owner string, challenges []*proto.CertificateChallenge, peerKey []byte) ([]certposture.Proof, error) {
+	user, ok := CurrentDesktopUser(owner)
 	if !ok {
 		return nil, nil
 	}
@@ -68,34 +80,29 @@ func collectAsDesktopUser(ctx context.Context, challenges []*proto.CertificateCh
 		return nil, fmt.Errorf("resolve own binary: %w", err)
 	}
 
-	payload, err := json.Marshal(helperRequest(challenges, peerKey))
+	// The user's own environment, not the service's: the service environment may carry
+	// secrets such as a setup key that the signed-in user must not be able to read.
+	env, err := user.Token.Environ(false)
 	if err != nil {
-		return nil, fmt.Errorf("encode helper request: %w", err)
+		return nil, fmt.Errorf("build environment of %s: %w", user.Name, err)
 	}
 
 	ctx, cancel := context.WithTimeout(ctx, helperTimeout)
 	defer cancel()
 
 	cmd := exec.CommandContext(ctx, binary, "posture", "cert-proof")
+	cmd.Env = env
 	cmd.SysProcAttr = &syscall.SysProcAttr{
 		Token:         syscall.Token(user.Token),
 		HideWindow:    true,
 		CreationFlags: windows.CREATE_NO_WINDOW,
 	}
-	cmd.Stdin = bytes.NewReader(payload)
-	var stdout, stderr bytes.Buffer
-	cmd.Stdout = &stdout
-	cmd.Stderr = &stderr
 
-	log.Infof("certificate posture: asking the session of %q (session %d) to answer %d challenges", user.Name, user.Session, len(challenges))
-	if err := cmd.Run(); err != nil {
-		return nil, fmt.Errorf("run helper as %s: %w: %s", user.Name, err, strings.TrimSpace(stderr.String()))
+	log.Debugf("certificate posture: asking session %d to answer %d challenges", user.Session, len(challenges))
+	proofs, err := runHelperCmd(cmd, helperRequest(challenges, peerKey))
+	if err != nil {
+		return nil, fmt.Errorf("run helper in session %d: %w", user.Session, err)
 	}
-
-	var resp HelperResponse
-	if err := json.Unmarshal(stdout.Bytes(), &resp); err != nil {
-		return nil, fmt.Errorf("decode helper response: %w", err)
-	}
-	log.Infof("certificate posture: session of %q returned %d proofs", user.Name, len(resp.Proofs))
-	return resp.Proofs, nil
+	log.Debugf("certificate posture: session %d returned %d proofs", user.Session, len(proofs))
+	return proofs, nil
 }
diff --git a/client/internal/certproof/collector.go b/client/internal/certproof/collector.go
new file mode 100644
index 000000000..abba4bf61
--- /dev/null
+++ b/client/internal/certproof/collector.go
@@ -0,0 +1,85 @@
+package certproof
+
+import (
+	"context"
+	"sync/atomic"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+const collectTimeout = 45 * time.Second
+
+// collecting is the single-flight flag Collectors share by default. It outlives the
+// engine, since a collection abandoned in a token, TPM or keychain call keeps running
+// after the engine that started it has stopped, and the next engine must not start
+// another one on top of it.
+var collecting atomic.Bool
+
+// Collector runs CollectProofs with a deadline and at most one collection at a time in
+// the process. Token, TPM and keychain calls cannot be interrupted, so a collection that
+// overruns is abandoned rather than awaited, and a new one is refused until it has
+// finished. The zero value is ready to use.
+type Collector struct {
+	// busy overrides the process-wide single-flight flag when set.
+	busy *atomic.Bool
+	// timeout overrides collectTimeout when set.
+	timeout time.Duration
+}
+
+// Collect answers the certificate challenges in checks, returning no proofs when there
+// are no challenges, when a previous collection is still running, or when this one does
+// not finish in time. Missing proofs fail the certificate check on management.
+func (c *Collector) Collect(ctx context.Context, checks []*proto.Checks, peerKey []byte, cfg Config) []certposture.Proof {
+	return c.collect(ctx, checks, func(ctx context.Context) []certposture.Proof {
+		return CollectProofs(ctx, checks, peerKey, cfg)
+	})
+}
+
+func (c *Collector) collect(ctx context.Context, checks []*proto.Checks, run func(context.Context) []certposture.Proof) []certposture.Proof {
+	if len(certificateChallenges(checks)) == 0 {
+		return nil
+	}
+	busy := c.flag()
+	if !busy.CompareAndSwap(false, true) {
+		log.Warnf("certificate posture: previous proof collection is still running, sending no proofs")
+		return nil
+	}
+
+	ctx, cancel := context.WithTimeout(ctx, c.deadline())
+	defer cancel()
+
+	done := make(chan []certposture.Proof, 1)
+	go func() {
+		// The slot is freed before the result is delivered, so a caller that starts the
+		// next collection right after this one returned is not turned away.
+		proofs := run(ctx)
+		busy.Store(false)
+		done <- proofs
+	}()
+
+	select {
+	case proofs := <-done:
+		return proofs
+	case <-ctx.Done():
+		log.Warnf("certificate posture: proof collection did not finish within %s, sending no proofs", c.deadline())
+		return nil
+	}
+}
+
+func (c *Collector) flag() *atomic.Bool {
+	if c.busy != nil {
+		return c.busy
+	}
+	return &collecting
+}
+
+func (c *Collector) deadline() time.Duration {
+	if c.timeout > 0 {
+		return c.timeout
+	}
+	return collectTimeout
+}
diff --git a/client/internal/certproof/collector_test.go b/client/internal/certproof/collector_test.go
new file mode 100644
index 000000000..d5108eb22
--- /dev/null
+++ b/client/internal/certproof/collector_test.go
@@ -0,0 +1,126 @@
+package certproof
+
+import (
+	"context"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+var challengeChecks = []*proto.Checks{{CertificateChallenge: &proto.CertificateChallenge{
+	Nonce: certposture.NewChallenger([]byte("secret")).Nonce(peerKey, time.Now()),
+}}}
+
+func TestCollector_SkipsChecksWithoutChallenges(t *testing.T) {
+	var c Collector
+	called := false
+
+	proofs := c.collect(context.Background(), []*proto.Checks{{Files: []string{"/bin/agent"}}}, func(context.Context) []certposture.Proof {
+		called = true
+		return nil
+	})
+
+	assert.Nil(t, proofs)
+	assert.False(t, called, "no store is touched when no check carries a challenge")
+}
+
+func TestCollector_ReturnsProofs(t *testing.T) {
+	var c Collector
+	want := []certposture.Proof{{Nonce: []byte("nonce")}}
+
+	proofs := c.collect(context.Background(), challengeChecks, func(context.Context) []certposture.Proof { return want })
+
+	assert.Equal(t, want, proofs, "a collection that finishes in time is returned as is")
+}
+
+func TestCollector_AbandonsStuckCollection(t *testing.T) {
+	c := Collector{timeout: 50 * time.Millisecond, busy: new(atomic.Bool)}
+	release := make(chan struct{})
+	finished := make(chan struct{})
+
+	// A token or keychain call that ignores its context and blocks well past the deadline.
+	stuck := func(context.Context) []certposture.Proof {
+		defer close(finished)
+		<-release
+		return []certposture.Proof{{Nonce: []byte("late")}}
+	}
+
+	start := time.Now()
+	proofs := c.collect(context.Background(), challengeChecks, stuck)
+	assert.Nil(t, proofs, "an overrunning collection yields no proofs")
+	assert.Less(t, time.Since(start), time.Second, "the caller is released at the deadline, not when the call returns")
+
+	called := false
+	proofs = c.collect(context.Background(), challengeChecks, func(context.Context) []certposture.Proof {
+		called = true
+		return nil
+	})
+	assert.Nil(t, proofs)
+	assert.False(t, called, "no second collection starts while the first is still running")
+
+	close(release)
+	<-finished
+	require.Eventually(t, func() bool { return !c.busy.Load() }, time.Second, 5*time.Millisecond, "the collector frees up once the stuck call returns")
+
+	want := []certposture.Proof{{Nonce: []byte("nonce")}}
+	assert.Equal(t, want, c.collect(context.Background(), challengeChecks, func(context.Context) []certposture.Proof { return want }),
+		"collection works again after the stuck call returned")
+}
+
+func TestCollector_CancelsContextAtDeadline(t *testing.T) {
+	c := Collector{timeout: 20 * time.Millisecond, busy: new(atomic.Bool)}
+	cancelled := make(chan struct{})
+
+	c.collect(context.Background(), challengeChecks, func(ctx context.Context) []certposture.Proof {
+		<-ctx.Done()
+		close(cancelled)
+		return nil
+	})
+
+	select {
+	case <-cancelled:
+	case <-time.After(time.Second):
+		t.Fatal("a collection that honours its context, like the helper process, must see it cancelled")
+	}
+}
+
+// TestCollector_SingleFlightAcrossCollectors: each engine has its own Collector, and a
+// collection stuck in a token call outlives the engine that started it, so the next
+// engine's Collector must not start another one until it has finished.
+func TestCollector_SingleFlightAcrossCollectors(t *testing.T) {
+	shared := new(atomic.Bool)
+	first := Collector{timeout: 20 * time.Millisecond, busy: shared}
+	second := Collector{timeout: time.Second, busy: shared}
+
+	release := make(chan struct{})
+	stuck := func(context.Context) []certposture.Proof {
+		<-release
+		return nil
+	}
+	assert.Nil(t, first.collect(context.Background(), challengeChecks, stuck), "the first collection is abandoned at its deadline")
+
+	called := false
+	proofs := second.collect(context.Background(), challengeChecks, func(context.Context) []certposture.Proof {
+		called = true
+		return []certposture.Proof{{}}
+	})
+	assert.Nil(t, proofs, "no proofs while the abandoned collection still runs")
+	assert.False(t, called, "a second collection does not start on top of the abandoned one")
+
+	close(release)
+	require.Eventually(t, func() bool { return !shared.Load() }, time.Second, 5*time.Millisecond)
+	assert.Len(t, second.collect(context.Background(), challengeChecks, func(context.Context) []certposture.Proof { return []certposture.Proof{{}} }), 1,
+		"collections resume once the abandoned one finished")
+}
+
+// TestCollector_ZeroValuesShareTheProcessFlag: the zero value uses the process-wide flag.
+func TestCollector_ZeroValuesShareTheProcessFlag(t *testing.T) {
+	var a, b Collector
+	assert.Same(t, a.flag(), b.flag(), "separate Collectors share one single-flight flag")
+}
diff --git a/client/internal/certproof/consoleuser_darwin.go b/client/internal/certproof/consoleuser_darwin.go
index f0489d605..a5182c7fd 100644
--- a/client/internal/certproof/consoleuser_darwin.go
+++ b/client/internal/certproof/consoleuser_darwin.go
@@ -1,8 +1,11 @@
+//go:build !ios
+
 package certproof
 
 import (
 	"bytes"
 	"fmt"
+	"strconv"
 	"sync"
 
 	"github.com/ebitengine/purego"
@@ -37,21 +40,21 @@ type ConsoleUser struct {
 // or attributes the session to root, and neither has a login keychain to offer.
 func CurrentConsoleUser() (ConsoleUser, bool) {
 	if err := loadConsoleUser(); err != nil {
-		log.Infof("console user lookup unavailable: %v", err)
+		log.Debugf("console user lookup unavailable: %v", err)
 		return ConsoleUser{}, false
 	}
 
 	var uid, gid uint32
 	name := scDynamicStoreCopyConsoleUser(0, &uid, &gid)
 	if name == 0 {
-		log.Info("no console user is logged in, no login keychain is reachable")
+		log.Debug("no console user is logged in, no login keychain is reachable")
 		return ConsoleUser{}, false
 	}
-	defer cfRelease(name)
+	defer release(name)
 
 	user := ConsoleUser{Name: cfString(name), UID: uid, GID: gid}
 	if !user.hasDesktop() {
-		log.Infof("console session belongs to %q uid=%d, which is not a desktop login, no login keychain is reachable", user.Name, user.UID)
+		log.Debugf("console session belongs to %q uid=%d, which is not a desktop login, no login keychain is reachable", user.Name, user.UID)
 		return ConsoleUser{}, false
 	}
 	return user, true
@@ -67,6 +70,13 @@ func (u ConsoleUser) hasDesktop() bool {
 	return u.UID != 0
 }
 
+// isOwner reports whether the console user is owner, the account of the active profile,
+// which is recorded as a short user name or, for an account without one, a numeric uid.
+// With no owner the console user counts, as macOS has a single console user.
+func (u ConsoleUser) isOwner(owner string) bool {
+	return owner == "" || owner == u.Name || owner == strconv.FormatUint(uint64(u.UID), 10)
+}
+
 func cfString(str uintptr) string {
 	buf := make([]byte, consoleNameBufSize)
 	if !cfStringGetCString(str, &buf[0], len(buf), encodingUTF8) {
diff --git a/client/internal/certproof/consoleuser_darwin_test.go b/client/internal/certproof/consoleuser_darwin_test.go
index a3ecba217..9c1aaa22c 100644
--- a/client/internal/certproof/consoleuser_darwin_test.go
+++ b/client/internal/certproof/consoleuser_darwin_test.go
@@ -1,3 +1,5 @@
+//go:build !ios
+
 package certproof
 
 import (
@@ -37,3 +39,13 @@ func TestCurrentConsoleUser_AgreesWithItself(t *testing.T) {
 	assert.NotZero(t, user.UID, "a desktop session never belongs to uid 0")
 	assert.True(t, user.hasDesktop(), "a reported console user must be a desktop session")
 }
+
+func TestConsoleUser_IsOwner(t *testing.T) {
+	user := ConsoleUser{Name: "maycon", UID: 501, GID: 20}
+
+	assert.True(t, user.isOwner(""), "a profile without owner accepts the single console user")
+	assert.True(t, user.isOwner("maycon"), "the owner by short name")
+	assert.True(t, user.isOwner("501"), "the owner recorded as a numeric uid")
+	assert.False(t, user.isOwner("viktor"), "another account's profile must not read this user's keychain")
+	assert.False(t, user.isOwner("502"), "another uid is another account")
+}
diff --git a/client/internal/certproof/desktopuser_windows.go b/client/internal/certproof/desktopuser_windows.go
index ae6a7221b..6f50aae4f 100644
--- a/client/internal/certproof/desktopuser_windows.go
+++ b/client/internal/certproof/desktopuser_windows.go
@@ -2,6 +2,7 @@ package certproof
 
 import (
 	"fmt"
+	"strings"
 	"unsafe"
 
 	log "github.com/sirupsen/logrus"
@@ -10,11 +11,14 @@ import (
 
 const (
 	noActiveSession = 0xFFFFFFFF
+	servicesSession = 0
 
-	// wtsCurrentServer is WTS_CURRENT_SERVER_HANDLE and wtsActive is WTSActive of
-	// WTS_CONNECTSTATE_CLASS. Neither is exported by x/sys/windows.
+	// wtsCurrentServer is WTS_CURRENT_SERVER_HANDLE; wtsActive and wtsDisconnected are
+	// WTSActive and WTSDisconnected of WTS_CONNECTSTATE_CLASS. None is exported by
+	// x/sys/windows.
 	wtsCurrentServer = windows.Handle(0)
 	wtsActive        = 0
+	wtsDisconnected  = 4
 )
 
 // DesktopUser is an interactive session and the account signed into it. The user's
@@ -33,35 +37,82 @@ func (u DesktopUser) Close() {
 	}
 }
 
-// CurrentDesktopUser returns a token for the interactive user whose certificate store
-// should be asked. The physical console comes first, and an active remote desktop
-// session is used when nobody is at the console, which is how servers and VDI hosts are
-// normally reached. The second return is false at the sign-in screen, where no
-// interactive session exists and only machine certificates can be proven.
+// CurrentDesktopUser returns a token for the session whose certificate store should be
+// asked: a session of owner, the account the active profile belongs to, with the
+// physical console preferred over remote sessions. With no owner only the console user
+// counts. Picking any signed-in user instead would let whoever else is logged in to a
+// terminal server or VDI host decide the result. The second return is false when no
+// such session exists, and only machine certificates can then be proven.
 //
 // Obtaining the token needs SE_TCB_NAME, which the LocalSystem service has and an
 // ordinary process does not.
-func CurrentDesktopUser() (DesktopUser, bool) {
-	if session := windows.WTSGetActiveConsoleSessionId(); session != noActiveSession {
-		if user, ok := desktopUser(session); ok {
-			return user, true
-		}
-		log.Infof("console session %d has nobody signed in, looking for an active remote session", session)
+func CurrentDesktopUser(owner string) (DesktopUser, bool) {
+	console := windows.WTSGetActiveConsoleSessionId()
+	if owner == "" {
+		return consoleUser(console)
 	}
 
-	sessions, err := activeSessions()
+	sessions, err := userSessions(console)
 	if err != nil {
-		log.Infof("cannot enumerate terminal sessions: %v", err)
+		log.Debugf("cannot enumerate terminal sessions: %v", err)
 		return DesktopUser{}, false
 	}
+	var found DesktopUser
+	var ok bool
 	for _, session := range sessions {
-		if user, ok := desktopUser(session); ok {
-			return user, true
+		user, signedIn := desktopUser(session)
+		if !signedIn {
+			continue
+		}
+		switch {
+		case !sameAccountName(user.Name, owner):
+			user.Close()
+		case !ok:
+			found, ok = user, true
+		case strings.EqualFold(user.Name, found.Name):
+			// Another session of the same account; the first one in preference order wins.
+			user.Close()
+		default:
+			// An owner recorded without a domain matches accounts of several domains here.
+			// Picking one would let another domain's user answer for the owner.
+			log.Debugf("certificate posture: profile owner %s matches both %s and %s, no user certificate store is used", owner, found.Name, user.Name)
+			user.Close()
+			found.Close()
+			return DesktopUser{}, false
 		}
 	}
+	if !ok {
+		log.Debugf("certificate posture: profile owner %s has no signed-in session, no user certificate store is reachable", owner)
+	}
+	return found, ok
+}
 
-	log.Info("no interactive session is signed in, no user certificate store is reachable")
-	return DesktopUser{}, false
+func consoleUser(console uint32) (DesktopUser, bool) {
+	if console == noActiveSession || console == servicesSession {
+		log.Debug("no console session, no user certificate store is reachable")
+		return DesktopUser{}, false
+	}
+	user, ok := desktopUser(console)
+	if !ok {
+		log.Debugf("console session %d has nobody signed in, no user certificate store is reachable", console)
+	}
+	return user, ok
+}
+
+// sameAccountName compares DOMAIN\account names case-insensitively, as Windows does, and an
+// owner given without a domain against the account part alone. The session side comes from
+// the session token's own SID, which Windows resolves from its cache of signed-in users.
+// Resolving the owner name to a SID instead would ask the domain controller, which on a
+// laptop that cannot reach it yet blocks for tens of seconds, past the collection deadline.
+func sameAccountName(sessionName, owner string) bool {
+	if strings.EqualFold(sessionName, owner) {
+		return true
+	}
+	if strings.Contains(owner, `\`) {
+		return false
+	}
+	_, account, found := strings.Cut(sessionName, `\`)
+	return found && strings.EqualFold(account, owner)
 }
 
 func desktopUser(session uint32) (DesktopUser, bool) {
@@ -73,7 +124,7 @@ func desktopUser(session uint32) (DesktopUser, bool) {
 
 	name, err := tokenAccount(token)
 	if err != nil {
-		log.Infof("session %d token has no readable account: %v", session, err)
+		log.Debugf("session %d token has no readable account: %v", session, err)
 		if closeErr := token.Close(); closeErr != nil {
 			log.Debugf("failed closing session token: %v", closeErr)
 		}
@@ -97,7 +148,10 @@ func tokenAccount(token windows.Token) (string, error) {
 	return domain + `\` + account, nil
 }
 
-func activeSessions() ([]uint32, error) {
+// userSessions lists the sessions a user can be signed in to, console first, then
+// active remote sessions, then disconnected ones, whose user is still signed in. Session
+// 0 is skipped: it hosts services and never belongs to an interactive user.
+func userSessions(console uint32) ([]uint32, error) {
 	var info *windows.WTS_SESSION_INFO
 	var count uint32
 	if err := windows.WTSEnumerateSessions(wtsCurrentServer, 0, 1, &info, &count); err != nil {
@@ -105,13 +159,19 @@ func activeSessions() ([]uint32, error) {
 	}
 	defer windows.WTSFreeMemory(uintptr(unsafe.Pointer(info)))
 
-	var active []uint32
-	for _, session := range unsafe.Slice(info, count) {
-		if session.State == wtsActive {
-			active = append(active, session.SessionID)
+	var sessions []uint32
+	if console != noActiveSession && console != servicesSession {
+		sessions = append(sessions, console)
+	}
+	for _, state := range []uint32{wtsActive, wtsDisconnected} {
+		for _, session := range unsafe.Slice(info, count) {
+			if session.SessionID == servicesSession || session.SessionID == console || session.State != state {
+				continue
+			}
+			sessions = append(sessions, session.SessionID)
 		}
 	}
-	return active, nil
+	return sessions, nil
 }
 
 // runningAsLocalSystem reports whether this process is the service. The helper runs as
diff --git a/client/internal/certproof/desktopuser_windows_test.go b/client/internal/certproof/desktopuser_windows_test.go
new file mode 100644
index 000000000..95d29eb5f
--- /dev/null
+++ b/client/internal/certproof/desktopuser_windows_test.go
@@ -0,0 +1,61 @@
+package certproof
+
+import (
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSameAccountName(t *testing.T) {
+	tests := []struct {
+		session, owner string
+		want           bool
+	}{
+		{`CORP\alice`, `CORP\alice`, true},
+		{`CORP\alice`, `corp\ALICE`, true},
+		{`CORP\alice`, `alice`, true},
+		{`CORP\alice`, `OTHER\alice`, false},
+		{`CORP\alice`, `bob`, false},
+		{`alice`, `alice`, true},
+		{`CORP\alice`, `CORP\alic`, false},
+	}
+	for _, tt := range tests {
+		assert.Equal(t, tt.want, sameAccountName(tt.session, tt.owner), "session %q, owner %q", tt.session, tt.owner)
+	}
+}
+
+// CurrentDesktopUser against the real session manager: an owner no session belongs to
+// must never yield a session, whoever else is signed in.
+func TestCurrentDesktopUser_UnknownOwnerHasNoSession(t *testing.T) {
+	user, ok := CurrentDesktopUser(`NO-SUCH-DOMAIN\no-such-user-netbird`)
+	if ok {
+		user.Close()
+	}
+	assert.False(t, ok, "a profile owner without a session must not borrow another user's store")
+}
+
+// TestCurrentDesktopUser_FindsTheOwnersSession runs against a real machine as LocalSystem,
+// with NB_TEST_DESKTOP_OWNER naming an account that is signed in. That account's session
+// must be found, and only that account's.
+func TestCurrentDesktopUser_FindsTheOwnersSession(t *testing.T) {
+	owner := os.Getenv("NB_TEST_DESKTOP_OWNER")
+	if owner == "" {
+		t.Skip("set NB_TEST_DESKTOP_OWNER to a signed-in account and run as LocalSystem")
+	}
+	user, ok := CurrentDesktopUser(owner)
+	require.True(t, ok, "the signed-in owner %s must have a session", owner)
+	defer user.Close()
+	t.Logf("owner %s resolved to session %d as %s", owner, user.Session, user.Name)
+	assert.True(t, sameAccountName(user.Name, owner), "the session found belongs to %s, not %s", owner, user.Name)
+	assert.NotZero(t, user.Session, "session 0 hosts services and never belongs to the owner")
+
+	console, consoleOK := CurrentDesktopUser("")
+	if consoleOK {
+		defer console.Close()
+		t.Logf("without an owner the console user counts: session %d as %s", console.Session, console.Name)
+	} else {
+		t.Log("without an owner nobody counts: no user at the console")
+	}
+}
diff --git a/client/internal/certproof/doc.go b/client/internal/certproof/doc.go
new file mode 100644
index 000000000..c8dc62f0c
--- /dev/null
+++ b/client/internal/certproof/doc.go
@@ -0,0 +1,26 @@
+// Package certproof answers certificate posture challenges: it finds the certificates a
+// peer holds a private key for and signs the challenge nonce, bound to the peer's
+// WireGuard key, with that key. Management verifies the signature and the chain against
+// the CAs of the check, so only a holder of the key passes and a proof made for one peer
+// cannot be replayed by another. Keys in the OS stores, the TPM and a PKCS#11 token are
+// used through the platform, which signs; a plain PEM key file is the exception, parsed
+// and used in the daemon's memory.
+//
+// Machine stores are read by the daemon itself: the Windows LocalMachine store, the macOS
+// System keychain, and on Linux a directory of PEM files, TSS2 key files the TPM signs
+// with, and a PKCS#11 token. On Linux the directory and the token URI come from the
+// daemon's environment (NB_CERT_STORE_DIR, NB_CERT_PKCS11_URI), as does the token PIN
+// (NB_TPM_PIN); none of them is read from the profile config.
+//
+// User stores cannot be read by a privileged daemon, so it starts this binary as
+// "netbird posture cert-proof" inside the user's session and receives only signatures
+// and chains on its stdout. On macOS uid is not what unlocks a login keychain, the
+// session's bootstrap namespace is, which is why the helper enters it through launchctl
+// asuser. On Windows a service opening CURRENT_USER silently reads its own empty hive, so
+// the helper runs with the session's token instead. Its output is untrusted: sizes are
+// capped and only proofs for requested nonces are kept.
+//
+// A user proof shows that some process in that user's session could use a key whose
+// certificate chains to the CA. It does not show which binary signed, or that the key is
+// hardware-bound; device stores are the stronger signal.
+package certproof
diff --git a/client/internal/certproof/helper.go b/client/internal/certproof/helper.go
index 26d719044..81a72ac70 100644
--- a/client/internal/certproof/helper.go
+++ b/client/internal/certproof/helper.go
@@ -57,7 +57,7 @@ func runHelper(ctx context.Context, store Store, in io.Reader, out io.Writer) er
 	if len(challenges) > 0 {
 		proofs = CollectChallenges(ctx, store, challenges, req.PeerKey)
 	}
-	log.Infof("certificate posture helper: answering %d challenges with %d proofs", len(challenges), len(proofs))
+	log.Debugf("certificate posture helper: answering %d challenges with %d proofs", len(challenges), len(proofs))
 
 	if err := json.NewEncoder(out).Encode(HelperResponse{Proofs: proofs}); err != nil {
 		return fmt.Errorf("encode helper response: %w", err)
diff --git a/client/internal/certproof/helper_backoff.go b/client/internal/certproof/helper_backoff.go
new file mode 100644
index 000000000..3372b026b
--- /dev/null
+++ b/client/internal/certproof/helper_backoff.go
@@ -0,0 +1,78 @@
+package certproof
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// helperQuietPeriod is how long a user whose helper proved nothing is not asked again
+// for the same CAs. On macOS each helper run may show a keychain prompt, so retrying on
+// every collection would put up a new one each time the user ignored or denied the last.
+const helperQuietPeriod = time.Hour
+
+// helperBackoff remembers, per user and set of CAs asked about, until when the helper
+// is not launched again because its last run proved nothing.
+type helperBackoff struct {
+	mu    sync.Mutex
+	until map[string]time.Time
+}
+
+func newHelperBackoff() *helperBackoff {
+	return &helperBackoff{until: map[string]time.Time{}}
+}
+
+// allow reports whether the helper may be launched for key now.
+func (b *helperBackoff) allow(key string, now time.Time) bool {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return !now.Before(b.until[key])
+}
+
+// record stores the outcome of a helper run for key: one that proved something clears
+// the back-off, one that proved nothing starts it. Expired entries are dropped, so the
+// map holds only users currently held off.
+func (b *helperBackoff) record(key string, proven bool, now time.Time) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	for other, until := range b.until {
+		if !now.Before(until) {
+			delete(b.until, other)
+		}
+	}
+	if proven {
+		delete(b.until, key)
+		return
+	}
+	b.until[key] = now.Add(helperQuietPeriod)
+}
+
+// helperBackoffKey identifies a user and the set of CAs the challenges accept, in any
+// order, leaving out the nonces, which rotate without changing what the user is asked to
+// prove.
+func helperBackoffKey(user string, challenges []*proto.CertificateChallenge) string {
+	sets := make([]string, 0, len(challenges))
+	for _, challenge := range challenges {
+		cas := make([]string, 0, len(challenge.GetCaCertificates()))
+		for _, ca := range challenge.GetCaCertificates() {
+			sum := sha256.Sum256([]byte(ca))
+			cas = append(cas, hex.EncodeToString(sum[:]))
+		}
+		slices.Sort(cas)
+		sets = append(sets, strings.Join(cas, ","))
+	}
+	slices.Sort(sets)
+
+	h := sha256.New()
+	h.Write([]byte(user))
+	for _, set := range sets {
+		h.Write([]byte{0})
+		h.Write([]byte(set))
+	}
+	return hex.EncodeToString(h.Sum(nil))
+}
diff --git a/client/internal/certproof/helper_backoff_test.go b/client/internal/certproof/helper_backoff_test.go
new file mode 100644
index 000000000..0d3cafea1
--- /dev/null
+++ b/client/internal/certproof/helper_backoff_test.go
@@ -0,0 +1,69 @@
+package certproof
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// TestHelperBackoff: a user whose helper proved nothing, for one ignoring or denying a
+// keychain prompt, is not asked again for the same CAs within the quiet period, while a
+// success or other CAs are asked at once.
+func TestHelperBackoff(t *testing.T) {
+	now := time.Now()
+	b := newHelperBackoff()
+	key := helperBackoffKey("501", []*proto.CertificateChallenge{{CaCertificates: []string{"ca-a"}}})
+
+	assert.True(t, b.allow(key, now), "a user never asked is asked")
+
+	b.record(key, false, now)
+	assert.False(t, b.allow(key, now.Add(helperQuietPeriod-time.Second)), "no new prompt within the quiet period")
+	assert.True(t, b.allow(key, now.Add(helperQuietPeriod)), "asked again once the quiet period passed")
+
+	other := helperBackoffKey("501", []*proto.CertificateChallenge{{CaCertificates: []string{"ca-b"}}})
+	assert.True(t, b.allow(other, now), "a check for other CAs is asked at once")
+	assert.True(t, b.allow(helperBackoffKey("502", []*proto.CertificateChallenge{{CaCertificates: []string{"ca-a"}}}), now), "another user is asked at once")
+
+	b.record(key, true, now)
+	assert.True(t, b.allow(key, now), "a run that proved something clears the quiet period")
+}
+
+// TestHelperBackoffKey_IgnoresNonces: nonces rotate every window without changing what
+// the user is asked to prove, so they do not reset the quiet period.
+func TestHelperBackoffKey_IgnoresNonces(t *testing.T) {
+	a := helperBackoffKey("501", []*proto.CertificateChallenge{{Nonce: []byte("one"), CaCertificates: []string{"ca"}}})
+	b := helperBackoffKey("501", []*proto.CertificateChallenge{{Nonce: []byte("two"), CaCertificates: []string{"ca"}}})
+	assert.Equal(t, a, b, "the key does not depend on the nonce")
+}
+
+// TestHelperBackoffKey_IgnoresOrder: the same CAs, listed in another order or with the
+// challenges reordered, are the same question to the user.
+func TestHelperBackoffKey_IgnoresOrder(t *testing.T) {
+	a := helperBackoffKey("501", []*proto.CertificateChallenge{
+		{CaCertificates: []string{"ca-1", "ca-2"}},
+		{CaCertificates: []string{"ca-3"}},
+	})
+	b := helperBackoffKey("501", []*proto.CertificateChallenge{
+		{CaCertificates: []string{"ca-3"}},
+		{CaCertificates: []string{"ca-2", "ca-1"}},
+	})
+	assert.Equal(t, a, b, "the key does not depend on the order of CAs or challenges")
+
+	c := helperBackoffKey("501", []*proto.CertificateChallenge{{CaCertificates: []string{"ca-1", "ca-2", "ca-3"}}})
+	assert.NotEqual(t, a, c, "the same CAs grouped into other challenges are another question")
+}
+
+// TestHelperBackoff_PrunesExpired: entries whose quiet period passed are dropped when the
+// next outcome is recorded, so the map does not grow with every user and CA set seen.
+func TestHelperBackoff_PrunesExpired(t *testing.T) {
+	now := time.Now()
+	b := newHelperBackoff()
+	b.record("old", false, now)
+	b.record("new", false, now.Add(helperQuietPeriod))
+
+	assert.NotContains(t, b.until, "old", "an expired entry is pruned")
+	assert.Contains(t, b.until, "new", "a current entry is kept")
+}
diff --git a/client/internal/certproof/helper_kill_other.go b/client/internal/certproof/helper_kill_other.go
new file mode 100644
index 000000000..2ececb27e
--- /dev/null
+++ b/client/internal/certproof/helper_kill_other.go
@@ -0,0 +1,10 @@
+//go:build !unix && !windows
+
+package certproof
+
+import "os/exec"
+
+// startHelper starts cmd.
+func startHelper(cmd *exec.Cmd) (func(), error) {
+	return func() {}, cmd.Start()
+}
diff --git a/client/internal/certproof/helper_kill_unix.go b/client/internal/certproof/helper_kill_unix.go
new file mode 100644
index 000000000..e434d4962
--- /dev/null
+++ b/client/internal/certproof/helper_kill_unix.go
@@ -0,0 +1,35 @@
+//go:build unix
+
+package certproof
+
+import (
+	"errors"
+	"os/exec"
+	"syscall"
+)
+
+// killHelperGroupOnCancel puts cmd in a process group of its own and kills the whole
+// group when cmd's context ends. The helper may run below launchers such as launchctl
+// and sudo, which do not pass a kill on, and it keeps the output pipes open, so killing
+// only the direct child would leave the helper running and Wait blocked until the
+// helper exits on its own, for one waiting on a keychain prompt nobody answers.
+func killHelperGroupOnCancel(cmd *exec.Cmd) {
+	if cmd.SysProcAttr == nil {
+		cmd.SysProcAttr = &syscall.SysProcAttr{}
+	}
+	cmd.SysProcAttr.Setpgid = true
+	cmd.Cancel = func() error {
+		err := syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
+		if errors.Is(err, syscall.ESRCH) {
+			return nil
+		}
+		return err
+	}
+	cmd.WaitDelay = helperWaitDelay
+}
+
+// startHelper starts cmd. Killing the helper with everything below it is arranged by
+// killHelperGroupOnCancel where the helper runs under a launcher.
+func startHelper(cmd *exec.Cmd) (func(), error) {
+	return func() {}, cmd.Start()
+}
diff --git a/client/internal/certproof/helper_kill_windows.go b/client/internal/certproof/helper_kill_windows.go
new file mode 100644
index 000000000..1e143c132
--- /dev/null
+++ b/client/internal/certproof/helper_kill_windows.go
@@ -0,0 +1,77 @@
+//go:build windows
+
+package certproof
+
+import (
+	"fmt"
+	"os/exec"
+	"unsafe"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+)
+
+// startHelper starts cmd inside a job object that is terminated when cmd's context ends
+// and closed, killing whatever is left in it, once the helper has been awaited. Killing
+// only the helper on Windows leaves its descendants running, and one that holds the
+// output pipe would block Wait until it exits, so WaitDelay bounds that wait as well.
+func startHelper(cmd *exec.Cmd) (func(), error) {
+	job, err := newKillOnCloseJob()
+	if err != nil {
+		return nil, err
+	}
+	closeJob := func() {
+		if err := windows.CloseHandle(job); err != nil {
+			log.Debugf("failed to close certificate proof helper job: %v", err)
+		}
+	}
+
+	cmd.Cancel = func() error {
+		return windows.TerminateJobObject(job, 1)
+	}
+	cmd.WaitDelay = helperWaitDelay
+	if err := cmd.Start(); err != nil {
+		closeJob()
+		return nil, err
+	}
+
+	// A helper outside the job is still killed directly and bounded by WaitDelay; only
+	// its descendants would outlive it.
+	if err := assignToJob(job, cmd.Process.Pid); err != nil {
+		log.Debugf("failed to put certificate proof helper %d in its job: %v", cmd.Process.Pid, err)
+		cmd.Cancel = func() error { return cmd.Process.Kill() }
+	}
+	return closeJob, nil
+}
+
+// newKillOnCloseJob creates a job object whose processes are killed when its last handle
+// is closed.
+func newKillOnCloseJob() (windows.Handle, error) {
+	job, err := windows.CreateJobObject(nil, nil)
+	if err != nil {
+		return 0, fmt.Errorf("create job object: %w", err)
+	}
+	info := windows.JOBOBJECT_EXTENDED_LIMIT_INFORMATION{
+		BasicLimitInformation: windows.JOBOBJECT_BASIC_LIMIT_INFORMATION{
+			LimitFlags: windows.JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE,
+		},
+	}
+	if _, err := windows.SetInformationJobObject(job, windows.JobObjectExtendedLimitInformation,
+		uintptr(unsafe.Pointer(&info)), uint32(unsafe.Sizeof(info))); err != nil {
+		_ = windows.CloseHandle(job)
+		return 0, fmt.Errorf("set job object limits: %w", err)
+	}
+	return job, nil
+}
+
+// assignToJob puts the process pid into job.
+func assignToJob(job windows.Handle, pid int) error {
+	process, err := windows.OpenProcess(windows.PROCESS_SET_QUOTA|windows.PROCESS_TERMINATE, false, uint32(pid))
+	if err != nil {
+		return fmt.Errorf("open process: %w", err)
+	}
+	defer func() {
+		_ = windows.CloseHandle(process)
+	}()
+	return windows.AssignProcessToJobObject(job, process)
+}
diff --git a/client/internal/certproof/helper_kill_windows_test.go b/client/internal/certproof/helper_kill_windows_test.go
new file mode 100644
index 000000000..4778d253b
--- /dev/null
+++ b/client/internal/certproof/helper_kill_windows_test.go
@@ -0,0 +1,29 @@
+//go:build windows
+
+package certproof
+
+import (
+	"context"
+	"os/exec"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestRunHelperCmd_KillsHelperTree: the helper's child holds stdout and runs for a minute,
+// like a helper stuck below a launcher. Killing only the helper would leave Wait blocked
+// on the child's pipe until WaitDelay gives up; terminating the job ends both at once.
+func TestRunHelperCmd_KillsHelperTree(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 200*time.Millisecond)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, "cmd.exe", "/c", "ping -n 60 127.0.0.1")
+
+	start := time.Now()
+	_, err := runHelperCmd(cmd, HelperRequest{Challenges: []HelperChallenge{{Nonce: []byte("asked")}}})
+
+	require.Error(t, err)
+	assert.Less(t, time.Since(start), helperWaitDelay, "the whole tree is killed at the timeout, not left for WaitDelay")
+}
diff --git a/client/internal/certproof/helper_run.go b/client/internal/certproof/helper_run.go
new file mode 100644
index 000000000..52c9db775
--- /dev/null
+++ b/client/internal/certproof/helper_run.go
@@ -0,0 +1,126 @@
+package certproof
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os/exec"
+	"strings"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+)
+
+const (
+	maxHelperStdout = 1 << 20
+	maxHelperStderr = 4 << 10
+
+	// helperWaitDelay bounds how long a helper's output is awaited after it was killed.
+	helperWaitDelay = 2 * time.Second
+)
+
+var errHelperOutputTooLarge = errors.New("helper output exceeds the size limit")
+
+// runHelperCmd feeds req to the helper process cmd and returns the proofs it answered.
+// The helper runs as an unprivileged user who can control its output, so both streams
+// are capped and only proofs for a nonce req asked about are kept, one per challenge.
+func runHelperCmd(cmd *exec.Cmd, req HelperRequest) ([]certposture.Proof, error) {
+	payload, err := json.Marshal(req)
+	if err != nil {
+		return nil, fmt.Errorf("encode helper request: %w", err)
+	}
+
+	stdout := &cappedBuffer{limit: maxHelperStdout}
+	stderr := &cappedBuffer{limit: maxHelperStderr}
+	cmd.Stdin = bytes.NewReader(payload)
+	cmd.Stdout = stdout
+	cmd.Stderr = stderr
+
+	release, err := startHelper(cmd)
+	if err != nil {
+		return nil, fmt.Errorf("start helper: %w", err)
+	}
+	defer release()
+	if err := cmd.Wait(); err != nil {
+		return nil, fmt.Errorf("%w: %s", err, strings.TrimSpace(stderr.String()))
+	}
+	logHelperStderr(stderr.String())
+	if stdout.truncated {
+		return nil, errHelperOutputTooLarge
+	}
+
+	var resp HelperResponse
+	if err := json.Unmarshal(stdout.Bytes(), &resp); err != nil {
+		return nil, fmt.Errorf("decode helper response: %w", err)
+	}
+	return requestedProofs(req, resp.Proofs), nil
+}
+
+// logHelperStderr records what a helper that succeeded wrote to stderr, such as a user
+// certificate it could not sign with, which is otherwise only visible in the user's
+// session. Each line is quoted because the helper's user controls its content.
+func logHelperStderr(stderr string) {
+	for _, line := range strings.Split(strings.TrimSpace(stderr), "\n") {
+		if line = strings.TrimSpace(line); line != "" {
+			log.Debugf("certificate posture helper: %q", line)
+		}
+	}
+}
+
+// requestedProofs keeps the proofs whose nonce belongs to one of req's challenges, at
+// most as many as req has challenges.
+func requestedProofs(req HelperRequest, proofs []certposture.Proof) []certposture.Proof {
+	var kept []certposture.Proof
+	for _, proof := range proofs {
+		if len(kept) == len(req.Challenges) {
+			break
+		}
+		if !req.asked(proof.Nonce) {
+			log.Debugf("certificate posture: dropping helper proof for a nonce that was not requested")
+			continue
+		}
+		kept = append(kept, proof)
+	}
+	return kept
+}
+
+func (r HelperRequest) asked(nonce []byte) bool {
+	for _, challenge := range r.Challenges {
+		if len(challenge.Nonce) > 0 && bytes.Equal(challenge.Nonce, nonce) {
+			return true
+		}
+	}
+	return false
+}
+
+// cappedBuffer keeps the first limit bytes written to it and discards the rest, so a
+// misbehaving child cannot grow the parent's memory without bound. The buffer is a
+// named field rather than embedded: an embedded bytes.Buffer would promote ReadFrom,
+// which io.Copy prefers over Write, bypassing the cap.
+type cappedBuffer struct {
+	buf       bytes.Buffer
+	limit     int
+	truncated bool
+}
+
+func (b *cappedBuffer) Write(p []byte) (int, error) {
+	if room := b.limit - b.buf.Len(); room < len(p) {
+		b.truncated = true
+		if room > 0 {
+			b.buf.Write(p[:room])
+		}
+		return len(p), nil
+	}
+	return b.buf.Write(p)
+}
+
+func (b *cappedBuffer) Bytes() []byte {
+	return b.buf.Bytes()
+}
+
+func (b *cappedBuffer) String() string {
+	return b.buf.String()
+}
diff --git a/client/internal/certproof/helper_run_test.go b/client/internal/certproof/helper_run_test.go
new file mode 100644
index 000000000..ea1246e93
--- /dev/null
+++ b/client/internal/certproof/helper_run_test.go
@@ -0,0 +1,119 @@
+//go:build !windows && !js
+
+package certproof
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+	"testing"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+)
+
+// fakeHelper is a child process that drains its stdin and then prints script's output,
+// standing in for a helper running in a user session the daemon cannot trust.
+func fakeHelper(t *testing.T, script string) *exec.Cmd {
+	t.Helper()
+	return exec.Command("/bin/sh", "-c", "cat >/dev/null; "+script)
+}
+
+func printJSON(t *testing.T, v any) string {
+	t.Helper()
+	out, err := json.Marshal(v)
+	require.NoError(t, err)
+	return fmt.Sprintf("printf '%%s' '%s'", out)
+}
+
+func TestRunHelperCmd_KeepsOnlyRequestedProofs(t *testing.T) {
+	req := HelperRequest{PeerKey: peerKey, Challenges: []HelperChallenge{{Nonce: []byte("asked")}}}
+	resp := HelperResponse{Proofs: []certposture.Proof{
+		{Nonce: []byte("injected"), Signature: []byte("x")},
+		{Nonce: []byte("asked"), Signature: []byte("first")},
+		{Nonce: []byte("asked"), Signature: []byte("second")},
+	}}
+
+	proofs, err := runHelperCmd(fakeHelper(t, printJSON(t, resp)), req)
+
+	require.NoError(t, err)
+	require.Len(t, proofs, 1, "a helper may not return more proofs than challenges or proofs for nonces it was not asked about")
+	assert.Equal(t, []byte("first"), proofs[0].Signature, "the first proof for the requested nonce is kept")
+}
+
+func TestRunHelperCmd_RejectsOversizedOutput(t *testing.T) {
+	req := HelperRequest{Challenges: []HelperChallenge{{Nonce: []byte("asked")}}}
+	script := fmt.Sprintf("head -c %d /dev/zero", maxHelperStdout+1)
+
+	_, err := runHelperCmd(fakeHelper(t, script), req)
+
+	assert.ErrorIs(t, err, errHelperOutputTooLarge)
+}
+
+func TestRunHelperCmd_CapsStderrInError(t *testing.T) {
+	req := HelperRequest{Challenges: []HelperChallenge{{Nonce: []byte("asked")}}}
+	script := fmt.Sprintf("head -c %d /dev/zero | tr '\\0' 'a' >&2; exit 3", 10*maxHelperStderr)
+
+	_, err := runHelperCmd(fakeHelper(t, script), req)
+
+	require.Error(t, err)
+	assert.LessOrEqual(t, len(err.Error()), maxHelperStderr+100, "a chatty helper must not blow up the daemon's error or log line")
+	assert.True(t, strings.Contains(err.Error(), "exit status 3"), "the exit status is kept: %v", err)
+}
+
+// TestRunHelperCmd_LogsStderrOfSuccessfulHelper covers a helper that answers but warns,
+// for one about a certificate it could not sign with: the warning reaches the daemon's
+// log, quoted so a helper cannot forge log lines with embedded newlines.
+func TestRunHelperCmd_LogsStderrOfSuccessfulHelper(t *testing.T) {
+	var logged bytes.Buffer
+	log.SetOutput(&logged)
+	level := log.GetLevel()
+	log.SetLevel(log.DebugLevel)
+	t.Cleanup(func() {
+		log.SetOutput(os.Stderr)
+		log.SetLevel(level)
+	})
+
+	req := HelperRequest{Challenges: []HelperChallenge{{Nonce: []byte("asked")}}}
+	script := "printf 'failed signing certificate proof for CN=user\\nforged line\\n' >&2; " + printJSON(t, HelperResponse{})
+
+	_, err := runHelperCmd(fakeHelper(t, script), req)
+
+	require.NoError(t, err)
+	assert.Contains(t, logged.String(), "failed signing certificate proof for CN=user", "the helper's warning reaches the daemon log")
+	assert.NotContains(t, logged.String(), "\nforged line", "helper output cannot start a log line of its own")
+}
+
+// TestRunHelperCmd_KillsHelperBelowLauncher stands in for launchctl and sudo starting the
+// helper: the direct child spawns a grandchild that holds stdout and never exits, like a
+// helper waiting on a keychain prompt. The timeout must end both, not wait for the
+// grandchild.
+func TestRunHelperCmd_KillsHelperBelowLauncher(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 200*time.Millisecond)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, "/bin/sh", "-c", "sleep 30 & cat >/dev/null; wait")
+	killHelperGroupOnCancel(cmd)
+
+	start := time.Now()
+	_, err := runHelperCmd(cmd, HelperRequest{Challenges: []HelperChallenge{{Nonce: []byte("asked")}}})
+
+	require.Error(t, err)
+	assert.Less(t, time.Since(start), 5*time.Second, "the helper is killed at the timeout, not awaited until it exits")
+}
+
+func TestRunHelperCmd_RejectsGarbage(t *testing.T) {
+	req := HelperRequest{Challenges: []HelperChallenge{{Nonce: []byte("asked")}}}
+
+	_, err := runHelperCmd(fakeHelper(t, "printf 'not json'"), req)
+
+	assert.ErrorContains(t, err, "decode helper response")
+}
diff --git a/client/internal/certproof/helper_spawn.go b/client/internal/certproof/helper_spawn.go
index ccf0567a5..968cc3679 100644
--- a/client/internal/certproof/helper_spawn.go
+++ b/client/internal/certproof/helper_spawn.go
@@ -1,4 +1,4 @@
-//go:build darwin || windows
+//go:build (darwin && !ios) || windows
 
 package certproof
 
@@ -56,8 +56,8 @@ func mergeProofs(device, user []certposture.Proof) []certposture.Proof {
 func logUserProof(proof certposture.Proof) {
 	leaf, err := x509.ParseCertificate(proof.Chain[0])
 	if err != nil {
-		log.Infof("certificate posture: user proof carries an unparsable leaf: %v", err)
+		log.Debugf("certificate posture: user proof carries an unparsable leaf: %v", err)
 		return
 	}
-	log.Infof("certificate posture: signed-in user proved %q issued by %q", leaf.Subject, leaf.Issuer)
+	log.Debugf("certificate posture: signed-in user proved %q issued by %q", leaf.Subject, leaf.Issuer)
 }
diff --git a/client/internal/certproof/helper_spawn_test.go b/client/internal/certproof/helper_spawn_test.go
index 5356a9b00..338a5f66a 100644
--- a/client/internal/certproof/helper_spawn_test.go
+++ b/client/internal/certproof/helper_spawn_test.go
@@ -1,4 +1,4 @@
-//go:build darwin || windows
+//go:build (darwin && !ios) || windows
 
 package certproof
 
diff --git a/client/internal/certproof/helper_test.go b/client/internal/certproof/helper_test.go
index b70bd71f3..37dadead2 100644
--- a/client/internal/certproof/helper_test.go
+++ b/client/internal/certproof/helper_test.go
@@ -16,7 +16,7 @@ import (
 
 func TestRunHelper_ProofSurvivesTheProcessBoundary(t *testing.T) {
 	ca := certtest.NewCA(t, "corp-root")
-	dir := t.TempDir()
+	dir := storeDir(t)
 	key := certtest.ECDSAKey(t)
 	writeFile(t, dir, "device.pem", certtest.CertPEM(ca.Issue(t, key, "device"))+certtest.KeyPEM(t, key))
 
@@ -47,7 +47,7 @@ func TestRunHelper_NoChallengesYieldsEmptyResponse(t *testing.T) {
 	require.NoError(t, err)
 
 	var stdout bytes.Buffer
-	require.NoError(t, runHelper(context.Background(), NewFileStore(t.TempDir()), bytes.NewReader(request), &stdout))
+	require.NoError(t, runHelper(context.Background(), NewFileStore(storeDir(t)), bytes.NewReader(request), &stdout))
 
 	var resp HelperResponse
 	require.NoError(t, json.Unmarshal(stdout.Bytes(), &resp), "an empty request must still emit valid JSON")
@@ -56,7 +56,7 @@ func TestRunHelper_NoChallengesYieldsEmptyResponse(t *testing.T) {
 
 func TestRunHelper_RejectsMalformedRequest(t *testing.T) {
 	var stdout bytes.Buffer
-	err := runHelper(context.Background(), NewFileStore(t.TempDir()), bytes.NewReader([]byte("not json")), &stdout)
+	err := runHelper(context.Background(), NewFileStore(storeDir(t)), bytes.NewReader([]byte("not json")), &stdout)
 
 	require.Error(t, err, "a malformed request must fail rather than emit an empty proof set")
 	assert.Empty(t, stdout.String(), "nothing should be written to stdout on a decode failure")
diff --git a/client/internal/certproof/keychain_darwin.go b/client/internal/certproof/keychain_darwin.go
index d53c15b27..2bffdc81e 100644
--- a/client/internal/certproof/keychain_darwin.go
+++ b/client/internal/certproof/keychain_darwin.go
@@ -1,3 +1,5 @@
+//go:build !ios
+
 package certproof
 
 import (
@@ -20,9 +22,17 @@ const (
 	securityFramework       = "/System/Library/Frameworks/Security.framework/Security"
 	coreFoundationFramework = "/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation"
 
-	errSecItemNotFound = -25300
+	errSecItemNotFound          = -25300
+	errSecInteractionNotAllowed = -25308
 )
 
+// errKeyNeedsApproval reports a key whose access list does not include netbird, so using
+// it needs the user's approval, which a daemon has no UI to ask for.
+var errKeyNeedsApproval = errors.New("the key's access control requires user approval for netbird; " +
+	"import the identity with netbird allowed (security import <identity.p12> -k <keychain> " +
+	"-T /Applications/NetBird.app/Contents/MacOS/netbird), " +
+	"or set AllowAllAppsAccess in the MDM certificate payload, which allows every application")
+
 var (
 	keychainOnce sync.Once
 	keychainErr  error
@@ -33,8 +43,10 @@ var (
 	secCertificateCopyData     func(cert uintptr) uintptr
 	secKeyCreateSignature      func(key, algorithm, data uintptr, err *uintptr) uintptr
 
+	secKeychainOpen           func(path *byte, keychain *uintptr) int32
 	secKeychainCopySearchList func(searchList *uintptr) int32
 	secKeychainGetPath        func(keychain uintptr, pathLength *uint32, path *byte) int32
+	cfArrayCreate             func(alloc uintptr, values *uintptr, count int, callBacks uintptr) uintptr
 
 	cfDictionaryCreate     func(alloc uintptr, keys, values *uintptr, count int, keyCallBacks, valueCallBacks uintptr) uintptr
 	cfArrayGetCount        func(array uintptr) int
@@ -45,37 +57,56 @@ var (
 	cfErrorGetCode         func(err uintptr) int
 	cfRelease              func(ref uintptr)
 
-	kSecClass, kSecClassIdentity, kSecClassCertificate, kSecMatchLimit, kSecMatchLimitAll, kSecReturnRef uintptr
-	kSecKeyAlgorithmECDSASHA256, kSecKeyAlgorithmECDSASHA384, kSecKeyAlgorithmRSAPSSSHA256               uintptr
-	kCFBooleanTrue, kCFTypeDictionaryKeyCallBacks, kCFTypeDictionaryValueCallBacks                       uintptr
+	kSecClass, kSecClassIdentity, kSecClassCertificate, kSecMatchLimit, kSecMatchLimitAll, kSecReturnRef  uintptr
+	kSecMatchSearchList                                                                                   uintptr
+	kSecKeyAlgorithmECDSASHA256, kSecKeyAlgorithmECDSASHA384, kSecKeyAlgorithmRSAPSSSHA256                uintptr
+	kCFBooleanTrue, kCFTypeDictionaryKeyCallBacks, kCFTypeDictionaryValueCallBacks, kCFTypeArrayCallBacks uintptr
 )
 
-// DefaultStore is the keychain search list of the daemon, which for the root daemon is
-// the System keychain where MDM installs device identities.
+// systemKeychain is where MDM installs device identities.
+const systemKeychain = "/Library/Keychains/System.keychain"
+
+// DefaultStore is the System keychain for the root daemon, so it never touches a user's
+// keychain, whose keys would ask for approval in a session the daemon has no UI in. Run
+// by an ordinary user, it is that user's keychain search list.
 func DefaultStore() Store {
+	if os.Geteuid() == 0 {
+		return NewKeychainStore(systemKeychain)
+	}
 	return NewKeychainStore()
 }
 
-// KeychainStore yields the identities of the process's keychain search list, reached
-// through purego so the client keeps building with CGO_ENABLED=0.
-type KeychainStore struct{}
+// KeychainStore yields the identities of a set of keychains, or of the process's keychain
+// search list when none is named, reached through purego so the client keeps building
+// with CGO_ENABLED=0.
+type KeychainStore struct {
+	keychains []string
+}
 
-func NewKeychainStore() *KeychainStore {
-	return &KeychainStore{}
+// NewKeychainStore returns a store that searches the keychain files at paths, or the
+// process's keychain search list when no path is given.
+func NewKeychainStore(paths ...string) *KeychainStore {
+	return &KeychainStore{keychains: paths}
 }
 
 func (s *KeychainStore) Candidates(_ context.Context) ([]Candidate, error) {
 	if err := loadKeychain(); err != nil {
 		return nil, err
 	}
+	searchList, done, err := searchListOf(s.keychains)
+	if err != nil {
+		return nil, err
+	}
+	defer done()
+
 	var leaves []*x509.Certificate
-	err := eachIdentity(func(_ uintptr, der []byte) (bool, error) {
+	err = eachIdentity(searchList, func(_ uintptr, der []byte) (bool, error) {
 		cert, err := x509.ParseCertificate(der)
 		if err != nil {
 			log.Warnf("skipping keychain identity: %v", err)
 			return false, nil
 		}
-		log.Infof("keychain identity: subject=%q issuer=%q serial=%s expires=%s", cert.Subject, cert.Issuer, cert.SerialNumber, cert.NotAfter)
+		log.Debugf("keychain identity: subject=%q issuer=%q serial=%s expires=%s", cert.Subject, cert.Issuer, cert.SerialNumber, cert.NotAfter)
 		leaves = append(leaves, cert)
 		return false, nil
 	})
@@ -84,24 +115,24 @@ func (s *KeychainStore) Candidates(_ context.Context) ([]Candidate, error) {
 	}
 	// The certificate query runs even without identities: it separates a keychain that is
 	// readable but holds no identity from one the process cannot read at all.
-	pool, err := keychainCertificates()
+	pool, err := keychainCertificates(searchList)
 	if err != nil {
 		return nil, err
 	}
 	if len(leaves) == 0 {
-		log.Infof("keychain search list holds no identities usable for certificate posture, but %d readable certificates: an identity needs its private key in the same keychain", len(pool))
+		log.Debugf("keychain search list holds no identities usable for certificate posture, but %d readable certificates: an identity needs its private key in the same keychain", len(pool))
 		return nil, nil
 	}
-	log.Infof("keychain search list holds %d identities and %d certificates for chain building", len(leaves), len(pool))
+	log.Debugf("keychain search list holds %d identities and %d certificates for chain building", len(leaves), len(pool))
 
 	candidates := make([]Candidate, 0, len(leaves))
 	for _, leaf := range leaves {
 		chain := buildChain(leaf, pool)
-		log.Infof("keychain candidate %q issued by %q built a chain of %d certificates", leaf.Subject, leaf.Issuer, len(chain))
+		log.Debugf("keychain candidate %q issued by %q built a chain of %d certificates", leaf.Subject, leaf.Issuer, len(chain))
 		if len(chain) == 1 && leaf.CheckSignatureFrom(leaf) != nil {
-			log.Infof("keychain candidate %q has no issuer in the keychain, its proof carries the leaf alone and only verifies if the challenge supplies %q", leaf.Subject, leaf.Issuer)
+			log.Debugf("keychain candidate %q has no issuer in the keychain, its proof carries the leaf alone and only verifies if the challenge supplies %q", leaf.Subject, leaf.Issuer)
 		}
-		candidates = append(candidates, Candidate{Chain: chain, Signer: &keychainSigner{leaf: leaf}})
+		candidates = append(candidates, Candidate{Chain: chain, Signer: &keychainSigner{leaf: leaf, keychains: s.keychains}, Intermediates: pool})
 	}
 	return candidates, nil
 }
@@ -109,7 +140,8 @@ func (s *KeychainStore) Candidates(_ context.Context) ([]Candidate, error) {
 // keychainSigner holds only the certificate; the identity is looked up again at signing
 // time so no keychain references outlive a call.
 type keychainSigner struct {
-	leaf *x509.Certificate
+	leaf      *x509.Certificate
+	keychains []string
 }
 
 func (s *keychainSigner) Public() crypto.PublicKey {
@@ -121,11 +153,17 @@ func (s *keychainSigner) Sign(_ io.Reader, digest []byte, opts crypto.SignerOpts
 	if err != nil {
 		return nil, err
 	}
-	log.Infof("signing certificate posture challenge with keychain key of %q", s.leaf.Subject)
+	log.Debugf("signing certificate posture challenge with keychain key of %q", s.leaf.Subject)
+
+	searchList, done, err := searchListOf(s.keychains)
+	if err != nil {
+		return nil, err
+	}
+	defer done()
 
 	algorithm := keychainAlgorithm(scheme)
 	var signature []byte
-	err = eachIdentity(func(identity uintptr, der []byte) (bool, error) {
+	err = eachIdentity(searchList, func(identity uintptr, der []byte) (bool, error) {
 		if !bytes.Equal(der, s.leaf.Raw) {
 			return false, nil
 		}
@@ -138,7 +176,7 @@ func (s *keychainSigner) Sign(_ io.Reader, digest []byte, opts crypto.SignerOpts
 	if signature == nil {
 		return nil, errors.New("certificate is no longer in the keychain")
 	}
-	log.Infof("keychain signed certificate posture challenge for %q, %d bytes", s.leaf.Subject, len(signature))
+	log.Debugf("keychain signed certificate posture challenge for %q, %d bytes", s.leaf.Subject, len(signature))
 	return signature, nil
 }
 
@@ -158,37 +196,94 @@ func signWithIdentity(identity, algorithm uintptr, digest []byte) ([]byte, error
 	if status := secIdentityCopyPrivateKey(identity, &key); status != 0 {
 		return nil, fmt.Errorf("SecIdentityCopyPrivateKey: %d", status)
 	}
-	defer cfRelease(key)
+	defer release(key)
 
 	data := cfDataCreate(0, &digest[0], len(digest))
-	defer cfRelease(data)
+	if data == 0 {
+		return nil, errors.New("CFDataCreate returned NULL")
+	}
+	defer release(data)
 
 	var cfErr uintptr
 	signature := secKeyCreateSignature(key, algorithm, data, &cfErr)
 	if signature == 0 {
-		defer cfRelease(cfErr)
-		return nil, fmt.Errorf("SecKeyCreateSignature: CFError %d", cfErrorGetCode(cfErr))
+		if cfErr == 0 {
+			return nil, errors.New("SecKeyCreateSignature failed without a CFError")
+		}
+		defer release(cfErr)
+		code := cfErrorGetCode(cfErr)
+		if code == errSecInteractionNotAllowed {
+			return nil, fmt.Errorf("SecKeyCreateSignature: CFError %d: %w", code, errKeyNeedsApproval)
+		}
+		return nil, fmt.Errorf("SecKeyCreateSignature: CFError %d", code)
 	}
-	defer cfRelease(signature)
+	defer release(signature)
 	return dataBytes(signature), nil
 }
 
-func eachIdentity(fn func(identity uintptr, der []byte) (bool, error)) error {
-	return eachMatching(kSecClassIdentity, "identity", func(identity uintptr) (bool, error) {
+// searchListOf opens the keychain files at paths as a CFArray for kSecMatchSearchList,
+// or yields 0, the process's own search list, when paths is empty. The caller calls done
+// once it no longer uses the list.
+func searchListOf(paths []string) (searchList uintptr, done func(), err error) {
+	if len(paths) == 0 {
+		return 0, func() {}, nil
+	}
+	list, err := openSearchList(paths)
+	if err != nil {
+		return 0, nil, err
+	}
+	return list, func() { release(list) }, nil
+}
+
+// openSearchList opens the keychain files at paths, at least one, as a CFArray. The
+// caller releases the array.
+func openSearchList(paths []string) (uintptr, error) {
+	refs := make([]uintptr, 0, len(paths))
+	defer func() {
+		for _, ref := range refs {
+			release(ref)
+		}
+	}()
+	for _, path := range paths {
+		cpath := append([]byte(path), 0)
+		var keychain uintptr
+		if status := secKeychainOpen(&cpath[0], &keychain); status != 0 {
+			return 0, fmt.Errorf("SecKeychainOpen %s: %d", path, status)
+		}
+		refs = append(refs, keychain)
+	}
+	// The array retains the keychains, so the references opened here are released.
+	list := cfArrayCreate(0, &refs[0], len(refs), kCFTypeArrayCallBacks)
+	if list == 0 {
+		return 0, errors.New("CFArrayCreate returned NULL")
+	}
+	return list, nil
+}
+
+// eachIdentity calls fn with every identity in searchList, or in the process's search
+// list when it is 0, and its certificate. An identity whose certificate cannot be read is
+// skipped rather than ending the walk.
+func eachIdentity(searchList uintptr, fn func(identity uintptr, der []byte) (bool, error)) error {
+	return eachMatching(searchList, kSecClassIdentity, "identity", func(identity uintptr) (bool, error) {
 		var cert uintptr
 		if status := secIdentityCopyCertificate(identity, &cert); status != 0 {
-			return true, fmt.Errorf("SecIdentityCopyCertificate: %d", status)
+			log.Debugf("skipping keychain identity: SecIdentityCopyCertificate: %d", status)
+			return false, nil
 		}
 		der := certificateDER(cert)
-		cfRelease(cert)
+		release(cert)
+		if der == nil {
+			log.Debug("skipping keychain identity whose certificate has no DER data")
+			return false, nil
+		}
 		return fn(identity, der)
 	})
 }
 
-func keychainCertificates() ([]*x509.Certificate, error) {
+func keychainCertificates(searchList uintptr) ([]*x509.Certificate, error) {
 	var certs []*x509.Certificate
 	var unparsable int
-	err := eachMatching(kSecClassCertificate, "certificate", func(item uintptr) (bool, error) {
+	err := eachMatching(searchList, kSecClassCertificate, "certificate", func(item uintptr) (bool, error) {
 		if cert, err := x509.ParseCertificate(certificateDER(item)); err == nil {
 			certs = append(certs, cert)
 			return false, nil
@@ -196,30 +291,34 @@ func keychainCertificates() ([]*x509.Certificate, error) {
 		unparsable++
 		return false, nil
 	})
-	log.Infof("keychain holds %d parsable certificates, %d unparsable", len(certs), unparsable)
+	log.Debugf("keychain holds %d parsable certificates, %d unparsable", len(certs), unparsable)
 	return certs, err
 }
 
-func eachMatching(class uintptr, name string, fn func(item uintptr) (bool, error)) error {
+func eachMatching(searchList, class uintptr, name string, fn func(item uintptr) (bool, error)) error {
 	keys := []uintptr{kSecClass, kSecMatchLimit, kSecReturnRef}
 	values := []uintptr{class, kSecMatchLimitAll, kCFBooleanTrue}
+	if searchList != 0 {
+		keys = append(keys, kSecMatchSearchList)
+		values = append(values, searchList)
+	}
 	query := cfDictionaryCreate(0, &keys[0], &values[0], len(keys), kCFTypeDictionaryKeyCallBacks, kCFTypeDictionaryValueCallBacks)
-	defer cfRelease(query)
+	defer release(query)
 
 	var items uintptr
 	switch status := secItemCopyMatching(query, &items); status {
 	case 0:
 	case errSecItemNotFound:
-		log.Infof("keychain %s query returned errSecItemNotFound (%d): the search list holds no item of this class", name, errSecItemNotFound)
+		log.Debugf("keychain %s query returned errSecItemNotFound (%d): the search list holds no item of this class", name, errSecItemNotFound)
 		return nil
 	default:
-		log.Infof("keychain %s query returned OSStatus %d", name, status)
+		log.Debugf("keychain %s query returned OSStatus %d", name, status)
 		return fmt.Errorf("SecItemCopyMatching: %d", status)
 	}
-	defer cfRelease(items)
+	defer release(items)
 
 	n := cfArrayGetCount(items)
-	log.Infof("keychain %s query returned %d items", name, n)
+	log.Debugf("keychain %s query returned %d items", name, n)
 	for i := 0; i < n; i++ {
 		if stop, err := fn(cfArrayGetValueAtIndex(items, i)); stop || err != nil {
 			return err
@@ -228,23 +327,40 @@ func eachMatching(class uintptr, name string, fn func(item uintptr) (bool, error
 	return nil
 }
 
+// certificateDER returns the DER form of cert, or nil when SecCertificateCopyData
+// returns NULL, which it does for an object that is not a valid certificate.
 func certificateDER(cert uintptr) []byte {
 	data := secCertificateCopyData(cert)
-	defer cfRelease(data)
+	if data == 0 {
+		return nil
+	}
+	defer release(data)
 	return dataBytes(data)
 }
 
 func dataBytes(data uintptr) []byte {
-	return bytes.Clone(unsafe.Slice((*byte)(cfDataGetBytePtr(data)), cfDataGetLength(data)))
+	n := cfDataGetLength(data)
+	if n <= 0 {
+		return nil
+	}
+	return bytes.Clone(unsafe.Slice((*byte)(cfDataGetBytePtr(data)), n))
+}
+
+// release drops a CoreFoundation reference. CFRelease crashes the process on NULL, and
+// several Security calls return NULL on failure, so every release goes through here.
+func release(ref uintptr) {
+	if ref != 0 {
+		cfRelease(ref)
+	}
 }
 
 func loadKeychain() error {
 	keychainOnce.Do(func() {
 		if keychainErr = resolveKeychain(); keychainErr != nil {
-			log.Infof("macOS keychain unavailable for certificate posture: %v", keychainErr)
+			log.Debugf("macOS keychain unavailable for certificate posture: %v", keychainErr)
 			return
 		}
-		log.Infof("macOS Security framework loaded for certificate posture, running as uid=%d euid=%d", os.Getuid(), os.Geteuid())
+		log.Debugf("macOS Security framework loaded for certificate posture, running as uid=%d euid=%d", os.Getuid(), os.Geteuid())
 		logSearchList()
 	})
 	return keychainErr
@@ -254,21 +370,21 @@ func loadKeychain() error {
 // System keychain and System Roots, never a user's login keychain.
 func logSearchList() {
 	if secKeychainCopySearchList == nil || secKeychainGetPath == nil {
-		log.Info("keychain search list diagnostics unavailable on this macOS version")
+		log.Debug("keychain search list diagnostics unavailable on this macOS version")
 		return
 	}
 
 	var list uintptr
 	if status := secKeychainCopySearchList(&list); status != 0 {
-		log.Infof("SecKeychainCopySearchList returned OSStatus %d", status)
+		log.Debugf("SecKeychainCopySearchList returned OSStatus %d", status)
 		return
 	}
-	defer cfRelease(list)
+	defer release(list)
 
 	n := cfArrayGetCount(list)
-	log.Infof("keychain search list contains %d keychains", n)
+	log.Debugf("keychain search list contains %d keychains", n)
 	for i := 0; i < n; i++ {
-		log.Infof("keychain search list[%d]: %s", i, keychainPath(cfArrayGetValueAtIndex(list, i)))
+		log.Debugf("keychain search list[%d]: %s", i, keychainPath(cfArrayGetValueAtIndex(list, i)))
 	}
 }
 
@@ -301,6 +417,8 @@ func resolveKeychain() error {
 		{&secIdentityCopyPrivateKey, security, "SecIdentityCopyPrivateKey"},
 		{&secCertificateCopyData, security, "SecCertificateCopyData"},
 		{&secKeyCreateSignature, security, "SecKeyCreateSignature"},
+		{&secKeychainOpen, security, "SecKeychainOpen"},
+		{&cfArrayCreate, coreFoundation, "CFArrayCreate"},
 		{&cfDictionaryCreate, coreFoundation, "CFDictionaryCreate"},
 		{&cfArrayGetCount, coreFoundation, "CFArrayGetCount"},
 		{&cfArrayGetValueAtIndex, coreFoundation, "CFArrayGetValueAtIndex"},
@@ -329,12 +447,14 @@ func resolveKeychain() error {
 		{&kSecMatchLimit, security, "kSecMatchLimit", true},
 		{&kSecMatchLimitAll, security, "kSecMatchLimitAll", true},
 		{&kSecReturnRef, security, "kSecReturnRef", true},
+		{&kSecMatchSearchList, security, "kSecMatchSearchList", true},
 		{&kSecKeyAlgorithmECDSASHA256, security, "kSecKeyAlgorithmECDSASignatureDigestX962SHA256", true},
 		{&kSecKeyAlgorithmECDSASHA384, security, "kSecKeyAlgorithmECDSASignatureDigestX962SHA384", true},
 		{&kSecKeyAlgorithmRSAPSSSHA256, security, "kSecKeyAlgorithmRSASignatureDigestPSSSHA256", true},
 		{&kCFBooleanTrue, coreFoundation, "kCFBooleanTrue", true},
 		{&kCFTypeDictionaryKeyCallBacks, coreFoundation, "kCFTypeDictionaryKeyCallBacks", false},
 		{&kCFTypeDictionaryValueCallBacks, coreFoundation, "kCFTypeDictionaryValueCallBacks", false},
+		{&kCFTypeArrayCallBacks, coreFoundation, "kCFTypeArrayCallBacks", false},
 	} {
 		addr, err := purego.Dlsym(global.lib, global.name)
 		if err != nil {
@@ -356,7 +476,7 @@ func resolveKeychain() error {
 func resolveOptional(lib uintptr, name string, ptr any) {
 	symbol, err := purego.Dlsym(lib, name)
 	if err != nil {
-		log.Infof("keychain diagnostics: %s unavailable: %v", name, err)
+		log.Debugf("keychain diagnostics: %s unavailable: %v", name, err)
 		return
 	}
 	purego.RegisterFunc(ptr, symbol)
diff --git a/client/internal/certproof/pinlatch.go b/client/internal/certproof/pinlatch.go
new file mode 100644
index 000000000..79e396b11
--- /dev/null
+++ b/client/internal/certproof/pinlatch.go
@@ -0,0 +1,54 @@
+package certproof
+
+import (
+	"crypto/sha256"
+	"encoding/binary"
+	"errors"
+	"sync"
+)
+
+// errPINRejectedBefore is returned instead of logging in with a PIN the token already
+// refused: every failed login counts towards the token's lockout, which for a TPM is
+// shared with everything else on the machine, and proofs are collected on every sync.
+var errPINRejectedBefore = errors.New("PKCS#11 token rejected this PIN before, not trying it again")
+
+// errPINNeedsToken refuses a PIN that names no token to log in to.
+var errPINNeedsToken = errors.New("a PKCS#11 PIN needs the token named in NB_CERT_PKCS11_URI, as token=<label>")
+
+// rejectedPINs outlives a single store, since a store is built for each collection.
+var rejectedPINs = &pinLatch{keys: map[[sha256.Size]byte]struct{}{}}
+
+// pinLoginMu serializes logging in to a PKCS#11 token with a PIN, from checking the latch
+// to recording a rejection.
+var pinLoginMu sync.Mutex
+
+// pinLatch remembers PINs a token rejected. Keys are hashes, so the PIN itself is not
+// kept in memory any longer than the store that read it.
+type pinLatch struct {
+	mu   sync.Mutex
+	keys map[[sha256.Size]byte]struct{}
+}
+
+func (l *pinLatch) has(key [sha256.Size]byte) bool {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	_, ok := l.keys[key]
+	return ok
+}
+
+func (l *pinLatch) add(key [sha256.Size]byte) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	l.keys[key] = struct{}{}
+}
+
+// rejectedPINKey identifies a PIN for one token of one module, so a PIN another token
+// rejected is still tried on the token it belongs to.
+func rejectedPINKey(module, token string, pin []byte) [sha256.Size]byte {
+	var buf []byte
+	for _, part := range [][]byte{[]byte(module), []byte(token), pin} {
+		buf = binary.BigEndian.AppendUint64(buf, uint64(len(part)))
+		buf = append(buf, part...)
+	}
+	return sha256.Sum256(buf)
+}
diff --git a/client/internal/certproof/pinlatch_test.go b/client/internal/certproof/pinlatch_test.go
new file mode 100644
index 000000000..bf3fa2b31
--- /dev/null
+++ b/client/internal/certproof/pinlatch_test.go
@@ -0,0 +1,29 @@
+package certproof
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestRejectedPINKey_ScopesToModuleTokenAndPIN(t *testing.T) {
+	base := rejectedPINKey("/lib/a.so", "netbird", []byte("1234"))
+
+	assert.Equal(t, base, rejectedPINKey("/lib/a.so", "netbird", []byte("1234")), "the same PIN on the same token is the same key")
+	assert.NotEqual(t, base, rejectedPINKey("/lib/a.so", "netbird", []byte("4321")), "a corrected PIN must be tried")
+	assert.NotEqual(t, base, rejectedPINKey("/lib/a.so", "piv", []byte("1234")), "a PIN rejected by one token is still tried on another")
+	assert.NotEqual(t, base, rejectedPINKey("/lib/b.so", "netbird", []byte("1234")), "a PIN rejected through one module is still tried through another")
+	assert.NotEqual(t, rejectedPINKey("ab", "", []byte("1")), rejectedPINKey("a", "b", []byte("1")),
+		"field boundaries are part of the key, so shifted fields do not collide")
+}
+
+func TestPINLatch_RemembersRejectedKeys(t *testing.T) {
+	latch := &pinLatch{keys: map[[32]byte]struct{}{}}
+	rejected := rejectedPINKey("/lib/a.so", "netbird", []byte("0000"))
+	other := rejectedPINKey("/lib/a.so", "netbird", []byte("1234"))
+
+	assert.False(t, latch.has(rejected), "nothing is rejected before a login fails")
+	latch.add(rejected)
+	assert.True(t, latch.has(rejected), "a rejected PIN is not tried again")
+	assert.False(t, latch.has(other), "other PINs are unaffected")
+}
diff --git a/client/internal/certproof/pkcs11store.go b/client/internal/certproof/pkcs11store.go
index 24d0a3b5f..1f88e7600 100644
--- a/client/internal/certproof/pkcs11store.go
+++ b/client/internal/certproof/pkcs11store.go
@@ -8,12 +8,22 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"os"
 
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/client/internal/pkcs11"
 )
 
+const (
+	// PINEnv carries the user PIN of the PKCS#11 token. It is read from the daemon's
+	// environment only, so the PIN never lands in the profile config or on a command line.
+	PINEnv = "NB_TPM_PIN"
+	// PKCS11URIEnv carries the RFC 7512 URI of the token. Like the PIN it lives in the
+	// daemon's environment rather than the profile config, since it may carry pin-value.
+	PKCS11URIEnv = "NB_CERT_PKCS11_URI"
+)
+
 // PKCS11Config names the token whose certificates the store yields. URI is an RFC 7512
 // PKCS#11 URI, or empty for the first token the p11-kit proxy exposes. PIN is the user
 // PIN, and takes precedence over a pin-value or pin-source the URI carries.
@@ -22,6 +32,12 @@ type PKCS11Config struct {
 	PIN string
 }
 
+// PKCS11FromEnv returns the token named by NB_CERT_PKCS11_URI with the PIN set in
+// NB_TPM_PIN, either empty when unset.
+func PKCS11FromEnv() PKCS11Config {
+	return PKCS11Config{URI: os.Getenv(PKCS11URIEnv), PIN: os.Getenv(PINEnv)}
+}
+
 // PKCS11Store yields the identities of a PKCS#11 token, which is how tpm2-pkcs11 exposes
 // TPM-held keys on Linux. Certificates on the token are paired with keys by CKA_ID, the
 // convention tpm2_ptool addcert and pkcs11-tool follow; certificate files in the PEM
@@ -34,16 +50,22 @@ type PKCS11Store struct {
 
 // NewPKCS11Store parses cfg.URI, standing in the bare defaults when it is empty. Files in
 // certDir without a key of their own are paired with the token's keys by public key.
+//
+// A PIN is only accepted together with a token label: without one the PIN would go to
+// whichever token the module lists first, which on a machine with a smartcard plugged
+// in may be the card, and every wrong PIN counts towards that card's lockout.
 func NewPKCS11Store(cfg PKCS11Config, certDir string) (*PKCS11Store, error) {
 	store := &PKCS11Store{uri: &pkcs11.URI{}, pin: cfg.PIN, certDir: certDir}
-	if cfg.URI == "" {
-		return store, nil
+	if cfg.URI != "" {
+		parsed, err := pkcs11.ParseURI(cfg.URI)
+		if err != nil {
+			return nil, err
+		}
+		store.uri = parsed
 	}
-	parsed, err := pkcs11.ParseURI(cfg.URI)
-	if err != nil {
-		return nil, err
+	if (cfg.PIN != "" || store.uri.HasPIN()) && store.uri.Token == "" {
+		return nil, errPINNeedsToken
 	}
-	store.uri = parsed
 	return store, nil
 }
 
@@ -62,7 +84,7 @@ func (s *PKCS11Store) Candidates(_ context.Context) ([]Candidate, error) {
 	if err != nil {
 		return nil, err
 	}
-	log.Infof("%s holds %d certificates, %d certificate files without a key wait for its keys", s, len(certs), len(fileChains))
+	log.Debugf("%s holds %d certificates, %d certificate files without a key wait for its keys", s, len(certs), len(fileChains))
 
 	pool := make([]*x509.Certificate, 0, len(certs))
 	for _, cert := range certs {
@@ -75,7 +97,7 @@ func (s *PKCS11Store) Candidates(_ context.Context) ([]Candidate, error) {
 	var candidates []Candidate
 	for _, cert := range certs {
 		if _, err := privateKey(session, cert.id); err != nil {
-			log.Infof("%s certificate %q has no usable private key: %v", s, cert.cert.Subject, err)
+			log.Debugf("%s certificate %q has no usable private key: %v", s, cert.cert.Subject, err)
 			continue
 		}
 		candidates = append(candidates, s.candidate(cert.cert, cert.id, pool))
@@ -102,8 +124,8 @@ func (s *PKCS11Store) Candidates(_ context.Context) ([]Candidate, error) {
 
 func (s *PKCS11Store) candidate(leaf *x509.Certificate, id []byte, pool []*x509.Certificate) Candidate {
 	chain := buildChain(leaf, pool)
-	log.Infof("%s candidate %q issued by %q built a chain of %d certificates", s, leaf.Subject, leaf.Issuer, len(chain))
-	return Candidate{Chain: chain, Signer: &pkcs11Signer{store: s, leaf: leaf, id: id}}
+	log.Debugf("%s candidate %q issued by %q built a chain of %d certificates", s, leaf.Subject, leaf.Issuer, len(chain))
+	return Candidate{Chain: chain, Signer: &pkcs11Signer{store: s, leaf: leaf, id: id}, Intermediates: pool}
 }
 
 // fileChains reads the certificate files in the PEM directory that carry no key of their
@@ -127,6 +149,49 @@ func (s *PKCS11Store) fileChains() ([][]*x509.Certificate, error) {
 	return chains, nil
 }
 
+func (s *PKCS11Store) String() string {
+	if s.uri.Token == "" {
+		return "PKCS#11 token"
+	}
+	return fmt.Sprintf("PKCS#11 token %q", s.uri.Token)
+}
+
+func (s *PKCS11Store) open() (*pkcs11.Session, error) {
+	module, err := pkcs11.Load(s.uri.Module())
+	if err != nil {
+		return nil, err
+	}
+	pin, err := s.userPIN()
+	if err != nil {
+		return nil, err
+	}
+	if pin == nil {
+		return module.OpenSession(s.uri.Token, nil)
+	}
+
+	// The check, the login and recording a rejection happen under one lock, so two
+	// collections running at once cannot both send a PIN the token is about to refuse.
+	pinLoginMu.Lock()
+	defer pinLoginMu.Unlock()
+	key := rejectedPINKey(s.uri.Module(), s.uri.Token, pin)
+	if rejectedPINs.has(key) {
+		return nil, errPINRejectedBefore
+	}
+	session, err := module.OpenSession(s.uri.Token, pin)
+	if pkcs11.PINRejected(err) {
+		rejectedPINs.add(key)
+		return nil, fmt.Errorf("%s rejected the PIN, not retrying it until the daemon restarts: %w", s, err)
+	}
+	return session, err
+}
+
+func (s *PKCS11Store) userPIN() ([]byte, error) {
+	if s.pin != "" {
+		return []byte(s.pin), nil
+	}
+	return s.uri.PIN()
+}
+
 type tokenKey struct {
 	id     []byte
 	public crypto.PublicKey
@@ -167,32 +232,6 @@ func (k tokenKeys) idFor(pub crypto.PublicKey) ([]byte, bool) {
 	return nil, false
 }
 
-func (s *PKCS11Store) String() string {
-	if s.uri.Token == "" {
-		return "PKCS#11 token"
-	}
-	return fmt.Sprintf("PKCS#11 token %q", s.uri.Token)
-}
-
-func (s *PKCS11Store) open() (*pkcs11.Session, error) {
-	module, err := pkcs11.Load(s.uri.Module())
-	if err != nil {
-		return nil, err
-	}
-	pin, err := s.userPIN()
-	if err != nil {
-		return nil, err
-	}
-	return module.OpenSession(s.uri.Token, pin)
-}
-
-func (s *PKCS11Store) userPIN() ([]byte, error) {
-	if s.pin != "" {
-		return []byte(s.pin), nil
-	}
-	return s.uri.PIN()
-}
-
 type tokenCertificate struct {
 	cert *x509.Certificate
 	id   []byte
diff --git a/client/internal/certproof/pkcs11store_test.go b/client/internal/certproof/pkcs11store_test.go
index 2a99bb296..485c84aae 100644
--- a/client/internal/certproof/pkcs11store_test.go
+++ b/client/internal/certproof/pkcs11store_test.go
@@ -11,6 +11,8 @@ import (
 	"errors"
 	"math/big"
 	"os"
+	"runtime"
+	"strconv"
 	"testing"
 	"time"
 
@@ -23,7 +25,12 @@ import (
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
-const testPKCS11URIEnv = "NB_TEST_PKCS11_URI"
+const (
+	testPKCS11URIEnv = "NB_TEST_PKCS11_URI"
+	// testPKCS11DisposableEnv marks the token as disposable, allowing tests that spend
+	// attempts of its PIN lockout counter.
+	testPKCS11DisposableEnv = "NB_TEST_PKCS11_DISPOSABLE"
+)
 
 type failingStore struct{}
 
@@ -34,7 +41,7 @@ func (failingStore) Candidates(context.Context) ([]Candidate, error) {
 func TestStores_KeepsFileCertificatesWhenTokenFails(t *testing.T) {
 	ca := certtest.NewCA(t, "corp")
 	key := certtest.ECDSAKey(t)
-	dir := t.TempDir()
+	dir := storeDir(t)
 	writeFile(t, dir, "device.pem", certtest.CertPEM(ca.Issue(t, key, "device"))+certtest.KeyPEM(t, key))
 
 	candidates, err := Stores{failingStore{}, NewFileStore(dir)}.Candidates(context.Background())
@@ -182,7 +189,7 @@ func privateKeyAttributes(t *testing.T, key crypto.Signer) []pkcs11.Attribute {
 		return []pkcs11.Attribute{
 			attr(pkcs11.AttrKeyType, pkcs11.ULong(pkcs11.KeyEC)),
 			attr(pkcs11.AttrECParams, oidP256),
-			attr(pkcs11.AttrValue, k.D.FillBytes(make([]byte, 32))),
+			attr(pkcs11.AttrValue, ecPrivateScalar(t, k)),
 		}
 	case *rsa.PrivateKey:
 		k.Precompute()
@@ -252,7 +259,7 @@ func pkcs11TestStore(t *testing.T, certDir string) (*PKCS11Store, string) {
 // token, the certificate is a PEM file in the directory, and the two are paired by public
 // key because nothing on the token carries the certificate's CKA_ID.
 func TestCollect_PKCS11KeyWithFileCertificate(t *testing.T) {
-	dir := t.TempDir()
+	dir := storeDir(t)
 	store, uri := pkcs11TestStore(t, dir)
 
 	keys := map[string]crypto.Signer{"ecdsa": certtest.ECDSAKey(t), "rsa": certtest.RSAKey(t)}
@@ -279,7 +286,7 @@ func TestCollect_PKCS11KeyWithFileCertificate(t *testing.T) {
 
 func TestPKCS11Store_FileChains(t *testing.T) {
 	ca := certtest.NewCA(t, "corp")
-	dir := t.TempDir()
+	dir := storeDir(t)
 	// Only certificate files without a key of their own belong to the token; the file
 	// store answers for the others, and non-certificate files are ignored.
 	writeFile(t, dir, "device.pem", certtest.CertPEM(ca.Issue(t, certtest.ECDSAKey(t), "device")))
@@ -310,9 +317,9 @@ func TestNewPKCS11Store_PIN(t *testing.T) {
 		wantPIN    []byte
 		wantModule string
 	}{
-		{"pin alone opens the first p11-kit token", PKCS11Config{PIN: "1234"}, []byte("1234"), pkcs11.DefaultModule},
-		{"pin field wins over pin-value", PKCS11Config{URI: "pkcs11:?module-path=/lib/x.so&pin-value=0000", PIN: "1234"}, []byte("1234"), "/lib/x.so"},
-		{"uri pin-value stands in for a missing field", PKCS11Config{URI: "pkcs11:?pin-value=0000"}, []byte("0000"), pkcs11.DefaultModule},
+		{"pin with a token label opens that token through p11-kit", PKCS11Config{URI: "pkcs11:token=netbird", PIN: "1234"}, []byte("1234"), pkcs11.DefaultModule},
+		{"pin field wins over pin-value", PKCS11Config{URI: "pkcs11:token=netbird?module-path=" + absModule("x.so") + "&pin-value=0000", PIN: "1234"}, []byte("1234"), absModule("x.so")},
+		{"uri pin-value stands in for a missing field", PKCS11Config{URI: "pkcs11:token=netbird?pin-value=0000"}, []byte("0000"), pkcs11.DefaultModule},
 		{"no pin at all means no login", PKCS11Config{URI: "pkcs11:token=netbird"}, nil, pkcs11.DefaultModule},
 	}
 	for _, tt := range tests {
@@ -328,4 +335,60 @@ func TestNewPKCS11Store_PIN(t *testing.T) {
 
 	_, err := NewPKCS11Store(PKCS11Config{URI: "not-a-pkcs11-uri", PIN: "1234"}, "")
 	assert.Error(t, err, "a malformed URI must not be silently replaced by the defaults")
+
+	for name, cfg := range map[string]PKCS11Config{
+		"env pin without uri":      {PIN: "1234"},
+		"env pin, uri lacks token": {URI: "pkcs11:?module-path=" + absModule("x.so"), PIN: "1234"},
+		"inline pin-value only":    {URI: "pkcs11:?pin-value=0000"},
+		"pin-source only":          {URI: "pkcs11:?pin-source=file:/etc/netbird/pkcs11.pin"},
+	} {
+		_, err := NewPKCS11Store(cfg, "")
+		assert.ErrorIs(t, err, errPINNeedsToken, "%s: a PIN must not go to whichever token is listed first", name)
+	}
+}
+
+// TestPKCS11Store_WrongPINIsTriedOnce logs in to the real token with a wrong PIN: the
+// token refuses it, and the next collection refuses to send the same PIN again rather
+// than spending another attempt of the token's lockout counter. The one attempt it does
+// spend counts against a real token's lockout, so it runs only on a token marked
+// disposable through NB_TEST_PKCS11_DISPOSABLE.
+func TestPKCS11Store_WrongPINIsTriedOnce(t *testing.T) {
+	disposable, _ := strconv.ParseBool(os.Getenv(testPKCS11DisposableEnv))
+	if !disposable {
+		t.Skipf("set %s=1 to spend a wrong-PIN attempt on the token", testPKCS11DisposableEnv)
+	}
+	_, uri := pkcs11TestStore(t, "")
+
+	wrongPIN := "wrong-pin-" + t.Name()
+	store, err := NewPKCS11Store(PKCS11Config{URI: uri, PIN: wrongPIN}, "")
+	require.NoError(t, err)
+
+	_, err = store.Candidates(context.Background())
+	require.Error(t, err)
+	assert.True(t, pkcs11.PINRejected(err), "the token itself rejects the PIN: %v", err)
+
+	_, err = store.Candidates(context.Background())
+	assert.ErrorIs(t, err, errPINRejectedBefore, "the rejected PIN is not sent to the token again")
+
+	good, err := NewPKCS11Store(PKCS11Config{URI: uri}, "")
+	require.NoError(t, err)
+	_, err = good.Candidates(context.Background())
+	assert.NoError(t, err, "the correct PIN for the same token is unaffected")
+}
+
+// absModule is an absolute module path on the platform the test runs on, as module-path
+// must be absolute.
+func absModule(name string) string {
+	if runtime.GOOS == "windows" {
+		return `C:\lib\` + name
+	}
+	return "/lib/" + name
+}
+
+// ecPrivateScalar returns the raw private scalar the token stores in CKA_VALUE.
+func ecPrivateScalar(t *testing.T, k *ecdsa.PrivateKey) []byte {
+	t.Helper()
+	raw, err := k.Bytes()
+	require.NoError(t, err)
+	return raw
 }
diff --git a/client/internal/certproof/store.go b/client/internal/certproof/store.go
index 666bb1be3..295d6caa4 100644
--- a/client/internal/certproof/store.go
+++ b/client/internal/certproof/store.go
@@ -9,22 +9,41 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"slices"
 	"strings"
 
 	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/tpm"
 )
 
 const (
 	StoreDirEnv     = "NB_CERT_STORE_DIR"
 	defaultStoreDir = "/etc/netbird/certs"
+
+	// maxStoreFileSize bounds a certificate or key file of the PEM directory. A chain with
+	// its key is a few kilobytes.
+	maxStoreFileSize = 1 << 20
+)
+
+// errKeyMismatch rejects a key that does not belong to the certificate it sits with: it
+// would sign a proof management can only reject, in place of a usable later candidate.
+var (
+	errKeyMismatch  = errors.New("private key does not match the certificate")
+	errNoSiblingKey = errors.New("no key file next to the certificate")
 )
 
 // Candidate is a certificate chain the peer can sign for. Signer never exposes the key.
+// Chain is leaf first. Intermediates holds every other certificate the store has, so a
+// path to a challenge's CAs can be found even where Chain followed a different issuer,
+// such as an expired copy of a renewed intermediate.
 type Candidate struct {
-	Chain  []*x509.Certificate
-	Signer crypto.Signer
+	Chain         []*x509.Certificate
+	Signer        crypto.Signer
+	Intermediates []*x509.Certificate
+}
+
+// issuers is every certificate other than the leaf that a path may run through.
+func (c Candidate) issuers() []*x509.Certificate {
+	return append(slices.Clip(c.Chain[1:]), c.Intermediates...)
 }
 
 // Store yields the certificates a peer may prove possession of. FileStore is the PEM
@@ -33,19 +52,20 @@ type Store interface {
 	Candidates(ctx context.Context) ([]Candidate, error)
 }
 
-// Config selects where the Linux daemon looks for certificates: Dir is the PEM directory,
-// empty for NB_CERT_STORE_DIR or /etc/netbird/certs, and PKCS11 names a token whose keys
-// sign for certificates on the token or in that directory.
+// Config selects where the daemon looks for certificates. PKCS11 names a token whose keys
+// sign for certificates on the token or in the PEM directory, which NB_CERT_STORE_DIR
+// names on Linux, /etc/netbird/certs by default.
+//
+// ProfileOwner is the OS account the active profile belongs to. On macOS and Windows only
+// that account's certificate store is consulted for user certificates, so on a machine
+// with several people signed in the result does not depend on who else is logged in.
+// Empty means the profile has no owner, and only the user at the physical console counts.
+// OwnerUnknown means the owner could not be determined, and no user store is consulted:
+// guessing would let whoever sits at the console answer for the profile.
 type Config struct {
-	Dir    string
-	PKCS11 PKCS11Config
-}
-
-func (c Config) dir() string {
-	if c.Dir != "" {
-		return c.Dir
-	}
-	return StoreDir()
+	PKCS11       PKCS11Config
+	ProfileOwner string
+	OwnerUnknown bool
 }
 
 // FileStore reads PEM files from a directory. A file holds the chain (leaf first) and
@@ -89,7 +109,16 @@ func (s *FileStore) Candidates(_ context.Context) ([]Candidate, error) {
 }
 
 // certFiles lists the certificate files in dir, none when the directory does not exist.
+// The directory is checked before it is listed, so one that others can write to is
+// refused before its entries are read.
 func certFiles(dir string) ([]string, error) {
+	err := checkStoreDir(dir)
+	if errors.Is(err, os.ErrNotExist) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, fmt.Errorf("refusing certificate store: %w", err)
+	}
 	entries, err := os.ReadDir(dir)
 	if errors.Is(err, os.ErrNotExist) {
 		return nil, nil
@@ -109,7 +138,7 @@ func certFiles(dir string) ([]string, error) {
 // loadPEM reads a certificate file and its private key, held in the file itself or in
 // the sibling "<name>.key" file. The signer is nil when neither holds a key.
 func loadPEM(path string) ([]*x509.Certificate, crypto.Signer, error) {
-	data, err := os.ReadFile(path)
+	data, err := readStoreFile(path)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -120,25 +149,47 @@ func loadPEM(path string) ([]*x509.Certificate, crypto.Signer, error) {
 	if len(chain) == 0 {
 		return nil, nil, errors.New("no certificate")
 	}
-	if signer != nil {
-		return chain, signer, nil
-	}
-	keyData, err := os.ReadFile(strings.TrimSuffix(path, filepath.Ext(path)) + ".key")
-	if errors.Is(err, os.ErrNotExist) {
-		return chain, nil, nil
-	}
-	if err != nil {
-		return nil, nil, fmt.Errorf("read key file: %w", err)
-	}
-	if _, signer, err = parsePEM(keyData); err != nil {
-		return nil, nil, err
-	}
 	if signer == nil {
-		return nil, nil, errors.New("no private key in key file")
+		signer, err = siblingKey(path)
+		switch {
+		case errors.Is(err, errNoSiblingKey):
+			// A certificate with no key of its own: the token store pairs it later.
+			return chain, nil, nil
+		case err != nil:
+			return nil, nil, err
+		}
+	}
+	if !samePublicKey(signer.Public(), chain[0].PublicKey) {
+		return nil, nil, errKeyMismatch
 	}
 	return chain, signer, nil
 }
 
+// siblingKey reads the private key from the "<name>.key" file next to a certificate
+// file, reporting errNoSiblingKey when there is none.
+func siblingKey(path string) (crypto.Signer, error) {
+	keyData, err := readStoreFile(strings.TrimSuffix(path, filepath.Ext(path)) + ".key")
+	if errors.Is(err, os.ErrNotExist) {
+		return nil, errNoSiblingKey
+	}
+	if err != nil {
+		return nil, fmt.Errorf("read key file: %w", err)
+	}
+	_, signer, err := parsePEM(keyData)
+	if err != nil {
+		return nil, err
+	}
+	if signer == nil {
+		return nil, errors.New("no private key in key file")
+	}
+	return signer, nil
+}
+
+func samePublicKey(a, b crypto.PublicKey) bool {
+	equaler, ok := a.(interface{ Equal(crypto.PublicKey) bool })
+	return ok && equaler.Equal(b)
+}
+
 func parsePEM(data []byte) ([]*x509.Certificate, crypto.Signer, error) {
 	var chain []*x509.Certificate
 	var signer crypto.Signer
@@ -155,7 +206,7 @@ func parsePEM(data []byte) ([]*x509.Certificate, crypto.Signer, error) {
 				return nil, nil, fmt.Errorf("parse certificate: %w", err)
 			}
 			chain = append(chain, cert)
-		case "PRIVATE KEY", "EC PRIVATE KEY", "RSA PRIVATE KEY", tpm.KeyPEMType:
+		case "PRIVATE KEY", "EC PRIVATE KEY", "RSA PRIVATE KEY", tss2KeyPEMType:
 			key, err := parsePrivateKey(block)
 			if err != nil {
 				return nil, nil, err
@@ -169,8 +220,8 @@ func parsePrivateKey(block *pem.Block) (crypto.Signer, error) {
 	var key any
 	var err error
 	switch block.Type {
-	case tpm.KeyPEMType:
-		return tpm.ParseKey(block.Bytes)
+	case tss2KeyPEMType:
+		return parseTSS2Key(block.Bytes)
 	case "EC PRIVATE KEY":
 		key, err = x509.ParseECPrivateKey(block.Bytes)
 	case "RSA PRIVATE KEY":
diff --git a/client/internal/certproof/store_other.go b/client/internal/certproof/store_other.go
index be467fa51..e6646732b 100644
--- a/client/internal/certproof/store_other.go
+++ b/client/internal/certproof/store_other.go
@@ -1,8 +1,16 @@
-//go:build !darwin && !windows
+//go:build ((!darwin && !windows) || ios) && !js
 
 package certproof
 
-import log "github.com/sirupsen/logrus"
+import (
+	"sync"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/pkcs11"
+)
+
+var unsupportedTokenOnce sync.Once
 
 // DefaultStore is the PEM directory named by NB_CERT_STORE_DIR, or /etc/netbird/certs.
 func DefaultStore() Store {
@@ -12,11 +20,17 @@ func DefaultStore() Store {
 // storeWithToken reads the PEM directory cfg names, joined by the PKCS#11 token when cfg
 // names one. The token pairs the directory's key-less certificates with its own keys.
 func storeWithToken(cfg Config) Store {
-	files := NewFileStore(cfg.dir())
+	files := NewFileStore(StoreDir())
 	if cfg.PKCS11.URI == "" && cfg.PKCS11.PIN == "" {
 		return files
 	}
-	token, err := NewPKCS11Store(cfg.PKCS11, cfg.dir())
+	if !pkcs11.Supported() {
+		unsupportedTokenOnce.Do(func() {
+			log.Warnf("ignoring the configured PKCS#11 token: %v", pkcs11.ErrUnsupported)
+		})
+		return files
+	}
+	token, err := NewPKCS11Store(cfg.PKCS11, StoreDir())
 	if err != nil {
 		log.Warnf("ignoring PKCS#11 URI: %v", err)
 		return files
diff --git a/client/internal/certproof/store_other_test.go b/client/internal/certproof/store_other_test.go
index 5787df9f9..47b05f058 100644
--- a/client/internal/certproof/store_other_test.go
+++ b/client/internal/certproof/store_other_test.go
@@ -1,4 +1,4 @@
-//go:build !darwin && !windows
+//go:build ((!darwin && !windows) || ios) && !js
 
 package certproof
 
@@ -7,26 +7,34 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/pkcs11"
 )
 
 func TestStoreWithToken(t *testing.T) {
-	dir := t.TempDir()
+	dir := storeDir(t)
+	t.Setenv(StoreDirEnv, dir)
 
-	files, ok := storeWithToken(Config{Dir: dir}).(*FileStore)
-	require.True(t, ok, "a directory alone reads that directory alone")
-	assert.Equal(t, dir, files.dir, "the configured directory replaces the default")
-
-	files, ok = storeWithToken(Config{}).(*FileStore)
-	require.True(t, ok, "nothing configured reads the PEM directory alone")
-	assert.Equal(t, StoreDir(), files.dir, "no directory configured falls back to the environment or the default")
+	files, ok := storeWithToken(Config{}).(*FileStore)
+	require.True(t, ok, "no token configured reads the PEM directory alone")
+	assert.Equal(t, dir, files.dir, "the directory comes from NB_CERT_STORE_DIR")
 
 	assert.IsType(t, &FileStore{}, storeWithToken(Config{PKCS11: PKCS11Config{URI: "not-a-pkcs11-uri"}}), "an invalid URI must not hide the PEM directory")
+	assert.IsType(t, &FileStore{}, storeWithToken(Config{PKCS11: PKCS11Config{PIN: "1234"}}), "a PIN naming no token is refused and leaves the PEM directory")
 
-	for name, cfg := range map[string]PKCS11Config{
-		"pin alone": {PIN: "1234"},
-		"uri alone": {URI: "pkcs11:token=netbird?pin-value=1234"},
-	} {
-		store, ok := storeWithToken(Config{Dir: dir, PKCS11: cfg}).(Stores)
+	configured := map[string]PKCS11Config{
+		"env pin with token uri": {URI: "pkcs11:token=netbird", PIN: "1234"},
+		"uri alone":              {URI: "pkcs11:token=netbird?pin-value=1234"},
+	}
+	if !pkcs11.Supported() {
+		for name, cfg := range configured {
+			assert.IsType(t, &FileStore{}, storeWithToken(Config{PKCS11: cfg}),
+				"%s: a build without PKCS#11 support reads the PEM directory alone", name)
+		}
+		return
+	}
+	for name, cfg := range configured {
+		store, ok := storeWithToken(Config{PKCS11: cfg}).(Stores)
 		require.True(t, ok, "%s joins the token to the PEM directory", name)
 		require.Len(t, store, 2, name)
 		token, ok := store[1].(*PKCS11Store)
diff --git a/client/internal/certproof/store_tpm_test.go b/client/internal/certproof/store_tpm_test.go
index 09f54e0b0..f8a7a0960 100644
--- a/client/internal/certproof/store_tpm_test.go
+++ b/client/internal/certproof/store_tpm_test.go
@@ -13,7 +13,6 @@ import (
 	"github.com/google/go-tpm/legacy/tpm2"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"go.step.sm/crypto/tpm/tss2"
 
 	"github.com/netbirdio/netbird/client/internal/tpm"
 	"github.com/netbirdio/netbird/client/internal/tpm/tpmtest"
@@ -28,15 +27,14 @@ func TestFileStore_TPMKeyFile(t *testing.T) {
 	require.NoError(t, err)
 	leaf := ca.Issue(t, key, "device")
 
-	dir := t.TempDir()
+	dir := storeDir(t)
 	writeFile(t, dir, "device.pem", certtest.CertPEM(leaf))
 	writeFile(t, dir, "device.key", tpmtest.KeyPEM(t, &key.PublicKey))
 
 	// A key that needs a password can never be used silently, so its certificate is skipped.
 	locked := certtest.ECDSAKey(t)
-	withAuth := func(k *tss2.TPMKey) { k.EmptyAuth = false }
 	writeFile(t, dir, "locked.pem", certtest.CertPEM(ca.Issue(t, locked, "locked")))
-	writeFile(t, dir, "locked.key", tpmtest.KeyPEM(t, locked.Public().(*ecdsa.PublicKey), withAuth))
+	writeFile(t, dir, "locked.key", tpmtest.KeyPEM(t, locked.Public().(*ecdsa.PublicKey), tpmtest.WithAuth()))
 
 	candidates, err := NewFileStore(dir).Candidates(context.Background())
 	require.NoError(t, err)
@@ -66,7 +64,7 @@ func TestCollect_TPMKeyEndToEnd(t *testing.T) {
 
 	ca := certtest.NewCA(t, "corp")
 	leaf := ca.Issue(t, signer, "device")
-	dir := t.TempDir()
+	dir := storeDir(t)
 	writeFile(t, dir, "device.pem", certtest.CertPEM(leaf))
 	writeFile(t, dir, "device.key", keyPEM)
 
@@ -88,7 +86,7 @@ func createTPMKey(t *testing.T) (public, private []byte) {
 	require.NoError(t, err)
 	defer func() { _ = rwc.Close() }()
 
-	parent, _, err := tpm2.CreatePrimary(rwc, tpm2.HandleOwner, tpm2.PCRSelection{}, "", "", tss2.ECCSRKTemplate)
+	parent, _, err := tpm2.CreatePrimary(rwc, tpm2.HandleOwner, tpm2.PCRSelection{}, "", "", tpmtest.ECCSRKTemplate)
 	require.NoError(t, err)
 	defer func() { _ = tpm2.FlushContext(rwc, parent) }()
 
diff --git a/client/internal/certproof/store_tss2.go b/client/internal/certproof/store_tss2.go
new file mode 100644
index 000000000..d8a0d0714
--- /dev/null
+++ b/client/internal/certproof/store_tss2.go
@@ -0,0 +1,17 @@
+//go:build !js
+
+package certproof
+
+import (
+	"crypto"
+
+	"github.com/netbirdio/netbird/client/internal/tpm"
+)
+
+// tss2KeyPEMType is the PEM block type of a TPM 2.0 key file.
+const tss2KeyPEMType = tpm.KeyPEMType
+
+// parseTSS2Key returns a signer for a TPM-held key file that signs inside the TPM.
+func parseTSS2Key(der []byte) (crypto.Signer, error) {
+	return tpm.ParseKey(der)
+}
diff --git a/client/internal/certproof/store_tss2_js.go b/client/internal/certproof/store_tss2_js.go
new file mode 100644
index 000000000..b143c9071
--- /dev/null
+++ b/client/internal/certproof/store_tss2_js.go
@@ -0,0 +1,16 @@
+//go:build js
+
+package certproof
+
+import (
+	"crypto"
+	"errors"
+)
+
+// tss2KeyPEMType is the PEM block type of a TPM 2.0 key file. A browser has no TPM, so
+// the TPM library stays out of the WebAssembly build and such a key is refused.
+const tss2KeyPEMType = "TSS2 PRIVATE KEY"
+
+func parseTSS2Key([]byte) (crypto.Signer, error) {
+	return nil, errors.New("TPM keys are not supported in this build")
+}
diff --git a/client/internal/certproof/storefile_other.go b/client/internal/certproof/storefile_other.go
new file mode 100644
index 000000000..0dc5da99c
--- /dev/null
+++ b/client/internal/certproof/storefile_other.go
@@ -0,0 +1,34 @@
+//go:build !unix
+
+package certproof
+
+import (
+	"fmt"
+	"io"
+	"os"
+)
+
+// readStoreFile reads a certificate or key file of the PEM directory, up to the size
+// limit. Ownership is checked on Unix only; elsewhere the PEM directory is not the store
+// the daemon reads by default.
+func readStoreFile(path string) ([]byte, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = f.Close() }()
+
+	data, err := io.ReadAll(io.LimitReader(f, maxStoreFileSize+1))
+	if err != nil {
+		return nil, fmt.Errorf("read %s: %w", path, err)
+	}
+	if len(data) > maxStoreFileSize {
+		return nil, fmt.Errorf("%s is over the %d byte limit", path, maxStoreFileSize)
+	}
+	return data, nil
+}
+
+// checkStoreDir accepts any directory where the PEM directory is not a default store.
+func checkStoreDir(string) error {
+	return nil
+}
diff --git a/client/internal/certproof/storefile_unix.go b/client/internal/certproof/storefile_unix.go
new file mode 100644
index 000000000..181bf9314
--- /dev/null
+++ b/client/internal/certproof/storefile_unix.go
@@ -0,0 +1,101 @@
+//go:build unix
+
+package certproof
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"syscall"
+)
+
+// readStoreFile reads a certificate or key file of the PEM directory as the daemon may
+// trust it: the path must not be a symlink and must be a regular file that only root or
+// this process's own user can write. Otherwise a user able to place or redirect a file
+// could make the daemon sign with a key of their choosing, or with a root-only key kept
+// elsewhere on the machine. The file is checked through the descriptor it is read from,
+// so it cannot be swapped between the check and the read.
+func readStoreFile(path string) ([]byte, error) {
+	// O_NONBLOCK keeps a FIFO planted in the directory from blocking the open; the
+	// regular-file check below then refuses it.
+	f, err := os.OpenFile(path, os.O_RDONLY|syscall.O_NOFOLLOW|syscall.O_NONBLOCK, 0)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = f.Close() }()
+
+	info, err := f.Stat()
+	if err != nil {
+		return nil, fmt.Errorf("stat %s: %w", path, err)
+	}
+	if !info.Mode().IsRegular() {
+		return nil, fmt.Errorf("%s is not a regular file", path)
+	}
+	if err := checkTrustedOwner(info); err != nil {
+		return nil, fmt.Errorf("%s: %w", path, err)
+	}
+	if info.Size() > maxStoreFileSize {
+		return nil, fmt.Errorf("%s is %d bytes, over the %d byte limit", path, info.Size(), maxStoreFileSize)
+	}
+	data, err := io.ReadAll(io.LimitReader(f, maxStoreFileSize+1))
+	if err != nil {
+		return nil, fmt.Errorf("read %s: %w", path, err)
+	}
+	if len(data) > maxStoreFileSize {
+		return nil, fmt.Errorf("%s grew past the %d byte limit while being read", path, maxStoreFileSize)
+	}
+	return data, nil
+}
+
+// checkStoreDir refuses a PEM directory that someone other than root or this process's
+// user could add files to or rename files in. The configured path may be a symlink, as
+// distributions place certificate directories behind them, but only one root or this
+// process's user owns: otherwise whoever owns the link could point it at any directory.
+func checkStoreDir(dir string) error {
+	link, err := os.Lstat(dir)
+	if err != nil {
+		return err
+	}
+	if link.Mode()&os.ModeSymlink != 0 {
+		if err := checkTrustedUID(link); err != nil {
+			return fmt.Errorf("symlink %s: %w", dir, err)
+		}
+	}
+	info, err := os.Stat(dir)
+	if err != nil {
+		return err
+	}
+	if !info.IsDir() {
+		return fmt.Errorf("%s is not a directory", dir)
+	}
+	if err := checkTrustedOwner(info); err != nil {
+		return fmt.Errorf("%s: %w", dir, err)
+	}
+	return nil
+}
+
+// checkTrustedOwner requires info to belong to root or to this process's user and to be
+// writable by nobody else. Group write is refused even for root's group, which ordinary
+// users may be members of. An owner that cannot be read is refused.
+func checkTrustedOwner(info os.FileInfo) error {
+	if err := checkTrustedUID(info); err != nil {
+		return err
+	}
+	if perm := info.Mode().Perm(); perm&0o022 != 0 {
+		return fmt.Errorf("writable by group or other users (mode %#o)", perm)
+	}
+	return nil
+}
+
+// checkTrustedUID requires info to belong to root or to this process's user.
+func checkTrustedUID(info os.FileInfo) error {
+	st, ok := info.Sys().(*syscall.Stat_t)
+	if !ok {
+		return errors.New("owner cannot be determined")
+	}
+	if st.Uid != 0 && int(st.Uid) != os.Geteuid() {
+		return fmt.Errorf("owned by uid %d, not by root", st.Uid)
+	}
+	return nil
+}
diff --git a/client/internal/certproof/storefile_unix_test.go b/client/internal/certproof/storefile_unix_test.go
new file mode 100644
index 000000000..d35a4e759
--- /dev/null
+++ b/client/internal/certproof/storefile_unix_test.go
@@ -0,0 +1,136 @@
+//go:build unix
+
+package certproof
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"syscall"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/management/certposture/certtest"
+)
+
+// devicePair writes a certificate and its key as separate files into dir.
+func devicePair(t *testing.T, dir string) {
+	t.Helper()
+	ca := certtest.NewCA(t, "corp-root")
+	key := certtest.ECDSAKey(t)
+	writeFile(t, dir, "device.crt", certtest.CertPEM(ca.Issue(t, key, "device")))
+	writeFile(t, dir, "device.key", certtest.KeyPEM(t, key))
+}
+
+func candidates(t *testing.T, dir string) ([]Candidate, error) {
+	t.Helper()
+	return NewFileStore(dir).Candidates(context.Background())
+}
+
+func TestFileStore_AcceptsAPrivatePair(t *testing.T) {
+	dir := storeDir(t)
+	devicePair(t, dir)
+
+	got, err := candidates(t, dir)
+	require.NoError(t, err)
+	assert.Len(t, got, 1, "a certificate and key only their owner can write are used")
+}
+
+func TestFileStore_RefusesASymlinkedKey(t *testing.T) {
+	dir := storeDir(t)
+	devicePair(t, dir)
+
+	// The real key moves elsewhere and the directory only links to it, as a user able
+	// to write the directory would do to point the daemon at a key it should not use.
+	elsewhere := filepath.Join(storeDir(t), "other.key")
+	require.NoError(t, os.Rename(filepath.Join(dir, "device.key"), elsewhere))
+	require.NoError(t, os.Symlink(elsewhere, filepath.Join(dir, "device.key")))
+
+	got, err := candidates(t, dir)
+	require.NoError(t, err)
+	assert.Empty(t, got, "a key reached through a symlink is never used")
+}
+
+func TestFileStore_RefusesASymlinkedCertificateFile(t *testing.T) {
+	dir := storeDir(t)
+	other := storeDir(t)
+	devicePair(t, other)
+	require.NoError(t, os.Symlink(filepath.Join(other, "device.crt"), filepath.Join(dir, "device.crt")))
+	require.NoError(t, os.Symlink(filepath.Join(other, "device.key"), filepath.Join(dir, "device.key")))
+
+	got, err := candidates(t, dir)
+	require.NoError(t, err)
+	assert.Empty(t, got, "a certificate file that is a symlink is skipped")
+}
+
+func TestFileStore_RefusesFilesOthersCanWrite(t *testing.T) {
+	for name, mode := range map[string]os.FileMode{"world-writable": 0o602, "group-writable": 0o620} {
+		t.Run(name, func(t *testing.T) {
+			dir := storeDir(t)
+			devicePair(t, dir)
+			require.NoError(t, os.Chmod(filepath.Join(dir, "device.key"), mode))
+
+			got, err := candidates(t, dir)
+			require.NoError(t, err)
+			assert.Empty(t, got, "a key %s may have been replaced by someone else, even when the group is root's", name)
+		})
+	}
+}
+
+func TestFileStore_RefusesADirectoryOthersCanWrite(t *testing.T) {
+	dir := storeDir(t)
+	devicePair(t, dir)
+	require.NoError(t, os.Chmod(dir, 0o777))
+
+	_, err := candidates(t, dir)
+	assert.ErrorContains(t, err, "refusing certificate store", "files in a directory anyone can write are not trusted")
+}
+
+func TestFileStore_SkipsAFIFOWithoutBlocking(t *testing.T) {
+	dir := storeDir(t)
+	require.NoError(t, syscall.Mkfifo(filepath.Join(dir, "trap.pem"), 0o600))
+	devicePair(t, dir)
+
+	got, err := candidates(t, dir)
+	require.NoError(t, err)
+	assert.Len(t, got, 1, "a FIFO is skipped and the real pair still loads")
+}
+
+func TestReadStoreFile_RefusesOversizedFiles(t *testing.T) {
+	dir := storeDir(t)
+	path := filepath.Join(dir, "huge.pem")
+	require.NoError(t, os.WriteFile(path, make([]byte, maxStoreFileSize+1), 0o600))
+
+	_, err := readStoreFile(path)
+	assert.ErrorContains(t, err, "limit")
+}
+
+func TestFileStore_AcceptsASymlinkedDirectoryItsOwnerControls(t *testing.T) {
+	target := storeDir(t)
+	devicePair(t, target)
+	link := filepath.Join(storeDir(t), "certs")
+	require.NoError(t, os.Symlink(target, link))
+
+	// The link belongs to this process's user, as one root creates belongs to root.
+	got, err := candidates(t, link)
+	require.NoError(t, err)
+	assert.Len(t, got, 1, "a certificate directory behind a symlink the owner controls is read")
+}
+
+func TestFileStore_ChecksTheDirectoryBeforeListingIt(t *testing.T) {
+	dir := storeDir(t)
+	devicePair(t, dir)
+	require.NoError(t, os.Chmod(dir, 0o777))
+
+	paths, err := certFiles(dir)
+	assert.ErrorContains(t, err, "refusing certificate store")
+	assert.Nil(t, paths, "nothing in a directory anyone can write to is listed")
+}
+
+func TestFileStore_MissingDirectoryIsEmpty(t *testing.T) {
+	paths, err := certFiles(filepath.Join(storeDir(t), "missing"))
+	assert.NoError(t, err, "a store directory that does not exist yet is not an error")
+	assert.Empty(t, paths)
+}
diff --git a/client/internal/certproof/systemstore_windows.go b/client/internal/certproof/systemstore_windows.go
index 0a91aa557..92aa03d4b 100644
--- a/client/internal/certproof/systemstore_windows.go
+++ b/client/internal/certproof/systemstore_windows.go
@@ -23,9 +23,15 @@ const (
 	cryptAcquireSilentFlag          = 0x00000040
 	cryptAcquirePreferNCryptKeyFlag = 0x00020000
 	certNCryptKeySpec               = 0xFFFFFFFF
+	atKeyExchange                   = 1
+	atSignature                     = 2
 	bcryptPadPSS                    = 0x00000008
 )
 
+// errLegacyKey reports a private key CNG cannot open: it lives in a legacy CryptoAPI
+// provider, which only offers PKCS#1 v1.5 and no RSA-PSS or ECDSA.
+var errLegacyKey = errors.New("private key is held by a legacy CryptoAPI provider, which certificate posture cannot sign with")
+
 var (
 	crypt32 = windows.NewLazySystemDLL("crypt32.dll")
 	ncrypt  = windows.NewLazySystemDLL("ncrypt.dll")
@@ -78,7 +84,7 @@ func (s *SystemStore) Candidates(_ context.Context) ([]Candidate, error) {
 	if err != nil {
 		return nil, err
 	}
-	log.Infof("certificate store %s holds %d personal certificates and %d intermediates", s, len(leaves), len(intermediates))
+	log.Debugf("certificate store %s holds %d personal certificates and %d intermediates", s, len(leaves), len(intermediates))
 	if len(leaves) == 0 {
 		return nil, nil
 	}
@@ -87,8 +93,8 @@ func (s *SystemStore) Candidates(_ context.Context) ([]Candidate, error) {
 	candidates := make([]Candidate, 0, len(leaves))
 	for _, leaf := range leaves {
 		chain := buildChain(leaf, pool)
-		log.Infof("certificate store %s candidate %q issued by %q built a chain of %d certificates", s, leaf.Subject, leaf.Issuer, len(chain))
-		candidates = append(candidates, Candidate{Chain: chain, Signer: &systemStoreSigner{leaf: leaf, location: s.location}})
+		log.Debugf("certificate store %s candidate %q issued by %q built a chain of %d certificates", s, leaf.Subject, leaf.Issuer, len(chain))
+		candidates = append(candidates, Candidate{Chain: chain, Signer: &systemStoreSigner{leaf: leaf, location: s.location}, Intermediates: pool})
 	}
 	return candidates, nil
 }
@@ -153,7 +159,7 @@ func signWithContext(ctx *windows.CertContext, scheme sigScheme, digest []byte)
 		if callerFree != 0 {
 			_ = windows.CryptReleaseContext(windows.Handle(key), 0)
 		}
-		return nil, errors.New("legacy CryptoAPI keys are not supported")
+		return nil, legacyKeyError(keySpec)
 	}
 	if callerFree != 0 {
 		defer func() { _, _, _ = procNCryptFreeObject.Call(key) }()
@@ -181,6 +187,19 @@ func signWithContext(ctx *windows.CertContext, scheme sigScheme, digest []byte)
 	return ecdsaSignatureASN1(signature)
 }
 
+// legacyKeyError describes a key acquired through CryptoAPI rather than CNG, naming its
+// key spec and the remedy, since the certificate otherwise looks usable in the store.
+func legacyKeyError(keySpec uint32) error {
+	spec := fmt.Sprintf("key spec %d", keySpec)
+	switch keySpec {
+	case atKeyExchange:
+		spec = "AT_KEYEXCHANGE"
+	case atSignature:
+		spec = "AT_SIGNATURE"
+	}
+	return fmt.Errorf("%w (%s); re-enrol it with a certificate template whose provider is a CNG key storage provider", errLegacyKey, spec)
+}
+
 func ncryptSignHash(key uintptr, padding unsafe.Pointer, digest, signature []byte, flags uintptr) (uint32, error) {
 	var result uint32
 	var signaturePtr uintptr
diff --git a/client/internal/certproof/systemstore_windows_test.go b/client/internal/certproof/systemstore_windows_test.go
new file mode 100644
index 000000000..fda23c2ef
--- /dev/null
+++ b/client/internal/certproof/systemstore_windows_test.go
@@ -0,0 +1,16 @@
+package certproof
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestLegacyKeyError_NamesTheKeySpecAndTheRemedy(t *testing.T) {
+	for spec, want := range map[uint32]string{atKeyExchange: "AT_KEYEXCHANGE", atSignature: "AT_SIGNATURE", 7: "key spec 7"} {
+		err := legacyKeyError(spec)
+		assert.ErrorIs(t, err, errLegacyKey, "callers can tell a legacy key from other failures")
+		assert.ErrorContains(t, err, want, "the key spec found is named")
+		assert.ErrorContains(t, err, "key storage provider", "the error says how to fix the enrolment")
+	}
+}
diff --git a/client/internal/connect.go b/client/internal/connect.go
index 3283b8897..de7f46b2e 100644
--- a/client/internal/connect.go
+++ b/client/internal/connect.go
@@ -76,6 +76,9 @@ type ConnectClient struct {
 	// netMgr gates every reconnection loop on OS-reported network
 	// availability and sweeps connections on network change.
 	netMgr *netevents.Manager
+
+	profileOwner        string
+	profileOwnerUnknown bool
 }
 
 // ConnectClientOption configures optional ConnectClient behavior.
@@ -86,6 +89,18 @@ func WithNetEvents(events *netevents.Manager) ConnectClientOption {
 	return func(c *ConnectClient) { c.netMgr = events }
 }
 
+// WithProfileOwner names the OS account the active profile belongs to, whose own
+// certificate store answers user certificate posture checks.
+func WithProfileOwner(username string) ConnectClientOption {
+	return func(c *ConnectClient) { c.profileOwner = username }
+}
+
+// WithUnknownProfileOwner records that the active profile's owner could not be
+// determined, so no user's certificate store answers certificate posture checks.
+func WithUnknownProfileOwner() ConnectClientOption {
+	return func(c *ConnectClient) { c.profileOwnerUnknown = true }
+}
+
 func NewConnectClient(
 	ctx context.Context,
 	config *profilemanager.Config,
@@ -421,6 +436,8 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 			return wrapErr(err)
 		}
 		engineConfig.TempDir = mobileDependency.TempDir
+		engineConfig.CertStore.ProfileOwner = c.profileOwner
+		engineConfig.CertStore.OwnerUnknown = c.profileOwnerUnknown
 		// Leave StateDir empty when there is no state path so a disk-backed
 		// syncstore falls back to os.TempDir() instead of filepath.Dir("") == ".".
 		if path != "" {
@@ -676,10 +693,7 @@ func createEngineConfig(key wgtypes.Key, config *profilemanager.Config, peerConf
 
 		LazyConnection: lazyconn.ParseState(config.LazyConnection),
 
-		CertStore: certproof.Config{
-			Dir:    config.CertStoreDir,
-			PKCS11: certproof.PKCS11Config{URI: config.CertPKCS11URI, PIN: config.CertPKCS11PIN},
-		},
+		CertStore: certStoreConfig(config),
 
 		MTU:     selectMTU(config.MTU, peerConfig.Mtu),
 		LogPath: logPath,
@@ -707,6 +721,22 @@ func createEngineConfig(key wgtypes.Key, config *profilemanager.Config, peerConf
 	return engineConf, nil
 }
 
+// certStoreConfig reads where certificate posture finds certificates from the daemon's
+// environment, NB_CERT_STORE_DIR and NB_CERT_PKCS11_URI with NB_TPM_PIN. The profile
+// config fields that once held them are ignored, and a value left there is reported
+// once, so a setup relying on it does not silently stop proving.
+func certStoreConfig(config *profilemanager.Config) certproof.Config {
+	if config.CertStoreDir != "" || config.CertPKCS11URI != "" {
+		legacyCertConfigOnce.Do(func() {
+			log.Warnf("certificate posture: CertStoreDir and CertPKCS11URI in the profile config are ignored, set %s and %s in the daemon's environment instead",
+				certproof.StoreDirEnv, certproof.PKCS11URIEnv)
+		})
+	}
+	return certproof.Config{PKCS11: certproof.PKCS11FromEnv()}
+}
+
+var legacyCertConfigOnce sync.Once
+
 func selectMTU(localMTU uint16, peerMTU int32) uint16 {
 	var finalMTU uint16 = iface.DefaultMTU
 	if localMTU > 0 {
diff --git a/client/internal/connect_certstore_test.go b/client/internal/connect_certstore_test.go
new file mode 100644
index 000000000..a20fbd809
--- /dev/null
+++ b/client/internal/connect_certstore_test.go
@@ -0,0 +1,26 @@
+package internal
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/netbirdio/netbird/client/internal/certproof"
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+)
+
+// TestCertStoreConfig_ReadsEnvironmentNotProfile: the token URI may carry the PIN, so it
+// and the store directory come from the daemon's environment, and values left in the
+// profile config from an older version are ignored.
+func TestCertStoreConfig_ReadsEnvironmentNotProfile(t *testing.T) {
+	t.Setenv(certproof.PKCS11URIEnv, "pkcs11:token=env")
+	t.Setenv(certproof.PINEnv, "1234")
+
+	cfg := certStoreConfig(&profilemanager.Config{
+		CertStoreDir:  "/from/profile",
+		CertPKCS11URI: "pkcs11:token=profile?pin-value=9999",
+	})
+
+	assert.Equal(t, "pkcs11:token=env", cfg.PKCS11.URI, "the URI comes from the environment")
+	assert.Equal(t, "1234", cfg.PKCS11.PIN, "the PIN comes from the environment")
+}
diff --git a/client/internal/debug/debug.go b/client/internal/debug/debug.go
index f4d1c3598..95419b0e9 100644
--- a/client/internal/debug/debug.go
+++ b/client/internal/debug/debug.go
@@ -647,7 +647,7 @@ const (
 	jsonKeyServiceEnv    = "service_env_vars"
 )
 
-var sensitiveEnvSubstrings = []string{"key", "token", "secret", "password", "credential"}
+var sensitiveEnvSubstrings = []string{"key", "token", "secret", "password", "credential", "pin", "pkcs11"}
 
 // addServiceParams reads the service.json file and adds a sanitized version to the bundle.
 // Non-NB_ env vars and vars with sensitive names are masked. Other NB_ values are anonymized.
diff --git a/client/internal/debug/debug_test.go b/client/internal/debug/debug_test.go
index 0f74490f2..a9cda5a46 100644
--- a/client/internal/debug/debug_test.go
+++ b/client/internal/debug/debug_test.go
@@ -458,6 +458,9 @@ func TestIsSensitiveEnvVar(t *testing.T) {
 		{"NB_CLIENT_SECRET", true},
 		{"NB_PASSWORD", true},
 		{"NB_CREDENTIAL", true},
+		// The token PIN, and the token URI, which may carry the PIN as pin-value.
+		{"NB_TPM_PIN", true},
+		{"NB_CERT_PKCS11_URI", true},
 		{"NB_LOG_LEVEL", false},
 		{"NB_MANAGEMENT_URL", false},
 		{"NB_HOSTNAME", false},
@@ -848,6 +851,8 @@ func TestAddConfig_AllFieldsCovered(t *testing.T) {
 		"policy":               "non-config: in-memory MDM policy snapshot, surfaced via Config.Policy() / GetConfigResponse.MDMManagedFields",
 		"probing":              "non-config: marks a throwaway copy built to be diffed against; never set on a config anyone runs with",
 		"DebugBundleUploadURL": "sensitive: MDM-provided upload URL may carry credentials or query tokens; kept out of the shared bundle",
+		"CertPKCS11URI":        "deprecated and ignored; sensitive: the URI may carry the token PIN as pin-value",
+		"CertStoreDir":         "deprecated and ignored: the directory comes from NB_CERT_STORE_DIR",
 	}
 
 	mURL, _ := url.Parse("https://api.example.com:443")
@@ -891,6 +896,7 @@ func TestAddConfig_AllFieldsCovered(t *testing.T) {
 		ClientCertKeyPath:             "/tmp/key",
 		LazyConnection:                "on",
 		DebugBundleUploadURL:          "https://upload.example.test/bundle?token=secret",
+		CertPKCS11URI:                 "pkcs11:token=netbird?pin-value=pin-secret",
 		MTU:                           1280,
 		DisableIPv6:                   true,
 		SyncMessageVersion:            func(v int) *int { return &v }(1),
@@ -915,6 +921,10 @@ func TestAddConfig_AllFieldsCovered(t *testing.T) {
 			assert.NotContains(t, rendered, "DebugBundleUploadURL:", "MDM upload URL field must not be serialized into the debug bundle")
 			assert.NotContains(t, rendered, "token=secret", "MDM upload URL value must not leak into the debug bundle")
 
+			// A leftover CertPKCS11URI may carry the token PIN as pin-value.
+			assert.NotContains(t, rendered, "CertPKCS11URI", "PKCS#11 URI field must not be serialized into the debug bundle")
+			assert.NotContains(t, rendered, "pin-secret", "PKCS#11 PIN must not leak into the debug bundle")
+
 			val := reflect.ValueOf(cfg).Elem()
 			typ := val.Type()
 			var missing []string
diff --git a/client/internal/engine.go b/client/internal/engine.go
index cb957eb2c..fdf89ae06 100644
--- a/client/internal/engine.go
+++ b/client/internal/engine.go
@@ -275,8 +275,26 @@ type Engine struct {
 
 	dnsServer dns.Server
 
-	// checks are the client-applied posture checks that need to be evaluated on the client
-	checks []*mgmProto.Checks
+	// checks are the client-applied posture checks that need to be evaluated on the client.
+	// Writers hold syncMsgMux and checksMu; readers hold either, see appliedChecks.
+	checks   []*mgmProto.Checks
+	checksMu sync.RWMutex
+	// pendingChecks are the newest received checks whose meta sync failed; the posture
+	// watcher retries them. Both are guarded by syncMsgMux, and
+	// hasPendingChecks lets the watcher skip the lock when nothing is pending.
+	pendingChecks    []*mgmProto.Checks
+	hasPendingChecks atomic.Bool
+	// infoTimeout overrides systemInfoTimeout when set.
+	infoTimeout time.Duration
+
+	// certProofs answers the certificate challenges in checks within a bounded time, and
+	// certState remembers what it last proved.
+	certProofs certproof.Collector
+	certState  certPostureState
+	// certWake wakes the posture watcher, which owns proof collection; certSendMu orders
+	// the meta syncs that carry proofs.
+	certWake   chan struct{}
+	certSendMu sync.Mutex
 
 	infoSource system.InfoSource
 
@@ -381,6 +399,7 @@ func NewEngine(
 		stateManager:       services.StateManager,
 		portForwardManager: portforward.NewManager(),
 		checks:             services.Checks,
+		certWake:           make(chan struct{}, 1),
 		probeStunTurn:      relay.NewStunTurnProbe(relay.DefaultCacheTTL),
 		jobExecutor:        jobexec.NewExecutor(),
 		clientMetrics:      services.ClientMetrics,
@@ -667,6 +686,12 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 		e.portForwardManager.Start(e.ctx, uint16(e.config.WgPort))
 	}()
 
+	e.shutdownWg.Add(1)
+	go func(ctx context.Context) {
+		defer e.shutdownWg.Done()
+		e.watchCertificatePosture(ctx)
+	}(e.ctx)
+
 	// Set the WireGuard interface for rosenpass after interface is up
 	if e.rpManager != nil {
 		e.rpManager.SetInterface(e.wgInterface)
@@ -1234,24 +1259,54 @@ func toFlowLoggerConfig(config *mgmProto.FlowConfig) (*nftypes.FlowConfig, error
 func (e *Engine) updateChecksIfNew(checks []*mgmProto.Checks) error {
 	// if checks are equal, we skip the update
 	if isChecksEqual(e.checks, checks) {
+		e.clearPendingChecks()
 		return nil
 	}
-	info, ok := e.infoSource.Refresh(e.ctx, systemInfoTimeout, checks, e.overlayAddresses()...)
-	if !ok {
-		// Gathering timed out; skip the meta sync this cycle rather than blocking the
-		// sync loop (and syncMsgMux) on a stuck system call. A later sync will retry.
-		return nil
+	if err := e.syncChecksMeta(checks); err != nil {
+		// The newest checks become the pending ones whatever failed, so the watcher
+		// never retries a set they superseded.
+		e.pendingChecks = checks
+		e.hasPendingChecks.Store(true)
+		if errors.Is(err, errSystemInfoTimeout) {
+			return nil
+		}
+		return err
 	}
-	e.applyInfoFlags(info)
-	e.attachCertificateProofs(info, checks)
-
-	if err := e.mgmClient.SyncMeta(info); err != nil {
-		return fmt.Errorf("could not sync meta: error %s", err)
-	}
-	e.checks = checks
+	e.setAppliedChecks(checks)
+	e.clearPendingChecks()
 	return nil
 }
 
+// appliedChecks returns the posture checks in effect, for callers that do not hold
+// syncMsgMux. The slice is replaced, never modified, so it may be read after return.
+func (e *Engine) appliedChecks() []*mgmProto.Checks {
+	e.checksMu.RLock()
+	defer e.checksMu.RUnlock()
+	return e.checks
+}
+
+// setAppliedChecks replaces the posture checks in effect. The caller holds syncMsgMux.
+func (e *Engine) setAppliedChecks(checks []*mgmProto.Checks) {
+	e.checksMu.Lock()
+	e.checks = checks
+	e.checksMu.Unlock()
+	e.wakeCertificatePosture()
+}
+
+// clearPendingChecks drops checks whose meta sync was still owed. The caller holds
+// syncMsgMux.
+func (e *Engine) clearPendingChecks() {
+	e.pendingChecks = nil
+	e.hasPendingChecks.Store(false)
+}
+
+func (e *Engine) infoGatherTimeout() time.Duration {
+	if e.infoTimeout > 0 {
+		return e.infoTimeout
+	}
+	return systemInfoTimeout
+}
+
 // applyInfoFlags sets the engine's config-derived feature flags on the gathered system info.
 func (e *Engine) applyInfoFlags(info *system.Info) {
 	info.SetFlags(
@@ -1275,17 +1330,10 @@ func (e *Engine) applyInfoFlags(info *system.Info) {
 	)
 }
 
-// attachCertificateProofs answers the certificate challenges in checks with the
-// certificates reachable on this device, signing each challenge nonce for our peer key.
-func (e *Engine) attachCertificateProofs(info *system.Info, checks []*mgmProto.Checks) {
-	peerKey := e.config.WgPrivateKey.PublicKey()
-	info.CertificateProofs = certproof.CollectProofs(e.ctx, checks, peerKey[:], e.config.CertStore)
-}
-
 func (e *Engine) currentSystemInfo(ctx context.Context) *system.Info {
 	info := e.infoSource.Current(ctx, e.overlayAddresses()...)
 	e.applyInfoFlags(info)
-	e.attachCertificateProofs(info, e.checks)
+	e.attachCertificateProofs(info, e.appliedChecks())
 	return info
 }
 
@@ -1301,7 +1349,7 @@ func (e *Engine) syncInfoFunc(refreshed *system.Info) func(ctx context.Context)
 		info := refreshed
 		refreshed = nil
 		e.applyInfoFlags(info)
-		e.attachCertificateProofs(info, e.checks)
+		e.attachCertificateProofs(info, e.appliedChecks())
 		return info
 	}
 }
@@ -1499,7 +1547,7 @@ func (e *Engine) receiveManagementEvents() {
 	e.shutdownWg.Add(1)
 	go func() {
 		defer e.shutdownWg.Done()
-		info, ok := e.infoSource.Refresh(e.ctx, systemInfoTimeout, e.checks, e.overlayAddresses()...)
+		info, ok := e.infoSource.Refresh(e.ctx, e.infoGatherTimeout(), e.appliedChecks(), e.overlayAddresses()...)
 		if !ok {
 			log.Warnf("posture checks not refreshed before the sync connect, sending the previous results")
 		}
diff --git a/client/internal/engine_authsession.go b/client/internal/engine_authsession.go
index 725c0903f..624487484 100644
--- a/client/internal/engine_authsession.go
+++ b/client/internal/engine_authsession.go
@@ -88,7 +88,7 @@ func (e *Engine) ExtendAuthSession(ctx context.Context, jwtToken string) (time.T
 		return time.Time{}, errors.New("management client is not initialised")
 	}
 
-	info, err := system.GetInfoWithChecks(ctx, e.checks)
+	info, err := system.GetInfoWithChecks(ctx, e.appliedChecks())
 	if err != nil {
 		log.Warnf("failed to collect system info for session extend: %v", err)
 		info = system.GetInfo(ctx)
diff --git a/client/internal/engine_certposture.go b/client/internal/engine_certposture.go
new file mode 100644
index 000000000..e3965e07b
--- /dev/null
+++ b/client/internal/engine_certposture.go
@@ -0,0 +1,358 @@
+package internal
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/binary"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/certproof"
+	cProto "github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/client/system"
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
+)
+
+const (
+	// certContextPollInterval is how often the engine checks whether the user who can
+	// answer certificate challenges has changed, such as a login after an autostart.
+	certContextPollInterval = time.Minute
+	// certRetryInterval is how long after a collection that proved nothing it is tried
+	// again with the same user, for stores that come up late: a keychain unlocked after
+	// login, or a TPM resource manager started after the daemon.
+	certRetryInterval = 5 * time.Minute
+)
+
+// undeliveredContext never matches a real user context, so a collection whose meta sync
+// failed is seen as stale on the next poll.
+const undeliveredContext = "\x00undelivered"
+
+// errSystemInfoTimeout reports that gathering the system info for a meta sync timed out,
+// so the sync was skipped rather than holding syncMsgMux on a stuck system call.
+var errSystemInfoTimeout = errors.New("system info gathering timed out")
+
+// certPostureState remembers what the last certificate proof collection saw, so the
+// engine can collect again when it went stale and tell the user when proofs go missing.
+//
+// Collection runs only on the posture watcher, never on the sync path, because a token,
+// a TPM or a user's keychain prompt can take long; the sync path attaches the proofs the
+// last collection cached. delivered identifies the chains management last received, so
+// a collection that proves the same chains is not sent again: every meta sync makes
+// management recompute and push network maps to the peer and its neighbours.
+type certPostureState struct {
+	mu          sync.Mutex
+	attempted   bool
+	attemptedAt time.Time
+	userContext string
+	proven      bool
+	delivered   string
+	hasDelivery bool
+	cached      []certposture.Proof
+	cachedFor   string
+}
+
+// record stores the outcome of a collection for the challenges identified by
+// challengesKey and reports whether it changed from proven to unproven or back. The first
+// collection only counts as a change when it proved nothing.
+func (s *certPostureState) record(challengesKey, userContext string, proofs []certposture.Proof, now time.Time) (changed bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	proven := len(proofs) > 0
+	changed = (s.attempted && s.proven != proven) || (!s.attempted && !proven)
+	s.attempted = true
+	s.attemptedAt = now
+	s.userContext = userContext
+	s.proven = proven
+	s.cached = proofs
+	s.cachedFor = challengesKey
+	return changed
+}
+
+// undelivered marks the last collection as not having reached management, so the next
+// poll collects and sends again instead of treating it as current.
+func (s *certPostureState) undelivered() {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.attempted {
+		s.userContext = undeliveredContext
+	}
+	s.hasDelivery = false
+}
+
+// markDelivered records the chains of proofs as the ones management holds.
+func (s *certPostureState) markDelivered(proofs []certposture.Proof) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.delivered = provenChainsKey(proofs)
+	s.hasDelivery = true
+}
+
+// sameAsDelivered reports whether proofs prove exactly the chains management already
+// holds. Nonces and signatures are left out: they differ on every signing while the
+// result management stores, the verified chains, stays the same.
+func (s *certPostureState) sameAsDelivered(proofs []certposture.Proof) bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.hasDelivery && s.delivered == provenChainsKey(proofs)
+}
+
+// needsCollection reports whether the cached proofs no longer reflect what the device
+// can prove for the challenges identified by challengesKey: they answer other
+// challenges, the user who can answer has changed, or nothing was proven and the retry
+// interval has passed.
+func (s *certPostureState) needsCollection(challengesKey, userContext string, now time.Time) bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	switch {
+	case !s.attempted || s.cachedFor != challengesKey:
+		return true
+	case userContext != s.userContext:
+		return true
+	default:
+		return !s.proven && now.Sub(s.attemptedAt) >= certRetryInterval
+	}
+}
+
+// cachedProofs returns the cached proofs management still accepts for the challenges in
+// checks: those whose nonce is current, or from the window before, for one of them. Proofs
+// signed for the previous nonce bridge the time until the watcher has signed the new one.
+func (s *certPostureState) cachedProofs(checks []*mgmProto.Checks) []certposture.Proof {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	var nonces [][]byte
+	for _, check := range checks {
+		if challenge := check.GetCertificateChallenge(); challenge != nil {
+			nonces = append(nonces, challenge.GetNonce())
+		}
+	}
+	var accepted []certposture.Proof
+	for _, proof := range s.cached {
+		if slices.ContainsFunc(nonces, func(nonce []byte) bool {
+			return certposture.NonceAcceptedAlongside(proof.Nonce, nonce)
+		}) {
+			accepted = append(accepted, proof)
+		}
+	}
+	return accepted
+}
+
+// provenChainsKey identifies the set of chains in proofs, independent of their order.
+func provenChainsKey(proofs []certposture.Proof) string {
+	keys := make([]string, 0, len(proofs))
+	for _, proof := range proofs {
+		h := sha256.New()
+		for _, cert := range proof.Chain {
+			writeLengthPrefixed(h, cert)
+		}
+		keys = append(keys, hex.EncodeToString(h.Sum(nil)))
+	}
+	slices.Sort(keys)
+	return strings.Join(keys, ",")
+}
+
+// challengesKey identifies the certificate challenges in checks: their nonces and CAs.
+func challengesKey(checks []*mgmProto.Checks) string {
+	h := sha256.New()
+	for _, check := range checks {
+		challenge := check.GetCertificateChallenge()
+		if challenge == nil {
+			continue
+		}
+		writeLengthPrefixed(h, challenge.GetNonce())
+		for _, ca := range challenge.GetCaCertificates() {
+			writeLengthPrefixed(h, []byte(ca))
+		}
+		writeLengthPrefixed(h, nil)
+	}
+	return hex.EncodeToString(h.Sum(nil))
+}
+
+func writeLengthPrefixed(h interface{ Write([]byte) (int, error) }, data []byte) {
+	var size [8]byte
+	binary.BigEndian.PutUint64(size[:], uint64(len(data)))
+	_, _ = h.Write(size[:])
+	_, _ = h.Write(data)
+}
+
+// attachCertificateProofs attaches the cached proofs management accepts for the
+// challenges in checks, without collecting: the caller is on the sync path. The info is
+// about to be sent on the sync stream, which resends it on every reconnect, so its proofs
+// count as delivered. The watcher is woken to collect when the cache is out of date.
+func (e *Engine) attachCertificateProofs(info *system.Info, checks []*mgmProto.Checks) {
+	if !certproof.HasChallenges(checks) {
+		info.CertificateProofs = nil
+		return
+	}
+	info.CertificateProofs = e.certState.cachedProofs(checks)
+	e.certState.markDelivered(info.CertificateProofs)
+	e.wakeCertificatePosture()
+}
+
+// wakeCertificatePosture asks the posture watcher to check its proofs now rather than at
+// its next tick. It never blocks.
+func (e *Engine) wakeCertificatePosture() {
+	if e.certWake == nil {
+		return
+	}
+	select {
+	case e.certWake <- struct{}{}:
+	default:
+	}
+}
+
+// publishCertificatePostureEvent tells the user when the device stops proving any
+// certificate, which management treats as failing every certificate posture check, and
+// when it proves one again. Without it the loss of access would have no visible cause.
+func (e *Engine) publishCertificatePostureEvent(proven bool) {
+	if e.statusRecorder == nil {
+		return
+	}
+	if proven {
+		e.statusRecorder.PublishEvent(cProto.SystemEvent_INFO, cProto.SystemEvent_SYSTEM,
+			"certificate posture: a certificate is proven again",
+			"A certificate required by your organization's device policy is available again.", nil)
+		return
+	}
+	e.statusRecorder.PublishEvent(cProto.SystemEvent_WARNING, cProto.SystemEvent_SYSTEM,
+		"certificate posture: no certificate could be proven",
+		"NetBird could not use a certificate required by your organization's device policy. "+
+			"Access to some resources may be blocked until one is available.", nil)
+}
+
+// watchCertificatePosture owns certificate proof collection until ctx is done. It
+// collects when woken by new checks or a sync, and on every tick when the cached proofs
+// went stale, such as after a login following an autostart.
+func (e *Engine) watchCertificatePosture(ctx context.Context) {
+	ticker := time.NewTicker(certContextPollInterval)
+	defer ticker.Stop()
+	for {
+		// A pending update that times out again stays pending; the applied checks'
+		// proofs are still refreshed so a lost certificate is reported meanwhile.
+		if err := e.retryPendingChecks(); err != nil && !errors.Is(err, errSystemInfoTimeout) {
+			log.Warnf("failed to sync posture checks that timed out before: %v", err)
+		}
+		if err := e.refreshCertificateProofs(); err != nil && !errors.Is(err, errSystemInfoTimeout) {
+			log.Warnf("failed to refresh certificate posture proofs: %v", err)
+		}
+
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+		case <-e.certWake:
+		}
+	}
+}
+
+// retryPendingChecks sends the meta sync for checks whose earlier sync timed out
+// gathering the system info, and applies them once it succeeds. Without it they would
+// wait for the next network map that changes the checks.
+func (e *Engine) retryPendingChecks() error {
+	if !e.hasPendingChecks.Load() {
+		return nil
+	}
+
+	e.syncMsgMux.Lock()
+	defer e.syncMsgMux.Unlock()
+	if e.stopping() || !e.hasPendingChecks.Load() {
+		return nil
+	}
+	checks := e.pendingChecks
+	log.Debugf("posture checks: retrying the meta sync that timed out")
+	if err := e.syncChecksMeta(checks); err != nil {
+		return err
+	}
+	e.setAppliedChecks(checks)
+	e.clearPendingChecks()
+	return nil
+}
+
+// refreshCertificateProofs collects the proofs for the applied checks when the cached
+// ones are out of date, and sends them to management when they prove other chains than
+// it holds. It holds no engine lock while collecting.
+func (e *Engine) refreshCertificateProofs() error {
+	checks := e.appliedChecks()
+	if e.stopping() || !certproof.HasChallenges(checks) {
+		return nil
+	}
+	key := challengesKey(checks)
+	userContext := certproof.UserContext(e.config.CertStore)
+	if !e.certState.needsCollection(key, userContext, time.Now()) {
+		return nil
+	}
+
+	log.Debugf("certificate posture: collecting proofs")
+	peerKey := e.config.WgPrivateKey.PublicKey()
+	proofs := e.certProofs.Collect(e.ctx, checks, peerKey[:], e.config.CertStore)
+	// A collection cut short by the engine stopping proved nothing about the device, and
+	// must not be reported to the user as a lost certificate.
+	if e.stopping() {
+		return nil
+	}
+	if e.certState.record(key, userContext, proofs, time.Now()) {
+		e.publishCertificatePostureEvent(len(proofs) > 0)
+	}
+
+	if e.certState.sameAsDelivered(proofs) {
+		log.Debugf("certificate posture: proofs unchanged since the last meta sync, not sending")
+		return nil
+	}
+	info, ok := e.infoSource.Refresh(e.ctx, e.infoGatherTimeout(), checks, e.overlayAddresses()...)
+	if !ok {
+		e.certState.undelivered()
+		return errSystemInfoTimeout
+	}
+	e.applyInfoFlags(info)
+	return e.sendMetaWithProofs(info, checks)
+}
+
+// stopping reports whether the engine is shutting down.
+func (e *Engine) stopping() bool {
+	select {
+	case <-e.ctx.Done():
+		return true
+	default:
+		return false
+	}
+}
+
+// syncChecksMeta gathers the system info that checks evaluate and sends it to management
+// with the cached certificate proofs. The caller holds syncMsgMux.
+func (e *Engine) syncChecksMeta(checks []*mgmProto.Checks) error {
+	info, ok := e.infoSource.Refresh(e.ctx, e.infoGatherTimeout(), checks, e.overlayAddresses()...)
+	if !ok {
+		// Gathering timed out; skip the meta sync this cycle rather than blocking the
+		// sync loop (and syncMsgMux) on a stuck system call. The posture watcher retries.
+		e.certState.undelivered()
+		return errSystemInfoTimeout
+	}
+	e.applyInfoFlags(info)
+	return e.sendMetaWithProofs(info, checks)
+}
+
+// sendMetaWithProofs sends info to management with the cached proofs for checks. Sends
+// are serialized and read the cache under that lock, so a send from the sync path cannot
+// overwrite newer proofs the watcher sent in the meantime.
+func (e *Engine) sendMetaWithProofs(info *system.Info, checks []*mgmProto.Checks) error {
+	e.certSendMu.Lock()
+	defer e.certSendMu.Unlock()
+
+	info.CertificateProofs = e.certState.cachedProofs(checks)
+	if err := e.mgmClient.SyncMeta(info); err != nil {
+		e.certState.undelivered()
+		return fmt.Errorf("sync meta: %w", err)
+	}
+	e.certState.markDelivered(info.CertificateProofs)
+	return nil
+}
diff --git a/client/internal/engine_certposture_test.go b/client/internal/engine_certposture_test.go
new file mode 100644
index 000000000..118a28f84
--- /dev/null
+++ b/client/internal/engine_certposture_test.go
@@ -0,0 +1,213 @@
+//go:build !windows && !darwin
+
+package internal
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"github.com/netbirdio/netbird/client/internal/certproof"
+	"github.com/netbirdio/netbird/client/internal/peer"
+	cProto "github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/client/system"
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/certposture/certtest"
+	mgmt "github.com/netbirdio/netbird/shared/management/client"
+	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
+)
+
+func TestCertPostureState_Record(t *testing.T) {
+	now := time.Now()
+	one := []certposture.Proof{{}}
+
+	var proven certPostureState
+	assert.False(t, proven.record("k", "", one, now), "a first collection that proves something is not news")
+
+	var unproven certPostureState
+	assert.True(t, unproven.record("k", "", nil, now), "a first collection that proves nothing is reported")
+	assert.False(t, unproven.record("k", "", nil, now), "the same outcome again is not reported twice")
+	assert.True(t, unproven.record("k", "", one, now), "proving again is reported")
+	assert.True(t, unproven.record("k", "", nil, now), "losing the proof again is reported")
+}
+
+func TestCertPostureState_NeedsCollection(t *testing.T) {
+	now := time.Now()
+	one := []certposture.Proof{{}}
+	var s certPostureState
+
+	assert.True(t, s.needsCollection("k", "", now), "nothing collected yet")
+
+	s.record("k", "501:alice", one, now)
+	assert.False(t, s.needsCollection("k", "501:alice", now.Add(time.Hour)), "a proven collection for the same challenges and user stays fresh")
+	assert.True(t, s.needsCollection("other", "501:alice", now), "new challenges, such as a rotated nonce, are answered again")
+	assert.True(t, s.needsCollection("k", "", now), "the user logging out changes what can be proven")
+	assert.True(t, s.needsCollection("k", "502:bob", now), "another owner session changes what can be proven")
+
+	s.record("k", "", nil, now)
+	assert.False(t, s.needsCollection("k", "", now.Add(certRetryInterval-time.Second)), "an unproven collection is not retried before the interval")
+	assert.True(t, s.needsCollection("k", "", now.Add(certRetryInterval)), "an unproven collection is retried once the interval passed")
+
+	s.record("k", "501:alice", one, now)
+	s.undelivered()
+	assert.True(t, s.needsCollection("k", "501:alice", now), "a proof management never received is collected and sent again")
+}
+
+// TestCertPostureState_CachedProofsAcrossNonceRotation: management rotates the nonce every
+// window and accepts the previous one, so a cached proof keeps being attached across one
+// rotation, while the watcher signs the new nonce, and not across two.
+func TestCertPostureState_CachedProofsAcrossNonceRotation(t *testing.T) {
+	challenger := certposture.NewChallenger([]byte("secret"))
+	peerKey := []byte("peer-public-key-aaaaaaaaaaaaaaaa")
+	now := time.Now()
+	checksAt := func(at time.Time) []*mgmProto.Checks {
+		return []*mgmProto.Checks{{CertificateChallenge: &mgmProto.CertificateChallenge{Nonce: challenger.Nonce(peerKey, at)}}}
+	}
+
+	var s certPostureState
+	current := checksAt(now)
+	s.record(challengesKey(current), "", []certposture.Proof{{Nonce: current[0].CertificateChallenge.Nonce}}, now)
+
+	assert.Len(t, s.cachedProofs(current), 1, "the proof for the current nonce is attached")
+	assert.Len(t, s.cachedProofs(checksAt(now.Add(certposture.Window))), 1, "after one rotation the proof is still accepted and attached")
+	assert.Empty(t, s.cachedProofs(checksAt(now.Add(2*certposture.Window))), "after two rotations management would reject it")
+	assert.Empty(t, s.cachedProofs([]*mgmProto.Checks{{Files: []string{"/bin/agent"}}}), "no challenge, no proof")
+}
+
+// newCertPostureEngine is an engine whose certificate store is a real PEM directory and
+// whose management client records the proofs of every meta sync.
+func newCertPostureEngine(t *testing.T, recorder *peer.Status, syncMeta func(*system.Info) error) (*Engine, string, *certtest.CA) {
+	t.Helper()
+	// The store refuses a group-writable directory, which t.TempDir yields under a
+	// user-private-group umask.
+	dir := t.TempDir()
+	require.NoError(t, os.Chmod(dir, 0o700))
+	t.Setenv(certproof.StoreDirEnv, dir)
+	key, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err)
+
+	e := &Engine{
+		ctx:            context.Background(),
+		syncMsgMux:     &sync.Mutex{},
+		config:         &EngineConfig{WgPrivateKey: key},
+		statusRecorder: recorder,
+		mgmClient:      &mgmt.MockClient{SyncMetaFunc: syncMeta},
+	}
+	ca := certtest.NewCA(t, "corp-root")
+	peerKey := key.PublicKey()
+	nonce := certposture.NewChallenger([]byte("secret")).Nonce(peerKey[:], time.Now())
+	e.checks = []*mgmProto.Checks{{CertificateChallenge: &mgmProto.CertificateChallenge{Nonce: nonce, CaCertificates: []string{ca.PEM}}}}
+	return e, dir, ca
+}
+
+func writeDeviceCert(t *testing.T, dir string, ca *certtest.CA) string {
+	t.Helper()
+	deviceKey := certtest.ECDSAKey(t)
+	pem := certtest.CertPEM(ca.Issue(t, deviceKey, "device")) + certtest.KeyPEM(t, deviceKey)
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "device.pem"), []byte(pem), 0o600))
+	return pem
+}
+
+// TestEngine_AttachCertificateProofsNeverCollects: the sync path only attaches what the
+// watcher collected, so a certificate that appears in the store is not proven on the sync
+// path until the watcher ran.
+func TestEngine_AttachCertificateProofsNeverCollects(t *testing.T) {
+	e, dir, ca := newCertPostureEngine(t, nil, func(*system.Info) error { return nil })
+	writeDeviceCert(t, dir, ca)
+
+	info := &system.Info{}
+	e.attachCertificateProofs(info, e.checks)
+	assert.Empty(t, info.CertificateProofs, "the sync path does not collect")
+
+	require.NoError(t, e.refreshCertificateProofs())
+	e.attachCertificateProofs(info, e.checks)
+	assert.Len(t, info.CertificateProofs, 1, "the sync path attaches what the watcher collected")
+}
+
+// TestEngine_RefreshReportsLostAndRegainedProofs: a device that cannot prove its
+// certificate gets one warning, and one notice when it can again.
+func TestEngine_RefreshReportsLostAndRegainedProofs(t *testing.T) {
+	recorder := peer.NewRecorder("")
+	e, dir, ca := newCertPostureEngine(t, recorder, func(*system.Info) error { return nil })
+	warnings := func() int {
+		n := 0
+		for _, ev := range recorder.GetEventHistory() {
+			if ev.Severity == cProto.SystemEvent_WARNING && ev.Category == cProto.SystemEvent_SYSTEM {
+				n++
+			}
+		}
+		return n
+	}
+	expire := func() { e.certState.attemptedAt = time.Now().Add(-certRetryInterval) }
+
+	require.NoError(t, e.refreshCertificateProofs())
+	assert.Equal(t, 1, warnings(), "the user is told the device proves no certificate")
+
+	expire()
+	require.NoError(t, e.refreshCertificateProofs())
+	assert.Equal(t, 1, warnings(), "an unchanged outcome is not reported again")
+
+	writeDeviceCert(t, dir, ca)
+	expire()
+	require.NoError(t, e.refreshCertificateProofs())
+	events := recorder.GetEventHistory()
+	require.NotEmpty(t, events)
+	assert.Equal(t, cProto.SystemEvent_INFO, events[len(events)-1].Severity, "regaining the proof is reported as good news")
+}
+
+// TestEngine_RefreshSendsOnlyChangedProofs: every meta sync makes management recompute
+// and push network maps, so a collection that proves the same chains as before must not
+// send, while a new certificate or a failed delivery must.
+func TestEngine_RefreshSendsOnlyChangedProofs(t *testing.T) {
+	var sent [][]certposture.Proof
+	failSync := false
+	e, dir, ca := newCertPostureEngine(t, nil, func(info *system.Info) error {
+		if failSync {
+			return errors.New("management unavailable")
+		}
+		sent = append(sent, info.CertificateProofs)
+		return nil
+	})
+	// expire makes the last collection due for the unproven retry.
+	expire := func() { e.certState.attemptedAt = time.Now().Add(-certRetryInterval) }
+	// switchUser makes the last collection stale as if another user signed in.
+	switchUser := func() { e.certState.userContext = "someone else" }
+
+	require.NoError(t, e.refreshCertificateProofs())
+	require.Len(t, sent, 1, "the first collection is sent")
+	assert.Empty(t, sent[0], "nothing to prove yet")
+
+	expire()
+	require.NoError(t, e.refreshCertificateProofs())
+	assert.Len(t, sent, 1, "still proving nothing is not sent again")
+
+	pem := writeDeviceCert(t, dir, ca)
+	expire()
+	require.NoError(t, e.refreshCertificateProofs())
+	require.Len(t, sent, 2, "a newly proven certificate is sent")
+	assert.Len(t, sent[1], 1, "the new proof is attached")
+
+	switchUser()
+	require.NoError(t, e.refreshCertificateProofs())
+	assert.Len(t, sent, 2, "the same chain proven again, with a fresh signature, is not sent")
+
+	failSync = true
+	require.NoError(t, os.Remove(filepath.Join(dir, "device.pem")))
+	switchUser()
+	require.Error(t, e.refreshCertificateProofs())
+	failSync = false
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "device.pem"), []byte(pem), 0o600))
+
+	// Management missed the empty proof set, so it still holds the chain the device proves
+	// again now; after a failed delivery the state is unknown, and it is sent regardless.
+	require.NoError(t, e.refreshCertificateProofs())
+	assert.Len(t, sent, 3, "after a failed delivery the next collection is sent")
+}
diff --git a/client/internal/engine_test.go b/client/internal/engine_test.go
index d33ac773f..4974eca87 100644
--- a/client/internal/engine_test.go
+++ b/client/internal/engine_test.go
@@ -359,6 +359,111 @@ func TestEngine_UpdateChecksIfNewRetriesAfterFailedSyncMeta(t *testing.T) {
 	assert.Equal(t, 2, syncMetaCalls)
 }
 
+// TestEngine_FailedUpdateReplacesOlderPendingChecks: checks A time out and stay pending,
+// then checks B fail to sync for another reason. B must replace A as pending, or the
+// watcher would later apply the superseded A.
+func TestEngine_FailedUpdateReplacesOlderPendingChecks(t *testing.T) {
+	key, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err)
+	ctx, cancel := context.WithCancel(CtxInitState(context.Background()))
+	defer cancel()
+
+	relayMgr := relayClient.NewManager(ctx, nil, key.PublicKey().String(), iface.DefaultMTU)
+	engine := NewEngine(ctx, cancel, &EngineConfig{
+		WgIfaceName:  "utun107",
+		WgAddr:       wgaddr.MustParseWGAddress("100.64.0.1/24"),
+		WgPrivateKey: key,
+		WgPort:       33102,
+		MTU:          iface.DefaultMTU,
+	}, EngineServices{
+		SignalClient:   &signal.MockClient{},
+		MgmClient:      &mgmt.MockClient{SyncMetaFunc: func(*system.Info) error { return errors.New("management unavailable") }},
+		RelayManager:   relayMgr,
+		StatusRecorder: peer.NewRecorder("https://mgm"),
+	}, MobileDependency{})
+
+	checksA := []*mgmtProto.Checks{{Files: []string{"/checks/a"}}}
+	checksB := []*mgmtProto.Checks{{Files: []string{"/checks/b"}}}
+
+	engine.infoTimeout = time.Nanosecond
+	require.NoError(t, engine.updateChecksIfNew(checksA))
+	require.Equal(t, checksA, engine.pendingChecks, "precondition: the timed-out checks are pending")
+
+	// Let the abandoned gathering finish so B gets as far as the meta sync.
+	engine.infoTimeout = 0
+	require.Eventually(t, func() bool {
+		_, ok := engine.infoSource.Refresh(ctx, 10*time.Second, nil)
+		return ok
+	}, 10*time.Second, 10*time.Millisecond)
+
+	require.Error(t, engine.updateChecksIfNew(checksB), "the meta sync of B fails")
+	assert.Equal(t, checksB, engine.pendingChecks, "the newest checks replace the older pending ones")
+}
+
+// TestEngine_PendingChecksRetriedAfterInfoTimeout covers a check update whose system info
+// gathering times out: the update is kept pending rather than dropped, and the posture
+// watcher's retry sends it and applies the checks, without waiting for management to
+// send different checks.
+func TestEngine_PendingChecksRetriedAfterInfoTimeout(t *testing.T) {
+	key, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err)
+
+	exe, err := os.Executable()
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithCancel(CtxInitState(context.Background()))
+	defer cancel()
+
+	var synced []*system.Info
+	mgmClient := &mgmt.MockClient{
+		SyncMetaFunc: func(info *system.Info) error {
+			synced = append(synced, info)
+			return nil
+		},
+	}
+
+	relayMgr := relayClient.NewManager(ctx, nil, key.PublicKey().String(), iface.DefaultMTU)
+	engine := NewEngine(ctx, cancel, &EngineConfig{
+		WgIfaceName:  "utun106",
+		WgAddr:       wgaddr.MustParseWGAddress("100.64.0.1/24"),
+		WgPrivateKey: key,
+		WgPort:       33101,
+		MTU:          iface.DefaultMTU,
+	}, EngineServices{
+		SignalClient:   &signal.MockClient{},
+		MgmClient:      mgmClient,
+		RelayManager:   relayMgr,
+		StatusRecorder: peer.NewRecorder("https://mgm"),
+	}, MobileDependency{})
+
+	checks := []*mgmtProto.Checks{{Files: []string{exe}}}
+
+	// Gathering cannot finish within a nanosecond, so the sync times out.
+	engine.infoTimeout = time.Nanosecond
+	require.NoError(t, engine.updateChecksIfNew(checks), "a timed-out gathering is not an error")
+	assert.Empty(t, synced, "nothing is sent when gathering timed out")
+	assert.Nil(t, engine.checks, "timed-out checks are not applied")
+	require.True(t, engine.hasPendingChecks.Load(), "timed-out checks are kept pending")
+
+	// The timed-out gathering keeps running in the background, and no new one starts
+	// until it exits, so the retry may time out again before it goes through.
+	engine.infoTimeout = 0
+	var retryErr error
+	require.Eventually(t, func() bool {
+		retryErr = engine.retryPendingChecks()
+		return retryErr == nil || !errors.Is(retryErr, errSystemInfoTimeout)
+	}, 10*time.Second, 10*time.Millisecond, "the pending checks are sent once the earlier gathering exits")
+	require.NoError(t, retryErr)
+	require.Len(t, synced, 1, "the retry sends the meta sync")
+	assert.Len(t, synced[0].Files, 1, "the retry evaluates the pending checks")
+	assert.Equal(t, checks, engine.checks, "the retried checks are applied")
+	assert.False(t, engine.hasPendingChecks.Load(), "nothing is pending after the retry")
+
+	require.NoError(t, engine.retryPendingChecks())
+	require.NoError(t, engine.updateChecksIfNew(checks))
+	assert.Len(t, synced, 1, "applied checks are not sent again")
+}
+
 func TestEngine_UpdateNetworkMap(t *testing.T) {
 	// test setup
 	key, err := wgtypes.GeneratePrivateKey()
diff --git a/client/internal/pkcs11/driver_linux.go b/client/internal/pkcs11/driver_linux.go
index 0d9eb8705..93bf4a5ba 100644
--- a/client/internal/pkcs11/driver_linux.go
+++ b/client/internal/pkcs11/driver_linux.go
@@ -1,4 +1,4 @@
-//go:build pkcs11 && linux && (amd64 || arm64)
+//go:build pkcs11 && linux && !android && (amd64 || arm64)
 
 package pkcs11
 
@@ -10,6 +10,7 @@ import (
 	"unsafe"
 
 	"github.com/ebitengine/purego"
+	log "github.com/sirupsen/logrus"
 )
 
 // ulong is CK_ULONG, an unsigned long, which is pointer-sized on the 64-bit Linux ABIs
@@ -25,6 +26,12 @@ const (
 	userTypeUser      = 0x1
 
 	findBatch = 32
+
+	// Upper bounds on sizes a module reports, so a buggy module cannot make the daemon
+	// allocate without limit. Certificates and keys are far smaller; an RSA-16384
+	// signature is 2 KiB.
+	maxAttributeLen = 1 << 20
+	maxSignatureLen = 1 << 16
 )
 
 type version struct {
@@ -115,11 +122,25 @@ type module struct {
 	cSign              func(session ulong, data *byte, dataLen ulong, signature *byte, signatureLen *ulong) ulong
 }
 
-func load(path string) (driver, error) {
+// Supported reports whether this build can load PKCS#11 modules.
+func Supported() bool {
+	return true
+}
+
+func load(path string) (_ driver, err error) {
 	lib, err := purego.Dlopen(path, purego.RTLD_NOW|purego.RTLD_LOCAL)
 	if err != nil {
 		return nil, fmt.Errorf("open PKCS#11 module %s: %w", path, err)
 	}
+	// A module that loads but cannot be used is not cached, so each later attempt opens
+	// it again; close it here or every attempt keeps another reference to the library.
+	defer func() {
+		if err != nil {
+			if closeErr := purego.Dlclose(lib); closeErr != nil {
+				log.Debugf("failed closing PKCS#11 module %s: %v", path, closeErr)
+			}
+		}
+	}()
 	symbol, err := purego.Dlsym(lib, "C_GetFunctionList")
 	if err != nil {
 		return nil, fmt.Errorf("%s is not a PKCS#11 module: %w", path, err)
@@ -211,7 +232,7 @@ func (m *module) login(session uint, pin []byte) error {
 	}
 	rv := m.cLogin(ulong(session), userTypeUser, pinPtr, ulong(len(pin)))
 	runtime.KeepAlive(pin)
-	if rv != rvOK && rv != rvUserAlreadyLoggedIn {
+	if rv != rvOK {
 		return Error{Op: "C_Login", Code: uint(rv)}
 	}
 	return nil
@@ -222,9 +243,10 @@ func (m *module) logout(session uint) {
 }
 
 func (m *module) findObjects(session uint, template []Attribute) ([]Object, error) {
-	attrs := toAttributes(template)
+	var pinner runtime.Pinner
+	attrs := toAttributes(template, &pinner)
 	rv := m.cFindObjectsInit(ulong(session), first(attrs), ulong(len(attrs)))
-	runtime.KeepAlive(template)
+	pinner.Unpin()
 	if rv != rvOK {
 		return nil, Error{Op: "C_FindObjectsInit", Code: uint(rv)}
 	}
@@ -237,6 +259,9 @@ func (m *module) findObjects(session uint, template []Attribute) ([]Object, erro
 		if rv := m.cFindObjects(ulong(session), &batch[0], findBatch, &count); rv != rvOK {
 			return nil, Error{Op: "C_FindObjects", Code: uint(rv)}
 		}
+		if count > findBatch {
+			return nil, fmt.Errorf("C_FindObjects reported %d handles for a batch of %d", count, findBatch)
+		}
 		for _, handle := range batch[:count] {
 			objects = append(objects, Object(handle))
 		}
@@ -257,13 +282,21 @@ func (m *module) attribute(session uint, obj Object, typ uint) ([]byte, error) {
 	if attr.len == 0 {
 		return nil, nil
 	}
+	if attr.len > maxAttributeLen {
+		return nil, fmt.Errorf("attribute 0x%x reports %d bytes, over the %d byte limit", typ, attr.len, maxAttributeLen)
+	}
 	value := make([]byte, attr.len)
+	var pinner runtime.Pinner
+	pinner.Pin(&value[0])
 	attr.value = unsafe.Pointer(&value[0])
 	rv := m.cGetAttributeValue(ulong(session), ulong(obj), &attr, 1)
-	runtime.KeepAlive(value)
+	pinner.Unpin()
 	if rv != rvOK {
 		return nil, Error{Op: "C_GetAttributeValue", Code: uint(rv)}
 	}
+	if attr.len > ulong(len(value)) {
+		return nil, fmt.Errorf("attribute 0x%x grew from %d to %d bytes between calls", typ, len(value), attr.len)
+	}
 	return value[:attr.len], nil
 }
 
@@ -272,14 +305,15 @@ func (m *module) sign(session uint, mech Mechanism, key Object, data []byte) ([]
 		return nil, errors.New("nothing to sign")
 	}
 	native := mechanism{typ: ulong(mech.Type)}
-	var params *pssParams
+	var pinner runtime.Pinner
 	if mech.PSS != nil {
-		params = &pssParams{hashAlg: ulong(mech.PSS.Hash), mgf: ulong(mech.PSS.MGF), saltLen: ulong(mech.PSS.SaltLen)}
+		params := &pssParams{hashAlg: ulong(mech.PSS.Hash), mgf: ulong(mech.PSS.MGF), saltLen: ulong(mech.PSS.SaltLen)}
+		pinner.Pin(params)
 		native.parameter = unsafe.Pointer(params)
 		native.len = ulong(unsafe.Sizeof(*params))
 	}
 	rv := m.cSignInit(ulong(session), &native, ulong(key))
-	runtime.KeepAlive(params)
+	pinner.Unpin()
 	if rv != rvOK {
 		return nil, Error{Op: "C_SignInit", Code: uint(rv)}
 	}
@@ -288,31 +322,41 @@ func (m *module) sign(session uint, mech Mechanism, key Object, data []byte) ([]
 	if rv := m.cSign(ulong(session), &data[0], ulong(len(data)), nil, &size); rv != rvOK {
 		return nil, Error{Op: "C_Sign", Code: uint(rv)}
 	}
+	if size == 0 || size > maxSignatureLen {
+		return nil, fmt.Errorf("C_Sign reports a %d byte signature", size)
+	}
 	signature := make([]byte, size)
 	rv = m.cSign(ulong(session), &data[0], ulong(len(data)), &signature[0], &size)
 	runtime.KeepAlive(data)
 	if rv != rvOK {
 		return nil, Error{Op: "C_Sign", Code: uint(rv)}
 	}
+	if size > ulong(len(signature)) {
+		return nil, fmt.Errorf("C_Sign wrote %d bytes into a %d byte buffer", size, len(signature))
+	}
 	return signature[:size], nil
 }
 
 func (m *module) createObject(session uint, template []Attribute) (Object, error) {
-	attrs := toAttributes(template)
+	var pinner runtime.Pinner
+	attrs := toAttributes(template, &pinner)
 	var object ulong
 	rv := m.cCreateObject(ulong(session), first(attrs), ulong(len(attrs)), &object)
-	runtime.KeepAlive(template)
+	pinner.Unpin()
 	if rv != rvOK {
 		return 0, Error{Op: "C_CreateObject", Code: uint(rv)}
 	}
 	return Object(object), nil
 }
 
-func toAttributes(template []Attribute) []attribute {
+// toAttributes builds the C template for template. The values stay Go memory referenced
+// from Go memory passed to C, so each is pinned; the caller unpins after the call.
+func toAttributes(template []Attribute, pinner *runtime.Pinner) []attribute {
 	attrs := make([]attribute, len(template))
 	for i, a := range template {
 		attrs[i].typ = ulong(a.Type)
 		if len(a.Value) > 0 {
+			pinner.Pin(&a.Value[0])
 			attrs[i].value = unsafe.Pointer(&a.Value[0])
 			attrs[i].len = ulong(len(a.Value))
 		}
diff --git a/client/internal/pkcs11/driver_linux_test.go b/client/internal/pkcs11/driver_linux_test.go
index b47b22890..408a3fabc 100644
--- a/client/internal/pkcs11/driver_linux_test.go
+++ b/client/internal/pkcs11/driver_linux_test.go
@@ -1,4 +1,4 @@
-//go:build pkcs11 && linux && (amd64 || arm64)
+//go:build pkcs11 && linux && !android && (amd64 || arm64)
 
 package pkcs11
 
diff --git a/client/internal/pkcs11/driver_stub.go b/client/internal/pkcs11/driver_stub.go
index 1f870bd8e..35d4d9333 100644
--- a/client/internal/pkcs11/driver_stub.go
+++ b/client/internal/pkcs11/driver_stub.go
@@ -1,7 +1,12 @@
-//go:build !(pkcs11 && linux && (amd64 || arm64))
+//go:build !(pkcs11 && linux && !android && (amd64 || arm64))
 
 package pkcs11
 
+// Supported reports whether this build can load PKCS#11 modules.
+func Supported() bool {
+	return false
+}
+
 func load(string) (driver, error) {
 	return nil, ErrUnsupported
 }
diff --git a/client/internal/pkcs11/pinrejected_test.go b/client/internal/pkcs11/pinrejected_test.go
new file mode 100644
index 000000000..6bbfbcae5
--- /dev/null
+++ b/client/internal/pkcs11/pinrejected_test.go
@@ -0,0 +1,19 @@
+package pkcs11
+
+import (
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestPINRejected(t *testing.T) {
+	for _, code := range []uint{rvPINIncorrect, rvPINInvalid, rvPINLenRange, rvPINExpired, rvPINLocked} {
+		err := fmt.Errorf("open session: %w", Error{Op: "C_Login", Code: code})
+		assert.True(t, PINRejected(err), "CKR 0x%x refuses the PIN, also when wrapped", code)
+	}
+	assert.False(t, PINRejected(Error{Op: "C_Login", Code: 0x30}), "a device error says nothing about the PIN")
+	assert.False(t, PINRejected(errors.New("CKR_PIN_INCORRECT")), "only a PKCS#11 return value counts")
+	assert.False(t, PINRejected(nil))
+}
diff --git a/client/internal/pkcs11/pkcs11.go b/client/internal/pkcs11/pkcs11.go
index 8f93da2a3..da874fb62 100644
--- a/client/internal/pkcs11/pkcs11.go
+++ b/client/internal/pkcs11/pkcs11.go
@@ -44,6 +44,11 @@ const (
 	MGF1SHA384 = 0x3
 
 	rvOK                  = 0x0
+	rvPINIncorrect        = 0xa0
+	rvPINInvalid          = 0xa1
+	rvPINLenRange         = 0xa2
+	rvPINExpired          = 0xa3
+	rvPINLocked           = 0xa4
 	rvUserAlreadyLoggedIn = 0x100
 	rvAlreadyInitialized  = 0x191
 )
@@ -63,6 +68,25 @@ func (e Error) Error() string {
 	return fmt.Sprintf("%s: CKR 0x%x", e.Op, e.Code)
 }
 
+// PINRejected reports whether err is the token refusing the user PIN. Retrying the same
+// PIN cannot succeed, and each attempt counts towards the token's lockout.
+func PINRejected(err error) bool {
+	var e Error
+	if !errors.As(err, &e) {
+		return false
+	}
+	switch e.Code {
+	case rvPINIncorrect, rvPINInvalid, rvPINLenRange, rvPINExpired, rvPINLocked:
+		return true
+	}
+	return false
+}
+
+func isCode(err error, code uint) bool {
+	var e Error
+	return errors.As(err, &e) && e.Code == code
+}
+
 var returnValueNames = map[uint]string{
 	0x2:   "CKR_HOST_MEMORY",
 	0x3:   "CKR_SLOT_ID_INVALID",
@@ -77,6 +101,9 @@ var returnValueNames = map[uint]string{
 	0x71:  "CKR_MECHANISM_PARAM_INVALID",
 	0x82:  "CKR_OBJECT_HANDLE_INVALID",
 	0xa0:  "CKR_PIN_INCORRECT",
+	0xa1:  "CKR_PIN_INVALID",
+	0xa2:  "CKR_PIN_LEN_RANGE",
+	0xa3:  "CKR_PIN_EXPIRED",
 	0xa4:  "CKR_PIN_LOCKED",
 	0xb3:  "CKR_SESSION_HANDLE_INVALID",
 	0xd0:  "CKR_TEMPLATE_INCOMPLETE",
@@ -120,6 +147,11 @@ type Token struct {
 // process exit releases everything anyway.
 type Module struct {
 	d driver
+
+	// loginMu guards logins, the number of open sessions relying on the user login of
+	// each slot, and serializes logging in so a PIN is never sent twice at once.
+	loginMu sync.Mutex
+	logins  map[uint]int
 }
 
 var (
@@ -173,14 +205,48 @@ func (m *Module) openSession(label string, pin []byte, readWrite bool) (*Session
 	if pin == nil {
 		return s, nil
 	}
-	if err := m.d.login(handle, pin); err != nil {
+	if err := m.acquireLogin(token.Slot, handle, pin); err != nil {
 		s.Close()
 		return nil, err
 	}
-	s.loggedIn = true
+	s.module, s.slot = m, token.Slot
 	return s, nil
 }
 
+// acquireLogin makes sure the user is logged in to the token in slot and counts the
+// session as one relying on it. PKCS#11 login state belongs to the application, not to
+// a session: every session with the token shares it, and logging out from any of them
+// ends it for all. So the PIN is sent only when no session holds the login yet, and the
+// last session to close logs out.
+func (m *Module) acquireLogin(slot, handle uint, pin []byte) error {
+	m.loginMu.Lock()
+	defer m.loginMu.Unlock()
+	if m.logins[slot] > 0 {
+		m.logins[slot]++
+		return nil
+	}
+	if err := m.d.login(handle, pin); err != nil && !isCode(err, rvUserAlreadyLoggedIn) {
+		return err
+	}
+	if m.logins == nil {
+		m.logins = make(map[uint]int)
+	}
+	m.logins[slot] = 1
+	return nil
+}
+
+// releaseLogin ends the session's share of the login, logging out when it is the last.
+func (m *Module) releaseLogin(slot, handle uint) {
+	m.loginMu.Lock()
+	defer m.loginMu.Unlock()
+	m.logins[slot]--
+	if m.logins[slot] > 0 {
+		return
+	}
+	delete(m.logins, slot)
+	m.d.logout(handle)
+}
+
 func (m *Module) token(label string) (Token, error) {
 	tokens, err := m.Tokens()
 	if err != nil {
@@ -197,16 +263,19 @@ func (m *Module) token(label string) (Token, error) {
 	return Token{}, fmt.Errorf("no token labelled %q among %d tokens", label, len(tokens))
 }
 
-// Session is an open session with one token. Close logs out again if the session logged in.
+// Session is an open session with one token. Close releases the session's share of the
+// login, logging out when no other session relies on it.
 type Session struct {
-	d        driver
-	handle   uint
-	loggedIn bool
+	d      driver
+	handle uint
+	// module is set when the session relies on the token's login.
+	module *Module
+	slot   uint
 }
 
 func (s *Session) Close() {
-	if s.loggedIn {
-		s.d.logout(s.handle)
+	if s.module != nil {
+		s.module.releaseLogin(s.slot, s.handle)
 	}
 	s.d.closeSession(s.handle)
 }
diff --git a/client/internal/pkcs11/publickey.go b/client/internal/pkcs11/publickey.go
index 70955e348..4d59598e6 100644
--- a/client/internal/pkcs11/publickey.go
+++ b/client/internal/pkcs11/publickey.go
@@ -87,9 +87,9 @@ func ecPublicKey(params, point []byte) (*ecdsa.PublicKey, error) {
 	if len(raw) != 1+2*size || raw[0] != 4 {
 		return nil, errors.New("CKA_EC_POINT is not an uncompressed point")
 	}
-	return &ecdsa.PublicKey{
-		Curve: curve,
-		X:     new(big.Int).SetBytes(raw[1 : 1+size]),
-		Y:     new(big.Int).SetBytes(raw[1+size:]),
-	}, nil
+	key, err := ecdsa.ParseUncompressedPublicKey(curve, raw)
+	if err != nil {
+		return nil, fmt.Errorf("CKA_EC_POINT: %w", err)
+	}
+	return key, nil
 }
diff --git a/client/internal/pkcs11/session_test.go b/client/internal/pkcs11/session_test.go
new file mode 100644
index 000000000..eacc5e15f
--- /dev/null
+++ b/client/internal/pkcs11/session_test.go
@@ -0,0 +1,72 @@
+package pkcs11
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// fakeDriver stands in for a loaded module and records the calls a session makes.
+type fakeDriver struct {
+	loginErr error
+	logins   int
+	logouts  int
+	closes   int
+}
+
+func (f *fakeDriver) tokens() ([]Token, error)             { return []Token{{Slot: 1, Label: "netbird"}}, nil }
+func (f *fakeDriver) openSession(uint, bool) (uint, error) { return 7, nil }
+func (f *fakeDriver) closeSession(uint)                    { f.closes++ }
+func (f *fakeDriver) login(uint, []byte) error             { f.logins++; return f.loginErr }
+func (f *fakeDriver) logout(uint)                          { f.logouts++ }
+func (f *fakeDriver) findObjects(uint, []Attribute) ([]Object, error) {
+	return nil, nil
+}
+func (f *fakeDriver) attribute(uint, Object, uint) ([]byte, error) { return nil, nil }
+func (f *fakeDriver) sign(uint, Mechanism, Object, []byte) ([]byte, error) {
+	return nil, nil
+}
+func (f *fakeDriver) createObject(uint, []Attribute) (Object, error) { return 0, nil }
+
+func TestOpenSession_LogsOutOnlyALoginItOwns(t *testing.T) {
+	t.Run("own login is logged out on close", func(t *testing.T) {
+		d := &fakeDriver{}
+		s, err := (&Module{d: d}).OpenSession("netbird", []byte("1234"))
+		require.NoError(t, err)
+		s.Close()
+		assert.Equal(t, 1, d.logouts, "the session that logged in logs out again")
+	})
+
+	t.Run("a login shared by sessions ends with the last one", func(t *testing.T) {
+		d := &fakeDriver{}
+		m := &Module{d: d}
+		first, err := m.OpenSession("netbird", []byte("1234"))
+		require.NoError(t, err)
+		second, err := m.OpenSession("netbird", []byte("1234"))
+		require.NoError(t, err)
+		assert.Equal(t, 1, d.logins, "the second session reuses the login instead of sending the PIN again")
+
+		first.Close()
+		assert.Zero(t, d.logouts, "logging out now would end the login the second session still uses")
+		second.Close()
+		assert.Equal(t, 1, d.logouts, "the last session to close logs out")
+		assert.Equal(t, 2, d.closes, "both sessions are closed")
+	})
+
+	t.Run("an existing login is taken over", func(t *testing.T) {
+		d := &fakeDriver{loginErr: Error{Op: "C_Login", Code: rvUserAlreadyLoggedIn}}
+		s, err := (&Module{d: d}).OpenSession("netbird", []byte("1234"))
+		require.NoError(t, err, "an existing login is good enough to use the token")
+		s.Close()
+		assert.Equal(t, 1, d.logouts, "no session of this client holds the login any more, so it ends")
+	})
+
+	t.Run("rejected pin closes the session", func(t *testing.T) {
+		d := &fakeDriver{loginErr: Error{Op: "C_Login", Code: rvPINIncorrect}}
+		_, err := (&Module{d: d}).OpenSession("netbird", []byte("0000"))
+		assert.True(t, PINRejected(err), "the PIN error reaches the caller")
+		assert.Zero(t, d.logouts, "nothing to log out after a failed login")
+		assert.Equal(t, 1, d.closes, "the session opened for the login is closed")
+	})
+}
diff --git a/client/internal/pkcs11/uri.go b/client/internal/pkcs11/uri.go
index 8794b7020..c7248c10e 100644
--- a/client/internal/pkcs11/uri.go
+++ b/client/internal/pkcs11/uri.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"net/url"
 	"os"
+	"path/filepath"
 	"strings"
 )
 
@@ -13,7 +14,7 @@ import (
 const DefaultModule = "p11-kit-proxy.so"
 
 // URI is the subset of an RFC 7512 PKCS#11 URI this client understands: the token label,
-// the module to load and where the user PIN comes from. Unknown attributes are ignored.
+// the module to load and where the user PIN comes from.
 type URI struct {
 	Token      string
 	ModulePath string
@@ -21,53 +22,57 @@ type URI struct {
 	pinSource  string
 }
 
+// ParseURI parses raw following RFC 7512 section 2.3. A path attribute other than token
+// is refused rather than ignored: the path narrows which token is used, and ignoring a
+// constraint such as serial would widen the match to whichever token is listed first,
+// where the RFC calls for no match at all. Duplicate attributes are refused, a
+// module-path must be absolute and a module-name must be a bare name. Unknown query
+// attributes are ignored, as the RFC asks.
 func ParseURI(raw string) (*URI, error) {
 	rest, ok := strings.CutPrefix(raw, "pkcs11:")
 	if !ok {
-		return nil, errors.New("PKCS#11 URI must start with pkcs11:")
+		return nil, errors.New("PKCS#11 URI does not start with the pkcs11 scheme")
 	}
 	path, query, _ := strings.Cut(rest, "?")
 
 	u := &URI{}
-	if err := eachAttribute(path, ";", func(name, value string) {
-		if name == "token" {
-			u.Token = value
-		}
-	}); err != nil {
+	if err := eachAttribute(path, ";", u.setPathAttribute); err != nil {
 		return nil, err
 	}
-	err := eachAttribute(query, "&", func(name, value string) {
-		switch name {
-		case "module-path":
-			u.ModulePath = value
-		case "module-name":
-			u.ModulePath = "lib" + value + ".so"
-		case "pin-value":
-			u.pinValue = &value
-		case "pin-source":
-			u.pinSource = value
-		}
-	})
-	if err != nil {
+	if err := eachAttribute(query, "&", u.setQueryAttribute); err != nil {
 		return nil, err
 	}
+	// RFC 7512 section 2.4: a URI with both pin-value and pin-source should be refused.
+	if u.pinValue != nil && u.pinSource != "" {
+		return nil, errors.New("PKCS#11 URI carries both pin-value and pin-source")
+	}
 	return u, nil
 }
 
-func eachAttribute(list, sep string, fn func(name, value string)) error {
-	if list == "" {
-		return nil
+func (u *URI) setPathAttribute(name, value string) error {
+	if name != "token" {
+		return fmt.Errorf("PKCS#11 URI path attribute %q is not supported, only token selects a token", name)
 	}
-	for _, pair := range strings.Split(list, sep) {
-		name, value, ok := strings.Cut(pair, "=")
-		if !ok {
-			return fmt.Errorf("PKCS#11 URI attribute %q has no value", pair)
+	u.Token = value
+	return nil
+}
+
+func (u *URI) setQueryAttribute(name, value string) error {
+	switch name {
+	case "module-path":
+		if !filepath.IsAbs(value) {
+			return fmt.Errorf("PKCS#11 URI module-path %q must be absolute", value)
 		}
-		value, err := url.PathUnescape(value)
-		if err != nil {
-			return fmt.Errorf("PKCS#11 URI attribute %s: %w", name, err)
+		u.ModulePath = value
+	case "module-name":
+		if value == "" || strings.ContainsAny(value, `/\`) || strings.Contains(value, "..") {
+			return fmt.Errorf("PKCS#11 URI module-name %q must be a module name, not a path", value)
 		}
-		fn(name, value)
+		u.ModulePath = "lib" + value + ".so"
+	case "pin-value":
+		u.pinValue = &value
+	case "pin-source":
+		u.pinSource = value
 	}
 	return nil
 }
@@ -80,6 +85,11 @@ func (u *URI) Module() string {
 	return u.ModulePath
 }
 
+// HasPIN reports whether the URI carries a PIN, inline or as a pin-source.
+func (u *URI) HasPIN() bool {
+	return u.pinValue != nil || u.pinSource != ""
+}
+
 // PIN returns the user PIN, or nil when the URI carries none and no login should happen.
 // A pin-source names a file whose single line is the PIN.
 func (u *URI) PIN() ([]byte, error) {
@@ -96,3 +106,30 @@ func (u *URI) PIN() ([]byte, error) {
 	}
 	return []byte(strings.TrimRight(string(pin), "\r\n")), nil
 }
+
+// eachAttribute splits list on sep and calls fn for every name=value pair, refusing a
+// name that appears twice.
+func eachAttribute(list, sep string, fn func(name, value string) error) error {
+	if list == "" {
+		return nil
+	}
+	seen := make(map[string]struct{})
+	for _, pair := range strings.Split(list, sep) {
+		name, value, ok := strings.Cut(pair, "=")
+		if !ok {
+			return fmt.Errorf("PKCS#11 URI attribute %q has no value", pair)
+		}
+		if _, dup := seen[name]; dup {
+			return fmt.Errorf("PKCS#11 URI attribute %s appears more than once", name)
+		}
+		seen[name] = struct{}{}
+		value, err := url.PathUnescape(value)
+		if err != nil {
+			return fmt.Errorf("PKCS#11 URI attribute %s: %w", name, err)
+		}
+		if err := fn(name, value); err != nil {
+			return err
+		}
+	}
+	return nil
+}
diff --git a/client/internal/pkcs11/uri_test.go b/client/internal/pkcs11/uri_test.go
index 63fc66d9a..54e8a0d91 100644
--- a/client/internal/pkcs11/uri_test.go
+++ b/client/internal/pkcs11/uri_test.go
@@ -3,6 +3,7 @@ package pkcs11
 import (
 	"os"
 	"path/filepath"
+	"runtime"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -19,9 +20,9 @@ func TestParseURI(t *testing.T) {
 	}{
 		{
 			name:       "token with module path and pin value",
-			raw:        "pkcs11:token=netbird?module-path=/usr/lib/libtpm2_pkcs11.so&pin-value=1234",
+			raw:        "pkcs11:token=netbird?module-path=" + absModule("libtpm2_pkcs11.so") + "&pin-value=1234",
 			wantToken:  "netbird",
-			wantModule: "/usr/lib/libtpm2_pkcs11.so",
+			wantModule: absModule("libtpm2_pkcs11.so"),
 			wantPIN:    []byte("1234"),
 		},
 		{
@@ -31,8 +32,8 @@ func TestParseURI(t *testing.T) {
 			wantModule: "libtpm2_pkcs11.so",
 		},
 		{
-			name:       "percent encoding and unknown attributes",
-			raw:        "pkcs11:model=SoftHSM%20v2;token=my%20token;serial=1?max-sessions=1",
+			name:       "percent encoding, unknown query attributes are ignored",
+			raw:        "pkcs11:token=my%20token?max-sessions=1&vendor-flag=on",
 			wantToken:  "my token",
 			wantModule: DefaultModule,
 		},
@@ -62,9 +63,31 @@ func TestParseURI(t *testing.T) {
 }
 
 func TestParseURI_Rejections(t *testing.T) {
-	for _, raw := range []string{"pkcs11", "https://example.com", "pkcs11:token", "pkcs11:token=%zz"} {
+	tests := map[string]string{
+		"no scheme":            "pkcs11",
+		"other scheme":         "https://example.com",
+		"attribute no value":   "pkcs11:token",
+		"bad percent encoding": "pkcs11:token=%zz",
+		// RFC 7512 2.3: an unrecognized path attribute matches nothing. Ignoring it
+		// instead would let the token listed first answer for the one serial names.
+		"unsupported serial":       "pkcs11:token=netbird;serial=1234",
+		"unsupported model":        "pkcs11:model=SoftHSM%20v2;token=netbird",
+		"object selector":          "pkcs11:token=netbird;object=device",
+		"vendor path attribute":    "pkcs11:token=netbird;vendor-slot=2",
+		"duplicate token":          "pkcs11:token=a;token=b",
+		"duplicate module-path":    "pkcs11:token=a?module-path=" + absModule("a.so") + "&module-path=" + absModule("b.so"),
+		"duplicate pin-value":      "pkcs11:token=a?pin-value=1&pin-value=2",
+		"relative module-path":     "pkcs11:token=a?module-path=lib/x.so",
+		"bare module-path":         "pkcs11:token=a?module-path=libtpm2_pkcs11.so",
+		"module-name with path":    "pkcs11:token=a?module-name=../../tmp/evil",
+		"module-name with slash":   "pkcs11:token=a?module-name=tmp/evil",
+		"module-name with dotdot":  "pkcs11:token=a?module-name=..",
+		"empty module-name":        "pkcs11:token=a?module-name=",
+		"pin-value and pin-source": "pkcs11:token=a?pin-value=1&pin-source=file:/etc/pin",
+	}
+	for name, raw := range tests {
 		_, err := ParseURI(raw)
-		assert.Error(t, err, raw)
+		assert.Error(t, err, "%s: %s must be refused", name, raw)
 	}
 }
 
@@ -85,3 +108,12 @@ func TestURI_PINFromFile(t *testing.T) {
 	_, err = uri.PIN()
 	assert.Error(t, err, "a missing PIN file must fail loudly instead of logging in without a PIN")
 }
+
+// absModule is an absolute module path on the platform the test runs on, as module-path
+// must be absolute.
+func absModule(name string) string {
+	if runtime.GOOS == "windows" {
+		return `C:\lib\` + name
+	}
+	return "/lib/" + name
+}
diff --git a/client/internal/profilemanager/config.go b/client/internal/profilemanager/config.go
index f713b0b57..3d378a9e6 100644
--- a/client/internal/profilemanager/config.go
+++ b/client/internal/profilemanager/config.go
@@ -185,19 +185,15 @@ type Config struct {
 
 	ClientCertKeyPair *tls.Certificate `json:"-"`
 
-	// CertStoreDir is the directory of PEM certificates, with their keys or with keys a
-	// PKCS#11 token holds, that answer certificate posture checks on Linux. Empty means
-	// NB_CERT_STORE_DIR or /etc/netbird/certs; see client/internal/certproof/README.md.
-	CertStoreDir string
+	// CertStoreDir is no longer read: certificate posture takes the directory from
+	// NB_CERT_STORE_DIR in the daemon's environment. The field is kept only to report a
+	// value left from an earlier version.
+	CertStoreDir string `json:",omitempty"`
 
-	// CertPKCS11PIN is the user PIN of the PKCS#11 token, tpm2-pkcs11 for one, whose
-	// certificates answer certificate posture checks on Linux. Setting it enables the
-	// token store; see client/internal/certproof/README.md.
-	CertPKCS11PIN string
-
-	// CertPKCS11URI is the RFC 7512 URI selecting that token and its module. Empty means
-	// the first token the p11-kit proxy exposes.
-	CertPKCS11URI string
+	// CertPKCS11URI is no longer read, as the URI may carry the token PIN: certificate
+	// posture takes it from NB_CERT_PKCS11_URI in the daemon's environment. The field is
+	// kept only to report a value left from an earlier version.
+	CertPKCS11URI string `json:",omitempty"`
 
 	// LazyConnection is the MDM-managed lazy-connection override ("on"/"off"/"").
 	// Runtime-only: re-derived from MDM policy on each load, never persisted.
diff --git a/client/internal/tpm/signer.go b/client/internal/tpm/signer.go
index b36097538..a6574bec7 100644
--- a/client/internal/tpm/signer.go
+++ b/client/internal/tpm/signer.go
@@ -2,11 +2,17 @@ package tpm
 
 import (
 	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rsa"
+	"encoding/asn1"
 	"errors"
 	"fmt"
 	"io"
+	"math/big"
 
-	"go.step.sm/crypto/tpm/tss2"
+	legacy "github.com/google/go-tpm/legacy/tpm2"
+	"github.com/google/go-tpm/tpmutil"
 )
 
 // KeyPEMType is the PEM block type of a TPM 2.0 key file as defined by
@@ -15,29 +21,46 @@ const KeyPEMType = "TSS2 PRIVATE KEY"
 
 var ErrKeyNeedsAuth = errors.New("TPM key requires an authorization value")
 
+// eccSRKTemplate is the TCG reference ECC-P256 storage root key. A key whose parent is
+// a hierarchy rather than a persistent handle was wrapped by the primary this template
+// derives, and tpm2-openssl and tpm2-tss-engine derive the same one, so the TPM
+// reproduces the identical parent from the hierarchy seed without anything being stored.
+var eccSRKTemplate = legacy.Public{
+	Type:       legacy.AlgECC,
+	NameAlg:    legacy.AlgSHA256,
+	Attributes: legacy.FlagStorageDefault | legacy.FlagNoDA,
+	ECCParameters: &legacy.ECCParams{
+		Symmetric: &legacy.SymScheme{Alg: legacy.AlgAES, KeyBits: 128, Mode: legacy.AlgCFB},
+		Sign:      &legacy.SigScheme{Alg: legacy.AlgNull},
+		CurveID:   legacy.CurveNISTP256,
+	},
+}
+
 // ParseKey reads a TSS2 key file and returns a signer that produces every signature
-// inside the TPM; only the digest goes in and only the signature comes out. A key with
-// a persistent parent is loaded under it, a key whose parent is a hierarchy under the
-// TCG default ECC primary that tpm2-openssl and tpm2-tss-engine derive as well. Keys
-// guarded by an authorization value are rejected, since nothing can supply it without
-// prompting.
+// inside the TPM; only the digest goes in and only the signature comes out. Keys guarded
+// by an authorization value are rejected, since nothing can supply it without prompting.
 func ParseKey(der []byte) (crypto.Signer, error) {
-	key, err := tss2.ParsePrivateKey(der)
+	key, err := parseTSS2(der)
 	if err != nil {
-		return nil, fmt.Errorf("parse TSS2 key: %w", err)
+		return nil, err
 	}
 	if !key.EmptyAuth {
 		return nil, ErrKeyNeedsAuth
 	}
-	public, err := key.Public()
+
+	public, err := legacy.DecodePublic(key.PublicKey[2:])
+	if err != nil {
+		return nil, fmt.Errorf("decode TSS2 public area: %w", err)
+	}
+	pub, err := public.Key()
 	if err != nil {
 		return nil, fmt.Errorf("decode TSS2 public key: %w", err)
 	}
-	return &keySigner{key: key, public: public}, nil
+	return &keySigner{key: key, public: pub}, nil
 }
 
 type keySigner struct {
-	key    *tss2.TPMKey
+	key    *tss2Key
 	public crypto.PublicKey
 }
 
@@ -45,17 +68,96 @@ func (s *keySigner) Public() crypto.PublicKey {
 	return s.public
 }
 
-func (s *keySigner) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts) ([]byte, error) {
+// Sign loads the key under its parent, signs, and releases both handles. The TPM is
+// opened per signature so no handle outlives the call, which matters on a device whose
+// transient object slots are few and shared with everything else on the host.
+func (s *keySigner) Sign(_ io.Reader, digest []byte, opts crypto.SignerOpts) ([]byte, error) {
 	rwc, err := Open()
 	if err != nil {
 		return nil, err
 	}
 	defer func() { _ = rwc.Close() }()
 
-	signer, err := tss2.CreateSigner(rwc, s.key)
+	parent := tpmutil.Handle(s.key.Parent)
+	if !persistentHandle(s.key.Parent) {
+		parent, _, err = legacy.CreatePrimary(rwc, parent, legacy.PCRSelection{}, "", "", eccSRKTemplate)
+		if err != nil {
+			return nil, fmt.Errorf("create TPM primary: %w", err)
+		}
+		defer func() { _ = legacy.FlushContext(rwc, parent) }()
+	}
+
+	public, private := s.key.blobs()
+	handle, _, err := legacy.Load(rwc, parent, "", public, private)
 	if err != nil {
-		return nil, fmt.Errorf("load TSS2 key: %w", err)
+		return nil, fmt.Errorf("load TPM key: %w", err)
+	}
+	defer func() { _ = legacy.FlushContext(rwc, handle) }()
+
+	switch pub := s.public.(type) {
+	case *ecdsa.PublicKey:
+		return signECDSA(rwc, handle, digest, pub.Curve)
+	case *rsa.PublicKey:
+		return signRSA(rwc, handle, digest, opts)
+	default:
+		return nil, fmt.Errorf("unsupported TPM key type %T", s.public)
+	}
+}
+
+// signECDSA returns the signature as the ASN.1 sequence crypto.Signer is defined to
+// return; the TPM hands back the two integers on their own.
+func signECDSA(rw io.ReadWriter, handle tpmutil.Handle, digest []byte, curve elliptic.Curve) ([]byte, error) {
+	hash, err := eccHash(curve)
+	if err != nil {
+		return nil, err
+	}
+	sig, err := legacy.Sign(rw, handle, "", digest, nil, &legacy.SigScheme{Alg: legacy.AlgECDSA, Hash: hash})
+	if err != nil {
+		return nil, fmt.Errorf("TPM ECDSA signature: %w", err)
+	}
+	if sig.ECC == nil {
+		return nil, fmt.Errorf("TPM returned a %v signature for an ECDSA key", sig.Alg)
+	}
+	return asn1.Marshal(struct{ R, S *big.Int }{sig.ECC.R, sig.ECC.S})
+}
+
+func signRSA(rw io.ReadWriter, handle tpmutil.Handle, digest []byte, opts crypto.SignerOpts) ([]byte, error) {
+	hash, err := legacy.HashToAlgorithm(opts.HashFunc())
+	if err != nil {
+		return nil, fmt.Errorf("TPM hash algorithm: %w", err)
+	}
+
+	scheme := &legacy.SigScheme{Alg: legacy.AlgRSASSA, Hash: hash}
+	if pss, ok := opts.(*rsa.PSSOptions); ok {
+		// The TPM chooses the salt length itself, the digest length on most chips, so
+		// only a request for that length is taken. PSSSaltLengthAuto asks for the
+		// largest salt the key allows and is refused. Verify with PSSSaltLengthAuto.
+		if pss.SaltLength != rsa.PSSSaltLengthEqualsHash &&
+			pss.SaltLength != len(digest) {
+			return nil, fmt.Errorf("TPM cannot produce a PSS signature with salt length %d", pss.SaltLength)
+		}
+		scheme.Alg = legacy.AlgRSAPSS
+	}
+
+	sig, err := legacy.Sign(rw, handle, "", digest, nil, scheme)
+	if err != nil {
+		return nil, fmt.Errorf("TPM RSA signature: %w", err)
+	}
+	if sig.RSA == nil {
+		return nil, fmt.Errorf("TPM returned a %v signature for an RSA key", sig.Alg)
+	}
+	return sig.RSA.Signature, nil
+}
+
+func eccHash(curve elliptic.Curve) (legacy.Algorithm, error) {
+	switch curve {
+	case elliptic.P256():
+		return legacy.AlgSHA256, nil
+	case elliptic.P384():
+		return legacy.AlgSHA384, nil
+	case elliptic.P521():
+		return legacy.AlgSHA512, nil
+	default:
+		return 0, fmt.Errorf("unsupported curve %s", curve.Params().Name)
 	}
-	signer.SetSRKTemplate(tss2.ECCSRKTemplate)
-	return signer.Sign(rand, digest, opts)
 }
diff --git a/client/internal/tpm/signer_test.go b/client/internal/tpm/signer_test.go
index d1be2636c..d923223ac 100644
--- a/client/internal/tpm/signer_test.go
+++ b/client/internal/tpm/signer_test.go
@@ -5,6 +5,7 @@ import (
 	"crypto/ecdsa"
 	"crypto/elliptic"
 	"crypto/rand"
+	"crypto/rsa"
 	"crypto/sha256"
 	"encoding/pem"
 	"path/filepath"
@@ -12,7 +13,6 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"go.step.sm/crypto/tpm/tss2"
 
 	"github.com/netbirdio/netbird/client/internal/tpm/tpmtest"
 )
@@ -27,9 +27,7 @@ func TestParseKey_ReportsPublicKeyWithoutTouchingTPM(t *testing.T) {
 
 func TestParseKey_RejectsKeyWithAuthorization(t *testing.T) {
 	key := newP256Key(t)
-	withAuth := func(k *tss2.TPMKey) { k.EmptyAuth = false }
-
-	_, err := ParseKey(decodePEM(t, tpmtest.KeyPEM(t, &key.PublicKey, withAuth)))
+	_, err := ParseKey(decodePEM(t, tpmtest.KeyPEM(t, &key.PublicKey, tpmtest.WithAuth())))
 	assert.ErrorIs(t, err, ErrKeyNeedsAuth)
 }
 
@@ -48,6 +46,17 @@ func TestSign_FailsWhenTPMIsUnreachable(t *testing.T) {
 	assert.Error(t, err, "signing must not fall back to software when the TPM is missing")
 }
 
+// TestSignRSA_RefusesSaltLengthsTheTPMDoesNotChoose checks the salt-length gate, which
+// runs before the TPM is touched: the TPM picks the salt itself, so a request for the
+// maximum salt (PSSSaltLengthAuto) or any other explicit length is refused.
+func TestSignRSA_RefusesSaltLengthsTheTPMDoesNotChoose(t *testing.T) {
+	digest := sha256.Sum256([]byte("challenge"))
+	for _, salt := range []int{rsa.PSSSaltLengthAuto, 20, 222} {
+		_, err := signRSA(nil, 0, digest[:], &rsa.PSSOptions{SaltLength: salt, Hash: crypto.SHA256})
+		assert.ErrorContains(t, err, "salt length", "salt length %d must be refused", salt)
+	}
+}
+
 func newP256Key(t *testing.T) *ecdsa.PrivateKey {
 	t.Helper()
 	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
diff --git a/client/internal/tpm/tpmtest/tpmtest.go b/client/internal/tpm/tpmtest/tpmtest.go
index c119eb55d..5d6b7ac2a 100644
--- a/client/internal/tpm/tpmtest/tpmtest.go
+++ b/client/internal/tpm/tpmtest/tpmtest.go
@@ -4,14 +4,49 @@ package tpmtest
 import (
 	"crypto/ecdsa"
 	"crypto/elliptic"
+	"encoding/asn1"
+	"encoding/pem"
 	"testing"
 
 	"github.com/google/go-tpm/legacy/tpm2"
 	"github.com/stretchr/testify/require"
-	"go.step.sm/crypto/tpm/tss2"
 )
 
-const p256Bytes = 32
+const (
+	p256Bytes = 32
+
+	// KeyPEMType is the PEM block type of a TPM 2.0 key file.
+	KeyPEMType = "TSS2 PRIVATE KEY"
+)
+
+// oidLoadableKey is the key type of draft-bottomley-tpm2-keys that a parent wraps.
+var oidLoadableKey = asn1.ObjectIdentifier{2, 23, 133, 10, 1, 3}
+
+// tss2KeyDER is the ASN.1 container, written out independently of the parser under test
+// so that an encoder bug and a decoder bug cannot cancel out. Policy, secret and auth
+// policy are left out entirely: they are optional, and a key that carries them is
+// refused anyway.
+type tss2KeyDER struct {
+	Type       asn1.ObjectIdentifier
+	EmptyAuth  bool `asn1:"optional,explicit,tag:0"`
+	Parent     int64
+	PublicKey  []byte
+	PrivateKey []byte
+}
+
+// Option adjusts a key before it is encoded.
+type Option func(*tss2KeyDER)
+
+// WithParent names the handle the key is wrapped by, instead of the owner hierarchy.
+func WithParent(handle int64) Option {
+	return func(k *tss2KeyDER) { k.Parent = handle }
+}
+
+// WithAuth marks the key as guarded by an authorization value, which this client refuses
+// because nothing can supply one without prompting.
+func WithAuth() Option {
+	return func(k *tss2KeyDER) { k.EmptyAuth = false }
+}
 
 // SigningTemplate is the public area of an unrestricted P-256 signing key with no fixed
 // scheme, the shape tpm2-openssl creates certificate keys in.
@@ -26,23 +61,61 @@ func SigningTemplate() tpm2.Public {
 
 // KeyPEM encodes pub as a TSS2 PRIVATE KEY over a placeholder private blob: it parses
 // and reports pub, but no TPM can load it.
-func KeyPEM(t *testing.T, pub *ecdsa.PublicKey, opts ...tss2.TPMOption) string {
+func KeyPEM(t *testing.T, pub *ecdsa.PublicKey, opts ...Option) string {
 	t.Helper()
 	require.Equal(t, elliptic.P256(), pub.Curve, "fixture keys must be P-256")
 	area := SigningTemplate()
-	area.ECCParameters.Point = tpm2.ECPoint{
-		XRaw: pub.X.FillBytes(make([]byte, p256Bytes)),
-		YRaw: pub.Y.FillBytes(make([]byte, p256Bytes)),
-	}
-	encoded, err := area.Encode()
+	// The uncompressed encoding is 0x04 followed by the two coordinates, which is
+	// what the TPM wants them as.
+	point, err := pub.Bytes()
 	require.NoError(t, err)
+	require.Len(t, point, 1+2*p256Bytes)
+	area.ECCParameters.Point = tpm2.ECPoint{
+		XRaw: point[1 : 1+p256Bytes],
+		YRaw: point[1+p256Bytes:],
+	}
+	encoded, encErr := area.Encode()
+	require.NoError(t, encErr)
 	return EncodePEM(t, encoded, []byte("placeholder"), opts...)
 }
 
-// EncodePEM wraps the public and private blobs TPM2_Create returned into a TSS2 PRIVATE KEY.
-func EncodePEM(t *testing.T, public, private []byte, opts ...tss2.TPMOption) string {
+// EncodePEM wraps the public and private blobs TPM2_Create returned into a TSS2 PRIVATE
+// KEY, giving each the TPM2B length prefix the format carries them with.
+func EncodePEM(t *testing.T, public, private []byte, opts ...Option) string {
 	t.Helper()
-	pemBytes, err := tss2.New(public, private, opts...).EncodeToMemory()
+
+	key := tss2KeyDER{
+		Type:       oidLoadableKey,
+		EmptyAuth:  true,
+		Parent:     int64(tpm2.HandleOwner),
+		PublicKey:  prefixTPM2B(public),
+		PrivateKey: prefixTPM2B(private),
+	}
+	for _, opt := range opts {
+		opt(&key)
+	}
+
+	der, err := asn1.Marshal(key)
 	require.NoError(t, err)
-	return string(pemBytes)
+	return string(pem.EncodeToMemory(&pem.Block{Type: KeyPEMType, Bytes: der}))
+}
+
+func prefixTPM2B(b []byte) []byte {
+	out := make([]byte, 0, len(b)+2)
+	out = append(out, byte(len(b)>>8), byte(len(b)))
+	return append(out, b...)
+}
+
+// ECCSRKTemplate is the TCG reference ECC-P256 storage root key, the parent a key under
+// a hierarchy is wrapped by. Tests that create a key in a real TPM have to use the same
+// template the signer re-derives it with.
+var ECCSRKTemplate = tpm2.Public{
+	Type:       tpm2.AlgECC,
+	NameAlg:    tpm2.AlgSHA256,
+	Attributes: tpm2.FlagStorageDefault | tpm2.FlagNoDA,
+	ECCParameters: &tpm2.ECCParams{
+		Symmetric: &tpm2.SymScheme{Alg: tpm2.AlgAES, KeyBits: 128, Mode: tpm2.AlgCFB},
+		Sign:      &tpm2.SigScheme{Alg: tpm2.AlgNull},
+		CurveID:   tpm2.CurveNISTP256,
+	},
 }
diff --git a/client/internal/tpm/tss2.go b/client/internal/tpm/tss2.go
new file mode 100644
index 000000000..b227fde32
--- /dev/null
+++ b/client/internal/tpm/tss2.go
@@ -0,0 +1,133 @@
+package tpm
+
+import (
+	"encoding/asn1"
+	"errors"
+	"fmt"
+	"math"
+
+	legacy "github.com/google/go-tpm/legacy/tpm2"
+)
+
+// oidLoadableKey marks a key wrapped by a parent inside the TPM, which is the only kind
+// enrollment tooling writes for a signing key and the only kind that can be loaded under
+// an SRK. The sealed and importable variants carry different material and are refused.
+var oidLoadableKey = asn1.ObjectIdentifier{2, 23, 133, 10, 1, 3}
+
+var (
+	errNotLoadable  = errors.New("TSS2 key is not a loadable key")
+	errKeyHasPolicy = errors.New("TSS2 key carries a policy, which is not supported")
+	errKeyHasSecret = errors.New("TSS2 key carries a secret, which is not supported")
+	errBadParent    = errors.New("TSS2 key names a parent that is neither persistent nor a hierarchy")
+	errBadBlob      = errors.New("TSS2 key blob is malformed")
+)
+
+// tss2KeyASN1 is the ASN.1 container of draft-bottomley-tpm2-keys, the format
+// tpm2-openssl, tpm2-tss-engine and tpm2_encodeobject write. PublicKey and PrivateKey
+// hold TPM2B structures, so each is its own two-byte length followed by that many bytes.
+//
+// EmptyAuth is decoded raw: OpenSSL-based tools write BOOLEAN TRUE as 0x01, which BER
+// allows but encoding/asn1 rejects, as it accepts only the DER form 0xff. Parent is an
+// int64 so a persistent handle such as 0x81000001 still fits on 32-bit platforms.
+type tss2KeyASN1 struct {
+	Type       asn1.ObjectIdentifier
+	EmptyAuth  asn1.RawValue   `asn1:"optional,explicit,tag:0"`
+	Policy     []asn1.RawValue `asn1:"optional,explicit,tag:1"`
+	Secret     []byte          `asn1:"optional,explicit,tag:2"`
+	AuthPolicy []asn1.RawValue `asn1:"optional,explicit,tag:3"`
+	Parent     int64
+	PublicKey  []byte
+	PrivateKey []byte
+}
+
+// tss2Key is a decoded key file the client can ask the TPM to load.
+type tss2Key struct {
+	EmptyAuth  bool
+	Parent     uint32
+	PublicKey  []byte
+	PrivateKey []byte
+}
+
+// parseTSS2 decodes a TSS2 key file and rejects everything this client cannot honour,
+// so a key that parses here is one the TPM can be asked to load.
+func parseTSS2(der []byte) (*tss2Key, error) {
+	raw := new(tss2KeyASN1)
+	rest, err := asn1.Unmarshal(der, raw)
+	if err != nil {
+		return nil, fmt.Errorf("parse TSS2 key: %w", err)
+	}
+	if len(rest) > 0 {
+		return nil, fmt.Errorf("parse TSS2 key: %d trailing bytes", len(rest))
+	}
+	emptyAuth, err := berBoolean(raw.EmptyAuth)
+	if err != nil {
+		return nil, fmt.Errorf("parse TSS2 key emptyAuth: %w", err)
+	}
+
+	switch {
+	case !raw.Type.Equal(oidLoadableKey):
+		return nil, fmt.Errorf("%w: %s", errNotLoadable, raw.Type)
+	case len(raw.Policy) > 0 || len(raw.AuthPolicy) > 0:
+		return nil, errKeyHasPolicy
+	case len(raw.Secret) > 0:
+		return nil, errKeyHasSecret
+	case raw.Parent < 0 || raw.Parent > math.MaxUint32 || !validParent(uint32(raw.Parent)):
+		return nil, fmt.Errorf("%w: %d", errBadParent, raw.Parent)
+	case !validTPM2B(raw.PublicKey) || !validTPM2B(raw.PrivateKey):
+		return nil, errBadBlob
+	}
+	return &tss2Key{
+		EmptyAuth:  emptyAuth,
+		Parent:     uint32(raw.Parent),
+		PublicKey:  raw.PublicKey,
+		PrivateKey: raw.PrivateKey,
+	}, nil
+}
+
+// berBoolean decodes an optional BOOLEAN, absent meaning false. Any non-zero content
+// byte is true, as BER (X.690 section 8.2.2) allows and OpenSSL writes.
+func berBoolean(v asn1.RawValue) (bool, error) {
+	if len(v.FullBytes) == 0 {
+		return false, nil
+	}
+	// The field is explicitly tagged, so v is the [0] wrapper and the BOOLEAN is inside it.
+	if v.Class == asn1.ClassContextSpecific && v.IsCompound {
+		var inner asn1.RawValue
+		rest, err := asn1.Unmarshal(v.Bytes, &inner)
+		if err != nil || len(rest) > 0 {
+			return false, errors.New("malformed explicit tag")
+		}
+		v = inner
+	}
+	if v.Class != asn1.ClassUniversal || v.Tag != asn1.TagBoolean || v.IsCompound || len(v.Bytes) != 1 {
+		return false, errors.New("not a BOOLEAN")
+	}
+	return v.Bytes[0] != 0, nil
+}
+
+// blobs returns the public and private areas with their TPM2B length prefix removed,
+// which is the form the load command takes them in.
+func (k *tss2Key) blobs() (public, private []byte) {
+	return k.PublicKey[2:], k.PrivateKey[2:]
+}
+
+// validParent accepts a persistent handle, under which the key was wrapped directly, or
+// one of the four hierarchies, under which the key is wrapped by a primary the TPM
+// re-derives from the hierarchy seed.
+func validParent(parent uint32) bool {
+	return persistentHandle(parent) ||
+		parent == uint32(legacy.HandleOwner) ||
+		parent == uint32(legacy.HandleNull) ||
+		parent == uint32(legacy.HandleEndorsement) ||
+		parent == uint32(legacy.HandlePlatform)
+}
+
+func persistentHandle(h uint32) bool {
+	return h>>24 == uint32(legacy.HandleTypePersistent)
+}
+
+// validTPM2B reports whether b is a TPM2B structure: a two-byte big-endian length
+// followed by exactly that many bytes.
+func validTPM2B(b []byte) bool {
+	return len(b) >= 2 && len(b)-2 == int(b[0])<<8+int(b[1])
+}
diff --git a/client/internal/tpm/tss2_test.go b/client/internal/tpm/tss2_test.go
new file mode 100644
index 000000000..27dfbba8b
--- /dev/null
+++ b/client/internal/tpm/tss2_test.go
@@ -0,0 +1,78 @@
+package tpm
+
+import (
+	"bytes"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"encoding/asn1"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/tpm/tpmtest"
+)
+
+// derEmptyAuthTrue is the explicit [0] tag around a DER BOOLEAN TRUE, as encoding/asn1
+// writes emptyAuth; OpenSSL writes the same element with 0x01 as the content byte.
+var (
+	derEmptyAuthTrue     = []byte{0xa0, 0x03, 0x01, 0x01, 0xff}
+	opensslEmptyAuthTrue = []byte{0xa0, 0x03, 0x01, 0x01, 0x01}
+)
+
+func p256(t *testing.T) *ecdsa.PrivateKey {
+	t.Helper()
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+	return key
+}
+
+func TestParseKey_AcceptsOpenSSLBoolean(t *testing.T) {
+	key := p256(t)
+	der := decodePEM(t, tpmtest.KeyPEM(t, &key.PublicKey))
+	require.Equal(t, 1, bytes.Count(der, derEmptyAuthTrue), "fixture carries one DER emptyAuth TRUE")
+
+	// The same key as tpm2-openssl and tpm2-tss-engine write it: identical apart from
+	// the BOOLEAN content byte.
+	openssl := bytes.Replace(der, derEmptyAuthTrue, opensslEmptyAuthTrue, 1)
+
+	signer, err := ParseKey(openssl)
+	require.NoError(t, err, "BER allows any non-zero byte for TRUE, and OpenSSL writes 0x01")
+	assert.True(t, key.PublicKey.Equal(signer.Public()), "the key is the same either way")
+}
+
+func TestParseKey_AcceptsPersistentParent(t *testing.T) {
+	key := p256(t)
+	// 0x81000001 overflows a 32-bit int, the width the parent used to be decoded into.
+	der := decodePEM(t, tpmtest.KeyPEM(t, &key.PublicKey, tpmtest.WithParent(0x81000001)))
+
+	parsed, err := parseTSS2(der)
+	require.NoError(t, err)
+	assert.Equal(t, uint32(0x81000001), parsed.Parent, "persistent parent handle")
+	assert.True(t, persistentHandle(parsed.Parent), "the key is loaded under the persistent parent directly")
+}
+
+func TestParseKey_RejectsParentOutOfRange(t *testing.T) {
+	key := p256(t)
+	for _, parent := range []int64{-1, 0x1_0000_0000, 0x02000000} {
+		_, err := parseTSS2(decodePEM(t, tpmtest.KeyPEM(t, &key.PublicKey, tpmtest.WithParent(parent))))
+		assert.ErrorIs(t, err, errBadParent, "parent %#x is neither persistent nor a hierarchy", parent)
+	}
+}
+
+func TestBERBoolean(t *testing.T) {
+	absent, err := berBoolean(asn1.RawValue{})
+	require.NoError(t, err)
+	assert.False(t, absent, "an absent emptyAuth means the key needs authorization")
+
+	for content, want := range map[byte]bool{0x00: false, 0x01: true, 0xff: true} {
+		v := asn1.RawValue{Class: asn1.ClassUniversal, Tag: asn1.TagBoolean, Bytes: []byte{content}, FullBytes: []byte{0x01, 0x01, content}}
+		got, err := berBoolean(v)
+		require.NoError(t, err)
+		assert.Equal(t, want, got, "content byte %#x", content)
+	}
+
+	_, err = berBoolean(asn1.RawValue{Class: asn1.ClassUniversal, Tag: asn1.TagInteger, Bytes: []byte{1}, FullBytes: []byte{0x02, 0x01, 0x01}})
+	assert.Error(t, err, "an INTEGER is not a BOOLEAN")
+}
diff --git a/client/server/server.go b/client/server/server.go
index e082e1f2a..4ce2a5c82 100644
--- a/client/server/server.go
+++ b/client/server/server.go
@@ -2717,9 +2717,23 @@ func (s *Server) checkDisableAdvancedView() *bool {
 	return nil
 }
 
+// profileOwnerOption passes the OS account of the active profile to the connect client,
+// which reads that account's certificate store for user certificate posture checks.
+func (s *Server) profileOwnerOption() []internal.ConnectClientOption {
+	if s.profileManager == nil {
+		return nil
+	}
+	activeProf, err := s.profileManager.GetActiveProfileState()
+	if err != nil {
+		log.Warnf("failed to read the active profile owner, no user certificate store is used for certificate posture: %v", err)
+		return []internal.ConnectClientOption{internal.WithUnknownProfileOwner()}
+	}
+	return []internal.ConnectClientOption{internal.WithProfileOwner(activeProf.Username)}
+}
+
 func (s *Server) connect(ctx context.Context, config *profilemanager.Config, statusRecorder *peer.Status, runningChan chan struct{}) error {
 	log.Tracef("running client connection")
-	client := internal.NewConnectClient(ctx, config, statusRecorder)
+	client := internal.NewConnectClient(ctx, config, statusRecorder, s.profileOwnerOption()...)
 	client.SetUpdateManager(s.updateManager)
 	client.SetSyncResponsePersistence(s.persistSyncResponse)
 
diff --git a/client/system/info.go b/client/system/info.go
index 7cac34261..c64093cb2 100644
--- a/client/system/info.go
+++ b/client/system/info.go
@@ -206,12 +206,27 @@ func GetInfoWithChecks(ctx context.Context, checks []*proto.Checks, excludeIPs .
 // The buffered channel lets the abandoned goroutine finish and exit once its blocking call
 // returns, so it does not leak beyond the duration of that call.
 func GetInfoWithChecksTimeout(ctx context.Context, timeout time.Duration, checks []*proto.Checks, excludeIPs ...netip.Addr) (*Info, bool) {
+	return getInfoWithChecksTimeout(ctx, timeout, checks, nil, excludeIPs...)
+}
+
+// gatherInfoWithChecks is the gathering getInfoWithChecksTimeout bounds. Tests replace it
+// to control when a gathering finishes.
+var gatherInfoWithChecks = GetInfoWithChecks
+
+// getInfoWithChecksTimeout is GetInfoWithChecksTimeout that calls done, when not nil, once
+// the gathering is over: on return when it finished in time, else when the goroutine
+// exits, which may be well after the timeout. done may be called twice and must be
+// idempotent.
+func getInfoWithChecksTimeout(ctx context.Context, timeout time.Duration, checks []*proto.Checks, done func(), excludeIPs ...netip.Addr) (*Info, bool) {
 	ctx, cancel := context.WithTimeout(ctx, timeout)
 	defer cancel()
 
 	infoCh := make(chan *Info, 1)
 	go func() {
-		info, err := GetInfoWithChecks(ctx, checks, excludeIPs...)
+		if done != nil {
+			defer done()
+		}
+		info, err := gatherInfoWithChecks(ctx, checks, excludeIPs...)
 		if err != nil {
 			if ctx.Err() != nil {
 				return
@@ -225,6 +240,9 @@ func GetInfoWithChecksTimeout(ctx context.Context, timeout time.Duration, checks
 
 	select {
 	case info := <-infoCh:
+		if done != nil {
+			done()
+		}
 		return info, true
 	case <-ctx.Done():
 		if errors.Is(ctx.Err(), context.DeadlineExceeded) {
diff --git a/client/system/info_source.go b/client/system/info_source.go
index 050e094e4..2d5c43a72 100644
--- a/client/system/info_source.go
+++ b/client/system/info_source.go
@@ -4,35 +4,154 @@ import (
 	"context"
 	"net/netip"
 	"slices"
+	"sync"
 	"sync/atomic"
 	"time"
 
+	log "github.com/sirupsen/logrus"
+
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
+const (
+	// infoLostAfter is how many timeouts an abandoned gathering is waited for before
+	// another may start beside it. A system call that is merely slow returns well within
+	// that; only one blocked for good, such as a stat on a dead network mount, is worked
+	// around.
+	infoLostAfter = 10
+
+	// maxAbandoned bounds how many gatherings may be left blocked, so a call that never
+	// returns cannot leak a goroutine on every refresh for the life of the daemon.
+	maxAbandoned = 2
+)
+
 // InfoSource gathers the system info sent to management, keeping the posture
-// check results from the last Refresh for the cheap Current snapshots.
+// check results from the last Refresh for the cheap Current snapshots. The zero value is
+// ready to use.
 type InfoSource struct {
-	files atomic.Pointer[[]File]
+	// started numbers Refresh calls in the order they began.
+	started atomic.Uint64
+	// now overrides the clock when set.
+	now func() time.Time
+
+	mu sync.Mutex
+	// abandoned holds the start of each gathering that timed out and is still blocked in
+	// a system call, by Refresh number.
+	abandoned map[uint64]time.Time
+	// files holds the file check results of the latest-started Refresh that succeeded,
+	// filesFrom its number.
+	files     []File
+	filesFrom uint64
 }
 
-// Refresh gathers the info with the posture checks evaluated, bounded by timeout.
+// Refresh gathers the info with the posture checks evaluated, bounded by timeout. It may
+// run concurrently with other calls; the results Current reuses are those of the call
+// that started last, so an older call finishing late cannot replace them. It reports
+// false on a timeout, and also while a gathering that timed out earlier is still blocked
+// in a system call: starting another would only add one more goroutine stuck on it.
+// That one is given up on once it has run for infoLostAfter timeouts, up to maxAbandoned.
 func (s *InfoSource) Refresh(ctx context.Context, timeout time.Duration, checks []*proto.Checks, excludeIPs ...netip.Addr) (*Info, bool) {
-	info, ok := GetInfoWithChecksTimeout(ctx, timeout, checks, excludeIPs...)
-	if !ok {
+	started := s.clock()
+	if !s.mayStart(started, time.Duration(infoLostAfter)*timeout) {
 		return nil, false
 	}
-	files := slices.Clone(info.Files)
-	s.files.Store(&files)
+	seq := s.started.Add(1)
+
+	var mu sync.Mutex
+	var finished, abandoned bool
+	done := func() {
+		mu.Lock()
+		defer mu.Unlock()
+		if finished {
+			return
+		}
+		finished = true
+		if abandoned {
+			s.release(seq)
+		}
+	}
+	info, ok := getInfoWithChecksTimeout(ctx, timeout, checks, done, excludeIPs...)
+	if !ok {
+		mu.Lock()
+		if !finished {
+			abandoned = true
+			s.abandon(seq, started)
+		}
+		mu.Unlock()
+		return nil, false
+	}
+	s.publishFiles(seq, info.Files)
 	return info, true
 }
 
+// mayStart reports whether a gathering may start at now. Every abandoned gathering must
+// have run for lost, and fewer than maxAbandoned may be left running.
+func (s *InfoSource) mayStart(now time.Time, lost time.Duration) bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if len(s.abandoned) == 0 {
+		return true
+	}
+	if len(s.abandoned) >= maxAbandoned {
+		log.Warnf("%d system info gatherings are stuck, skipping this one", len(s.abandoned))
+		return false
+	}
+	for _, started := range s.abandoned {
+		if now.Sub(started) < lost {
+			log.Warnf("system info gathering that timed out earlier is still running, skipping this one")
+			return false
+		}
+	}
+	log.Warnf("system info gathering has been stuck for over %s, starting another", lost)
+	return true
+}
+
+// abandon records that gathering seq, started at started, timed out but is still running.
+func (s *InfoSource) abandon(seq uint64, started time.Time) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.abandoned == nil {
+		s.abandoned = map[uint64]time.Time{}
+	}
+	s.abandoned[seq] = started
+}
+
+// release records that the abandoned gathering seq has returned.
+func (s *InfoSource) release(seq uint64) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	delete(s.abandoned, seq)
+}
+
+func (s *InfoSource) abandonedCount() int {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return len(s.abandoned)
+}
+
+func (s *InfoSource) clock() time.Time {
+	if s.now != nil {
+		return s.now()
+	}
+	return time.Now()
+}
+
+func (s *InfoSource) publishFiles(seq uint64, files []File) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if seq < s.filesFrom {
+		return
+	}
+	s.files = slices.Clone(files)
+	s.filesFrom = seq
+}
+
 // Current gathers the info without evaluating the checks, reusing the last Refresh results.
 func (s *InfoSource) Current(ctx context.Context, excludeIPs ...netip.Addr) *Info {
 	info := GetInfo(ctx)
 	info.removeAddresses(excludeIPs...)
-	if files := s.files.Load(); files != nil {
-		info.Files = *files
-	}
+	s.mu.Lock()
+	info.Files = slices.Clone(s.files)
+	s.mu.Unlock()
 	return info
 }
diff --git a/client/system/info_source_test.go b/client/system/info_source_test.go
index 1c86806af..29183e134 100644
--- a/client/system/info_source_test.go
+++ b/client/system/info_source_test.go
@@ -2,6 +2,7 @@ package system
 
 import (
 	"context"
+	"net/netip"
 	"os"
 	"path/filepath"
 	"testing"
@@ -36,6 +37,106 @@ func TestInfoSource_CurrentReusesRefreshedFiles(t *testing.T) {
 	assert.Equal(t, refreshed.Files, info.Files)
 }
 
+// TestInfoSource_RefreshSkipsWhileEarlierGatheringRuns stands in for a gathering that
+// timed out and is still blocked in a system call: no second one starts on top of it,
+// and gathering works again once it exits.
+func TestInfoSource_RefreshSkipsWhileEarlierGatheringRuns(t *testing.T) {
+	var src InfoSource
+	src.abandoned = map[uint64]time.Time{1: time.Now()}
+
+	_, ok := src.Refresh(context.Background(), 15*time.Second, nil)
+	assert.False(t, ok, "no gathering starts while an earlier one is still running")
+
+	src.abandoned = nil
+	_, ok = src.Refresh(context.Background(), 15*time.Second, nil)
+	require.True(t, ok, "gathering runs once the earlier one exited")
+
+	_, ok = src.Refresh(context.Background(), 15*time.Second, nil)
+	assert.True(t, ok, "a gathering that finished in time does not block the next one")
+}
+
+// TestInfoSource_RefreshReleasesAfterTimedOutGatheringExits checks that a gathering that
+// timed out releases the source once its goroutine finishes, not before.
+func TestInfoSource_RefreshReleasesAfterTimedOutGatheringExits(t *testing.T) {
+	var src InfoSource
+
+	_, ok := src.Refresh(context.Background(), time.Nanosecond, nil)
+	require.False(t, ok, "gathering cannot finish within a nanosecond")
+
+	require.Eventually(t, func() bool { return src.abandonedCount() == 0 }, 10*time.Second, 10*time.Millisecond,
+		"the source is released when the abandoned gathering exits")
+	_, ok = src.Refresh(context.Background(), 15*time.Second, nil)
+	assert.True(t, ok, "gathering works again after the abandoned one exited")
+}
+
+// stubGathering replaces the gathering with one that reports a single file check for the
+// path the checks name, and blocks a gathering for blockedPath until release is closed.
+// entered receives once that gathering has started.
+func stubGathering(t *testing.T, blockedPath string) (entered chan struct{}, release chan struct{}) {
+	t.Helper()
+	entered = make(chan struct{}, 1)
+	release = make(chan struct{})
+	original := gatherInfoWithChecks
+	gatherInfoWithChecks = func(_ context.Context, checks []*proto.Checks, _ ...netip.Addr) (*Info, error) {
+		path := checks[0].Files[0]
+		if path == blockedPath {
+			entered <- struct{}{}
+			<-release
+		}
+		return &Info{Files: []File{{Path: path, Exist: true}}}, nil
+	}
+	t.Cleanup(func() { gatherInfoWithChecks = original })
+	return entered, release
+}
+
+func filesCheck(path string) []*proto.Checks {
+	return []*proto.Checks{{Files: []string{path}}}
+}
+
+// TestInfoSource_RefreshRunsConcurrently: only a gathering that timed out holds off new
+// ones; a caller gathering while another gathering is in progress is served.
+func TestInfoSource_RefreshRunsConcurrently(t *testing.T) {
+	entered, release := stubGathering(t, "/slow")
+	var src InfoSource
+
+	slowDone := make(chan bool, 1)
+	go func() {
+		_, ok := src.Refresh(context.Background(), 15*time.Second, filesCheck("/slow"))
+		slowDone <- ok
+	}()
+	<-entered
+
+	_, ok := src.Refresh(context.Background(), 15*time.Second, filesCheck("/fast"))
+	assert.True(t, ok, "a gathering runs while another one is still in progress")
+
+	close(release)
+	assert.True(t, <-slowDone, "the slower gathering completes too")
+}
+
+// TestInfoSource_LateOlderRefreshDoesNotReplaceNewerResults: a Refresh for the previous
+// checks that finishes after one for the current checks must not bring back the old
+// results Current reports.
+func TestInfoSource_LateOlderRefreshDoesNotReplaceNewerResults(t *testing.T) {
+	entered, release := stubGathering(t, "/old")
+	var src InfoSource
+
+	oldDone := make(chan struct{})
+	go func() {
+		defer close(oldDone)
+		_, _ = src.Refresh(context.Background(), 15*time.Second, filesCheck("/old"))
+	}()
+	<-entered
+
+	_, ok := src.Refresh(context.Background(), 15*time.Second, filesCheck("/new"))
+	require.True(t, ok)
+	close(release)
+	<-oldDone
+
+	files := src.Current(context.Background()).Files
+	require.Len(t, files, 1)
+	assert.Equal(t, "/new", files[0].Path, "the results of the refresh that started last are kept")
+}
+
 func TestInfoSource_CurrentExcludesAddresses(t *testing.T) {
 	addrs := GetInfo(context.Background()).NetworkAddresses
 	if len(addrs) == 0 {
@@ -57,3 +158,41 @@ func TestInfoSource_CurrentExcludesAddresses(t *testing.T) {
 		assert.NotEqual(t, excluded, addr.NetIP.Addr())
 	}
 }
+
+// TestInfoSource_LostGatheringDoesNotBlockForever: a gathering blocked for good, such as
+// an os.Stat on a dead network mount, must not stop every later meta sync. Once it has
+// run for lostAfter timeouts another starts beside it, and no more than maxAbandoned
+// are ever left running.
+func TestInfoSource_LostGatheringDoesNotBlockForever(t *testing.T) {
+	entered, release := stubGathering(t, "/wedged")
+	t.Cleanup(func() { close(release) })
+	now := time.Now()
+	src := InfoSource{now: func() time.Time { return now }}
+	const timeout = 10 * time.Millisecond
+	lost := time.Duration(infoLostAfter) * timeout
+
+	_, ok := src.Refresh(context.Background(), timeout, filesCheck("/wedged"))
+	require.False(t, ok, "the wedged gathering times out")
+	<-entered
+
+	_, ok = src.Refresh(context.Background(), timeout, filesCheck("/wedged"))
+	assert.False(t, ok, "a gathering that may still finish holds off the next one")
+
+	now = now.Add(lost)
+	_, ok = src.Refresh(context.Background(), timeout, filesCheck("/wedged"))
+	require.False(t, ok, "the second wedged gathering times out too")
+	select {
+	case <-entered:
+	case <-time.After(time.Second):
+		t.Fatal("once the first gathering is lost another one starts")
+	}
+
+	now = now.Add(lost)
+	_, ok = src.Refresh(context.Background(), timeout, filesCheck("/wedged"))
+	assert.False(t, ok, "no more than maxAbandoned gatherings are left running")
+	select {
+	case <-entered:
+		t.Fatal("a third gathering started beside two lost ones")
+	case <-time.After(50 * time.Millisecond):
+	}
+}
diff --git a/go.mod b/go.mod
index 1642de4e0..a365ffc27 100644
--- a/go.mod
+++ b/go.mod
@@ -17,27 +17,27 @@ require (
 	github.com/onsi/ginkgo v1.16.5
 	github.com/onsi/gomega v1.34.1
 	github.com/rs/cors v1.8.0
-	github.com/sirupsen/logrus v1.10.1
+	github.com/sirupsen/logrus v1.9.4
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
 	github.com/vishvananda/netlink v1.3.1
-	golang.org/x/crypto v0.57.0
-	golang.org/x/sys v0.48.0
+	golang.org/x/crypto v0.55.0
+	golang.org/x/sys v0.47.0
 	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10
 	golang.zx2c4.com/wireguard/windows v0.5.3
-	google.golang.org/grpc v1.83.2
-	google.golang.org/protobuf v1.36.12
+	google.golang.org/grpc v1.80.0
+	google.golang.org/protobuf v1.36.11
 )
 
 require (
 	github.com/DeRuina/timberjack v1.4.2
 	github.com/Microsoft/go-winio v0.6.2
 	github.com/awnumar/memguard v0.23.0
-	github.com/aws/aws-sdk-go-v2 v1.47.0
+	github.com/aws/aws-sdk-go-v2 v1.38.3
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.1
-	github.com/aws/aws-sdk-go-v2/config v1.33.4
-	github.com/aws/aws-sdk-go-v2/credentials v1.20.4
+	github.com/aws/aws-sdk-go-v2/config v1.31.6
+	github.com/aws/aws-sdk-go-v2/credentials v1.18.10
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.87.3
 	github.com/c-robinson/iplib v1.0.3
 	github.com/caarlos0/env/v11 v11.4.1
@@ -74,7 +74,7 @@ require (
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/hashicorp/go-secure-stdlib/base62 v0.1.2
-	github.com/hashicorp/go-version v1.9.0
+	github.com/hashicorp/go-version v1.7.0
 	github.com/jackc/pgx/v5 v5.10.0
 	github.com/libdns/route53 v1.5.0
 	github.com/libp2p/go-netroute v0.4.0
@@ -124,24 +124,23 @@ require (
 	github.com/yusufpapurcu/wmi v1.2.4
 	github.com/zcalusic/sysinfo v1.1.3
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0
-	go.opentelemetry.io/otel v1.44.0
+	go.opentelemetry.io/otel v1.43.0
 	go.opentelemetry.io/otel/exporters/prometheus v0.64.0
-	go.opentelemetry.io/otel/metric v1.44.0
-	go.opentelemetry.io/otel/sdk/metric v1.44.0
-	go.step.sm/crypto v0.91.0
+	go.opentelemetry.io/otel/metric v1.43.0
+	go.opentelemetry.io/otel/sdk/metric v1.43.0
 	go.uber.org/mock v0.6.0
 	go.uber.org/zap v1.27.0
 	goauthentik.io/api/v3 v3.2023051.3
 	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f
 	golang.org/x/mobile v0.0.0-20260816165457-f98cc9b3c733
-	golang.org/x/mod v0.41.0
-	golang.org/x/net v0.59.0
+	golang.org/x/mod v0.39.0
+	golang.org/x/net v0.58.0
 	golang.org/x/oauth2 v0.36.0
 	golang.org/x/sync v0.23.0
-	golang.org/x/term v0.46.0
+	golang.org/x/term v0.45.0
 	golang.org/x/time v0.15.0
-	google.golang.org/api v0.297.0
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688
+	google.golang.org/api v0.276.0
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9
 	gopkg.in/yaml.v3 v3.0.1
 	gorm.io/driver/mysql v1.5.7
 	gorm.io/driver/postgres v1.5.7
@@ -152,18 +151,18 @@ require (
 )
 
 require (
-	cloud.google.com/go/auth v0.23.2 // indirect
+	cloud.google.com/go/auth v0.20.0 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
 	dario.cat/mergo v1.0.2 // indirect
-	filippo.io/edwards25519 v1.2.0 // indirect
+	filippo.io/edwards25519 v1.1.1 // indirect
 	git.sr.ht/~jackmordaunt/go-toast/v2 v2.0.3 // indirect
 	github.com/AppsFlyer/go-sundheit v0.6.0 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
 	github.com/Azure/go-ntlmssp v0.1.0 // indirect
 	github.com/BurntSushi/toml v1.6.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
-	github.com/Masterminds/semver/v3 v3.5.0 // indirect
+	github.com/Masterminds/semver/v3 v3.4.0 // indirect
 	github.com/Masterminds/sprig/v3 v3.3.0 // indirect
 	github.com/ProtonMail/go-crypto v1.3.0 // indirect
 	github.com/adrg/xdg v0.5.3 // indirect
@@ -171,20 +170,20 @@ require (
 	github.com/apapsch/go-jsonmerge/v2 v2.0.0 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
 	github.com/awnumar/memcall v0.4.0 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.0 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.3 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.3 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.6 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.6 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.6 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.8.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.6 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.6 // indirect
 	github.com/aws/aws-sdk-go-v2/service/route53 v1.42.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/signin v1.10.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.38.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.50.0 // indirect
-	github.com/aws/smithy-go v1.28.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.29.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.34.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.38.2 // indirect
+	github.com/aws/smithy-go v1.23.0 // indirect
 	github.com/bahlo/generic-list-go v0.2.0 // indirect
 	github.com/basgys/goxml2json v1.1.1-0.20231018121955-e66ee54ceaad // indirect
 	github.com/beevik/etree v1.6.0 // indirect
@@ -207,7 +206,8 @@ require (
 	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
-	github.com/felixge/httpsnoop v1.1.0 // indirect
+	github.com/fatih/color v1.19.0 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.1 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
@@ -238,9 +238,10 @@ require (
 	github.com/golang/mock v1.6.0 // indirect
 	github.com/google/btree v1.1.3 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
+	github.com/google/go-tpm-tools v0.4.9 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.20 // indirect
-	github.com/googleapis/gax-go/v2 v2.24.1 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.14 // indirect
+	github.com/googleapis/gax-go/v2 v2.21.0 // indirect
 	github.com/goreleaser/chglog v0.7.4 // indirect
 	github.com/gorilla/handlers v1.5.2 // indirect
 	github.com/grafana/pyroscope-go/godeltaprof v0.1.11 // indirect
@@ -278,8 +279,8 @@ require (
 	github.com/magiconair/properties v1.8.10 // indirect
 	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/mattermost/xml-roundtrip-validator v0.1.0 // indirect
-	github.com/mattn/go-colorable v0.1.15 // indirect
-	github.com/mattn/go-isatty v0.0.24 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-sqlite3 v1.14.42 // indirect
 	github.com/mdelapenya/tlscert v0.2.0 // indirect
 	github.com/mdlayher/genetlink v1.3.2 // indirect
@@ -307,7 +308,7 @@ require (
 	github.com/pb33f/libopenapi v0.41.2
 	github.com/pb33f/libopenapi-validator v0.15.0
 	github.com/pb33f/ordered-map/v2 v2.3.2 // indirect
-	github.com/pelletier/go-toml/v2 v2.4.3 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/philhofer/fwd v1.2.0 // indirect
 	github.com/pion/dtls/v2 v2.2.10 // indirect
 	github.com/pion/dtls/v3 v3.0.9 // indirect
@@ -321,10 +322,11 @@ require (
 	github.com/prometheus/common v0.67.5 // indirect
 	github.com/prometheus/otlptranslator v1.0.0 // indirect
 	github.com/prometheus/procfs v0.19.2 // indirect
+	github.com/rogpeppe/go-internal v1.16.0 // indirect
 	github.com/russellhaering/goxmldsig v1.6.0 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
 	github.com/sagikazarmark/locafero v0.11.0 // indirect
-	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
 	github.com/sergi/go-diff v1.4.0 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/skeema/knownhosts v1.3.2 // indirect
@@ -346,16 +348,16 @@ require (
 	gitlab.com/digitalxero/go-conventional-commit v1.0.7 // indirect
 	go.mongodb.org/mongo-driver v1.17.9 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.44.0 // indirect
-	go.opentelemetry.io/otel/trace v1.44.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.43.0 // indirect
+	go.opentelemetry.io/otel/trace v1.43.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
-	golang.org/x/text v0.42.0 // indirect
-	golang.org/x/tools v0.50.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
+	golang.org/x/tools v0.49.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260715232425-e75dac1f907d // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7 // indirect
 	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
 	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
diff --git a/go.sum b/go.sum
index 0f39bc53e..9e3adae98 100644
--- a/go.sum
+++ b/go.sum
@@ -1,5 +1,5 @@
-cloud.google.com/go/auth v0.23.2 h1:pxSCpfiji41hpzpPdMCftEUCezpgpqmmDdYiAjCKXxo=
-cloud.google.com/go/auth v0.23.2/go.mod h1:4DhBRcqvtljQN3dJ57qtqbib5ZGCYE5f2crfiiC2EM0=
+cloud.google.com/go/auth v0.20.0 h1:kXTssoVb4azsVDoUiF8KvxAqrsQcQtB53DcSgta74CA=
+cloud.google.com/go/auth v0.20.0/go.mod h1:942/yi/itH1SsmpyrbnTMDgGfdy2BUqIKyd0cyYLc5Q=
 cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
 cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
 cloud.google.com/go/compute/metadata v0.2.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
@@ -11,8 +11,8 @@ cunicu.li/go-rosenpass v0.5.42 h1:fRDsGwCxd7DhDgZI1Pxeo8GtNyq8BESZJ7w2/BGGJtU=
 cunicu.li/go-rosenpass v0.5.42/go.mod h1:YRBeyKOe/gWpSX2kpDUec5p9t0XOLsshTguId5gTGVg=
 dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
 dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
-filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
-filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
+filippo.io/edwards25519 v1.1.1 h1:YpjwWWlNmGIDyXOn8zLzqiD+9TyIlPhGFG96P39uBpw=
+filippo.io/edwards25519 v1.1.1/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 git.sr.ht/~jackmordaunt/go-toast/v2 v2.0.3 h1:N3IGoHHp9pb6mj1cbXbuaSXV/UMKwmbKLf53nQmtqMA=
 git.sr.ht/~jackmordaunt/go-toast/v2 v2.0.3/go.mod h1:QtOLZGz8olr4qH2vWK0QH0w0O4T9fEIjMuWpKUsH7nc=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=
@@ -29,8 +29,8 @@ github.com/DeRuina/timberjack v1.4.2 h1:4bKlzhKdsR+2oNkgef9mqb4n11ICow8VK88RfzJP
 github.com/DeRuina/timberjack v1.4.2/go.mod h1:RLoeQrwrCGIEF8gO5nV5b/gMD0QIy7bzQhBUgpp1EqE=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
-github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=
-github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
+github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/Masterminds/sprig/v3 v3.3.0 h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=
 github.com/Masterminds/sprig/v3 v3.3.0/go.mod h1:Zy1iXRYNqNLUolqCpL4uhk6SHUMAOSCzdgBfDb35Lz0=
 github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
@@ -55,44 +55,44 @@ github.com/awnumar/memcall v0.4.0 h1:B7hgZYdfH6Ot1Goaz8jGne/7i8xD4taZie/PNSFZ29g
 github.com/awnumar/memcall v0.4.0/go.mod h1:8xOx1YbfyuCg3Fy6TO8DK0kZUua3V42/goA5Ru47E8w=
 github.com/awnumar/memguard v0.23.0 h1:sJ3a1/SWlcuKIQ7MV+R9p0Pvo9CWsMbGZvcZQtmc68A=
 github.com/awnumar/memguard v0.23.0/go.mod h1:olVofBrsPdITtJ2HgxQKrEYEMyIBAIciVG4wNnZhW9M=
-github.com/aws/aws-sdk-go-v2 v1.47.0 h1:0jsHallhJCeaU0Ko48c/3FK1ctOQ7NpzggxriJOQ8MQ=
-github.com/aws/aws-sdk-go-v2 v1.47.0/go.mod h1:bttEH6JqnUL8LepvDVfdrds/fZ5bCIxzpe3abyUrhDU=
+github.com/aws/aws-sdk-go-v2 v1.38.3 h1:B6cV4oxnMs45fql4yRH+/Po/YU+597zgWqvDpYMturk=
+github.com/aws/aws-sdk-go-v2 v1.38.3/go.mod h1:sDioUELIUO9Znk23YVmIk86/9DOpkbyyVb1i/gUNFXY=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.1 h1:i8p8P4diljCr60PpJp6qZXNlgX4m2yQFpYk+9ZT+J4E=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.1/go.mod h1:ddqbooRZYNoJ2dsTwOty16rM+/Aqmk/GOXrK8cg7V00=
-github.com/aws/aws-sdk-go-v2/config v1.33.4 h1:FzvkXKSzwqHni4U7nDigHg4jjtqMpVUuHgmZfSoJVQ0=
-github.com/aws/aws-sdk-go-v2/config v1.33.4/go.mod h1:VZqGZnZsCWVfK/iGPptJIyNIX3XEX6iQU2Rel4sLrr8=
-github.com/aws/aws-sdk-go-v2/credentials v1.20.4 h1:hTvrJJseKbvw32kmiE0G+u/9ZqpqscjDrTigHIXP2qs=
-github.com/aws/aws-sdk-go-v2/credentials v1.20.4/go.mod h1:gWp9O1ZBWwpcIrgV+mVHk4gZUurAEDkgypu/OXOlIaw=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.0 h1:AM4hHjww+PSFtt6E+UrBrPlZkWsePCLEt9AjkfQX+yM=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.0/go.mod h1:3x/yXezeQjpOvBb4jEMxrS8SXvpdvJ5abv6l5c1gWM8=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.3 h1:Hp/VgjP0BysR3OgLlR057Vz2LcbbVnoWeJ+3qWiS/fY=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.3/go.mod h1:nwGV5qw7F1IZPgxCvA/ph8N2TAuz+BkRG/bXn808qMA=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.3 h1:MUaM4f+kj1ZIBPZfUS8cxP1GKXXZtHJjAthy93AN7SM=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.3/go.mod h1:6YmVmEVRI5ZZzRjCSsb9SryKH0hAlMRdgA7kG9aDvBU=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.3 h1:fuSCw4Z2qfRCztMPO3GXJNSiEp6Wee+WOLwrHHUMy9c=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.3/go.mod h1:6SxcHheD1pPR5+kWm1wGvjlL/YqUsh267sAfEmN4K7A=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19 h1:bAdDl/HkGCcGPoe25ToSHEw23VIxt6CT5fLcg111BKg=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19/go.mod h1:KaUzbLxv4CeSxh6ZCl9B4m7CuFenS8kUEaDs+f/DQr4=
+github.com/aws/aws-sdk-go-v2/config v1.31.6 h1:a1t8fXY4GT4xjyJExz4knbuoxSCacB5hT/WgtfPyLjo=
+github.com/aws/aws-sdk-go-v2/config v1.31.6/go.mod h1:5ByscNi7R+ztvOGzeUaIu49vkMk2soq5NaH5PYe33MQ=
+github.com/aws/aws-sdk-go-v2/credentials v1.18.10 h1:xdJnXCouCx8Y0NncgoptztUocIYLKeQxrCgN6x9sdhg=
+github.com/aws/aws-sdk-go-v2/credentials v1.18.10/go.mod h1:7tQk08ntj914F/5i9jC4+2HQTAuJirq7m1vZVIhEkWs=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.6 h1:wbjnrrMnKew78/juW7I2BtKQwa1qlf6EjQgS69uYY14=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.6/go.mod h1:AtiqqNrDioJXuUgz3+3T0mBWN7Hro2n9wll2zRUc0ww=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.6 h1:uF68eJA6+S9iVr9WgX1NaRGyQ/6MdIyc4JNUo6TN1FA=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.6/go.mod h1:qlPeVZCGPiobx8wb1ft0GHT5l+dc6ldnwInDFaMvC7Y=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.6 h1:pa1DEC6JoI0zduhZePp3zmhWvk/xxm4NB8Hy/Tlsgos=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.6/go.mod h1:gxEjPebnhWGJoaDdtDkA0JX46VRg1wcTHYe63OfX5pE=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 h1:bIqFDwgGXXN1Kpp99pDOdKMTTb5d2KyU5X/BZxjOkRo=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3/go.mod h1:H5O/EsxDWyU+LP/V8i5sm8cxoZgc2fdNR9bxlOFrQTo=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.6 h1:R0tNFJqfjHL3900cqhXuwQ+1K4G0xc9Yf8EDbFXCKEw=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.6/go.mod h1:y/7sDdu+aJvPtGXr4xYosdpq9a6T9Z0jkXfugmti0rI=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 h1:oegbebPEMA/1Jny7kvwejowCaHz1FWZAQ94WXFNCyTM=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1/go.mod h1:kemo5Myr9ac0U9JfSjMo9yHLtw+pECEHsFtJ9tqCEI8=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.8.6 h1:hncKj/4gR+TPauZgTAsxOxNcvBayhUlYZ6LO/BYiQ30=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.8.6/go.mod h1:OiIh45tp6HdJDDJGnja0mw8ihQGz3VGrUflLqSL0SmM=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.3 h1:bON1rJf67TSTDCKg816AAIE4xSTtoo9tl0XRkO72R+I=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.3/go.mod h1:c5BBpjJcQXpfeq9iASyVKA3T6vX6B6LEXY4mL/gklDY=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.6 h1:LHS1YAIJXJ4K9zS+1d/xa9JAA9sL2QyXIQCQFQW/X08=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.6/go.mod h1:c9PCiTEuh0wQID5/KqA32J+HAgZxN9tOGXKCiYJjTZI=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.6 h1:nEXUSAwyUfLTgnc9cxlDWy637qsq4UWwp3sNAfl0Z3Y=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.6/go.mod h1:HGzIULx4Ge3Do2V0FaiYKcyKzOqwrhUZgCI77NisswQ=
 github.com/aws/aws-sdk-go-v2/service/route53 v1.42.3 h1:MmLCRqP4U4Cw9gJ4bNrCG0mWqEtBlmAVleyelcHARMU=
 github.com/aws/aws-sdk-go-v2/service/route53 v1.42.3/go.mod h1:AMPjK2YnRh0YgOID3PqhJA1BRNfXDfGOnSsKHtAe8yA=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.87.3 h1:ETkfWcXP2KNPLecaDa++5bsQhCRa5M5sLUJa5DWYIIg=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.87.3/go.mod h1:+/3ZTqoYb3Ur7DObD00tarKMLMuKg8iqz5CHEanqTnw=
-github.com/aws/aws-sdk-go-v2/service/signin v1.10.0 h1:ZD5qFpWcaOKdTuhBi431pIDkCgrMkMlMT6jlpSPoIRI=
-github.com/aws/aws-sdk-go-v2/service/signin v1.10.0/go.mod h1:8Nuuf+tR346PjJ3MvZPh9pekbLiLQFWJhzMXfwy7alA=
-github.com/aws/aws-sdk-go-v2/service/sso v1.38.0 h1:JGeeBcMlhg1xtOXYpeCaTQBZObtXMPQCUqBcmr65NRA=
-github.com/aws/aws-sdk-go-v2/service/sso v1.38.0/go.mod h1:XwteswG9EOMRFm73UT0t+MbTwyLxMrEXkU6e+v92Lzo=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.0 h1:obhahQXDEdVEv8y5bTKXR30LVaxYe1kyYM0L7l2Iq+k=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.0/go.mod h1:6twZZ/aXHNy1vXUO8koUbp++MYzMASkOgEBdkbJYmO0=
-github.com/aws/aws-sdk-go-v2/service/sts v1.50.0 h1:khXV3+K5D3f4e8xtplaRdSFn1bEg3gj5EBHQvbCOZbQ=
-github.com/aws/aws-sdk-go-v2/service/sts v1.50.0/go.mod h1:/8JRcdTt//hG0Q4BTmGbuOplT7ABe+5rdtqUHqXvYIM=
-github.com/aws/smithy-go v1.28.1 h1:R/nXH00c8qcfCzQVELtRw+eLQWtzv+VAIEFJ1/xxXlQ=
-github.com/aws/smithy-go v1.28.1/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
+github.com/aws/aws-sdk-go-v2/service/sso v1.29.1 h1:8OLZnVJPvjnrxEwHFg9hVUof/P4sibH+Ea4KKuqAGSg=
+github.com/aws/aws-sdk-go-v2/service/sso v1.29.1/go.mod h1:27M3BpVi0C02UiQh1w9nsBEit6pLhlaH3NHna6WUbDE=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.34.2 h1:gKWSTnqudpo8dAxqBqZnDoDWCiEh/40FziUjr/mo6uA=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.34.2/go.mod h1:x7+rkNmRoEN1U13A6JE2fXne9EWyJy54o3n6d4mGaXQ=
+github.com/aws/aws-sdk-go-v2/service/sts v1.38.2 h1:YZPjhyaGzhDQEvsffDEcpycq49nl7fiGcfJTIo8BszI=
+github.com/aws/aws-sdk-go-v2/service/sts v1.38.2/go.mod h1:2dIN8qhQfv37BdUYGgEC8Q3tteM3zFxTI1MLO2O3J3c=
+github.com/aws/smithy-go v1.23.0 h1:8n6I3gXzWJB2DxBDnfxgBaSX6oe0d/t10qGz7OKqMCE=
+github.com/aws/smithy-go v1.23.0/go.mod h1:t1ufH5HMublsJYulve2RKmHDC15xu1f26kHCp/HgceI=
 github.com/bahlo/generic-list-go v0.2.0 h1:5sz/EEAK+ls5wF+NeqDpk5+iNdMDXrh3z3nPnH1Wvgk=
 github.com/bahlo/generic-list-go v0.2.0/go.mod h1:2KvAjgMlE5NNynlg/5iLrrCCZ2+5xWbdbCW3pNTGyYg=
 github.com/basgys/goxml2json v1.1.1-0.20231018121955-e66ee54ceaad h1:3swAvbzgfaI6nKuDDU7BiKfZRdF+h2ZwKgMHd8Ha4t8=
@@ -185,8 +185,8 @@ github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc
 github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
-github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=
-github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/fortytw2/leaktest v1.3.0 h1:u8491cBMTQ8ft8aeV+adlcytMZylmA5nnwwkRZjI8vw=
 github.com/fortytw2/leaktest v1.3.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
@@ -329,10 +329,10 @@ github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
 github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.3.20 h1:t/xL64VUoN69MuMRQuJETqYGOw4Z9mSRJK9epIEtwFk=
-github.com/googleapis/enterprise-certificate-proxy v0.3.20/go.mod h1:L3D/IQExI6LqEjBdXcZQ1WluSgigQmSwBboFstVPM4w=
-github.com/googleapis/gax-go/v2 v2.24.1 h1:AtqTN21IXMMWo99LiEVAiBfNNQmO40d8xUfZI640mc0=
-github.com/googleapis/gax-go/v2 v2.24.1/go.mod h1:bWeBei0NVwaNZKb2y1HUBS7gLXIF3/Tu3pq7j8D2Tb0=
+github.com/googleapis/enterprise-certificate-proxy v0.3.14 h1:yh8ncqsbUY4shRD5dA6RlzjJaT4hi3kII+zYw8wmLb8=
+github.com/googleapis/enterprise-certificate-proxy v0.3.14/go.mod h1:vqVt9yG9480NtzREnTlmGSBmFrA+bzb0yl0TxoBQXOg=
+github.com/googleapis/gax-go/v2 v2.21.0 h1:h45NjjzEO3faG9Lg/cFrBh2PgegVVgzqKzuZl/wMbiI=
+github.com/googleapis/gax-go/v2 v2.21.0/go.mod h1:But/NJU6TnZsrLai/xBAQLLz+Hc7fHZJt/hsCz3Fih4=
 github.com/gopacket/gopacket v1.4.0 h1:cr1OlFpzksCkZHNO0eLjaSSOrMQnpPXg0j6qHIY3y2U=
 github.com/gopacket/gopacket v1.4.0/go.mod h1:EpvsxINeehp5qj4YMKMLf2/dekdhKn2IIAO/ZOifS7o=
 github.com/gopherjs/gopherjs v1.17.2 h1:fQnZVsXk8uxXIStYb0N4bGk7jeyTalG/wsZjQ25dO0g=
@@ -373,8 +373,8 @@ github.com/hashicorp/go-sockaddr v1.0.7/go.mod h1:FZQbEYa1pxkQ7WLpyXJ6cbjpT8q0Yg
 github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/go-version v1.9.0 h1:CeOIz6k+LoN3qX9Z0tyQrPtiB1DFYRPfCIBtaXPSCnA=
-github.com/hashicorp/go-version v1.9.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/hashicorp/go-version v1.7.0 h1:5tqGy27NaOTB8yJKUZELlFAS/LTKJkrmONwQKeRZfjY=
+github.com/hashicorp/go-version v1.7.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/hcl v1.0.1-vault-7 h1:ag5OxFVy3QYTFTJODRzTKVZ6xvdfLLCA1cy/Y6xGI0I=
 github.com/hashicorp/hcl v1.0.1-vault-7/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
@@ -470,11 +470,11 @@ github.com/matryer/is v1.4.1 h1:55ehd8zaGABKLXQUe2awZ99BD/PTc2ls+KV/dXphgEQ=
 github.com/matryer/is v1.4.1/go.mod h1:8I/i5uYgLzgsgEloJE1U6xx5HkBQpAZvepWuujKwMRU=
 github.com/mattermost/xml-roundtrip-validator v0.1.0 h1:RXbVD2UAl7A7nOTR4u7E3ILa4IbtvKBHw64LDsmu9hU=
 github.com/mattermost/xml-roundtrip-validator v0.1.0/go.mod h1:qccnGMcpgwcNaBnxqpJpWWUiPNr5H3O8eDgGV9gT5To=
-github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY=
-github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.9/go.mod h1:YNRxwqDuOph6SZLI9vUUz6OYw3QyUt7WiY2yME+cCiQ=
-github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
-github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-sqlite3 v1.14.42 h1:MigqEP4ZmHw3aIdIT7T+9TLa90Z6smwcthx+Azv4Cgo=
 github.com/mattn/go-sqlite3 v1.14.42/go.mod h1:pjEuOr8IwzLJP2MfGeTb0A35jauH+C2kbHKBr7yXKVQ=
 github.com/mdelapenya/tlscert v0.2.0 h1:7H81W6Z/4weDvZBNOfQte5GpIMo0lGYEeWbkGp5LJHI=
@@ -587,8 +587,8 @@ github.com/pb33f/ordered-map/v2 v2.3.2 h1:wDyaZ2Pv9QLh64X4utCeD5Zoi9nIv2aW3lwv17
 github.com/pb33f/ordered-map/v2 v2.3.2/go.mod h1:1OhFrXu3OYw3kM+FXF+Ug3ugmmZ9LE8z0JfQMLvtV0w=
 github.com/pb33f/testify v0.1.1 h1:mnHe7uxKt8dyNYEGUspow72VjD264DB5rOJq4bz5tJw=
 github.com/pb33f/testify v0.1.1/go.mod h1:keghMqOLECF1ENzESnfM+cwPcKN5uhTOpvbtjgL6aZg=
-github.com/pelletier/go-toml/v2 v2.4.3 h1:GTRvJQutkOSftxIFD5xw9aepkYNuPWmVJpffdDPYVpY=
-github.com/pelletier/go-toml/v2 v2.4.3/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
+github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/petermattis/goid v0.0.0-20250303134427-723919f7f203 h1:E7Kmf11E4K7B5hDti2K2NqPb1nlYlGYsu02S1JNd/Bs=
 github.com/petermattis/goid v0.0.0-20250303134427-723919f7f203/go.mod h1:pxMtw7cyUw6B2bRH0ZBANSPg+AoSud1I1iyJHI69jH4=
 github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
@@ -664,8 +664,8 @@ github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkB
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
 github.com/sagikazarmark/locafero v0.11.0 h1:1iurJgmM9G3PA/I+wWYIOw/5SyBtxapeHDcg+AAIFXc=
 github.com/sagikazarmark/locafero v0.11.0/go.mod h1:nVIGvgyzw595SUSUE6tvCp3YYTeHs15MvlmU87WwIik=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
 github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
 github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/shirou/gopsutil/v4 v4.25.8 h1:NnAsw9lN7587WHxjJA9ryDnqhJpFH6A+wagYWTOH970=
@@ -673,8 +673,8 @@ github.com/shirou/gopsutil/v4 v4.25.8/go.mod h1:q9QdMmfAOVIw7a+eF86P7ISEU6ka+NLg
 github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
 github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/sirupsen/logrus v1.10.1 h1:xi4336Zh11WpU14fXR6I67V3yaTPQYwRx2WEtHbRg4Q=
-github.com/sirupsen/logrus v1.10.1/go.mod h1:vsQHnG7xzNsxk3NrwboUiWPnIC3dmbjcGPykD7+tiHk=
+github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
+github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
 github.com/skeema/knownhosts v1.3.2 h1:EDL9mgf4NzwMXCTfaxSD/o/a5fxDw/xL9nkU28JjdBg=
 github.com/skeema/knownhosts v1.3.2/go.mod h1:bEg3iQAuw+jyiw+484wwFJoKSLwcfd7fqRy+N0QTiow=
 github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 h1:JIAuq3EEf9cgbU6AtGPK4CTG3Zf6CKMNqf0MHTggAUA=
@@ -777,30 +777,26 @@ go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 h1:yI1/OhfEPy7J9eoa6Sj051C7n5dvpj0QX8g4sRchg04=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0/go.mod h1:NoUCKYWK+3ecatC4HjkRktREheMeEtrXoQxrqYFeHSc=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0/go.mod h1:z9+yiacE0IHRqM4qFfkbt/JYlmYXgss8GY/jXoNuPJI=
-go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=
-go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg=
+go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
+go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0 h1:Mne5On7VWdx7omSrSSZvM4Kw7cS7NQkOOmLcgscI51U=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0/go.mod h1:IPtUMKL4O3tH5y+iXVyAXqpAwMuzC1IrxVS81rummfE=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0 h1:IeMeyr1aBvBiPVYihXIaeIZba6b8E1bYp7lbdxK8CQg=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0/go.mod h1:oVdCUtjq9MK9BlS7TtucsQwUcXcymNiEDjgDD2jMtZU=
 go.opentelemetry.io/otel/exporters/prometheus v0.64.0 h1:g0LRDXMX/G1SEZtK8zl8Chm4K6GBwRkjPKE36LxiTYs=
 go.opentelemetry.io/otel/exporters/prometheus v0.64.0/go.mod h1:UrgcjnarfdlBDP3GjDIJWe6HTprwSazNjwsI+Ru6hro=
-go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=
-go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=
-go.opentelemetry.io/otel/metric/x v0.66.0 h1:YkCrx1zLOChi9ZcZ6euupOcsgzbVlec7D/xoEU1+cTA=
-go.opentelemetry.io/otel/metric/x v0.66.0/go.mod h1:d1+BDj9t96do0/1LoU1ayfCv79ZgNE41qbhBvnMOBZk=
-go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=
-go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0=
-go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=
-go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
-go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
-go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
+go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
+go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
+go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
+go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
+go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
+go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
+go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
+go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
 go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lIVU/I=
 go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM=
-go.step.sm/crypto v0.91.0 h1:0mN0DwVOvUuh7VbyTnxABZuAkxwak/Grp8Y/b4YaZDU=
-go.step.sm/crypto v0.91.0/go.mod h1:NxxObRBymdbyXLoTCW5Ea6sLxuy5yI/xr9+hSBlbU/Q=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
@@ -829,8 +825,8 @@ golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1m
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
-golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
+golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
+golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
@@ -845,8 +841,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
-golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
+golang.org/x/mod v0.39.0 h1:UF5zwQdCRRUpHfyPwr7d4UrGiVeldIsogtzWVnczL74=
+golang.org/x/mod v0.39.0/go.mod h1:bvIbwjQ0HUFFf5AKukeeYQG4ZBUG9yxQbR9aEweIwYY=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
@@ -867,8 +863,8 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
-golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
 golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
@@ -923,8 +919,8 @@ golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
-golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -938,8 +934,8 @@ golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
-golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -953,8 +949,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
-golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -968,8 +964,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.50.0 h1:c2ifzfcuY7L90lZ2aKd8S4K2NpASF08SZx9ZuJkHmSU=
-golang.org/x/tools v0.50.0/go.mod h1:7ulVMw3831Mwi5EZD6RomGyffr4VFjuNYXf2BbCEAV0=
+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
+golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -982,17 +978,17 @@ golang.zx2c4.com/wireguard/windows v0.5.3 h1:On6j2Rpn3OEMXqBq00QEDC7bWSZrPIHKIus
 golang.zx2c4.com/wireguard/windows v0.5.3/go.mod h1:9TEe8TJmtwyQebdFwAkEWOPr3prrtqm+REGFifP60hI=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/api v0.297.0 h1:WktxTsnnx0yZNnsR6j0q6hR21RnnK81FHTOPy/ux4OE=
-google.golang.org/api v0.297.0/go.mod h1:S4m8x0M6OkQpkOzGk1y9JG2sm4fFQrMh6dxzjCTszhE=
+google.golang.org/api v0.276.0 h1:nVArUtfLEihtW+b0DdcqRGK1xoEm2+ltAihyztq7MKY=
+google.golang.org/api v0.276.0/go.mod h1:Fnag/EWUPIcJXuIkP1pjoTgS5vdxlk3eeemL7Do6bvw=
 google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d h1:C9v1o0/4quuhOAfmRXA2j+we0PqZIp8traLdeogF3Ms=
-google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d/go.mod h1:Wz2wFJntZFmLGo7pLDXZ3wYk5hyc0Mb+SkHhDDXT+lU=
-google.golang.org/genproto/googleapis/api v0.0.0-20260715232425-e75dac1f907d h1:QwnJwPte4XXAkhPu26LTDIahnsMSUV0kK8HkxbC+Pc4=
-google.golang.org/genproto/googleapis/api v0.0.0-20260715232425-e75dac1f907d/go.mod h1:WRrQ7/7N19PypuT0fxLOL5Lq0waoiRri4FbtHDEKrGE=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 h1:cYNAzI2sUwhmCcoj9TxvihSrqsxt6uIkj3rDRhSDmW4=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688/go.mod h1:DjtHYE8FKJLivXcBEjGwndXfIC23G0VpXiXKqG179uA=
-google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
-google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
+google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 h1:XzmzkmB14QhVhgnawEVsOn6OFsnpyxNPRY9QV01dNB0=
+google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:L43LFes82YgSonw6iTXTxXUX1OlULt4AQtkik4ULL/I=
+google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7 h1:41r6JMbpzBMen0R/4TZeeAmGXSJC7DftGINUodzTkPI=
+google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:EIQZ5bFCfRQDV4MhRle7+OgjNtZ6P1PiZBgAKuxXu/Y=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 h1:m8qni9SQFH0tJc1X0vmnpw/0t+AImlSvp30sEupozUg=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=
+google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -1003,8 +999,8 @@ google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp0
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
-google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
diff --git a/management/internals/shared/grpc/certposture.go b/management/internals/shared/grpc/certposture.go
index a0c2fa675..d3d8f08be 100644
--- a/management/internals/shared/grpc/certposture.go
+++ b/management/internals/shared/grpc/certposture.go
@@ -14,18 +14,34 @@ import (
 
 const certChallengeKeyDomain = "netbird-cert-challenge-key"
 
-// certChallenger derives the nonce secret from the management WireGuard key so every
-// instance sharing that key issues and verifies the same nonces without extra state.
-func certChallenger(serverKey wgtypes.Key) *certposture.Challenger {
+// newCertChallenger derives the nonce secret from the data store encryption key:
+// generated once, written back to the configuration, and read by every instance, so a
+// nonce stays verifiable across a restart and between instances.
+//
+// Where none is configured it falls back to the server's WireGuard key, which is
+// regenerated per process. Unpredictable is the property that has to hold either way: a
+// peer that could guess the secret would mint future windows' nonces, sign them while
+// its key is present, and keep passing after it is gone.
+func newCertChallenger(encryptionKey string, serverKey wgtypes.Key) *certposture.Challenger {
+	secret := []byte(encryptionKey)
+	if len(secret) == 0 {
+		log.Warnf("no data store encryption key, deriving certificate challenges from the ephemeral server key: peers will be rejected once per restart and across instances")
+		secret = serverKey[:]
+	}
+
 	h := sha256.New()
 	h.Write([]byte(certChallengeKeyDomain))
-	h.Write(serverKey[:])
+	h.Write(secret)
 	return certposture.NewChallenger(h.Sum(nil))
 }
 
 // stampCertificateChallenges fills the per-peer nonce into every certificate challenge
-// right before the response is encrypted for that peer.
-func stampCertificateChallenges(checks []*proto.Checks, peerKey, serverKey wgtypes.Key) {
+// right before the response is encrypted for that peer, reporting whether it issued one.
+//
+// On a sync stream the answer registers the peer for renewal. A nonce is stateless, but
+// the renewal that keeps it fresh is local: only the instance holding a peer's stream
+// can push to it, so an instance renews exactly the peers it streams nonces to.
+func stampCertificateChallenges(checks []*proto.Checks, challenger *certposture.Challenger, peerKey wgtypes.Key) bool {
 	var nonce []byte
 	for _, check := range checks {
 		challenge := check.GetCertificateChallenge()
@@ -33,40 +49,40 @@ func stampCertificateChallenges(checks []*proto.Checks, peerKey, serverKey wgtyp
 			continue
 		}
 		if nonce == nil {
-			nonce = certChallenger(serverKey).Nonce(peerKey[:], time.Now())
+			nonce = challenger.Nonce(peerKey[:], time.Now())
 		}
 		challenge.Nonce = nonce
 	}
+	return nonce != nil
 }
 
 // verifiedCertificates turns the peer's proofs into PEM chains for its meta. Possession
 // (nonce + signature) is verified here; trust against a check's CAs is evaluated by the
-// posture check itself. Any invalid proof rejects the whole set.
+// posture check itself. Each proof stands for its own key, so an invalid one is dropped
+// without the others: a user store answering with an unusable key must not cost the
+// device the machine certificate it proved.
 func (s *Server) verifiedCertificates(ctx context.Context, peerKey wgtypes.Key, proofs []*proto.CertificateProof) []string {
 	if len(proofs) == 0 {
 		return nil
 	}
-	serverKey, err := s.secretsManager.GetWGKey()
-	if err != nil {
-		log.WithContext(ctx).Warnf("skipping certificate proofs of peer %s: %v", peerKey, err)
-		return nil
-	}
 
-	challenger := certChallenger(serverKey)
 	now := time.Now()
 	chains := make([]string, 0, len(proofs))
 	for _, p := range proofs {
-		chain, err := challenger.Verify(certposture.Proof{
+		chain, err := s.challenger.Verify(certposture.Proof{
 			Nonce:     p.GetNonce(),
 			Chain:     p.GetChain(),
 			SigAlg:    p.GetSigAlg(),
 			Signature: p.GetSignature(),
 		}, peerKey[:], now)
 		if err != nil {
-			log.WithContext(ctx).Warnf("rejecting certificate proofs of peer %s: %v", peerKey, err)
-			return nil
+			log.WithContext(ctx).Warnf("dropping a certificate proof of peer %s: %v", peerKey, err)
+			continue
 		}
 		chains = append(chains, certposture.EncodeChainPEM(chain))
 	}
+	if len(chains) == 0 {
+		return nil
+	}
 	return chains
 }
diff --git a/management/internals/shared/grpc/certposture_test.go b/management/internals/shared/grpc/certposture_test.go
index 5239264ba..e713c9aac 100644
--- a/management/internals/shared/grpc/certposture_test.go
+++ b/management/internals/shared/grpc/certposture_test.go
@@ -16,7 +16,8 @@ import (
 )
 
 func TestCertificateChallenge_StampAndVerifyRoundTrip(t *testing.T) {
-	serverKey := generateKey(t)
+	const encryptionKey = "data-store-encryption-key"
+	challenger := newCertChallenger(encryptionKey, generateKey(t))
 	peerKey := generateKey(t).PublicKey()
 	ca := certtest.NewCA(t, "corp-root")
 	ctx := context.Background()
@@ -29,7 +30,7 @@ func TestCertificateChallenge_StampAndVerifyRoundTrip(t *testing.T) {
 	require.Equal(t, []string{ca.PEM}, checks[0].GetCertificateChallenge().GetCaCertificates())
 	require.Empty(t, checks[0].GetCertificateChallenge().GetNonce())
 
-	stampCertificateChallenges(checks, peerKey, serverKey)
+	stampCertificateChallenges(checks, challenger, peerKey)
 	nonce := checks[0].GetCertificateChallenge().GetNonce()
 	require.NotEmpty(t, nonce)
 
@@ -39,7 +40,7 @@ func TestCertificateChallenge_StampAndVerifyRoundTrip(t *testing.T) {
 	require.NoError(t, err)
 	proofs := []*proto.CertificateProof{{Nonce: nonce, Chain: [][]byte{leaf.Raw}, SigAlg: sigAlg, Signature: sig}}
 
-	s := &Server{secretsManager: &TimeBasedAuthSecretsManager{wgKey: serverKey}}
+	s := &Server{challenger: challenger}
 
 	chains := s.verifiedCertificates(ctx, peerKey, proofs)
 	require.Len(t, chains, 1)
@@ -48,13 +49,28 @@ func TestCertificateChallenge_StampAndVerifyRoundTrip(t *testing.T) {
 	t.Run("proof replayed by another peer is rejected", func(t *testing.T) {
 		assert.Nil(t, s.verifiedCertificates(ctx, generateKey(t).PublicKey(), proofs))
 	})
-	t.Run("nonce from another management key is rejected", func(t *testing.T) {
-		other := &Server{secretsManager: &TimeBasedAuthSecretsManager{wgKey: generateKey(t)}}
+	t.Run("nonce from another deployment's secret is rejected", func(t *testing.T) {
+		other := &Server{challenger: newCertChallenger("a-different-encryption-key", generateKey(t))}
 		assert.Nil(t, other.verifiedCertificates(ctx, peerKey, proofs))
 	})
-	t.Run("one invalid proof rejects the whole set", func(t *testing.T) {
+	t.Run("a second instance with the same encryption key accepts it", func(t *testing.T) {
+		// The point of deriving from the stored key: another instance, with its own
+		// freshly generated WireGuard key, verifies what this one issued. This is also
+		// what a restart looks like, and it used to reject.
+		peer := &Server{challenger: newCertChallenger(encryptionKey, generateKey(t))}
+		assert.Len(t, peer.verifiedCertificates(ctx, peerKey, proofs), 1)
+	})
+	t.Run("an invalid proof is dropped without the valid ones", func(t *testing.T) {
+		// A device proving its machine certificate while a user store answers with a key
+		// it cannot use must keep the machine certificate.
 		bad := &proto.CertificateProof{Nonce: nonce, Chain: [][]byte{leaf.Raw}, SigAlg: sigAlg, Signature: []byte("junk")}
-		assert.Nil(t, s.verifiedCertificates(ctx, peerKey, append(proofs, bad)))
+		chains := s.verifiedCertificates(ctx, peerKey, append([]*proto.CertificateProof{bad}, proofs...))
+		require.Len(t, chains, 1, "the valid proof survives the invalid one")
+		assert.True(t, certposture.ChainMatchesCAs(chains[0], []string{ca.PEM}, time.Now()))
+	})
+	t.Run("only invalid proofs yield no certificates", func(t *testing.T) {
+		bad := &proto.CertificateProof{Nonce: nonce, Chain: [][]byte{leaf.Raw}, SigAlg: sigAlg, Signature: []byte("junk")}
+		assert.Empty(t, s.verifiedCertificates(ctx, peerKey, []*proto.CertificateProof{bad}))
 	})
 	t.Run("no proofs yields no certificates", func(t *testing.T) {
 		assert.Nil(t, s.verifiedCertificates(ctx, peerKey, nil))
@@ -63,7 +79,7 @@ func TestCertificateChallenge_StampAndVerifyRoundTrip(t *testing.T) {
 
 func TestStampCertificateChallenges_SkipsFileOnlyChecks(t *testing.T) {
 	checks := []*proto.Checks{{Files: []string{"/bin/agent"}}}
-	stampCertificateChallenges(checks, generateKey(t).PublicKey(), generateKey(t))
+	stampCertificateChallenges(checks, newCertChallenger("key", generateKey(t)), generateKey(t).PublicKey())
 	assert.Nil(t, checks[0].GetCertificateChallenge())
 }
 
diff --git a/management/internals/shared/grpc/peer_update_handler.go b/management/internals/shared/grpc/peer_update_handler.go
index d3ff9b6af..5037083c1 100644
--- a/management/internals/shared/grpc/peer_update_handler.go
+++ b/management/internals/shared/grpc/peer_update_handler.go
@@ -7,6 +7,7 @@ import (
 	"github.com/netbirdio/netbird/encryption"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
 	"github.com/netbirdio/netbird/management/server/telemetry"
+	"github.com/netbirdio/netbird/shared/management/certposture"
 	"github.com/netbirdio/netbird/shared/management/proto"
 	log "github.com/sirupsen/logrus"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
@@ -18,16 +19,20 @@ func PeerUpdateHandlerFactory(
 	peerKey wgtypes.Key,
 	updates chan *network_map.UpdateMessage,
 	secretsManager SecretsManager,
+	challenger *certposture.Challenger,
+	onChallengeStamped func(),
 	srv proto.ManagementService_SyncServer,
 	cleanupfunc func()) *PeerUpdateHandler {
 	return &PeerUpdateHandler{
-		peerKey:        peerKey,
-		updates:        updates,
-		secretsManager: secretsManager,
-		srv:            srv,
-		encrypter:      encryption.DefaultEncrypter{},
-		debouncer:      NewUpdateDebouncer(1000 * time.Millisecond),
-		cleanupFunc:    cleanupfunc,
+		peerKey:            peerKey,
+		updates:            updates,
+		secretsManager:     secretsManager,
+		challenger:         challenger,
+		onChallengeStamped: onChallengeStamped,
+		srv:                srv,
+		encrypter:          encryption.DefaultEncrypter{},
+		debouncer:          NewUpdateDebouncer(1000 * time.Millisecond),
+		cleanupFunc:        cleanupfunc,
 	}
 }
 
@@ -40,10 +45,15 @@ type PeerUpdateHandler struct {
 	updates        chan *network_map.UpdateMessage
 	appMetrics     telemetry.AppMetrics
 	secretsManager SecretsManager
-	srv            syncSender
-	encrypter      encryption.Encrypter
-	debouncer      Debouncer
-	cleanupFunc    func()
+	challenger     *certposture.Challenger
+	// onChallengeStamped registers the account for renewal. Every push reaches this
+	// path, including the ones a REST update on another instance broadcasts, which is
+	// what lets an instance pick up an account whose peers never reconnect.
+	onChallengeStamped func()
+	srv                syncSender
+	encrypter          encryption.Encrypter
+	debouncer          Debouncer
+	cleanupFunc        func()
 }
 
 func (pu *PeerUpdateHandler) WithMetrics(appMetrics telemetry.AppMetrics) *PeerUpdateHandler {
@@ -117,7 +127,9 @@ func (pu *PeerUpdateHandler) SendUpdate(ctx context.Context, update *network_map
 		return status.Errorf(codes.Internal, "failed processing update message")
 	}
 
-	stampCertificateChallenges(update.Update.GetChecks(), pu.peerKey, key)
+	if stampCertificateChallenges(update.Update.GetChecks(), pu.challenger, pu.peerKey) && pu.onChallengeStamped != nil {
+		pu.onChallengeStamped()
+	}
 	encryptedResp, err := pu.encrypter.EncryptMessage(pu.peerKey, key, update.Update)
 	if err != nil {
 		pu.cleanupFunc()
diff --git a/management/internals/shared/grpc/proxy_connect_authorizer_test.go b/management/internals/shared/grpc/proxy_connect_authorizer_test.go
index d0d196d20..a2c52296f 100644
--- a/management/internals/shared/grpc/proxy_connect_authorizer_test.go
+++ b/management/internals/shared/grpc/proxy_connect_authorizer_test.go
@@ -5,9 +5,9 @@ import (
 	"errors"
 	"testing"
 
-	"go.uber.org/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 	"google.golang.org/grpc/codes"
 	grpcstatus "google.golang.org/grpc/status"
 
diff --git a/management/internals/shared/grpc/proxy_snapshot_test.go b/management/internals/shared/grpc/proxy_snapshot_test.go
index 8b84a849e..684a984d2 100644
--- a/management/internals/shared/grpc/proxy_snapshot_test.go
+++ b/management/internals/shared/grpc/proxy_snapshot_test.go
@@ -6,9 +6,9 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/metadata"
 
diff --git a/management/internals/shared/grpc/server.go b/management/internals/shared/grpc/server.go
index 32fa11bc2..51023c34d 100644
--- a/management/internals/shared/grpc/server.go
+++ b/management/internals/shared/grpc/server.go
@@ -45,6 +45,7 @@ import (
 	"github.com/netbirdio/netbird/management/server/settings"
 	"github.com/netbirdio/netbird/management/server/telemetry"
 	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/certposture"
 	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 	"github.com/netbirdio/netbird/shared/management/proto"
 	internalStatus "github.com/netbirdio/netbird/shared/management/status"
@@ -70,6 +71,7 @@ type Server struct {
 	peerLocks      sync.Map
 	authManager    auth.Manager
 	sessionStore   *auth.SessionStore
+	challenger     *certposture.Challenger
 
 	logBlockedPeers          bool
 	blockPeersWithSameConfig bool
@@ -131,7 +133,13 @@ func NewServer(
 		}
 	}
 
+	serverKey, err := secretsManager.GetWGKey()
+	if err != nil {
+		return nil, fmt.Errorf("get server WireGuard key: %w", err)
+	}
+
 	return &Server{
+		challenger:               newCertChallenger(config.DataStoreEncryptionKey, serverKey),
 		jobManager:               jobManager,
 		accountManager:           accountManager,
 		settingsManager:          settingsManager,
@@ -310,7 +318,8 @@ func (s *Server) Sync(req *proto.EncryptedMessage, srv proto.ManagementService_S
 		return mapError(ctx, err)
 	}
 
-	err = s.sendInitialSync(ctx, peerKey, peer, netMap, postureChecks, srv, dnsFwdPort)
+	trackChallenge := func() { s.accountManager.TrackCertificateChallenges(ctx, accountID, peer.ID, syncStart) }
+	err = s.sendInitialSync(ctx, peerKey, peer, netMap, postureChecks, srv, dnsFwdPort, trackChallenge)
 	if err != nil {
 		log.WithContext(ctx).Debugf("error while sending initial sync for %s: %v", peerKey.String(), err)
 		s.syncSem.Add(-1)
@@ -338,7 +347,9 @@ func (s *Server) Sync(req *proto.EncryptedMessage, srv proto.ManagementService_S
 
 	s.syncSem.Add(-1)
 
-	return PeerUpdateHandlerFactory(peerKey, updates, s.secretsManager, srv, func() { s.cancelPeerRoutines(ctx, accountID, peer, syncStart, updates) }).
+	return PeerUpdateHandlerFactory(peerKey, updates, s.secretsManager, s.challenger,
+		trackChallenge,
+		srv, func() { s.cancelPeerRoutines(ctx, accountID, peer, syncStart, updates) }).
 		WithMetrics(s.appMetrics).HandleUpdates(ctx)
 }
 
@@ -452,6 +463,7 @@ func (s *Server) cancelPeerRoutinesWithoutLock(ctx context.Context, accountID st
 		return
 	}
 	s.secretsManager.CancelRefresh(peer.ID)
+	s.accountManager.UntrackCertificateChallenges(accountID, peer.ID, streamStartTime)
 
 	log.WithContext(ctx).Debugf("peer %s has been disconnected", peer.Key)
 }
@@ -727,7 +739,8 @@ func (s *Server) Login(ctx context.Context, req *proto.EncryptedMessage) (*proto
 		return nil, status.Errorf(codes.Internal, "failed logging in peer")
 	}
 
-	stampCertificateChallenges(loginResp.Checks, peerKey, key)
+	// Renewal is tracked by the sync stream that follows, on whichever instance it lands.
+	stampCertificateChallenges(loginResp.Checks, s.challenger, peerKey)
 	encryptedResp, err := encryption.EncryptMessage(peerKey, key, loginResp)
 	if err != nil {
 		log.WithContext(ctx).Warnf("failed encrypting peer %s message", peer.ID)
@@ -907,7 +920,7 @@ func (s *Server) IsHealthy(ctx context.Context, req *proto.Empty) (*proto.Empty,
 }
 
 // sendInitialSync sends initial proto.SyncResponse to the peer requesting synchronization
-func (s *Server) sendInitialSync(ctx context.Context, peerKey wgtypes.Key, peer *nbpeer.Peer, networkMap *types.NetworkMap, postureChecks []*nmdata.PostureChecks, srv proto.ManagementService_SyncServer, dnsFwdPort int64) error {
+func (s *Server) sendInitialSync(ctx context.Context, peerKey wgtypes.Key, peer *nbpeer.Peer, networkMap *types.NetworkMap, postureChecks []*nmdata.PostureChecks, srv proto.ManagementService_SyncServer, dnsFwdPort int64, onChallengeStamped func()) error {
 	var err error
 	var turnToken *Token
 
@@ -979,7 +992,9 @@ func (s *Server) sendInitialSync(ctx context.Context, peerKey wgtypes.Key, peer
 		return status.Errorf(codes.Internal, "failed getting server key")
 	}
 
-	stampCertificateChallenges(plainResp.Checks, peerKey, key)
+	if stampCertificateChallenges(plainResp.Checks, s.challenger, peerKey) {
+		onChallengeStamped()
+	}
 	encryptedResp, err := encryption.EncryptMessage(peerKey, key, plainResp)
 	if err != nil {
 		return status.Errorf(codes.Internal, "error handling request")
diff --git a/management/internals/shared/grpc/server_disconnect_test.go b/management/internals/shared/grpc/server_disconnect_test.go
index 9a19a9b1a..7d186b715 100644
--- a/management/internals/shared/grpc/server_disconnect_test.go
+++ b/management/internals/shared/grpc/server_disconnect_test.go
@@ -40,6 +40,9 @@ func TestCancelPeerRoutines_SessionOwnership(t *testing.T) {
 			controller.EXPECT().OnPeerDisconnected(gomock.Any(), "account-1", peer.ID, tt.session).Return(tt.ownsPeer)
 			if tt.cancelRefresh {
 				secretsManager.EXPECT().CancelRefresh(peer.ID)
+				// The stream's challenge renewal ends with it; a stale session leaves the
+				// newer one's alone.
+				accountManager.EXPECT().UntrackCertificateChallenges("account-1", peer.ID, streamStart)
 			}
 
 			s.cancelPeerRoutines(context.Background(), "account-1", peer, streamStart, tt.session)
diff --git a/management/internals/shared/grpc/sync_mappings_test.go b/management/internals/shared/grpc/sync_mappings_test.go
index 6db43d7c2..6949b79e9 100644
--- a/management/internals/shared/grpc/sync_mappings_test.go
+++ b/management/internals/shared/grpc/sync_mappings_test.go
@@ -7,9 +7,9 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/metadata"
 
diff --git a/management/internals/shared/grpc/token_mgr_test.go b/management/internals/shared/grpc/token_mgr_test.go
index b1be5f99a..0856e7a43 100644
--- a/management/internals/shared/grpc/token_mgr_test.go
+++ b/management/internals/shared/grpc/token_mgr_test.go
@@ -10,8 +10,8 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/update_channel"
diff --git a/management/server/account.go b/management/server/account.go
index 1b7e4d66c..7bc682830 100644
--- a/management/server/account.go
+++ b/management/server/account.go
@@ -100,6 +100,8 @@ type DefaultAccountManager struct {
 
 	peerInactivityExpiry Scheduler
 
+	certChallenges *certChallengeRefresher
+
 	// userDeleteFromIDPEnabled allows to delete user from IDP when user is deleted from account
 	userDeleteFromIDPEnabled bool
 
@@ -255,6 +257,9 @@ func BuildManager(
 		disableDefaultPolicy:     disableDefaultPolicy,
 	}
 
+	am.certChallenges = newCertChallengeRefresher(am.refreshCertificateChallenges)
+	am.certChallenges.Start(ctx)
+
 	am.networkMapController.StartWarmup(ctx)
 
 	accountsCounter, err := store.GetAccountsCounter(ctx)
@@ -961,6 +966,7 @@ func (am *DefaultAccountManager) DeleteAccount(ctx context.Context, accountID, u
 	}
 	// cancel peer login expiry job
 	am.peerLoginExpiry.Cancel(ctx, []string{account.Id})
+	am.certChallenges.Forget(account.Id)
 
 	meta := map[string]any{"account_id": account.Id, "domain": account.Domain, "created_at": account.CreatedAt}
 	am.StoreEvent(ctx, userID, accountID, accountID, activity.AccountDeleted, meta)
diff --git a/management/server/account/manager.go b/management/server/account/manager.go
index 2ac8584f4..15fe11241 100644
--- a/management/server/account/manager.go
+++ b/management/server/account/manager.go
@@ -64,6 +64,8 @@ type Manager interface {
 	ListUsers(ctx context.Context, accountID string) ([]*types.User, error)
 	GetPeers(ctx context.Context, accountID, userID, nameFilter, ipFilter, macFilter string) ([]*nbpeer.Peer, error)
 	MarkPeerConnected(ctx context.Context, peerKey string, accountID string, sessionStartedAt int64, nmap *types.NetworkMap) error
+	TrackCertificateChallenges(ctx context.Context, accountID, peerID string, streamStart time.Time)
+	UntrackCertificateChallenges(accountID, peerID string, streamStart time.Time)
 	MarkPeerDisconnected(ctx context.Context, peerKey string, accountID string, sessionStartedAt int64) error
 	DeletePeer(ctx context.Context, accountID, peerID, userID string) error
 	UpdatePeer(ctx context.Context, accountID, userID string, p *nbpeer.Peer) (*nbpeer.Peer, error)
diff --git a/management/server/account/manager_mock.go b/management/server/account/manager_mock.go
index 60075b169..b3868f2e2 100644
--- a/management/server/account/manager_mock.go
+++ b/management/server/account/manager_mock.go
@@ -1632,6 +1632,30 @@ func (mr *MockManagerMockRecorder) SyncUserJWTGroups(ctx, userAuth any) *gomock.
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SyncUserJWTGroups", reflect.TypeOf((*MockManager)(nil).SyncUserJWTGroups), ctx, userAuth)
 }
 
+// TrackCertificateChallenges mocks base method.
+func (m *MockManager) TrackCertificateChallenges(ctx context.Context, accountID, peerID string, streamStart time.Time) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "TrackCertificateChallenges", ctx, accountID, peerID, streamStart)
+}
+
+// TrackCertificateChallenges indicates an expected call of TrackCertificateChallenges.
+func (mr *MockManagerMockRecorder) TrackCertificateChallenges(ctx, accountID, peerID, streamStart any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "TrackCertificateChallenges", reflect.TypeOf((*MockManager)(nil).TrackCertificateChallenges), ctx, accountID, peerID, streamStart)
+}
+
+// UntrackCertificateChallenges mocks base method.
+func (m *MockManager) UntrackCertificateChallenges(accountID, peerID string, streamStart time.Time) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "UntrackCertificateChallenges", accountID, peerID, streamStart)
+}
+
+// UntrackCertificateChallenges indicates an expected call of UntrackCertificateChallenges.
+func (mr *MockManagerMockRecorder) UntrackCertificateChallenges(accountID, peerID, streamStart any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UntrackCertificateChallenges", reflect.TypeOf((*MockManager)(nil).UntrackCertificateChallenges), accountID, peerID, streamStart)
+}
+
 // UpdateAccountOnboarding mocks base method.
 func (m *MockManager) UpdateAccountOnboarding(ctx context.Context, accountID, userID string, newOnboarding *types.AccountOnboarding) (*types.AccountOnboarding, error) {
 	m.ctrl.T.Helper()
diff --git a/management/server/certificate_challenge.go b/management/server/certificate_challenge.go
new file mode 100644
index 000000000..8dd004f7b
--- /dev/null
+++ b/management/server/certificate_challenge.go
@@ -0,0 +1,344 @@
+package server
+
+import (
+	"context"
+	"encoding/binary"
+	"hash/fnv"
+	"maps"
+	"slices"
+	"sync"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/certposture"
+)
+
+const (
+	minCertChallengeTick = time.Second
+	maxCertChallengeTick = 15 * time.Minute
+
+	maxCertChallengeRefresh = 30 * time.Second
+)
+
+// certChallengePeriod is how often an account whose policies carry a certificate
+// posture check is pushed a fresh challenge. A nonce is accepted for its own window and
+// the one before it, so one issued at the very end of a window lives only one window. A
+// third of that leaves a missed run well clear of the edge, where a half would put it
+// exactly on it.
+func certChallengePeriod() time.Duration {
+	return certposture.EffectiveWindow() / 3
+}
+
+// certChallengeTick is how often the refresher looks for accounts that are due. It is
+// derived from the period rather than fixed, so shortening the challenge window for a
+// test shortens this with it; the bounds keep a tiny window from spinning and a normal
+// one from checking less often than is useful.
+func certChallengeTick(period time.Duration) time.Duration {
+	return min(max(period/10, minCertChallengeTick), maxCertChallengeTick)
+}
+
+// certChallengeRefresh is how long one account's refresh is given before it is
+// abandoned. Resolving the target peers reads the store and accounts are swept one
+// after another, so an unbounded refresh lets one wedged read starve all the others.
+func certChallengeRefresh(tick time.Duration) time.Duration {
+	return min(tick, maxCertChallengeRefresh)
+}
+
+// certChallengeRefresher pushes a fresh certificate challenge to the peers connected to
+// this instance that answer one, from a single goroutine.
+//
+// A nonce only reaches a peer attached to a network map, and a quiet account sends no
+// map, so without this the peer eventually re-sends an expired nonce, has its whole
+// proof set rejected, and silently leaves the policies the check gates.
+//
+// Each instance renews only the peers whose sync stream it holds, so a peer is renewed
+// once however many instances run, and an account is dropped as soon as none of its
+// peers here answers a challenge.
+type certChallengeRefresher struct {
+	mu       sync.Mutex
+	accounts map[string]*certChallengeAccount
+	// refreshing holds the accounts whose refresh is running, and whether Track was
+	// called for one meanwhile, which makes its refresh's verdict stale.
+	refreshing map[string]bool
+
+	period  time.Duration
+	tick    time.Duration
+	timeout time.Duration
+	now     func() time.Time
+	// refresh pushes an update to those of peerIDs that answer a certificate challenge,
+	// and reports whether any of them does.
+	refresh func(ctx context.Context, accountID string, peerIDs []string) bool
+}
+
+// certChallengeAccount is one account's renewal schedule and the peers it covers, each
+// with the start of the sync stream it was stamped on.
+type certChallengeAccount struct {
+	due   time.Time
+	peers map[string]time.Time
+}
+
+// certChallengeDue is an account handed out for refresh, with its peers at that moment.
+type certChallengeDue struct {
+	accountID string
+	peerIDs   []string
+}
+
+func newCertChallengeRefresher(refresh func(ctx context.Context, accountID string, peerIDs []string) bool) *certChallengeRefresher {
+	period := certChallengePeriod()
+	tick := certChallengeTick(period)
+	return &certChallengeRefresher{
+		accounts:   map[string]*certChallengeAccount{},
+		refreshing: map[string]bool{},
+		period:     period,
+		tick:       tick,
+		timeout:    certChallengeRefresh(tick),
+		now:        time.Now,
+		refresh:    refresh,
+	}
+}
+
+// Start runs the refresh loop until ctx is done.
+func (r *certChallengeRefresher) Start(ctx context.Context) {
+	go r.run(ctx)
+}
+
+// Track renews the challenge of peerID, which was stamped one on the sync stream that
+// started at streamStart. An account seen for the first time has its first run spread
+// over one period, so that a global window rollover does not fan out to every account in
+// the same moment; an account already tracked keeps its schedule. A stamp from an older
+// stream than the one recorded for the peer is ignored.
+func (r *certChallengeRefresher) Track(ctx context.Context, accountID, peerID string, streamStart time.Time) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if _, ok := r.refreshing[accountID]; ok {
+		r.refreshing[accountID] = true
+	}
+	account, ok := r.accounts[accountID]
+	if !ok {
+		account = &certChallengeAccount{
+			due:   r.now().Add(offsetWithin(accountID, r.period)),
+			peers: map[string]time.Time{},
+		}
+		r.accounts[accountID] = account
+		log.WithContext(ctx).Debugf("tracking certificate challenge refresh for account %s", accountID)
+	}
+	if started, ok := account.peers[peerID]; ok && streamStart.Before(started) {
+		return
+	}
+	account.peers[peerID] = streamStart
+}
+
+// Untrack stops renewing peerID once the sync stream that started at streamStart ends.
+// A newer stream of the same peer keeps it tracked. The account is dropped with its
+// last peer.
+func (r *certChallengeRefresher) Untrack(accountID, peerID string, streamStart time.Time) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	account, ok := r.accounts[accountID]
+	if !ok {
+		return
+	}
+	if started, ok := account.peers[peerID]; !ok || !started.Equal(streamStart) {
+		return
+	}
+	delete(account.peers, peerID)
+	if len(account.peers) == 0 {
+		delete(r.accounts, accountID)
+	}
+}
+
+// Forget stops refreshing accountID.
+func (r *certChallengeRefresher) Forget(accountID string) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	delete(r.accounts, accountID)
+}
+
+func (r *certChallengeRefresher) tracked(accountID string) bool {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	_, ok := r.accounts[accountID]
+	return ok
+}
+
+func (r *certChallengeRefresher) run(ctx context.Context) {
+	ticker := time.NewTicker(r.tick)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			for _, due := range r.takeDue() {
+				r.finish(due.accountID, r.refreshOne(ctx, due))
+			}
+		}
+	}
+}
+
+// refreshOne refreshes a single account under the refresh deadline. A refresh that runs
+// out of time reports the account as still wanting challenges, since a deadline says
+// nothing about the account's posture checks; the next sweep tries again.
+func (r *certChallengeRefresher) refreshOne(ctx context.Context, due certChallengeDue) bool {
+	ctx, cancel := context.WithTimeout(ctx, r.timeout)
+	defer cancel()
+	return r.refresh(ctx, due.accountID, due.peerIDs)
+}
+
+// finish records the outcome of an account's refresh. An account none of whose peers
+// answers a challenge any more is dropped, unless one was tracked again while the
+// refresh ran: the refresh may have read the store before a certificate check was added.
+// A dropped peer is tracked again the next time it is stamped a challenge.
+func (r *certChallengeRefresher) finish(accountID string, wanted bool) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	retracked := r.refreshing[accountID]
+	delete(r.refreshing, accountID)
+	if !wanted && !retracked {
+		delete(r.accounts, accountID)
+	}
+}
+
+// takeDue returns the accounts due now and books their next run straight away, so a
+// slow refresh cannot make an account fall due twice, and so the refresh itself runs
+// without the lock.
+func (r *certChallengeRefresher) takeDue() []certChallengeDue {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	now := r.now()
+	var due []certChallengeDue
+	for accountID, account := range r.accounts {
+		if account.due.After(now) {
+			continue
+		}
+		due = append(due, certChallengeDue{accountID: accountID, peerIDs: slices.Collect(maps.Keys(account.peers))})
+		account.due = now.Add(r.period)
+		r.refreshing[accountID] = false
+	}
+	return due
+}
+
+// offsetWithin maps a key to a stable duration in [0, period).
+func offsetWithin(key string, period time.Duration) time.Duration {
+	h := fnv.New64a()
+	//nolint:errcheck // hash.Write never returns an error
+	h.Write([]byte(key))
+	return time.Duration(binary.BigEndian.Uint64(h.Sum(nil)) % uint64(period))
+}
+
+// refreshCertificateChallenges pushes an update to those of peerIDs that answer a
+// certificate challenge, so each is stamped with a nonce for the current window. It
+// reports whether any of them answers one.
+func (am *DefaultAccountManager) refreshCertificateChallenges(ctx context.Context, accountID string, peerIDs []string) bool {
+	targets, err := am.certificateChallengeTargets(ctx, accountID)
+	if err != nil {
+		log.WithContext(ctx).Debugf("cannot resolve the certificate challenge targets of account %s: %v", accountID, err)
+		// Keep the account tracked: a store error now says nothing about its checks.
+		return true
+	}
+	peerIDs = slices.DeleteFunc(peerIDs, func(id string) bool { return !slices.Contains(targets, id) })
+	if len(peerIDs) == 0 {
+		log.WithContext(ctx).Debugf("no peer of account %s on this instance answers a certificate challenge, stopping challenge refresh", accountID)
+		return false
+	}
+
+	log.WithContext(ctx).Debugf("refreshing certificate challenges for %d peers of account %s", len(peerIDs), accountID)
+	reason := types.UpdateReason{Resource: types.UpdateResourcePostureCheck, Operation: types.UpdateOperationRefresh}
+	if err := am.networkMapController.BufferUpdateAffectedPeers(ctx, accountID, peerIDs, reason); err != nil {
+		log.WithContext(ctx).Warnf("failed refreshing certificate challenges for account %s: %v", accountID, err)
+	}
+	return true
+}
+
+// certificateChallengeTargets returns the peers that are sent a certificate challenge.
+// Only those peers hold a nonce, so pushing to the whole account would wake every peer
+// that never uses the feature.
+//
+// It is the inverse of processPeerPostureChecks, which decides the same thing one peer
+// at a time; TestCertificateChallengeTargets_MatchesThePerPeerRule holds them together.
+func (am *DefaultAccountManager) certificateChallengeTargets(ctx context.Context, accountID string) ([]string, error) {
+	certCheckIDs, err := am.certificatePostureCheckIDs(ctx, accountID)
+	if err != nil {
+		return nil, err
+	}
+	if len(certCheckIDs) == 0 {
+		return nil, nil
+	}
+
+	policies, err := am.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
+	if err != nil {
+		return nil, err
+	}
+	groups, err := am.Store.GetAccountGroups(ctx, store.LockingStrengthNone, accountID)
+	if err != nil {
+		return nil, err
+	}
+	groupPeers := make(map[string][]string, len(groups))
+	for _, g := range groups {
+		groupPeers[g.ID] = g.Peers
+	}
+
+	return certificateChallengeTargets(policies, groupPeers, certCheckIDs), nil
+}
+
+// certificateChallengeTargets collects the source peers of every enabled policy whose
+// posture checks include a certificate check.
+func certificateChallengeTargets(policies []*types.Policy, groupPeers map[string][]string, certCheckIDs map[string]struct{}) []string {
+	targets := map[string]struct{}{}
+	for _, policy := range policies {
+		if !policy.Enabled || !slices.ContainsFunc(policy.SourcePostureChecks, func(id string) bool {
+			_, ok := certCheckIDs[id]
+			return ok
+		}) {
+			continue
+		}
+		for _, rule := range policy.Rules {
+			if !rule.Enabled {
+				continue
+			}
+			if rule.SourceResource.Type == types.ResourceTypePeer && rule.SourceResource.ID != "" {
+				targets[rule.SourceResource.ID] = struct{}{}
+			}
+			for _, groupID := range rule.Sources {
+				for _, peerID := range groupPeers[groupID] {
+					targets[peerID] = struct{}{}
+				}
+			}
+		}
+	}
+	return slices.Collect(maps.Keys(targets))
+}
+
+// certificatePostureCheckIDs returns the IDs of the account's posture checks that ask a
+// peer to prove a certificate.
+func (am *DefaultAccountManager) certificatePostureCheckIDs(ctx context.Context, accountID string) (map[string]struct{}, error) {
+	checks, err := am.Store.GetAccountPostureChecks(ctx, store.LockingStrengthNone, accountID)
+	if err != nil {
+		return nil, err
+	}
+	ids := map[string]struct{}{}
+	for _, check := range checks {
+		if check.Checks.CertificateCheck != nil {
+			ids[check.ID] = struct{}{}
+		}
+	}
+	return ids, nil
+}
+
+// TrackCertificateChallenges starts renewing the certificate challenge of a peer that was
+// stamped one on the sync stream started at streamStart. It is called on every stamped
+// update, so it has to stay cheap: no store access, just a map the refresher sweeps.
+func (am *DefaultAccountManager) TrackCertificateChallenges(ctx context.Context, accountID, peerID string, streamStart time.Time) {
+	am.certChallenges.Track(ctx, accountID, peerID, streamStart)
+}
+
+// UntrackCertificateChallenges stops renewing the certificate challenge of a peer whose
+// sync stream started at streamStart has ended.
+func (am *DefaultAccountManager) UntrackCertificateChallenges(accountID, peerID string, streamStart time.Time) {
+	am.certChallenges.Untrack(accountID, peerID, streamStart)
+}
diff --git a/management/server/certificate_challenge_test.go b/management/server/certificate_challenge_test.go
new file mode 100644
index 000000000..52887d872
--- /dev/null
+++ b/management/server/certificate_challenge_test.go
@@ -0,0 +1,493 @@
+package server
+
+import (
+	"context"
+	"slices"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/certposture"
+)
+
+// fakeClock lets a test drive the refresher's schedule without waiting for it.
+type fakeClock struct {
+	mu sync.Mutex
+	at time.Time
+}
+
+func (c *fakeClock) Now() time.Time {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.at
+}
+
+func (c *fakeClock) Advance(d time.Duration) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.at = c.at.Add(d)
+}
+
+// scheduleRefresher builds a refresher on a clock the test drives and never starts its
+// loop, so the schedule can be checked by calling takeDue directly.
+func scheduleRefresher(refresh func(accountID string) bool) (*certChallengeRefresher, *fakeClock) {
+	clock := &fakeClock{at: time.Date(2026, 10, 1, 0, 0, 0, 0, time.UTC)}
+	r := newCertChallengeRefresher(func(_ context.Context, accountID string, _ []string) bool {
+		return refresh(accountID)
+	})
+	r.now = clock.Now
+	return r, clock
+}
+
+// runningRefresher builds a refresher whose period and tick are short enough to observe
+// in a test, and starts its loop.
+func runningRefresher(t *testing.T, refresh func(accountID string) bool) *certChallengeRefresher {
+	t.Helper()
+	r := newCertChallengeRefresher(func(_ context.Context, accountID string, _ []string) bool {
+		return refresh(accountID)
+	})
+	r.period = 10 * time.Millisecond
+	r.tick = time.Millisecond
+	r.Start(t.Context())
+	return r
+}
+
+// streamStart is the start of the sync stream the tests' peers are stamped on.
+var streamStart = time.Date(2026, 10, 1, 0, 0, 0, 0, time.UTC)
+
+// track tracks one peer of accountID, as a stamped sync stream does.
+func track(r *certChallengeRefresher, accountID string) {
+	r.Track(context.Background(), accountID, accountID+"-peer", streamStart)
+}
+
+// dueAccounts returns the IDs of the accounts takeDue hands out.
+func dueAccounts(r *certChallengeRefresher) []string {
+	var ids []string
+	for _, due := range r.takeDue() {
+		ids = append(ids, due.accountID)
+	}
+	return ids
+}
+
+func (r *certChallengeRefresher) dueAt(accountID string) time.Time {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return r.accounts[accountID].due
+}
+
+func TestCertChallengePeriod_LeavesRoomForAMissedRun(t *testing.T) {
+	// A nonce issued at the very end of a window is accepted for that window and the
+	// next one only, so the shortest life a peer can be handed is one window. Renewing
+	// has to stay clear of that edge even when a run is missed.
+	assert.Less(t, 2*certChallengePeriod(), certposture.EffectiveWindow(),
+		"a missed refresh must still leave the peer's nonce valid, with margin")
+}
+
+func TestCertChallengeTick_FollowsTheWindow(t *testing.T) {
+	// An end-to-end test shortens the challenge window to watch a renewal happen. The
+	// tick has to come down with it, or the refresher would still be looking for due
+	// accounts every quarter of an hour and never renew anything in time.
+	short := certChallengeTick(30 * time.Second)
+	assert.Less(t, short, 30*time.Second, "the tick must be shorter than the period it serves")
+	assert.GreaterOrEqual(t, short, minCertChallengeTick, "the tick must not spin")
+
+	assert.Equal(t, maxCertChallengeTick, certChallengeTick(24*time.Hour),
+		"a long period must not stretch the tick without bound")
+	assert.Equal(t, minCertChallengeTick, certChallengeTick(time.Millisecond),
+		"a tiny period must not drive the tick below its floor")
+}
+
+func TestCertChallengeRefresher_SpreadsAccountsOverThePeriod(t *testing.T) {
+	// Every account on an instance shares the same global challenge window, so a
+	// restart arms them all at once. The offset is what keeps them from fanning out
+	// to their peers in the same moment.
+	r, clock := scheduleRefresher(func(string) bool { return true })
+
+	ids := []string{"account-a", "account-b", "account-c", "account-d", "account-e", "account-f"}
+	for _, id := range ids {
+		track(r, id)
+	}
+
+	start := clock.Now()
+	offsets := map[time.Duration]bool{}
+	for _, id := range ids {
+		offset := r.dueAt(id).Sub(start)
+		assert.GreaterOrEqual(t, offset, time.Duration(0), "account %s is due in the past", id)
+		assert.Less(t, offset, r.period, "account %s is due beyond one period", id)
+		offsets[offset] = true
+	}
+	assert.Greater(t, len(offsets), 1, "all accounts were given the same offset, which defeats the spreading")
+}
+
+func TestCertChallengeOffset_IsStablePerAccount(t *testing.T) {
+	assert.Equal(t, offsetWithin("account-a", certChallengePeriod()), offsetWithin("account-a", certChallengePeriod()),
+		"the same account must keep its slot across restarts")
+	assert.NotEqual(t, offsetWithin("account-a", certChallengePeriod()), offsetWithin("account-b", certChallengePeriod()),
+		"two accounts must not share a slot")
+}
+
+func TestCertChallengeRefresher_RenewsOncePerPeriod(t *testing.T) {
+	r, clock := scheduleRefresher(func(string) bool { return true })
+	track(r, "account-a")
+
+	assert.Empty(t, r.takeDue(), "an account just tracked is not due before its offset elapses")
+
+	clock.Advance(r.period)
+	assert.Equal(t, []string{"account-a"}, dueAccounts(r), "the account is due once its offset has elapsed")
+
+	clock.Advance(r.period / 2)
+	assert.Empty(t, r.takeDue(), "the next run is booked a full period out")
+
+	clock.Advance(r.period / 2)
+	assert.Equal(t, []string{"account-a"}, dueAccounts(r), "the account is due again one period later")
+}
+
+func TestCertChallengeRefresher_BooksTheNextRunBeforeRefreshing(t *testing.T) {
+	// takeDue reserves the next run while it holds the lock, so a refresh that outlives
+	// a tick cannot have the same account handed out twice.
+	r, clock := scheduleRefresher(func(string) bool { return true })
+	track(r, "account-a")
+	clock.Advance(r.period)
+
+	require.Len(t, r.takeDue(), 1, "the account is due")
+	assert.Empty(t, r.takeDue(), "a second pass at the same instant must not hand out the account again")
+}
+
+func TestCertChallengeRefresher_TrackIsIdempotent(t *testing.T) {
+	r, clock := scheduleRefresher(func(string) bool { return true })
+
+	track(r, "account-a")
+	first := r.dueAt("account-a")
+
+	clock.Advance(certChallengePeriod())
+	track(r, "account-a")
+
+	assert.Equal(t, first, r.dueAt("account-a"), "re-tracking must not push the next run further out")
+}
+
+func TestCertChallengeRefresher_RefreshesATrackedAccount(t *testing.T) {
+	refreshed := make(chan string, 4)
+	r := runningRefresher(t, func(accountID string) bool {
+		select {
+		case refreshed <- accountID:
+		default:
+		}
+		return true
+	})
+	track(r, "account-a")
+
+	select {
+	case got := <-refreshed:
+		assert.Equal(t, "account-a", got)
+	case <-time.After(3 * time.Second):
+		t.Fatal("a tracked account was never refreshed")
+	}
+	assert.True(t, r.tracked("account-a"), "an account that still wants challenges stays tracked")
+}
+
+func TestCertChallengeRefresher_DropsAnAccountThatNoLongerWantsChallenges(t *testing.T) {
+	var mu sync.Mutex
+	var calls int
+
+	r := runningRefresher(t, func(string) bool {
+		mu.Lock()
+		defer mu.Unlock()
+		calls++
+		return false
+	})
+	track(r, "account-a")
+
+	require.Eventually(t, func() bool { return !r.tracked("account-a") }, 3*time.Second, time.Millisecond,
+		"an account whose refresh reports it no longer wants challenges must be dropped")
+
+	time.Sleep(20 * r.tick)
+	mu.Lock()
+	defer mu.Unlock()
+	assert.Equal(t, 1, calls, "the account must not be refreshed again after being dropped")
+}
+
+func TestCertChallengeRefresher_RefreshesWithoutHoldingTheLock(t *testing.T) {
+	// The refresh fans out to every peer of the account, so holding the lock across it
+	// would stall every peer that connects meanwhile. Calling back into the refresher
+	// from inside the refresh deadlocks if the loop still holds it.
+	reentered := make(chan bool, 1)
+	var once sync.Once
+
+	r := newCertChallengeRefresher(nil)
+	r.period = 10 * time.Millisecond
+	r.tick = time.Millisecond
+	r.refresh = func(_ context.Context, accountID string, _ []string) bool {
+		once.Do(func() {
+			answered := make(chan bool, 1)
+			go func() { answered <- r.tracked(accountID) }()
+			select {
+			case got := <-answered:
+				reentered <- got
+			case <-time.After(2 * time.Second):
+				reentered <- false
+			}
+		})
+		return true
+	}
+	r.Start(t.Context())
+	track(r, "account-a")
+
+	select {
+	case ok := <-reentered:
+		assert.True(t, ok, "the refresher was not reachable while a refresh was in flight")
+	case <-time.After(5 * time.Second):
+		t.Fatal("the refresh never ran")
+	}
+}
+
+// TestCertificateChallengeTargets_MatchesThePerPeerRule holds the renewal to the same
+// rule management uses when it hands out the challenge. The refresher asks "which peers
+// get one", processPeerPostureChecks asks "does this peer get one", and the two have to
+// answer identically: a peer the refresher forgets stops being renewed and silently
+// falls out of its policies, which is the failure the refresher exists to prevent.
+func TestCertificateChallengeTargets_MatchesThePerPeerRule(t *testing.T) {
+	const certCheck, osCheck = "check-cert", "check-os"
+	certCheckIDs := map[string]struct{}{certCheck: {}}
+
+	groupPeers := map[string][]string{
+		"g-devs":    {"p1", "p2"},
+		"g-servers": {"p3"},
+		"g-empty":   {},
+		"g-mixed":   {"p2", "p4"},
+	}
+	peerGroups := map[string][]string{
+		"p1": {"g-devs"},
+		"p2": {"g-devs", "g-mixed"},
+		"p3": {"g-servers"},
+		"p4": {"g-mixed"},
+		"p5": {},
+	}
+
+	policies := []*types.Policy{
+		{
+			ID: "gated", Enabled: true, SourcePostureChecks: []string{certCheck},
+			Rules: []*types.PolicyRule{{Enabled: true, Sources: []string{"g-devs"}}},
+		},
+		{
+			// A disabled policy hands out nothing.
+			ID: "disabled-policy", Enabled: false, SourcePostureChecks: []string{certCheck},
+			Rules: []*types.PolicyRule{{Enabled: true, Sources: []string{"g-servers"}}},
+		},
+		{
+			// A disabled rule inside an enabled policy likewise.
+			ID: "disabled-rule", Enabled: true, SourcePostureChecks: []string{certCheck},
+			Rules: []*types.PolicyRule{{Enabled: false, Sources: []string{"g-servers"}}},
+		},
+		{
+			// Gated on something other than a certificate: no nonce to renew.
+			ID: "other-check", Enabled: true, SourcePostureChecks: []string{osCheck},
+			Rules: []*types.PolicyRule{{Enabled: true, Sources: []string{"g-mixed"}}},
+		},
+		{
+			// A peer named directly rather than through a group.
+			ID: "by-resource", Enabled: true, SourcePostureChecks: []string{osCheck, certCheck},
+			Rules: []*types.PolicyRule{{
+				Enabled:        true,
+				SourceResource: types.Resource{Type: types.ResourceTypePeer, ID: "p4"},
+			}},
+		},
+		{
+			// Destinations are never filtered, so being one earns no challenge.
+			ID: "as-destination", Enabled: true, SourcePostureChecks: []string{certCheck},
+			Rules: []*types.PolicyRule{{Enabled: true, Sources: []string{"g-empty"}, Destinations: []string{"g-servers"}}},
+		},
+	}
+
+	got := certificateChallengeTargets(policies, groupPeers, certCheckIDs)
+
+	// The same question, asked one peer at a time the way the gRPC layer asks it.
+	var want []string
+	for peerID, groupIDs := range peerGroups {
+		for _, policy := range policies {
+			if !policy.Enabled {
+				continue
+			}
+			ids := processPeerPostureChecks(policy, peerID, groupIDs)
+			if slices.ContainsFunc(ids, func(id string) bool { _, ok := certCheckIDs[id]; return ok }) {
+				want = append(want, peerID)
+				break
+			}
+		}
+	}
+
+	slices.Sort(got)
+	slices.Sort(want)
+	assert.Equal(t, want, got, "the peers the refresher renews must be exactly the peers that are sent a challenge")
+	assert.Equal(t, []string{"p1", "p2", "p4"}, got, "p3 is only reachable through disabled rules, p5 is in no source group")
+}
+
+func TestCertChallengeRefresher_StopsWithItsContext(t *testing.T) {
+	// BuildManager hands the loop the manager's context. A refresher that detached from
+	// it could never be stopped: it would keep sweeping after the server it belongs to
+	// is gone, and leak a goroutine per manager a test builds.
+	var mu sync.Mutex
+	var calls int
+
+	r := newCertChallengeRefresher(func(_ context.Context, _ string, _ []string) bool {
+		mu.Lock()
+		defer mu.Unlock()
+		calls++
+		return true
+	})
+	r.period = time.Millisecond
+	r.tick = time.Millisecond
+
+	ctx, cancel := context.WithCancel(context.Background())
+	r.Start(ctx)
+	track(r, "account-a")
+
+	require.Eventually(t, func() bool {
+		mu.Lock()
+		defer mu.Unlock()
+		return calls > 0
+	}, 3*time.Second, time.Millisecond, "the refresher never ran")
+
+	cancel()
+	time.Sleep(20 * r.tick)
+	mu.Lock()
+	afterCancel := calls
+	mu.Unlock()
+
+	time.Sleep(20 * r.tick)
+	mu.Lock()
+	defer mu.Unlock()
+	assert.Equal(t, afterCancel, calls, "the refresher kept sweeping after its context was cancelled")
+}
+
+func TestCertChallengeRefresh_StaysWithinTheSweep(t *testing.T) {
+	assert.Equal(t, maxCertChallengeRefresh, certChallengeRefresh(time.Hour),
+		"a long tick must not grant a store read minutes")
+	assert.Equal(t, time.Second, certChallengeRefresh(time.Second),
+		"a short tick must bound the refresh to itself, so the sweep keeps its cadence")
+}
+
+func TestCertChallengeRefresher_AbandonsAWedgedAccount(t *testing.T) {
+	// Accounts are swept one after another and resolving the targets reads the store, so
+	// an account whose read never returns would hold up every other account on the
+	// instance for as long as the process lives.
+	entered := make(chan struct{}, 1)
+	refreshed := make(chan string, 4)
+
+	r := newCertChallengeRefresher(func(ctx context.Context, accountID string, _ []string) bool {
+		if accountID == "account-wedged" {
+			select {
+			case entered <- struct{}{}:
+			default:
+			}
+			<-ctx.Done()
+			return true
+		}
+		select {
+		case refreshed <- accountID:
+		default:
+		}
+		return true
+	})
+	r.period = 10 * time.Millisecond
+	r.tick = time.Millisecond
+	r.timeout = 20 * time.Millisecond
+	r.Start(t.Context())
+
+	track(r, "account-wedged")
+	select {
+	case <-entered:
+	case <-time.After(3 * time.Second):
+		t.Fatal("the wedged account was never refreshed")
+	}
+
+	// Tracked only once the sweep is already stuck, so reaching it proves the deadline
+	// released the loop rather than the map happening to hand this one out first.
+	track(r, "account-healthy")
+	select {
+	case got := <-refreshed:
+		assert.Equal(t, "account-healthy", got)
+	case <-time.After(3 * time.Second):
+		t.Fatal("a healthy account was never refreshed from behind a wedged one")
+	}
+}
+
+// TestCertChallengeRefresher_KeepsAnAccountTrackedDuringItsRefresh: a refresh reads the
+// store before an admin adds a certificate check; the push that follows the change
+// tracks the account again. The refresh then reports the account as not wanting
+// challenges, which is stale, and must not untrack it.
+func TestCertChallengeRefresher_KeepsAnAccountTrackedDuringItsRefresh(t *testing.T) {
+	r, clock := scheduleRefresher(func(string) bool { return false })
+	track(r, "account-a")
+	clock.Advance(r.period)
+	require.Equal(t, []string{"account-a"}, dueAccounts(r), "the account is due")
+
+	track(r, "account-a")
+	r.finish("account-a", false)
+	assert.True(t, r.tracked("account-a"), "an account tracked again during its refresh stays tracked")
+
+	clock.Advance(r.period)
+	require.Equal(t, []string{"account-a"}, dueAccounts(r), "the account is due again")
+	r.finish("account-a", false)
+	assert.False(t, r.tracked("account-a"), "an account nobody tracked again is dropped once it no longer wants challenges")
+}
+
+// TestCertChallengeRefresher_RenewsOnlyThePeersStreamedHere: every instance runs its
+// own refresher, and a push fans out to all of them, so an instance must hand out only
+// the peers whose sync stream it holds. Otherwise each peer is pushed once per instance.
+func TestCertChallengeRefresher_RenewsOnlyThePeersStreamedHere(t *testing.T) {
+	r, clock := scheduleRefresher(func(string) bool { return true })
+	r.Track(context.Background(), "account-a", "peer-1", streamStart)
+	r.Track(context.Background(), "account-a", "peer-2", streamStart)
+	clock.Advance(r.period)
+
+	due := r.takeDue()
+	require.Len(t, due, 1, "the account is due")
+	assert.ElementsMatch(t, []string{"peer-1", "peer-2"}, due[0].peerIDs, "only the peers tracked here are renewed")
+}
+
+// TestCertChallengeRefresher_DropsAnAccountWithItsLastPeer: an instance whose peers of an
+// account have all disconnected has nobody left to renew, and must not keep sweeping it.
+func TestCertChallengeRefresher_DropsAnAccountWithItsLastPeer(t *testing.T) {
+	r, _ := scheduleRefresher(func(string) bool { return true })
+	r.Track(context.Background(), "account-a", "peer-1", streamStart)
+	r.Track(context.Background(), "account-a", "peer-2", streamStart)
+
+	r.Untrack("account-a", "peer-1", streamStart)
+	assert.True(t, r.tracked("account-a"), "the account stays tracked while a peer is still streamed here")
+
+	r.Untrack("account-a", "peer-2", streamStart)
+	assert.False(t, r.tracked("account-a"), "the account is dropped with its last peer")
+}
+
+// TestCertChallengeRefresher_StaleStreamKeepsTheNewerOne: a peer that reconnects to the
+// same instance opens its new stream before the old one is torn down. The old stream's
+// teardown must not untrack the peer the new stream is renewing.
+func TestCertChallengeRefresher_StaleStreamKeepsTheNewerOne(t *testing.T) {
+	r, _ := scheduleRefresher(func(string) bool { return true })
+	newer := streamStart.Add(time.Minute)
+	r.Track(context.Background(), "account-a", "peer-1", streamStart)
+	r.Track(context.Background(), "account-a", "peer-1", newer)
+
+	r.Untrack("account-a", "peer-1", streamStart)
+	assert.True(t, r.tracked("account-a"), "the stale stream's teardown must leave the newer stream tracked")
+
+	r.Untrack("account-a", "peer-1", newer)
+	assert.False(t, r.tracked("account-a"), "the newer stream's teardown untracks the peer")
+}
+
+// TestCertChallengeRefresher_LateStampFromAStaleStream: the old stream of a reconnected
+// peer can still deliver a stamped update after the new stream started. Its Track must
+// not take the peer over, or the old stream's teardown would untrack the live one.
+func TestCertChallengeRefresher_LateStampFromAStaleStream(t *testing.T) {
+	r, _ := scheduleRefresher(func(string) bool { return true })
+	newer := streamStart.Add(time.Minute)
+	r.Track(context.Background(), "account-a", "peer-1", newer)
+
+	r.Track(context.Background(), "account-a", "peer-1", streamStart)
+	r.Untrack("account-a", "peer-1", streamStart)
+	assert.True(t, r.tracked("account-a"), "a late stamp from the stale stream must leave the newer stream tracked")
+}
diff --git a/management/server/mock_server/account_mock.go b/management/server/mock_server/account_mock.go
index 3313bf99c..079e60548 100644
--- a/management/server/mock_server/account_mock.go
+++ b/management/server/mock_server/account_mock.go
@@ -133,6 +133,7 @@ type MockAccountManager struct {
 	GetOrCreateAccountByPrivateDomainFunc func(ctx context.Context, initiatorId, domain string) (*types.Account, bool, error)
 
 	AllowSyncFunc                  func(string, uint64) bool
+	TrackCertificateChallengesFunc func(ctx context.Context, accountID, peerID string, streamStart time.Time)
 	UpdateAccountPeersFunc         func(ctx context.Context, accountID string, reason types.UpdateReason)
 	ExpandAndUpdateAffectedFunc    func(ctx context.Context, accountID string, snap *affectedpeers.Snapshot, change affectedpeers.Change)
 	BufferUpdateAccountPeersFunc   func(ctx context.Context, accountID string, reason types.UpdateReason)
@@ -206,6 +207,16 @@ func (am *MockAccountManager) UpdateGroups(ctx context.Context, accountID, userI
 	return status.Errorf(codes.Unimplemented, "method UpdateGroups is not implemented")
 }
 
+// TrackCertificateChallenges mocks TrackCertificateChallenges of the account manager.
+func (am *MockAccountManager) TrackCertificateChallenges(ctx context.Context, accountID, peerID string, streamStart time.Time) {
+	if am.TrackCertificateChallengesFunc != nil {
+		am.TrackCertificateChallengesFunc(ctx, accountID, peerID, streamStart)
+	}
+}
+
+// UntrackCertificateChallenges mocks UntrackCertificateChallenges of the account manager.
+func (am *MockAccountManager) UntrackCertificateChallenges(string, string, time.Time) {}
+
 func (am *MockAccountManager) UpdateAccountPeers(ctx context.Context, accountID string, reason types.UpdateReason) {
 	if am.UpdateAccountPeersFunc != nil {
 		am.UpdateAccountPeersFunc(ctx, accountID, reason)
diff --git a/management/server/store/sql_store_peer_test.go b/management/server/store/sql_store_peer_test.go
index 1432b5d96..41dc9edcb 100644
--- a/management/server/store/sql_store_peer_test.go
+++ b/management/server/store/sql_store_peer_test.go
@@ -54,7 +54,7 @@ func TestSqlStore_SavePeer(t *testing.T) {
 
 		numOfFields, err := populateFields.PopulateAll(reflectedMetadata)
 		assert.NoError(t, err)
-		assert.Equal(t, 33, numOfFields)
+		assert.Equal(t, 34, numOfFields)
 
 		// save status of non-existing peer
 		peer := &nbpeer.Peer{
diff --git a/management/server/types/update_reason.go b/management/server/types/update_reason.go
index 9d752da9a..e829a1b2a 100644
--- a/management/server/types/update_reason.go
+++ b/management/server/types/update_reason.go
@@ -34,4 +34,7 @@ const (
 	UpdateOperationCreate UpdateOperation = "create"
 	UpdateOperationUpdate UpdateOperation = "update"
 	UpdateOperationDelete UpdateOperation = "delete"
+	// UpdateOperationRefresh is a periodic push that carries no change of its own, so
+	// it stays out of the counters that track what an administrator actually edited.
+	UpdateOperationRefresh UpdateOperation = "refresh"
 )
diff --git a/release_files/netbird.sysconfig b/release_files/netbird.sysconfig
index a515a9ab7..655e746a7 100644
--- a/release_files/netbird.sysconfig
+++ b/release_files/netbird.sysconfig
@@ -12,3 +12,8 @@
 #
 # Peer name shown in the dashboard (defaults to the system hostname):
 #NB_HOSTNAME=
+#
+# Certificate posture checks:
+#NB_CERT_STORE_DIR=/etc/netbird/certs
+#NB_CERT_PKCS11_URI=pkcs11:token=netbird?module-path=/usr/lib64/pkcs11/libtpm2_pkcs11.so
+#NB_TPM_PIN=
diff --git a/release_files/post_install.sh b/release_files/post_install.sh
index 12b272698..c763b7447 100644
--- a/release_files/post_install.sh
+++ b/release_files/post_install.sh
@@ -9,8 +9,18 @@ else
     systemd_version=$(systemctl --version | head -1 | sed 's/systemd //g')
 fi
 
+# The service environment file may hold the PKCS#11 token PIN (NB_TPM_PIN). Package
+# upgrades keep a locally modified copy with its old mode, so restrict it on every run.
+restrict_env_file() {
+    if [ -f /etc/sysconfig/netbird ]; then
+      chmod 0600 /etc/sysconfig/netbird
+    fi
+    return 0
+}
+
 cleanInstall() {
     printf "\033[32m Post Install of an clean install\033[0m\n"
+    restrict_env_file
     # Step 3 (clean install), enable the service in the proper way for this platform
     /usr/bin/netbird service install
     /usr/bin/netbird service start
@@ -18,6 +28,7 @@ cleanInstall() {
 
 upgrade() {
     printf "\033[32m Post Install of an upgrade\033[0m\n"
+    restrict_env_file
     if [ "${use_systemctl}" = "True" ]; then
       printf "\033[32m Stopping the service\033[0m\n"
       systemctl stop netbird 2> /dev/null || true
diff --git a/shared/management/certposture/certposture_test.go b/shared/management/certposture/certposture_test.go
index 7073332ff..dbe651cb1 100644
--- a/shared/management/certposture/certposture_test.go
+++ b/shared/management/certposture/certposture_test.go
@@ -58,6 +58,27 @@ func TestChallenger_VerifyNonce(t *testing.T) {
 	}
 }
 
+// TestNonceAcceptedAlongside must agree with verifyNonce: a proof for a nonce is still
+// accepted while the next window's nonce is issued, and no longer two windows on.
+func TestNonceAcceptedAlongside(t *testing.T) {
+	c := NewChallenger(secret)
+	issued := c.Nonce(peerKey, now)
+
+	assert.True(t, NonceAcceptedAlongside(issued, issued), "the current nonce is accepted")
+	assert.True(t, NonceAcceptedAlongside(issued, c.Nonce(peerKey, now.Add(Window))), "a proof from the previous window is accepted")
+	assert.False(t, NonceAcceptedAlongside(issued, c.Nonce(peerKey, now.Add(2*Window))), "a proof two windows old is not")
+	assert.False(t, NonceAcceptedAlongside(c.Nonce(peerKey, now.Add(Window)), issued), "a nonce from a later window is not")
+	assert.False(t, NonceAcceptedAlongside([]byte("short"), issued), "a malformed nonce is not")
+
+	for _, tt := range []struct {
+		later time.Duration
+		want  bool
+	}{{0, true}, {Window, true}, {2 * Window, false}} {
+		err := c.verifyNonce(issued, peerKey, now.Add(tt.later))
+		assert.Equal(t, tt.want, err == nil, "verifyNonce agrees %s later", tt.later)
+	}
+}
+
 func TestSignVerify_RoundTripPerKeyType(t *testing.T) {
 	ca := certtest.NewCA(t, "root")
 	keys := map[string]crypto.Signer{
diff --git a/shared/management/certposture/chain.go b/shared/management/certposture/chain.go
index d0e4bc27d..80fb46b4b 100644
--- a/shared/management/certposture/chain.go
+++ b/shared/management/certposture/chain.go
@@ -28,17 +28,32 @@ func VerifyChain(chain []*x509.Certificate, roots *x509.CertPool, now time.Time)
 	if len(chain) == 0 {
 		return ErrEmptyChain
 	}
-	intermediates := x509.NewCertPool()
-	for _, cert := range chain[1:] {
-		intermediates.AddCert(cert)
+	_, err := VerifiedChain(chain[0], chain[1:], roots, now)
+	return err
+}
+
+// VerifiedChain finds a path from leaf to one of roots through any of intermediates,
+// trying every candidate issuer rather than the first that matches, and returns it
+// without the root, leaf first. It applies the same rules as VerifyChain.
+func VerifiedChain(leaf *x509.Certificate, intermediates []*x509.Certificate, roots *x509.CertPool, now time.Time) ([]*x509.Certificate, error) {
+	pool := x509.NewCertPool()
+	for _, cert := range intermediates {
+		pool.AddCert(cert)
 	}
-	_, err := chain[0].Verify(x509.VerifyOptions{
+	chains, err := leaf.Verify(x509.VerifyOptions{
 		Roots:         roots,
-		Intermediates: intermediates,
+		Intermediates: pool,
 		CurrentTime:   now,
 		KeyUsages:     []x509.ExtKeyUsage{x509.ExtKeyUsageAny},
 	})
-	return err
+	if err != nil {
+		return nil, err
+	}
+	chain := chains[0]
+	if len(chain) > 1 {
+		chain = chain[:len(chain)-1]
+	}
+	return chain, nil
 }
 
 // ChainMatchesCAs is VerifyChain over the PEM forms stored in peer meta and check config.
diff --git a/shared/management/certposture/challenge.go b/shared/management/certposture/challenge.go
index 584d2f30e..274230672 100644
--- a/shared/management/certposture/challenge.go
+++ b/shared/management/certposture/challenge.go
@@ -5,17 +5,66 @@ import (
 	"crypto/sha256"
 	"encoding/binary"
 	"errors"
+	"os"
+	"sync"
 	"time"
+
+	log "github.com/sirupsen/logrus"
 )
 
 const (
+	// Window is the default challenge window. A nonce is accepted for its own window
+	// and the one before it, so a peer re-proves possession of its key between once
+	// and twice per window.
 	Window = 12 * time.Hour
 
+	// EnvWindow overrides Window, for end-to-end tests that cannot wait half a day to
+	// watch a renewal. Every management instance has to be given the same value: the
+	// window is part of the nonce, so instances that disagree reject each other's.
+	EnvWindow = "NB_CERT_CHALLENGE_WINDOW"
+
+	minWindow = time.Second
+	maxWindow = 24 * time.Hour
+
 	challengeDomain = "netbird-cert-challenge-v1"
 	windowLen       = 8
 	nonceLen        = windowLen + sha256.Size
+
+	// NonceSize is the length of every nonce a Challenger issues.
+	NonceSize = nonceLen
 )
 
+var effectiveWindow = sync.OnceValue(resolveWindow)
+
+// EffectiveWindow returns the challenge window in force, which is Window unless
+// EnvWindow overrides it. Everything timed against the window derives from this, so a
+// test that shortens it shortens the renewal that goes with it.
+func EffectiveWindow() time.Duration {
+	return effectiveWindow()
+}
+
+func resolveWindow() time.Duration {
+	val := os.Getenv(EnvWindow)
+	if val == "" {
+		return Window
+	}
+
+	window, err := time.ParseDuration(val)
+	if err != nil {
+		log.Warnf("failed to parse %s, keeping the %s certificate challenge window: %v", EnvWindow, Window, err)
+		return Window
+	}
+	if window < minWindow || window > maxWindow {
+		log.Warnf("%s of %s is outside %s..%s, keeping the %s certificate challenge window", EnvWindow, window, minWindow, maxWindow, Window)
+		return Window
+	}
+
+	// Loud on purpose: this sets how long a device can pass the certificate check after
+	// its key has gone, and it has to match on every instance.
+	log.Warnf("certificate challenge window overridden to %s by %s", window, EnvWindow)
+	return window
+}
+
 var (
 	ErrNonceMalformed = errors.New("certificate challenge nonce is malformed")
 	ErrNonceExpired   = errors.New("certificate challenge nonce is expired")
@@ -30,7 +79,7 @@ type Challenger struct {
 }
 
 func NewChallenger(secret []byte) *Challenger {
-	return &Challenger{secret: secret, window: Window}
+	return &Challenger{secret: secret, window: EffectiveWindow()}
 }
 
 func (c *Challenger) Nonce(peerKey []byte, now time.Time) []byte {
@@ -66,3 +115,15 @@ func (c *Challenger) nonceForWindow(peerKey []byte, window uint64) []byte {
 	mac.Write(nonce[:windowLen])
 	return mac.Sum(nonce)
 }
+
+// NonceAcceptedAlongside reports whether a proof answering nonce is still accepted while
+// management issues current to the same peer: verification takes a nonce of the current
+// or the previous window.
+func NonceAcceptedAlongside(nonce, current []byte) bool {
+	if len(nonce) != nonceLen || len(current) != nonceLen {
+		return false
+	}
+	window := binary.BigEndian.Uint64(nonce[:windowLen])
+	currentWindow := binary.BigEndian.Uint64(current[:windowLen])
+	return window == currentWindow || window+1 == currentWindow
+}
diff --git a/shared/management/certposture/challenge_test.go b/shared/management/certposture/challenge_test.go
new file mode 100644
index 000000000..bdb212f66
--- /dev/null
+++ b/shared/management/certposture/challenge_test.go
@@ -0,0 +1,106 @@
+package certposture
+
+import (
+	"os"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestResolveWindow(t *testing.T) {
+	// An end-to-end run shortens the window so a renewal can be watched in seconds
+	// rather than half a day. Anything it cannot make sense of leaves the default in
+	// place, because a window nobody intended is a security property nobody chose.
+	tests := []struct {
+		name string
+		env  string
+		want time.Duration
+	}{
+		{name: "unset keeps the default", env: "", want: Window},
+		{name: "a test-sized window is taken", env: "30s", want: 30 * time.Second},
+		{name: "garbage keeps the default", env: "soon", want: Window},
+		{name: "below the floor keeps the default", env: "10ms", want: Window},
+		{name: "above the ceiling keeps the default", env: "100h", want: Window},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Setenv(EnvWindow, tt.env)
+			if tt.env == "" {
+				require.NoError(t, os.Unsetenv(EnvWindow))
+			}
+			assert.Equal(t, tt.want, resolveWindow())
+		})
+	}
+}
+
+func TestChallenger_HonoursAShortenedWindow(t *testing.T) {
+	// The window is what a nonce is stamped with, so a shortened one has to make a
+	// nonce expire sooner, not just change a number in a log line.
+	short := 2 * time.Second
+	c := &Challenger{secret: []byte("secret"), window: short}
+	peerKey := []byte("peer-key")
+
+	issued := time.Unix(1_790_000_000, 0)
+	nonce := c.Nonce(peerKey, issued)
+
+	require.NoError(t, c.verifyNonce(nonce, peerKey, issued), "a nonce is valid when issued")
+	require.NoError(t, c.verifyNonce(nonce, peerKey, issued.Add(short)), "and through the window after it")
+	assert.ErrorIs(t, c.verifyNonce(nonce, peerKey, issued.Add(3*short)), ErrNonceExpired,
+		"a shortened window must actually expire the nonce sooner")
+}
+
+// heldNonceAlwaysAccepted walks ten windows and, at every step, checks the nonce the peer
+// would be holding if it were re-stamped every period starting at offset. It returns how
+// many of those checks would have rejected the peer.
+func heldNonceAlwaysAccepted(c *Challenger, peerKey []byte, period, offset time.Duration) int {
+	start := time.Unix(0, 0).UTC().Add(offset)
+	var rejected int
+	for elapsed := time.Duration(0); elapsed < 10*Window; elapsed += 7 * time.Minute {
+		periods := int64(elapsed / period)
+		lastRefresh := start.Add(time.Duration(periods) * period)
+		if c.verifyNonce(c.Nonce(peerKey, lastRefresh), peerKey, start.Add(elapsed)) != nil {
+			rejected++
+		}
+	}
+	return rejected
+}
+
+// TestNonce_StaysValidWhenRestampedWithinAWindow is the reason management keeps no per-peer
+// nonce state. A nonce carries the window it was minted in, not the instant, and is accepted
+// for that window and the next. A peer re-stamped at least once per window therefore can
+// never be holding one that has fallen outside the accepted pair, whoever it is and whenever
+// it was last served. There is nothing to track and nothing to search for: the guarantee
+// comes from the cadence alone.
+//
+// The offsets matter: each account is given a phase of its own so a restart does not fan out
+// to every account at once, so the property has to hold off the window boundary too.
+func TestNonce_StaysValidWhenRestampedWithinAWindow(t *testing.T) {
+	c := &Challenger{secret: []byte("secret"), window: Window}
+	peerKey := []byte("peer-key")
+
+	for _, period := range []time.Duration{Window / 3, Window / 2, Window} {
+		for _, offset := range []time.Duration{0, Window / 7, Window / 2, Window - time.Minute} {
+			t.Run(period.String()+"+"+offset.String(), func(t *testing.T) {
+				assert.Zero(t, heldNonceAlwaysAccepted(c, peerKey, period, offset),
+					"a peer re-stamped every %v is never left holding an expired nonce", period)
+			})
+		}
+	}
+}
+
+func TestNonce_ExpiresWhenRestampedTooSlowly(t *testing.T) {
+	// The counterpart, which is what gives the test above its teeth. Note the aligned case
+	// does not fail: a cadence of exactly two windows that lands on the boundaries is
+	// covered by the grace window. Off the boundary it is not, and real refreshes are off
+	// the boundary by design.
+	c := &Challenger{secret: []byte("secret"), window: Window}
+	peerKey := []byte("peer-key")
+
+	assert.Zero(t, heldNonceAlwaysAccepted(c, peerKey, 2*Window, 0),
+		"two windows exactly on the boundary happens to be covered by the grace window")
+	assert.NotZero(t, heldNonceAlwaysAccepted(c, peerKey, 2*Window, Window/2),
+		"the same cadence off the boundary must leave the peer rejected for a stretch")
+}
diff --git a/shared/management/client/grpc.go b/shared/management/client/grpc.go
index aaa80f447..c007020f5 100644
--- a/shared/management/client/grpc.go
+++ b/shared/management/client/grpc.go
@@ -1028,7 +1028,7 @@ func infoToMetaData(info *system.Info) *proto.PeerSystemMeta {
 		})
 	}
 	if len(proofs) > 0 {
-		log.Infof("peer meta carries %d certificate posture proofs", len(proofs))
+		log.Debugf("peer meta carries %d certificate posture proofs", len(proofs))
 	}
 
 	return &proto.PeerSystemMeta{

From 008cf4751250ff0fb86d403d362617a4ecaa5c20 Mon Sep 17 00:00:00 2001
From: Riccardo Manfrin <3090891+riccardomanfrin@users.noreply.github.com>
Date: Fri, 9 Oct 2026 16:39:15 +0200
Subject: [PATCH 35/70] [client, management] Recover from stuck proof
 collections and keep re-tracked accounts on the challenge refresher (#7890)

Co-authored-by: Viktor Liu <viktor@netbird.io>
---
 client/internal/certproof/collector.go        | 150 +++++++++++++++---
 client/internal/certproof/collector_test.go   |  97 ++++++++++-
 client/internal/engine_certposture.go         |  30 +++-
 client/internal/engine_certposture_test.go    |  11 ++
 management/server/account.go                  |   5 +-
 management/server/certificate_challenge.go    |   4 +-
 .../certposture/certposture_test.go           |   7 +-
 shared/management/certposture/challenge.go    |  30 ++--
 .../management/certposture/challenge_test.go  |   2 +
 9 files changed, 289 insertions(+), 47 deletions(-)

diff --git a/client/internal/certproof/collector.go b/client/internal/certproof/collector.go
index abba4bf61..2931f4b00 100644
--- a/client/internal/certproof/collector.go
+++ b/client/internal/certproof/collector.go
@@ -2,7 +2,7 @@ package certproof
 
 import (
 	"context"
-	"sync/atomic"
+	"sync"
 	"time"
 
 	log "github.com/sirupsen/logrus"
@@ -11,28 +11,51 @@ import (
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
-const collectTimeout = 45 * time.Second
+const (
+	collectTimeout = 45 * time.Second
 
-// collecting is the single-flight flag Collectors share by default. It outlives the
-// engine, since a collection abandoned in a token, TPM or keychain call keeps running
-// after the engine that started it has stopped, and the next engine must not start
-// another one on top of it.
-var collecting atomic.Bool
+	// lostAfter is how many deadlines an abandoned collection is waited for before a new
+	// one may start beside it. A store that is merely slow finishes well within that and
+	// releases its slot; only one wedged for good is worked around.
+	lostAfter = 10
 
-// Collector runs CollectProofs with a deadline and at most one collection at a time in
-// the process. Token, TPM and keychain calls cannot be interrupted, so a collection that
-// overruns is abandoned rather than awaited, and a new one is refused until it has
-// finished. The zero value is ready to use.
+	// maxInFlight bounds how many abandoned collections may pile up. A store that never
+	// answers would otherwise leak a goroutine on every collection for the life of the
+	// daemon.
+	maxInFlight = 2
+)
+
+// collectSlots tracks the collections running in the process. Collectors share one by
+// default: a collection abandoned in a token, TPM or keychain call keeps running after
+// the engine that started it has stopped, and the next engine must account for it.
+type collectSlots struct {
+	mu   sync.Mutex
+	next uint64
+	// running holds the start time of each collection still running, by slot id.
+	running map[uint64]time.Time
+}
+
+var processSlots collectSlots
+
+// Collector runs CollectProofs with a deadline and, in the normal case, one collection
+// at a time in the process. Token, TPM and keychain calls cannot be interrupted, and on
+// Linux there is not even a process to kill, so a collection that overruns is abandoned
+// rather than awaited. A single wedged call would then refuse every later collection for
+// the life of the daemon, so once an abandoned collection has been running for lostAfter
+// deadlines another may start beside it, up to maxInFlight. The zero value is ready to
+// use.
 type Collector struct {
-	// busy overrides the process-wide single-flight flag when set.
-	busy *atomic.Bool
+	// slots overrides the process-wide slots when set.
+	slots *collectSlots
 	// timeout overrides collectTimeout when set.
 	timeout time.Duration
+	// now overrides the clock when set.
+	now func() time.Time
 }
 
 // Collect answers the certificate challenges in checks, returning no proofs when there
-// are no challenges, when a previous collection is still running, or when this one does
-// not finish in time. Missing proofs fail the certificate check on management.
+// are no challenges, when previous collections still hold the slots, or when this one
+// does not finish in time. Missing proofs fail the certificate check on management.
 func (c *Collector) Collect(ctx context.Context, checks []*proto.Checks, peerKey []byte, cfg Config) []certposture.Proof {
 	return c.collect(ctx, checks, func(ctx context.Context) []certposture.Proof {
 		return CollectProofs(ctx, checks, peerKey, cfg)
@@ -43,9 +66,9 @@ func (c *Collector) collect(ctx context.Context, checks []*proto.Checks, run fun
 	if len(certificateChallenges(checks)) == 0 {
 		return nil
 	}
-	busy := c.flag()
-	if !busy.CompareAndSwap(false, true) {
-		log.Warnf("certificate posture: previous proof collection is still running, sending no proofs")
+	slots := c.slotsInUse()
+	slot, ok := slots.start(c.clock(), time.Duration(lostAfter)*c.deadline())
+	if !ok {
 		return nil
 	}
 
@@ -57,7 +80,7 @@ func (c *Collector) collect(ctx context.Context, checks []*proto.Checks, run fun
 		// The slot is freed before the result is delivered, so a caller that starts the
 		// next collection right after this one returned is not turned away.
 		proofs := run(ctx)
-		busy.Store(false)
+		slots.finish(slot)
 		done <- proofs
 	}()
 
@@ -70,11 +93,24 @@ func (c *Collector) collect(ctx context.Context, checks []*proto.Checks, run fun
 	}
 }
 
-func (c *Collector) flag() *atomic.Bool {
-	if c.busy != nil {
-		return c.busy
+// Stuck reports whether lost collections hold every slot. No collection starts again
+// until one of them returns, which for a store that never answers means a restart.
+func (c *Collector) Stuck() bool {
+	return c.slotsInUse().allLost(c.clock(), time.Duration(lostAfter)*c.deadline())
+}
+
+func (c *Collector) slotsInUse() *collectSlots {
+	if c.slots != nil {
+		return c.slots
 	}
-	return &collecting
+	return &processSlots
+}
+
+func (c *Collector) clock() time.Time {
+	if c.now != nil {
+		return c.now()
+	}
+	return time.Now()
 }
 
 func (c *Collector) deadline() time.Duration {
@@ -83,3 +119,71 @@ func (c *Collector) deadline() time.Duration {
 	}
 	return collectTimeout
 }
+
+// start claims a slot at now, reporting its id and whether the caller may collect. A
+// collection that has held a slot for lost is taken to be wedged.
+func (s *collectSlots) start(now time.Time, lost time.Duration) (uint64, bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if len(s.running) > 0 {
+		oldest := s.oldest()
+		switch {
+		case len(s.running) >= maxInFlight:
+			log.Warnf("certificate posture: %d proof collections are wedged, sending no proofs", len(s.running))
+			return 0, false
+		case now.Sub(oldest) < lost:
+			log.Warnf("certificate posture: previous proof collection is still running, sending no proofs")
+			return 0, false
+		default:
+			log.Warnf("certificate posture: a proof collection has been stuck since %s, starting another", oldest.Format(time.RFC3339))
+		}
+	}
+	if s.running == nil {
+		s.running = make(map[uint64]time.Time, maxInFlight)
+	}
+	s.next++
+	s.running[s.next] = now
+	return s.next, true
+}
+
+// finish releases the slot with the given id.
+func (s *collectSlots) finish(slot uint64) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	delete(s.running, slot)
+}
+
+// allLost reports whether every slot is held by a collection that has run for lost.
+func (s *collectSlots) allLost(now time.Time, lost time.Duration) bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if len(s.running) < maxInFlight {
+		return false
+	}
+	for _, started := range s.running {
+		if now.Sub(started) < lost {
+			return false
+		}
+	}
+	return true
+}
+
+// idle reports whether no collection is running.
+func (s *collectSlots) idle() bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return len(s.running) == 0
+}
+
+// oldest returns the start time of the longest-running collection. The caller holds mu
+// and has checked that one is running.
+func (s *collectSlots) oldest() time.Time {
+	var oldest time.Time
+	for _, started := range s.running {
+		if oldest.IsZero() || started.Before(oldest) {
+			oldest = started
+		}
+	}
+	return oldest
+}
diff --git a/client/internal/certproof/collector_test.go b/client/internal/certproof/collector_test.go
index d5108eb22..a28c47da2 100644
--- a/client/internal/certproof/collector_test.go
+++ b/client/internal/certproof/collector_test.go
@@ -40,7 +40,7 @@ func TestCollector_ReturnsProofs(t *testing.T) {
 }
 
 func TestCollector_AbandonsStuckCollection(t *testing.T) {
-	c := Collector{timeout: 50 * time.Millisecond, busy: new(atomic.Bool)}
+	c := Collector{timeout: 50 * time.Millisecond, slots: &collectSlots{}}
 	release := make(chan struct{})
 	finished := make(chan struct{})
 
@@ -66,7 +66,7 @@ func TestCollector_AbandonsStuckCollection(t *testing.T) {
 
 	close(release)
 	<-finished
-	require.Eventually(t, func() bool { return !c.busy.Load() }, time.Second, 5*time.Millisecond, "the collector frees up once the stuck call returns")
+	require.Eventually(t, func() bool { return c.slots.idle() }, time.Second, 5*time.Millisecond, "the collector frees up once the stuck call returns")
 
 	want := []certposture.Proof{{Nonce: []byte("nonce")}}
 	assert.Equal(t, want, c.collect(context.Background(), challengeChecks, func(context.Context) []certposture.Proof { return want }),
@@ -74,7 +74,7 @@ func TestCollector_AbandonsStuckCollection(t *testing.T) {
 }
 
 func TestCollector_CancelsContextAtDeadline(t *testing.T) {
-	c := Collector{timeout: 20 * time.Millisecond, busy: new(atomic.Bool)}
+	c := Collector{timeout: 20 * time.Millisecond, slots: &collectSlots{}}
 	cancelled := make(chan struct{})
 
 	c.collect(context.Background(), challengeChecks, func(ctx context.Context) []certposture.Proof {
@@ -94,9 +94,9 @@ func TestCollector_CancelsContextAtDeadline(t *testing.T) {
 // collection stuck in a token call outlives the engine that started it, so the next
 // engine's Collector must not start another one until it has finished.
 func TestCollector_SingleFlightAcrossCollectors(t *testing.T) {
-	shared := new(atomic.Bool)
-	first := Collector{timeout: 20 * time.Millisecond, busy: shared}
-	second := Collector{timeout: time.Second, busy: shared}
+	shared := &collectSlots{}
+	first := Collector{timeout: 20 * time.Millisecond, slots: shared}
+	second := Collector{timeout: time.Second, slots: shared}
 
 	release := make(chan struct{})
 	stuck := func(context.Context) []certposture.Proof {
@@ -114,7 +114,7 @@ func TestCollector_SingleFlightAcrossCollectors(t *testing.T) {
 	assert.False(t, called, "a second collection does not start on top of the abandoned one")
 
 	close(release)
-	require.Eventually(t, func() bool { return !shared.Load() }, time.Second, 5*time.Millisecond)
+	require.Eventually(t, func() bool { return shared.idle() }, time.Second, 5*time.Millisecond)
 	assert.Len(t, second.collect(context.Background(), challengeChecks, func(context.Context) []certposture.Proof { return []certposture.Proof{{}} }), 1,
 		"collections resume once the abandoned one finished")
 }
@@ -122,5 +122,86 @@ func TestCollector_SingleFlightAcrossCollectors(t *testing.T) {
 // TestCollector_ZeroValuesShareTheProcessFlag: the zero value uses the process-wide flag.
 func TestCollector_ZeroValuesShareTheProcessFlag(t *testing.T) {
 	var a, b Collector
-	assert.Same(t, a.flag(), b.flag(), "separate Collectors share one single-flight flag")
+	assert.Same(t, a.slotsInUse(), b.slotsInUse(), "separate Collectors share the process slots")
+}
+
+// TestCollector_LostCollectionDoesNotBlockForever: a store call that never answers, such
+// as a wedged token on Linux where there is no process to kill, must not refuse every
+// later collection. Once it has run for lostAfter deadlines another starts beside it,
+// and no more than maxInFlight ever run.
+func TestCollector_LostCollectionDoesNotBlockForever(t *testing.T) {
+	now := time.Now()
+	slots := &collectSlots{}
+	c := Collector{timeout: 10 * time.Millisecond, slots: slots, now: func() time.Time { return now }}
+
+	release := make(chan struct{})
+	defer close(release)
+	var started atomic.Int32
+	wedged := func(context.Context) []certposture.Proof {
+		started.Add(1)
+		<-release
+		return nil
+	}
+
+	c.collect(context.Background(), challengeChecks, wedged)
+	waitStarted(t, &started, 1)
+	c.collect(context.Background(), challengeChecks, wedged)
+	assert.Equal(t, int32(1), started.Load(), "a second collection is refused while the first may still finish")
+	assert.False(t, c.Stuck(), "one slow collection is not stuck yet")
+
+	now = now.Add(time.Duration(lostAfter) * c.deadline())
+	c.collect(context.Background(), challengeChecks, wedged)
+	waitStarted(t, &started, 2)
+	assert.False(t, c.Stuck(), "the second collection may still return, so the collector is not stuck yet")
+
+	now = now.Add(time.Duration(lostAfter) * c.deadline())
+	c.collect(context.Background(), challengeChecks, wedged)
+	assert.Equal(t, int32(2), started.Load(), "no more than maxInFlight collections run")
+	assert.True(t, c.Stuck(), "with every slot held by a lost collection the collector reports itself stuck")
+}
+
+// TestCollector_LostWindowFollowsTheOldestRunningCollection: A wedges, B starts beside it
+// once A counts as lost, then A returns. B is recent, so a third collection must wait for
+// B to be lost in its own right rather than inherit A's start time.
+func TestCollector_LostWindowFollowsTheOldestRunningCollection(t *testing.T) {
+	now := time.Now()
+	slots := &collectSlots{}
+	c := Collector{timeout: 10 * time.Millisecond, slots: slots, now: func() time.Time { return now }}
+	lost := time.Duration(lostAfter) * c.deadline()
+
+	releaseA := make(chan struct{})
+	releaseB := make(chan struct{})
+	defer close(releaseB)
+	var started atomic.Int32
+	blockOn := func(release chan struct{}) func(context.Context) []certposture.Proof {
+		return func(context.Context) []certposture.Proof {
+			started.Add(1)
+			<-release
+			return nil
+		}
+	}
+
+	c.collect(context.Background(), challengeChecks, blockOn(releaseA))
+	waitStarted(t, &started, 1)
+	now = now.Add(lost)
+	c.collect(context.Background(), challengeChecks, blockOn(releaseB))
+	waitStarted(t, &started, 2)
+
+	close(releaseA)
+	require.Eventually(t, func() bool {
+		slots.mu.Lock()
+		defer slots.mu.Unlock()
+		return len(slots.running) == 1
+	}, time.Second, 5*time.Millisecond, "A frees its slot once it returns")
+
+	c.collect(context.Background(), challengeChecks, blockOn(make(chan struct{})))
+	assert.Equal(t, int32(2), started.Load(), "a third collection waits while B is recent")
+}
+
+// waitStarted waits for the collections the test launched to have started. collect may
+// return at its deadline before the goroutine running the store call was scheduled.
+func waitStarted(t *testing.T, started *atomic.Int32, n int32) {
+	t.Helper()
+	require.Eventually(t, func() bool { return started.Load() == n }, time.Second, time.Millisecond,
+		"%d collections should have started", n)
 }
diff --git a/client/internal/engine_certposture.go b/client/internal/engine_certposture.go
index e3965e07b..5aacb72d1 100644
--- a/client/internal/engine_certposture.go
+++ b/client/internal/engine_certposture.go
@@ -57,6 +57,9 @@ type certPostureState struct {
 	hasDelivery bool
 	cached      []certposture.Proof
 	cachedFor   string
+	// stuck is whether the collector was last seen with every slot held by a lost
+	// collection.
+	stuck bool
 }
 
 // record stores the outcome of a collection for the challenges identified by
@@ -123,8 +126,17 @@ func (s *certPostureState) needsCollection(challengesKey, userContext string, no
 	}
 }
 
+// setStuck records whether the collector is stuck and reports whether it just became so.
+func (s *certPostureState) setStuck(stuck bool) bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	became := stuck && !s.stuck
+	s.stuck = stuck
+	return became
+}
+
 // cachedProofs returns the cached proofs management still accepts for the challenges in
-// checks: those whose nonce is current, or from the window before, for one of them. Proofs
+// checks: those whose nonce is current, or from an adjacent window, for one of them. Proofs
 // signed for the previous nonce bridge the time until the watcher has signed the new one.
 func (s *certPostureState) cachedProofs(checks []*mgmProto.Checks) []certposture.Proof {
 	s.mu.Lock()
@@ -230,6 +242,19 @@ func (e *Engine) publishCertificatePostureEvent(proven bool) {
 			"Access to some resources may be blocked until one is available.", nil)
 }
 
+// publishCertificateStoreStuckEvent tells the user that reading the certificate store
+// stopped answering. Collection resumes only once a stuck call returns, which a store
+// that hangs for good never does short of a restart.
+func (e *Engine) publishCertificateStoreStuckEvent() {
+	if e.statusRecorder == nil {
+		return
+	}
+	e.statusRecorder.PublishEvent(cProto.SystemEvent_WARNING, cProto.SystemEvent_SYSTEM,
+		"certificate posture: the certificate store stopped responding",
+		"NetBird cannot read the certificates required by your organization's device policy because "+
+			"the certificate store stopped responding. If this persists, restart the NetBird service.", nil)
+}
+
 // watchCertificatePosture owns certificate proof collection until ctx is done. It
 // collects when woken by new checks or a sync, and on every tick when the cached proofs
 // went stale, such as after a login following an autostart.
@@ -303,6 +328,9 @@ func (e *Engine) refreshCertificateProofs() error {
 	if e.certState.record(key, userContext, proofs, time.Now()) {
 		e.publishCertificatePostureEvent(len(proofs) > 0)
 	}
+	if e.certState.setStuck(e.certProofs.Stuck()) {
+		e.publishCertificateStoreStuckEvent()
+	}
 
 	if e.certState.sameAsDelivered(proofs) {
 		log.Debugf("certificate posture: proofs unchanged since the last meta sync, not sending")
diff --git a/client/internal/engine_certposture_test.go b/client/internal/engine_certposture_test.go
index 118a28f84..a66ab2107 100644
--- a/client/internal/engine_certposture_test.go
+++ b/client/internal/engine_certposture_test.go
@@ -39,6 +39,17 @@ func TestCertPostureState_Record(t *testing.T) {
 	assert.True(t, unproven.record("k", "", nil, now), "losing the proof again is reported")
 }
 
+// TestCertPostureState_ReportsStuckOnce: a store that stopped answering is reported to
+// the user once when it wedges the collector, not on every collection that follows, and
+// again if it wedges anew after recovering.
+func TestCertPostureState_ReportsStuckOnce(t *testing.T) {
+	var s certPostureState
+	assert.True(t, s.setStuck(true), "becoming stuck is reported")
+	assert.False(t, s.setStuck(true), "staying stuck is not reported again")
+	assert.False(t, s.setStuck(false), "recovering is not a stuck report")
+	assert.True(t, s.setStuck(true), "getting stuck again is reported again")
+}
+
 func TestCertPostureState_NeedsCollection(t *testing.T) {
 	now := time.Now()
 	one := []certposture.Proof{{}}
diff --git a/management/server/account.go b/management/server/account.go
index 7bc682830..4003e7e7b 100644
--- a/management/server/account.go
+++ b/management/server/account.go
@@ -258,7 +258,6 @@ func BuildManager(
 	}
 
 	am.certChallenges = newCertChallengeRefresher(am.refreshCertificateChallenges)
-	am.certChallenges.Start(ctx)
 
 	am.networkMapController.StartWarmup(ctx)
 
@@ -301,6 +300,10 @@ func BuildManager(
 		am.onPeersInvalidated(ctx, accountID, peerIDs)
 	})
 
+	// Started last: a manager that fails to build is never returned, so nothing would
+	// stop its refresher.
+	am.certChallenges.Start(ctx)
+
 	return am, nil
 }
 
diff --git a/management/server/certificate_challenge.go b/management/server/certificate_challenge.go
index 8dd004f7b..a63748727 100644
--- a/management/server/certificate_challenge.go
+++ b/management/server/certificate_challenge.go
@@ -24,8 +24,8 @@ const (
 )
 
 // certChallengePeriod is how often an account whose policies carry a certificate
-// posture check is pushed a fresh challenge. A nonce is accepted for its own window and
-// the one before it, so one issued at the very end of a window lives only one window. A
+// posture check is pushed a fresh challenge. A nonce stays valid through the window
+// after its own, so one issued at the very end of a window lives only one window. A
 // third of that leaves a missed run well clear of the edge, where a half would put it
 // exactly on it.
 func certChallengePeriod() time.Duration {
diff --git a/shared/management/certposture/certposture_test.go b/shared/management/certposture/certposture_test.go
index dbe651cb1..ae31a2203 100644
--- a/shared/management/certposture/certposture_test.go
+++ b/shared/management/certposture/certposture_test.go
@@ -45,7 +45,9 @@ func TestChallenger_VerifyNonce(t *testing.T) {
 		{"current window", nonce, peerKey, now, nil},
 		{"previous window still accepted", nonce, peerKey, now.Add(Window), nil},
 		{"two windows later expired", nonce, peerKey, now.Add(2 * Window), ErrNonceExpired},
-		{"issued in the future rejected", c.Nonce(peerKey, now.Add(Window)), peerKey, now, ErrNonceExpired},
+		// An instance whose clock runs a little ahead issues the next window's nonce early.
+		{"issued one window ahead accepted", c.Nonce(peerKey, now.Add(Window)), peerKey, now, nil},
+		{"issued two windows ahead rejected", c.Nonce(peerKey, now.Add(2*Window)), peerKey, now, ErrNonceExpired},
 		{"other peer", nonce, otherKey, now, ErrNonceMismatch},
 		{"tampered mac", tamper(nonce, len(nonce)-1), peerKey, now, ErrNonceMismatch},
 		{"malformed", nonce[:10], peerKey, now, ErrNonceMalformed},
@@ -67,7 +69,8 @@ func TestNonceAcceptedAlongside(t *testing.T) {
 	assert.True(t, NonceAcceptedAlongside(issued, issued), "the current nonce is accepted")
 	assert.True(t, NonceAcceptedAlongside(issued, c.Nonce(peerKey, now.Add(Window))), "a proof from the previous window is accepted")
 	assert.False(t, NonceAcceptedAlongside(issued, c.Nonce(peerKey, now.Add(2*Window))), "a proof two windows old is not")
-	assert.False(t, NonceAcceptedAlongside(c.Nonce(peerKey, now.Add(Window)), issued), "a nonce from a later window is not")
+	assert.True(t, NonceAcceptedAlongside(c.Nonce(peerKey, now.Add(Window)), issued), "a nonce from an instance one window ahead is accepted")
+	assert.False(t, NonceAcceptedAlongside(c.Nonce(peerKey, now.Add(2*Window)), issued), "a nonce two windows ahead is not")
 	assert.False(t, NonceAcceptedAlongside([]byte("short"), issued), "a malformed nonce is not")
 
 	for _, tt := range []struct {
diff --git a/shared/management/certposture/challenge.go b/shared/management/certposture/challenge.go
index 274230672..62da17349 100644
--- a/shared/management/certposture/challenge.go
+++ b/shared/management/certposture/challenge.go
@@ -13,9 +13,9 @@ import (
 )
 
 const (
-	// Window is the default challenge window. A nonce is accepted for its own window
-	// and the one before it, so a peer re-proves possession of its key between once
-	// and twice per window.
+	// Window is the default challenge window. A nonce stays valid through the window
+	// after the one it was issued in, so a peer re-proves possession of its key between
+	// once and twice per window. One window early is accepted too, for clock skew.
 	Window = 12 * time.Hour
 
 	// EnvWindow overrides Window, for end-to-end tests that cannot wait half a day to
@@ -23,7 +23,9 @@ const (
 	// window is part of the nonce, so instances that disagree reject each other's.
 	EnvWindow = "NB_CERT_CHALLENGE_WINDOW"
 
-	minWindow = time.Second
+	// minWindow keeps the renewal period, a third of the window, well above the
+	// refresher's one-second tick.
+	minWindow = 30 * time.Second
 	maxWindow = 24 * time.Hour
 
 	challengeDomain = "netbird-cert-challenge-v1"
@@ -58,6 +60,10 @@ func resolveWindow() time.Duration {
 		log.Warnf("%s of %s is outside %s..%s, keeping the %s certificate challenge window", EnvWindow, window, minWindow, maxWindow, Window)
 		return Window
 	}
+	if window%time.Second != 0 {
+		log.Warnf("%s of %s is not a whole number of seconds, keeping the %s certificate challenge window", EnvWindow, window, Window)
+		return Window
+	}
 
 	// Loud on purpose: this sets how long a device can pass the certificate check after
 	// its key has gone, and it has to match on every instance.
@@ -91,8 +97,7 @@ func (c *Challenger) verifyNonce(nonce, peerKey []byte, now time.Time) error {
 		return ErrNonceMalformed
 	}
 	window := binary.BigEndian.Uint64(nonce[:windowLen])
-	current := c.windowOf(now)
-	if window != current && window+1 != current {
+	if !windowAccepted(window, c.windowOf(now)) {
 		return ErrNonceExpired
 	}
 	if !hmac.Equal(nonce, c.nonceForWindow(peerKey, window)) {
@@ -117,13 +122,18 @@ func (c *Challenger) nonceForWindow(peerKey []byte, window uint64) []byte {
 }
 
 // NonceAcceptedAlongside reports whether a proof answering nonce is still accepted while
-// management issues current to the same peer: verification takes a nonce of the current
-// or the previous window.
+// management issues current to the same peer, by the same window rule verification uses.
 func NonceAcceptedAlongside(nonce, current []byte) bool {
 	if len(nonce) != nonceLen || len(current) != nonceLen {
 		return false
 	}
 	window := binary.BigEndian.Uint64(nonce[:windowLen])
-	currentWindow := binary.BigEndian.Uint64(current[:windowLen])
-	return window == currentWindow || window+1 == currentWindow
+	return windowAccepted(window, binary.BigEndian.Uint64(current[:windowLen]))
+}
+
+// windowAccepted reports whether a nonce of window is accepted in window current: the
+// current window, the previous one so a nonce outlives a rollover, and the next one so an
+// instance whose clock runs slightly ahead is not rejected by the others.
+func windowAccepted(window, current uint64) bool {
+	return window == current || window+1 == current || window == current+1
 }
diff --git a/shared/management/certposture/challenge_test.go b/shared/management/certposture/challenge_test.go
index bdb212f66..1d1acddc4 100644
--- a/shared/management/certposture/challenge_test.go
+++ b/shared/management/certposture/challenge_test.go
@@ -22,6 +22,8 @@ func TestResolveWindow(t *testing.T) {
 		{name: "a test-sized window is taken", env: "30s", want: 30 * time.Second},
 		{name: "garbage keeps the default", env: "soon", want: Window},
 		{name: "below the floor keeps the default", env: "10ms", want: Window},
+		{name: "too short for the refresh tick keeps the default", env: "1s", want: Window},
+		{name: "a fractional second keeps the default", env: "30500ms", want: Window},
 		{name: "above the ceiling keeps the default", env: "100h", want: Window},
 	}
 

From 67c2041fb5534c19d7b2320617cfc3aaab8e7d3d Mon Sep 17 00:00:00 2001
From: Pascal Fischer <32096965+pascal-fischer@users.noreply.github.com>
Date: Fri, 9 Oct 2026 16:40:17 +0200
Subject: [PATCH 36/70] [management] update proxy mappings on peer IP change
 (#8139)

---
 .../reverseproxy/service/manager/manager.go   | 10 ++-
 .../service/manager/manager_test.go           | 40 +++++++++
 management/server/account.go                  | 15 ++++
 management/server/account_test.go             | 81 +++++++++++++++++++
 4 files changed, 142 insertions(+), 4 deletions(-)

diff --git a/management/internals/modules/reverseproxy/service/manager/manager.go b/management/internals/modules/reverseproxy/service/manager/manager.go
index 900b7759f..d1ed8d078 100644
--- a/management/internals/modules/reverseproxy/service/manager/manager.go
+++ b/management/internals/modules/reverseproxy/service/manager/manager.go
@@ -2,6 +2,7 @@ package manager
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"math/rand/v2"
 	"net"
@@ -1079,15 +1080,16 @@ func (m *Manager) ReloadAllServicesForAccount(ctx context.Context, accountID str
 
 	oidcCfg := m.proxyController.GetOIDCValidationConfig()
 
+	var errs []error
 	for _, s := range services {
-		err = m.replaceHostByLookup(ctx, accountID, s)
-		if err != nil {
-			return fmt.Errorf("failed to replace host by lookup for service %s: %w", s.ID, err)
+		if err := m.replaceHostByLookup(ctx, accountID, s); err != nil {
+			errs = append(errs, fmt.Errorf("replace host by lookup for service %s: %w", s.ID, err))
+			continue
 		}
 		m.proxyController.SendServiceUpdateToCluster(ctx, accountID, s.ToProtoMapping(service.Update, "", oidcCfg), s.ProxyCluster)
 	}
 
-	return nil
+	return errors.Join(errs...)
 }
 
 func (m *Manager) GetGlobalServices(ctx context.Context) ([]*service.Service, error) {
diff --git a/management/internals/modules/reverseproxy/service/manager/manager_test.go b/management/internals/modules/reverseproxy/service/manager/manager_test.go
index 2ec1af1a2..f9273d594 100644
--- a/management/internals/modules/reverseproxy/service/manager/manager_test.go
+++ b/management/internals/modules/reverseproxy/service/manager/manager_test.go
@@ -27,6 +27,7 @@ import (
 	"github.com/netbirdio/netbird/management/server/permissions/operations"
 	"github.com/netbirdio/netbird/management/server/store"
 	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/proto"
 	"github.com/netbirdio/netbird/shared/management/status"
 )
 
@@ -1481,3 +1482,42 @@ func TestReplaceHostByLookup_SkipsClusterTarget(t *testing.T) {
 	require.NoError(t, mgr.replaceHostByLookup(ctx, accountID, svc), "cluster target must not trigger peer/resource lookup")
 	assert.Equal(t, "127.0.0.1", svc.Targets[0].Host, "operator-supplied host must be preserved for cluster target")
 }
+
+func TestReloadAllServicesForAccount_ContinuesAfterFailedService(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	mockStore := store.NewMockStore(ctrl)
+	proxyController := proxy.NewMockController(ctrl)
+	accountID := "test-account"
+
+	broken := &rpservice.Service{
+		ID:           "svc-broken",
+		AccountID:    accountID,
+		ProxyCluster: "eu.proxy.netbird.io",
+		Targets:      []*rpservice.Target{{TargetId: "x", TargetType: "unknown"}},
+	}
+	healthy := &rpservice.Service{
+		ID:           "svc-healthy",
+		AccountID:    accountID,
+		ProxyCluster: "eu.proxy.netbird.io",
+		Targets:      []*rpservice.Target{{TargetId: "peer-1", TargetType: rpservice.TargetTypePeer, Host: "100.64.0.1", Protocol: "http", Port: 8080, Enabled: true}},
+	}
+
+	mockStore.EXPECT().GetAccountServices(ctx, store.LockingStrengthNone, accountID).Return([]*rpservice.Service{broken, healthy}, nil)
+	mockStore.EXPECT().GetPeerByID(ctx, store.LockingStrengthNone, accountID, "peer-1").
+		Return(&nbpeer.Peer{ID: "peer-1", IP: netip.MustParseAddr("100.70.0.9")}, nil)
+	proxyController.EXPECT().GetOIDCValidationConfig().Return(proxy.OIDCValidationConfig{})
+	proxyController.EXPECT().SendServiceUpdateToCluster(ctx, accountID, gomock.Any(), "eu.proxy.netbird.io").
+		Do(func(_ context.Context, _ string, mapping *proto.ProxyMapping, _ string) {
+			assert.Equal(t, "svc-healthy", mapping.GetId())
+			require.Len(t, mapping.GetPath(), 1)
+			assert.Contains(t, mapping.GetPath()[0].GetTarget(), "100.70.0.9", "mapping must carry the peer's current IP")
+		})
+
+	mgr := &Manager{store: mockStore, proxyController: proxyController}
+
+	err := mgr.ReloadAllServicesForAccount(ctx, accountID)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "svc-broken")
+	assert.NotContains(t, err.Error(), "svc-healthy")
+}
diff --git a/management/server/account.go b/management/server/account.go
index 4003e7e7b..6de1642e5 100644
--- a/management/server/account.go
+++ b/management/server/account.go
@@ -2706,6 +2706,8 @@ func (am *DefaultAccountManager) UpdatePeerIP(ctx context.Context, accountID, us
 	}
 
 	if updateNetworkMap {
+		am.reloadServicesTargetingPeer(ctx, accountID, peerID)
+
 		peer, err := am.Store.GetPeerByID(ctx, store.LockingStrengthNone, accountID, peerID)
 		if err != nil {
 			return err
@@ -2720,6 +2722,19 @@ func (am *DefaultAccountManager) UpdatePeerIP(ctx context.Context, accountID, us
 	return nil
 }
 
+// reloadServicesTargetingPeer resends the account's reverse proxy services unless none of them targets the peer.
+func (am *DefaultAccountManager) reloadServicesTargetingPeer(ctx context.Context, accountID, peerID string) {
+	serviceID, err := am.serviceManager.GetServiceIDByTargetID(ctx, accountID, peerID)
+	if err != nil {
+		log.WithContext(ctx).Warnf("failed to look up services targeting peer %s, reloading all: %v", peerID, err)
+	} else if serviceID == "" {
+		return
+	}
+	if err := am.serviceManager.ReloadAllServicesForAccount(ctx, accountID); err != nil {
+		log.WithContext(ctx).Warnf("failed to reload services for account %s: %v", accountID, err)
+	}
+}
+
 func (am *DefaultAccountManager) updatePeerIPInTransaction(ctx context.Context, accountID, userID, peerID string, newIP netip.Addr) (bool, error) {
 	var updateNetworkMap bool
 	err := am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
diff --git a/management/server/account_test.go b/management/server/account_test.go
index 7dc02b428..d3ad2dfc9 100644
--- a/management/server/account_test.go
+++ b/management/server/account_test.go
@@ -3,6 +3,7 @@ package server
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net"
@@ -4460,6 +4461,86 @@ func TestDefaultAccountManager_UpdatePeerIP(t *testing.T) {
 	})
 }
 
+func TestDefaultAccountManager_UpdatePeerIP_ReloadsTargetingServices(t *testing.T) {
+	manager, _, err := createManager(t)
+	require.NoError(t, err, "unable to create account manager")
+
+	ctx := context.Background()
+	accountID, err := manager.GetAccountIDByUserID(ctx, auth.UserAuth{UserId: userID})
+	require.NoError(t, err, "unable to create an account")
+
+	key, err := wgtypes.GenerateKey()
+	require.NoError(t, err, "unable to generate WireGuard key")
+	peer, _, _, _, err := manager.AddPeer(ctx, "", "", userID, &nbpeer.Peer{
+		Key:  key.PublicKey().String(),
+		Meta: nbpeer.PeerSystemMeta{Hostname: "proxied-peer"},
+	}, false)
+	require.NoError(t, err, "unable to add peer")
+
+	account, err := manager.Store.GetAccount(ctx, accountID)
+	require.NoError(t, err, "unable to get account")
+	network := netip.MustParsePrefix(account.Network.Net.String())
+
+	t.Run("targeted peer reloads services", func(t *testing.T) {
+		serviceManager := service.NewMockManager(gomock.NewController(t))
+		manager.SetServiceManager(serviceManager)
+		serviceManager.EXPECT().GetServiceIDByTargetID(gomock.Any(), accountID, peer.ID).Return("svc-1", nil)
+		serviceManager.EXPECT().ReloadAllServicesForAccount(gomock.Any(), accountID).Return(nil)
+
+		current, err := manager.Store.GetPeerByID(ctx, store.LockingStrengthNone, accountID, peer.ID)
+		require.NoError(t, err)
+		newIP, err := types.AllocatePeerIP(network, []netip.Addr{current.IP})
+		require.NoError(t, err)
+		require.NoError(t, manager.UpdatePeerIP(ctx, accountID, userID, peer.ID, newIP))
+	})
+
+	t.Run("untargeted peer skips reload", func(t *testing.T) {
+		serviceManager := service.NewMockManager(gomock.NewController(t))
+		manager.SetServiceManager(serviceManager)
+		serviceManager.EXPECT().GetServiceIDByTargetID(gomock.Any(), accountID, peer.ID).Return("", nil)
+
+		current, err := manager.Store.GetPeerByID(ctx, store.LockingStrengthNone, accountID, peer.ID)
+		require.NoError(t, err)
+		newIP, err := types.AllocatePeerIP(network, []netip.Addr{current.IP})
+		require.NoError(t, err)
+		require.NoError(t, manager.UpdatePeerIP(ctx, accountID, userID, peer.ID, newIP))
+	})
+
+	t.Run("lookup failure reloads services", func(t *testing.T) {
+		serviceManager := service.NewMockManager(gomock.NewController(t))
+		manager.SetServiceManager(serviceManager)
+		serviceManager.EXPECT().GetServiceIDByTargetID(gomock.Any(), accountID, peer.ID).Return("", errors.New("store unavailable"))
+		serviceManager.EXPECT().ReloadAllServicesForAccount(gomock.Any(), accountID).Return(nil)
+
+		current, err := manager.Store.GetPeerByID(ctx, store.LockingStrengthNone, accountID, peer.ID)
+		require.NoError(t, err)
+		newIP, err := types.AllocatePeerIP(network, []netip.Addr{current.IP})
+		require.NoError(t, err)
+		require.NoError(t, manager.UpdatePeerIP(ctx, accountID, userID, peer.ID, newIP))
+	})
+
+	t.Run("network map notification failure still reloads services", func(t *testing.T) {
+		ctrl := gomock.NewController(t)
+		serviceManager := service.NewMockManager(ctrl)
+		manager.SetServiceManager(serviceManager)
+		serviceManager.EXPECT().GetServiceIDByTargetID(gomock.Any(), accountID, peer.ID).Return("svc-1", nil)
+		serviceManager.EXPECT().ReloadAllServicesForAccount(gomock.Any(), accountID).Return(nil)
+
+		originalController := manager.networkMapController
+		t.Cleanup(func() { manager.networkMapController = originalController })
+		networkMapController := network_map.NewMockController(ctrl)
+		networkMapController.EXPECT().GetDNSDomain(gomock.Any()).Return("netbird.cloud").AnyTimes()
+		networkMapController.EXPECT().OnPeersUpdated(gomock.Any(), accountID, []string{peer.ID}, gomock.Any()).Return(errors.New("notify failed"))
+		manager.networkMapController = networkMapController
+
+		current, err := manager.Store.GetPeerByID(ctx, store.LockingStrengthNone, accountID, peer.ID)
+		require.NoError(t, err)
+		newIP, err := types.AllocatePeerIP(network, []netip.Addr{current.IP})
+		require.NoError(t, err)
+		require.Error(t, manager.UpdatePeerIP(ctx, accountID, userID, peer.ID, newIP))
+	})
+}
+
 func TestAddNewUserToDomainAccountWithApproval(t *testing.T) {
 	manager, _, err := createManager(t)
 	if err != nil {

From 01185ba3536bcc037481578420d73cb7cee96094 Mon Sep 17 00:00:00 2001
From: Zoltan Papp <zoltan.pmail@gmail.com>
Date: Mon, 12 Oct 2026 10:29:26 +0200
Subject: [PATCH 37/70] [client] Configure the userspace device through its
 typed API (#7937)

* [client] Configure the userspace device through its typed API

The userspace configurer drove wireguard-go through UAPI text: every
write was rendered to the configuration protocol and parsed back, and
every read, including the per-second statistics poll, dumped the whole
device as text and parsed it again. With 10000 peers a statistics read
cost about 16 ms, and clearing one endpoint needed a peer remove and a
re-add because the protocol cannot clear an endpoint or drop a single
prefix in place. The allowed IP mirror in the configurer existed only
to feed those rewrites.

The wireguard-go fork now exposes a typed peer API, so the configurer
calls the device directly: ConfigurePeer for creates and updates,
single-prefix add and remove on the routing table, ClearEndpoint, and
accessors for statistics. The mirror, the UAPI rendering and the
parsers are gone from the userspace path; the UAPI socket for wg show
stays.

Clearing an endpoint keeps the peer object, its counters and its
allowed IPs, but resets the session and switches the keepalive off
until the next endpoint arrives. The watcher expects a fresh handshake
after an endpoint reset, and an endpoint-less peer with a keepalive
would retry handshakes it cannot send; this is what the remove and
re-add provided before. Handshake times now carry nanosecond precision
like the kernel path.

Measured with 10000 peers against the UAPI implementation: clearing an
endpoint drops from 713 ms to 3 ms for all peers, a statistics read
from 15 ms to 0.9 ms, a full dump from 18 ms to 4 ms, and single
allowed IP changes are 7 to 20 times faster.

* [client] Keep the allowed IP mirror kernel-only

The userspace configurer no longer uses the allowed IP mirror, so its
ensure method and the preshared key config helper had no caller left
on Windows and macOS, where the kernel configurer is not compiled, and
the unused linter failed there.

The mirror and its tests now carry the kernel build tag, the prefix
normalizers that both paths share move to common.go, and the preshared
key helper moves next to its only caller.

* [client] Trim historical references from configurer comments

* [client] Keep the endpoint zone in the userspace configurer

The UAPI path wrote the endpoint as text, so a link-local IPv6 endpoint
reached the device with its zone. The typed path built the address from
the IP bytes only and dropped the zone, leaving the device with an
unroutable fe80:: address. The activity recorder keeps the zone-less
address it always had.

* [client] Run the prefix conversion tests on every platform

prefixesToIPNets lives in the untagged common.go and the userspace stats
path uses it on every platform, but its tests stayed in the kernel-tagged
allowedips_test.go, so darwin and windows CI stopped running them. Move
them next to the normalizePrefix tests. The round-trip test stays tagged
because ipNetsToPrefixes is kernel-only.

* [client] Pin wireguard-go to the merged typed peer API

The typed peer configuration API landed on master as #23, so the
replace no longer needs to point at the PR branch commit.
---
 client/iface/configurer/allowedips.go         |  29 +-
 client/iface/configurer/allowedips_test.go    |  75 +--
 client/iface/configurer/common.go             |  41 +-
 client/iface/configurer/common_test.go        |  81 +++
 client/iface/configurer/kernel_unix.go        |  10 +
 client/iface/configurer/usp.go                | 615 ++++--------------
 .../iface/configurer/usp_allowedips_test.go   |  76 +--
 client/iface/configurer/usp_test.go           | 276 ++++++--
 go.mod                                        |   2 +-
 go.sum                                        |   4 +-
 10 files changed, 472 insertions(+), 737 deletions(-)
 create mode 100644 client/iface/configurer/common_test.go

diff --git a/client/iface/configurer/allowedips.go b/client/iface/configurer/allowedips.go
index 193197d4a..08a766ee0 100644
--- a/client/iface/configurer/allowedips.go
+++ b/client/iface/configurer/allowedips.go
@@ -1,3 +1,5 @@
+//go:build (linux && !android) || freebsd
+
 package configurer
 
 import (
@@ -165,33 +167,6 @@ func (s *allowedIPStore) releaseLocked(k wgtypes.Key) {
 	}
 }
 
-// normalizePrefix puts a prefix into the form the store recognises it by. It clears the
-// host bits, which a device does on its own, so a caller passing 10.20.0.1/16 still matches
-// the 10.20.0.0/16 read back from the device; and it unmaps a v4-mapped prefix so that it
-// compares equal to, and marshals like, the plain v4 prefix for the same network.
-//
-// Masking comes first because it also decides the address family: only a prefix at least 96
-// bits long keeps the mapped marker through the mask, so a shorter prefix inside the mapped
-// range is a genuine v6 prefix and unmapping it would yield an invalid v4 prefix.
-func normalizePrefix(prefix netip.Prefix) netip.Prefix {
-	masked := prefix.Masked()
-
-	addr := masked.Addr()
-	if !addr.Is4In6() {
-		return masked
-	}
-	return netip.PrefixFrom(addr.Unmap(), masked.Bits()-96)
-}
-
-// normalizePrefixes returns a normalized copy without changing the caller's slice.
-func normalizePrefixes(prefixes []netip.Prefix) []netip.Prefix {
-	normalized := make([]netip.Prefix, len(prefixes))
-	for i, prefix := range prefixes {
-		normalized[i] = normalizePrefix(prefix)
-	}
-	return normalized
-}
-
 // ipNetsToPrefixes converts addresses read back from a device. Unmap keeps a v4-mapped v6
 // address comparable to the plain v4 prefix the configurer was given.
 func ipNetsToPrefixes(ipNets []net.IPNet) []netip.Prefix {
diff --git a/client/iface/configurer/allowedips_test.go b/client/iface/configurer/allowedips_test.go
index 1d272d8c4..405609e29 100644
--- a/client/iface/configurer/allowedips_test.go
+++ b/client/iface/configurer/allowedips_test.go
@@ -1,3 +1,5 @@
+//go:build (linux && !android) || freebsd
+
 package configurer
 
 import (
@@ -125,24 +127,6 @@ func TestAllowedIPStoreNormalizesMappedPrefixes(t *testing.T) {
 	assert.Equal(t, []netip.Prefix{v4}, prefixes, "a mapped prefix must be stored unmapped and not duplicated")
 }
 
-func TestNormalizePrefix(t *testing.T) {
-	v4 := netip.MustParsePrefix("10.20.0.0/16")
-	v6 := netip.MustParsePrefix("fd00::/64")
-
-	assert.Equal(t, v4, normalizePrefix(v4), "a plain v4 prefix is unchanged")
-	assert.Equal(t, v6, normalizePrefix(v6), "a real v6 prefix is unchanged")
-	assert.Equal(t, v4, normalizePrefix(netip.PrefixFrom(netip.AddrFrom16(v4.Addr().As16()), 112)),
-		"a mapped prefix under a 128 bit mask becomes plain v4")
-	// A prefix shorter than /96 inside the mapped range is a genuine v6 prefix. Unmapping it
-	// would pair a v4 address with a v6 sized mask, which is invalid, and the store would then
-	// record a zero prefix that can never recreate the allowed IP.
-	for _, tc := range []string{"::ffff:0:0/64", "::ffff:1.2.3.4/80", "::ffff:1.2.3.4/95"} {
-		got := normalizePrefix(netip.MustParsePrefix(tc))
-		assert.True(t, got.IsValid(), "%s must normalize to a valid prefix", tc)
-		assert.False(t, got.Addr().Is4(), "%s must stay v6", tc)
-	}
-}
-
 func TestAllowedIPStoreAddExistingDoesNotCreate(t *testing.T) {
 	s := newAllowedIPStore()
 	routed := netip.MustParsePrefix("10.20.0.0/16")
@@ -194,15 +178,6 @@ func TestAllowedIPStoreForgetReleasesOwnership(t *testing.T) {
 	assert.Equal(t, []netip.Prefix{routed}, current, "the new owner must hold the prefix")
 }
 
-func TestNormalizePrefixClearsHostBits(t *testing.T) {
-	// A device stores a prefix masked, so a caller passing host bits must still match what a
-	// device fallback seeded, otherwise that prefix could never be removed by value.
-	assert.Equal(t, netip.MustParsePrefix("10.20.0.0/16"),
-		normalizePrefix(netip.MustParsePrefix("10.20.0.1/16")), "host bits must be cleared")
-	assert.Equal(t, netip.MustParsePrefix("fd00::/64"),
-		normalizePrefix(netip.MustParsePrefix("fd00::1/64")), "host bits must be cleared for v6")
-}
-
 func TestIPNetsToPrefixesKeepsV6InTheMappedRange(t *testing.T) {
 	// ::ffff:0:0/64 reads as v4-mapped but is a genuine v6 prefix: unmapping it would leave a
 	// v4 address under a 64 bit mask, which is invalid, and the allowed IP would be dropped.
@@ -215,49 +190,3 @@ func TestIPNetsToPrefixesKeepsV6InTheMappedRange(t *testing.T) {
 	assert.False(t, got[0].Addr().Is4(), "a v6 prefix in the mapped range must not become v4")
 	assert.Equal(t, 64, got[0].Bits(), "the prefix length must survive the conversion")
 }
-
-func TestPrefixesToIPNetsNormalizes(t *testing.T) {
-	// net.IPNet prints a v4-mapped address as v4 but takes the length from its 16 byte
-	// mask, so an unnormalized ::ffff:10.1.2.3/64 reaches a userspace device as 10.1.2.3/0,
-	// an allowed IP that matches every v4 address.
-	tests := []struct {
-		name  string
-		given string
-		want  string
-	}{
-		{name: "mapped below /96", given: "::ffff:10.1.2.3/64", want: "::/64"},
-		{name: "mapped at /112", given: "::ffff:10.1.2.3/112", want: "10.1.0.0/16"},
-		{name: "host bits are cleared", given: "10.20.0.1/16", want: "10.20.0.0/16"},
-		{name: "v6 is untouched", given: "fd00::1/64", want: "fd00::/64"},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			got := prefixesToIPNets([]netip.Prefix{netip.MustParsePrefix(tc.given)})
-			require.Len(t, got, 1, "the prefix must be converted, not dropped")
-			assert.Equal(t, tc.want, got[0].String(), "what the device is given")
-			assert.NotEqual(t, 0, mustOnes(t, got[0]), "a device must never be given a zero length allowed IP")
-		})
-	}
-}
-
-func mustOnes(t *testing.T, ipNet net.IPNet) int {
-	t.Helper()
-
-	ones, _ := ipNet.Mask.Size()
-	return ones
-}
-
-// TestPrefixesToIPNetsAgreesWithTheStore pins the property the store depends on: what a
-// device is given and what is recorded for it are the same prefix.
-func TestPrefixesToIPNetsAgreesWithTheStore(t *testing.T) {
-	for _, given := range []string{"::ffff:10.1.2.3/64", "::ffff:10.1.2.3/112", "10.20.0.1/16", "fd00::1/64"} {
-		prefix := netip.MustParsePrefix(given)
-
-		toDevice := prefixesToIPNets([]netip.Prefix{prefix})
-		recorded := normalizePrefix(prefix)
-
-		assert.Equal(t, recorded.String(), toDevice[0].String(),
-			"%s must reach the device in the form the store records", given)
-	}
-}
diff --git a/client/iface/configurer/common.go b/client/iface/configurer/common.go
index 40f8209e9..02d2a7e6a 100644
--- a/client/iface/configurer/common.go
+++ b/client/iface/configurer/common.go
@@ -3,22 +3,8 @@ package configurer
 import (
 	"net"
 	"net/netip"
-
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )
 
-// buildPresharedKeyConfig creates a wgtypes.Config for setting a preshared key on a peer.
-// This is a shared helper used by both kernel and userspace configurers.
-func buildPresharedKeyConfig(peerKey wgtypes.Key, psk wgtypes.Key, updateOnly bool) wgtypes.Config {
-	return wgtypes.Config{
-		Peers: []wgtypes.PeerConfig{{
-			PublicKey:    peerKey,
-			PresharedKey: &psk,
-			UpdateOnly:   updateOnly,
-		}},
-	}
-}
-
 // prefixesToIPNets converts prefixes on their way to a device. It is the only place that
 // conversion happens, so it also normalizes: the device is then given the same form the
 // store records, and a v4-mapped prefix cannot reach net.IPNet, which prints such an
@@ -35,3 +21,30 @@ func prefixesToIPNets(prefixes []netip.Prefix) []net.IPNet {
 	}
 	return ipNets
 }
+
+// normalizePrefix puts a prefix into the form the store recognises it by. It clears the
+// host bits, which a device does on its own, so a caller passing 10.20.0.1/16 still matches
+// the 10.20.0.0/16 read back from the device; and it unmaps a v4-mapped prefix so that it
+// compares equal to, and marshals like, the plain v4 prefix for the same network.
+//
+// Masking comes first because it also decides the address family: only a prefix at least 96
+// bits long keeps the mapped marker through the mask, so a shorter prefix inside the mapped
+// range is a genuine v6 prefix and unmapping it would yield an invalid v4 prefix.
+func normalizePrefix(prefix netip.Prefix) netip.Prefix {
+	masked := prefix.Masked()
+
+	addr := masked.Addr()
+	if !addr.Is4In6() {
+		return masked
+	}
+	return netip.PrefixFrom(addr.Unmap(), masked.Bits()-96)
+}
+
+// normalizePrefixes returns a normalized copy without changing the caller's slice.
+func normalizePrefixes(prefixes []netip.Prefix) []netip.Prefix {
+	normalized := make([]netip.Prefix, len(prefixes))
+	for i, prefix := range prefixes {
+		normalized[i] = normalizePrefix(prefix)
+	}
+	return normalized
+}
diff --git a/client/iface/configurer/common_test.go b/client/iface/configurer/common_test.go
new file mode 100644
index 000000000..487c1a734
--- /dev/null
+++ b/client/iface/configurer/common_test.go
@@ -0,0 +1,81 @@
+package configurer
+
+import (
+	"net"
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNormalizePrefix(t *testing.T) {
+	v4 := netip.MustParsePrefix("10.20.0.0/16")
+	v6 := netip.MustParsePrefix("fd00::/64")
+
+	assert.Equal(t, v4, normalizePrefix(v4), "a plain v4 prefix is unchanged")
+	assert.Equal(t, v6, normalizePrefix(v6), "a real v6 prefix is unchanged")
+	assert.Equal(t, v4, normalizePrefix(netip.PrefixFrom(netip.AddrFrom16(v4.Addr().As16()), 112)),
+		"a mapped prefix under a 128 bit mask becomes plain v4")
+	// A prefix shorter than /96 inside the mapped range is a genuine v6 prefix. Unmapping it
+	// would pair a v4 address with a v6 sized mask, which is invalid, and the store would then
+	// record a zero prefix that can never recreate the allowed IP.
+	for _, tc := range []string{"::ffff:0:0/64", "::ffff:1.2.3.4/80", "::ffff:1.2.3.4/95"} {
+		got := normalizePrefix(netip.MustParsePrefix(tc))
+		assert.True(t, got.IsValid(), "%s must normalize to a valid prefix", tc)
+		assert.False(t, got.Addr().Is4(), "%s must stay v6", tc)
+	}
+}
+
+func TestNormalizePrefixClearsHostBits(t *testing.T) {
+	// A device stores a prefix masked, so a caller passing host bits must still match what a
+	// device fallback seeded, otherwise that prefix could never be removed by value.
+	assert.Equal(t, netip.MustParsePrefix("10.20.0.0/16"),
+		normalizePrefix(netip.MustParsePrefix("10.20.0.1/16")), "host bits must be cleared")
+	assert.Equal(t, netip.MustParsePrefix("fd00::/64"),
+		normalizePrefix(netip.MustParsePrefix("fd00::1/64")), "host bits must be cleared for v6")
+}
+
+func TestPrefixesToIPNetsNormalizes(t *testing.T) {
+	// net.IPNet prints a v4-mapped address as v4 but takes the length from its 16 byte
+	// mask, so an unnormalized ::ffff:10.1.2.3/64 reaches a userspace device as 10.1.2.3/0,
+	// an allowed IP that matches every v4 address.
+	tests := []struct {
+		name  string
+		given string
+		want  string
+	}{
+		{name: "mapped below /96", given: "::ffff:10.1.2.3/64", want: "::/64"},
+		{name: "mapped at /112", given: "::ffff:10.1.2.3/112", want: "10.1.0.0/16"},
+		{name: "host bits are cleared", given: "10.20.0.1/16", want: "10.20.0.0/16"},
+		{name: "v6 is untouched", given: "fd00::1/64", want: "fd00::/64"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := prefixesToIPNets([]netip.Prefix{netip.MustParsePrefix(tc.given)})
+			require.Len(t, got, 1, "the prefix must be converted, not dropped")
+			assert.Equal(t, tc.want, got[0].String(), "what the device is given")
+			assert.NotEqual(t, 0, mustOnes(t, got[0]), "a device must never be given a zero length allowed IP")
+		})
+	}
+}
+
+func TestPrefixesToIPNetsAgreesWithTheStore(t *testing.T) {
+	for _, given := range []string{"::ffff:10.1.2.3/64", "::ffff:10.1.2.3/112", "10.20.0.1/16", "fd00::1/64"} {
+		prefix := netip.MustParsePrefix(given)
+
+		toDevice := prefixesToIPNets([]netip.Prefix{prefix})
+		recorded := normalizePrefix(prefix)
+
+		assert.Equal(t, recorded.String(), toDevice[0].String(),
+			"%s must reach the device in the form the store records", given)
+	}
+}
+
+func mustOnes(t *testing.T, ipNet net.IPNet) int {
+	t.Helper()
+
+	ones, _ := ipNet.Mask.Size()
+	return ones
+}
diff --git a/client/iface/configurer/kernel_unix.go b/client/iface/configurer/kernel_unix.go
index 3a95249c1..7b1ad9683 100644
--- a/client/iface/configurer/kernel_unix.go
+++ b/client/iface/configurer/kernel_unix.go
@@ -371,3 +371,13 @@ func (c *KernelConfigurer) fetchStats() (map[string]WGStats, error) {
 	}
 	return stats, nil
 }
+
+func buildPresharedKeyConfig(peerKey wgtypes.Key, psk wgtypes.Key, updateOnly bool) wgtypes.Config {
+	return wgtypes.Config{
+		Peers: []wgtypes.PeerConfig{{
+			PublicKey:    peerKey,
+			PresharedKey: &psk,
+			UpdateOnly:   updateOnly,
+		}},
+	}
+}
diff --git a/client/iface/configurer/usp.go b/client/iface/configurer/usp.go
index 334d99369..1b0965f0d 100644
--- a/client/iface/configurer/usp.go
+++ b/client/iface/configurer/usp.go
@@ -1,19 +1,16 @@
 package configurer
 
 import (
-	"encoding/base64"
-	"encoding/hex"
 	"fmt"
+	"math"
 	"net"
 	"net/netip"
 	"os"
 	"runtime"
-	"slices"
-	"strconv"
-	"strings"
 	"time"
 
 	log "github.com/sirupsen/logrus"
+	wgconn "golang.zx2c4.com/wireguard/conn"
 	"golang.zx2c4.com/wireguard/device"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
@@ -22,19 +19,6 @@ import (
 	"github.com/netbirdio/netbird/monotime"
 )
 
-const (
-	privateKey                 = "private_key"
-	ipcKeyLastHandshakeTimeSec = "last_handshake_time_sec"
-	ipcKeyTxBytes              = "tx_bytes"
-	ipcKeyRxBytes              = "rx_bytes"
-	allowedIP                  = "allowed_ip"
-	endpoint                   = "endpoint"
-	fwmark                     = "fwmark"
-	listenPort                 = "listen_port"
-	publicKey                  = "public_key"
-	presharedKey               = "preshared_key"
-)
-
 var ErrAllowedIPNotFound = fmt.Errorf("allowed IP not found")
 
 type WGUSPConfigurer struct {
@@ -42,20 +26,13 @@ type WGUSPConfigurer struct {
 	deviceName       string
 	activityRecorder *bind.ActivityRecorder
 	statsCache       *statsCache
-	allowedIPs       *allowedIPStore
 
 	uapiListener net.Listener
 }
 
 // NewUSPConfigurer creates a userspace configurer and starts its UAPI listener.
 func NewUSPConfigurer(device *device.Device, deviceName string, activityRecorder *bind.ActivityRecorder) *WGUSPConfigurer {
-	wgCfg := &WGUSPConfigurer{
-		device:           device,
-		deviceName:       deviceName,
-		activityRecorder: activityRecorder,
-		allowedIPs:       newAllowedIPStore(),
-	}
-	wgCfg.statsCache = newStatsCache(statsCacheTTL, wgCfg.fetchStats)
+	wgCfg := NewUSPConfigurerNoUAPI(device, deviceName, activityRecorder)
 	wgCfg.startUAPI()
 	return wgCfg
 }
@@ -66,33 +43,32 @@ func NewUSPConfigurerNoUAPI(device *device.Device, deviceName string, activityRe
 		device:           device,
 		deviceName:       deviceName,
 		activityRecorder: activityRecorder,
-		allowedIPs:       newAllowedIPStore(),
 	}
 	wgCfg.statsCache = newStatsCache(statsCacheTTL, wgCfg.fetchStats)
 	return wgCfg
 }
 
 // ConfigureInterface sets the device key, port and firewall mark, replacing all peers.
-// The allowed IP mirror is reset only after the device accepts the configuration.
 func (c *WGUSPConfigurer) ConfigureInterface(privateKey string, port int) error {
 	log.Debugf("adding Wireguard private key")
 	key, err := wgtypes.ParseKey(privateKey)
 	if err != nil {
 		return err
 	}
-	fwmark := getFwmark()
-	config := wgtypes.Config{
-		PrivateKey:   &key,
-		ReplacePeers: true,
-		FirewallMark: &fwmark,
-		ListenPort:   &port,
+	if port < 0 || port > math.MaxUint16 {
+		return fmt.Errorf("invalid listen port %d", port)
 	}
 
-	if err := c.device.IpcSet(toWgUserspaceString(config)); err != nil {
-		return err
+	if err := c.device.SetPrivateKey(device.NoisePrivateKey(key)); err != nil {
+		return fmt.Errorf("set private key: %w", err)
+	}
+	if err := c.device.SetListenPort(uint16(port)); err != nil {
+		return fmt.Errorf("set listen port %d: %w", port, err)
+	}
+	c.device.RemoveAllPeers()
+	if err := c.device.BindSetMark(uint32(getFwmark())); err != nil {
+		return fmt.Errorf("set fwmark: %w", err)
 	}
-
-	c.allowedIPs.reset()
 	return nil
 }
 
@@ -104,131 +80,91 @@ func (c *WGUSPConfigurer) SetPresharedKey(peerKey string, psk wgtypes.Key, updat
 		return err
 	}
 
-	cfg := buildPresharedKeyConfig(parsedPeerKey, psk, updateOnly)
-	if err := c.device.IpcSet(toWgUserspaceString(cfg)); err != nil {
-		return err
-	}
-
-	// Without updateOnly this creates the peer when it is absent, so the store has to
-	// know about it even though no allowed IP was configured.
-	if !updateOnly {
-		c.allowedIPs.ensure(parsedPeerKey)
-	}
-	return nil
+	presharedKey := device.NoisePresharedKey(psk)
+	return c.device.ConfigurePeer(device.NoisePublicKey(parsedPeerKey), device.PeerConfig{
+		PresharedKey: &presharedKey,
+		UpdateOnly:   updateOnly,
+	})
 }
 
 // UpdatePeer creates or updates a peer, merging allowed IPs with its existing set.
-// It validates the endpoint before writing and records changes after a successful write.
 func (c *WGUSPConfigurer) UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error {
 	peerKeyParsed, err := wgtypes.ParseKey(peerKey)
 	if err != nil {
 		return err
 	}
 
-	// Everything that can fail is done before the device is touched, so a failure here
-	// cannot leave the device holding a peer that the activity recorder and the allowed
-	// IP store never learned about.
+	prefixes, err := validPrefixes(allowedIps)
+	if err != nil {
+		return err
+	}
+
+	cfg := device.PeerConfig{
+		PersistentKeepalive: &keepAlive,
+		AllowedIPs:          prefixes,
+	}
+
 	var addrPort netip.AddrPort
 	if endpoint != nil {
-		addr, err := netip.ParseAddr(endpoint.IP.String())
-		if err != nil {
-			return fmt.Errorf("parse endpoint address: %w", err)
+		addr, ok := netip.AddrFromSlice(endpoint.IP)
+		if !ok {
+			return fmt.Errorf("parse endpoint address %v", endpoint.IP)
 		}
-		addrPort = netip.AddrPortFrom(addr.Unmap(), uint16(endpoint.Port))
+		addr = addr.Unmap()
+		addrPort = netip.AddrPortFrom(addr, uint16(endpoint.Port))
+		cfg.Endpoint = &bind.Endpoint{AddrPort: netip.AddrPortFrom(addr.WithZone(endpoint.Zone), addrPort.Port())}
 	}
 
-	peer := wgtypes.PeerConfig{
-		PublicKey:         peerKeyParsed,
-		ReplaceAllowedIPs: false,
-		// don't replace allowed ips, wg will handle duplicated peer IP
-		AllowedIPs:                  prefixesToIPNets(allowedIps),
-		PersistentKeepaliveInterval: &keepAlive,
-		PresharedKey:                preSharedKey,
-		Endpoint:                    endpoint,
+	if preSharedKey != nil {
+		psk := device.NoisePresharedKey(*preSharedKey)
+		cfg.PresharedKey = &psk
 	}
 
-	config := wgtypes.Config{
-		Peers: []wgtypes.PeerConfig{peer},
-	}
-
-	if ipcErr := c.device.IpcSet(toWgUserspaceString(config)); ipcErr != nil {
-		return ipcErr
+	if err := c.device.ConfigurePeer(device.NoisePublicKey(peerKeyParsed), cfg); err != nil {
+		return fmt.Errorf("configure peer: %w", err)
 	}
 
 	if endpoint != nil {
 		c.activityRecorder.UpsertAddress(peerKey, addrPort)
 	}
-
-	c.allowedIPs.add(peerKeyParsed, allowedIps)
 	return nil
 }
 
 // RemoveEndpointAddress clears the endpoint of a peer while keeping it configured.
-// The UAPI cannot clear an endpoint in place, so the peer is removed and re-added with the
-// allowed IPs it already had.
+// The session is reset and the keepalive is switched off until the next endpoint arrives.
 func (c *WGUSPConfigurer) RemoveEndpointAddress(peerKey string) error {
 	peerKeyParsed, err := wgtypes.ParseKey(peerKey)
 	if err != nil {
 		return fmt.Errorf("parse peer key: %w", err)
 	}
 
-	allowedIPs, err := c.peerAllowedIPs(peerKeyParsed)
-	if err != nil {
-		return err
+	peer := c.device.LookupPeer(device.NoisePublicKey(peerKeyParsed))
+	if peer == nil {
+		return ErrPeerNotFound
 	}
 
-	peer := wgtypes.PeerConfig{
-		PublicKey: peerKeyParsed,
-		Remove:    true,
-	}
+	peer.ClearEndpoint()
+	peer.ZeroAndFlushAll()
 
-	config := wgtypes.Config{
-		Peers: []wgtypes.PeerConfig{peer},
+	var noKeepAlive time.Duration
+	if err := c.device.ConfigurePeer(device.NoisePublicKey(peerKeyParsed), device.PeerConfig{
+		PersistentKeepalive: &noKeepAlive,
+		UpdateOnly:          true,
+	}); err != nil {
+		return fmt.Errorf("disable keepalive: %w", err)
 	}
-	if ipcErr := c.device.IpcSet(toWgUserspaceString(config)); ipcErr != nil {
-		return fmt.Errorf("remove peer: %w", ipcErr)
-	}
-
-	peer = wgtypes.PeerConfig{
-		PublicKey:         peerKeyParsed,
-		ReplaceAllowedIPs: true,
-		AllowedIPs:        prefixesToIPNets(allowedIPs),
-	}
-
-	config = wgtypes.Config{
-		Peers: []wgtypes.PeerConfig{peer},
-	}
-
-	if err := c.device.IpcSet(toWgUserspaceString(config)); err != nil {
-		c.allowedIPs.forget(peerKeyParsed)
-		return fmt.Errorf("re-add peer without endpoint: %w", err)
-	}
-
 	return nil
 }
 
-// RemovePeer removes a peer, then clears its activity and allowed IP records.
-// A failed device write leaves both records intact.
+// RemovePeer removes a peer and clears its activity record.
 func (c *WGUSPConfigurer) RemovePeer(peerKey string) error {
 	peerKeyParsed, err := wgtypes.ParseKey(peerKey)
 	if err != nil {
 		return err
 	}
 
-	peer := wgtypes.PeerConfig{
-		PublicKey: peerKeyParsed,
-		Remove:    true,
-	}
-
-	config := wgtypes.Config{
-		Peers: []wgtypes.PeerConfig{peer},
-	}
-	if ipcErr := c.device.IpcSet(toWgUserspaceString(config)); ipcErr != nil {
-		return ipcErr
-	}
-
+	c.device.RemovePeer(device.NoisePublicKey(peerKeyParsed))
 	c.activityRecorder.Remove(peerKey)
-	c.allowedIPs.forget(peerKeyParsed)
 	return nil
 }
 
@@ -238,22 +174,16 @@ func (c *WGUSPConfigurer) AddAllowedIP(peerKey string, allowedIP netip.Prefix) e
 	if err != nil {
 		return err
 	}
-	peer := wgtypes.PeerConfig{
-		PublicKey:         peerKeyParsed,
-		UpdateOnly:        true,
-		ReplaceAllowedIPs: false,
-		AllowedIPs:        prefixesToIPNets([]netip.Prefix{allowedIP}),
+	if !allowedIP.IsValid() {
+		return fmt.Errorf("invalid allowed IP %v", allowedIP)
 	}
 
-	config := wgtypes.Config{
-		Peers: []wgtypes.PeerConfig{peer},
+	peer := c.device.LookupPeer(device.NoisePublicKey(peerKeyParsed))
+	if peer == nil {
+		return nil
 	}
 
-	if err := c.device.IpcSet(toWgUserspaceString(config)); err != nil {
-		return err
-	}
-
-	c.allowedIPs.addExisting(peerKeyParsed, []netip.Prefix{allowedIP})
+	peer.AddAllowedIP(normalizePrefix(allowedIP))
 	return nil
 }
 
@@ -264,86 +194,64 @@ func (c *WGUSPConfigurer) RemoveAllowedIP(peerKey string, allowedIP netip.Prefix
 	if err != nil {
 		return fmt.Errorf("parse peer key: %w", err)
 	}
-
-	currentAllowedIPs, err := c.peerAllowedIPs(peerKeyParsed)
-	if err != nil {
-		return err
-	}
-
-	idx := slices.Index(currentAllowedIPs, normalizePrefix(allowedIP))
-	if idx < 0 {
+	if !allowedIP.IsValid() {
 		return ErrAllowedIPNotFound
 	}
-	newAllowedIPs := slices.Delete(currentAllowedIPs, idx, idx+1)
 
-	peer := wgtypes.PeerConfig{
-		PublicKey:         peerKeyParsed,
-		UpdateOnly:        true,
-		ReplaceAllowedIPs: true,
-		AllowedIPs:        prefixesToIPNets(newAllowedIPs),
+	peer := c.device.LookupPeer(device.NoisePublicKey(peerKeyParsed))
+	if peer == nil {
+		return ErrPeerNotFound
 	}
 
-	config := wgtypes.Config{
-		Peers: []wgtypes.PeerConfig{peer},
+	if !peer.RemoveAllowedIP(normalizePrefix(allowedIP)) {
+		return ErrAllowedIPNotFound
 	}
-	if err := c.device.IpcSet(toWgUserspaceString(config)); err != nil {
-		return fmt.Errorf("remove allowed IP %s: %w", allowedIP, err)
-	}
-
-	c.allowedIPs.set(peerKeyParsed, newAllowedIPs)
 	return nil
 }
 
-// peerAllowedIPs returns the allowed IPs configured for a peer, reading them from the device
-// only for a peer the store has not seen. Reading them back means dumping and parsing the
-// whole device configuration, and this runs on every relay and ICE transition.
-func (c *WGUSPConfigurer) peerAllowedIPs(peerKey wgtypes.Key) ([]netip.Prefix, error) {
-	if prefixes, ok := c.allowedIPs.get(peerKey); ok {
-		return prefixes, nil
-	}
-
-	ipcStr, err := c.device.IpcGet()
-	if err != nil {
-		return nil, fmt.Errorf("get IPC config: %w", err)
-	}
-
-	stats, err := parseStatus(c.deviceName, ipcStr)
-	if err != nil {
-		return nil, fmt.Errorf("parse IPC config: %w", err)
-	}
-
-	// parseStatus reports keys in their textual form, so the comparison needs it once.
-	wanted := peerKey.String()
-	for _, peer := range stats.Peers {
-		if peer.PublicKey != wanted {
-			continue
-		}
-
-		prefixes := ipNetsToPrefixes(peer.AllowedIPs)
-		c.allowedIPs.set(peerKey, prefixes)
-		return prefixes, nil
-	}
-
-	return nil, ErrPeerNotFound
-}
-
 func (c *WGUSPConfigurer) FullStats() (*Stats, error) {
-	ipcStr, err := c.device.IpcGet()
-	if err != nil {
-		return nil, fmt.Errorf("IpcGet failed: %w", err)
+	peers := c.device.Peers()
+	stats := &Stats{
+		DeviceName: c.deviceName,
+		PublicKey:  wgtypes.Key(c.device.PublicKey()).String(),
+		ListenPort: int(c.device.ListenPort()),
+		FWMark:     int(c.device.FirewallMark()),
+		Peers:      make([]Peer, 0, len(peers)),
 	}
-
-	return parseStatus(c.deviceName, ipcStr)
+	for _, peer := range peers {
+		stats.Peers = append(stats.Peers, peerStats(peer))
+	}
+	return stats, nil
 }
 
 func (c *WGUSPConfigurer) LastActivities() map[string]monotime.Time {
 	return c.activityRecorder.GetLastActivities()
 }
 
+func (c *WGUSPConfigurer) GetStats() (map[string]WGStats, error) {
+	return c.statsCache.get()
+}
+
+func (c *WGUSPConfigurer) Close() {
+	if c.uapiListener != nil {
+		err := c.uapiListener.Close()
+		if err != nil {
+			log.Errorf("failed to close uapi listener: %v", err)
+		}
+	}
+
+	if runtime.GOOS == "linux" {
+		sockPath := "/var/run/wireguard/" + c.deviceName + ".sock"
+		if _, statErr := os.Stat(sockPath); statErr == nil {
+			_ = os.Remove(sockPath)
+		}
+	}
+}
+
 // startUAPI starts the UAPI listener for managing the WireGuard interface via external tool
-func (t *WGUSPConfigurer) startUAPI() {
+func (c *WGUSPConfigurer) startUAPI() {
 	var err error
-	t.uapiListener, err = openUAPI(t.deviceName)
+	c.uapiListener, err = openUAPI(c.deviceName)
 	if err != nil {
 		log.Errorf("failed to open uapi listener: %v", err)
 		return
@@ -357,175 +265,61 @@ func (t *WGUSPConfigurer) startUAPI() {
 				return
 			}
 			go func() {
-				t.device.IpcHandle(uapiConn)
+				c.device.IpcHandle(uapiConn)
 			}()
 		}
-	}(t.uapiListener)
+	}(c.uapiListener)
 }
 
-func (t *WGUSPConfigurer) Close() {
-	if t.uapiListener != nil {
-		err := t.uapiListener.Close()
-		if err != nil {
-			log.Errorf("failed to close uapi listener: %v", err)
+func (c *WGUSPConfigurer) fetchStats() (map[string]WGStats, error) {
+	peers := c.device.Peers()
+	stats := make(map[string]WGStats, len(peers))
+	for _, peer := range peers {
+		stats[wgtypes.Key(peer.PublicKey()).String()] = WGStats{
+			LastHandshake: peer.LastHandshake(),
+			TxBytes:       int64(peer.TxBytes()),
+			RxBytes:       int64(peer.RxBytes()),
 		}
 	}
-
-	if runtime.GOOS == "linux" {
-		sockPath := "/var/run/wireguard/" + t.deviceName + ".sock"
-		if _, statErr := os.Stat(sockPath); statErr == nil {
-			_ = os.Remove(sockPath)
-		}
-	}
-}
-
-func (t *WGUSPConfigurer) GetStats() (map[string]WGStats, error) {
-	return t.statsCache.get()
-}
-
-func (t *WGUSPConfigurer) fetchStats() (map[string]WGStats, error) {
-	ipc, err := t.device.IpcGet()
-	if err != nil {
-		return nil, fmt.Errorf("ipc get: %w", err)
-	}
-
-	return parseTransfers(ipc)
-}
-
-func parseTransfers(ipc string) (map[string]WGStats, error) {
-	stats := make(map[string]WGStats)
-	var (
-		currentKey   string
-		currentStats WGStats
-		hasPeer      bool
-	)
-	lines := strings.Split(ipc, "\n")
-	for _, line := range lines {
-		line = strings.TrimSpace(line)
-
-		// If we're within the details of the found peer and encounter another public key,
-		// this means we're starting another peer's details. So, stop.
-		if strings.HasPrefix(line, "public_key=") {
-			peerID := strings.TrimPrefix(line, "public_key=")
-			h, err := hex.DecodeString(peerID)
-			if err != nil {
-				return nil, fmt.Errorf("decode peerID: %w", err)
-			}
-			currentKey = base64.StdEncoding.EncodeToString(h)
-			currentStats = WGStats{} // Reset stats for the new peer
-			hasPeer = true
-			stats[currentKey] = currentStats
-			continue
-		}
-
-		if !hasPeer {
-			continue
-		}
-
-		key := strings.SplitN(line, "=", 2)
-		if len(key) != 2 {
-			continue
-		}
-		switch key[0] {
-		case ipcKeyLastHandshakeTimeSec:
-			hs, err := toLastHandshake(key[1])
-			if err != nil {
-				return nil, err
-			}
-			currentStats.LastHandshake = hs
-			stats[currentKey] = currentStats
-		case ipcKeyRxBytes:
-			rxBytes, err := toBytes(key[1])
-			if err != nil {
-				return nil, fmt.Errorf("parse rx_bytes: %w", err)
-			}
-			currentStats.RxBytes = rxBytes
-			stats[currentKey] = currentStats
-		case ipcKeyTxBytes:
-			TxBytes, err := toBytes(key[1])
-			if err != nil {
-				return nil, fmt.Errorf("parse tx_bytes: %w", err)
-			}
-			currentStats.TxBytes = TxBytes
-			stats[currentKey] = currentStats
-		}
-	}
-
 	return stats, nil
 }
 
-func toWgUserspaceString(wgCfg wgtypes.Config) string {
-	var sb strings.Builder
-	if wgCfg.PrivateKey != nil {
-		hexKey := hex.EncodeToString(wgCfg.PrivateKey[:])
-		sb.WriteString(fmt.Sprintf("private_key=%s\n", hexKey))
+func peerStats(peer *device.Peer) Peer {
+	stats := Peer{
+		PublicKey:     wgtypes.Key(peer.PublicKey()).String(),
+		AllowedIPs:    prefixesToIPNets(peer.AllowedIPs()),
+		TxBytes:       int64(peer.TxBytes()),
+		RxBytes:       int64(peer.RxBytes()),
+		LastHandshake: peer.LastHandshake(),
+		PresharedKey:  [32]byte(peer.PresharedKey()),
 	}
-
-	if wgCfg.ListenPort != nil {
-		sb.WriteString(fmt.Sprintf("listen_port=%d\n", *wgCfg.ListenPort))
+	if addrPort, ok := endpointAddrPort(peer.Endpoint()); ok {
+		stats.Endpoint = net.UDPAddr{IP: addrPort.Addr().AsSlice(), Port: int(addrPort.Port())}
 	}
-
-	if wgCfg.ReplacePeers {
-		sb.WriteString("replace_peers=true\n")
-	}
-
-	if wgCfg.FirewallMark != nil {
-		sb.WriteString(fmt.Sprintf("fwmark=%d\n", *wgCfg.FirewallMark))
-	}
-
-	for _, p := range wgCfg.Peers {
-		hexKey := hex.EncodeToString(p.PublicKey[:])
-		sb.WriteString(fmt.Sprintf("public_key=%s\n", hexKey))
-
-		if p.Remove {
-			sb.WriteString("remove=true\n")
-		}
-
-		if p.UpdateOnly {
-			sb.WriteString("update_only=true\n")
-		}
-
-		if p.PresharedKey != nil {
-			preSharedHexKey := hex.EncodeToString(p.PresharedKey[:])
-			sb.WriteString(fmt.Sprintf("preshared_key=%s\n", preSharedHexKey))
-		}
-
-		if p.Endpoint != nil {
-			sb.WriteString(fmt.Sprintf("endpoint=%s\n", p.Endpoint.String()))
-		}
-
-		if p.PersistentKeepaliveInterval != nil {
-			sb.WriteString(fmt.Sprintf("persistent_keepalive_interval=%d\n", int(p.PersistentKeepaliveInterval.Seconds())))
-		}
-
-		if p.ReplaceAllowedIPs {
-			sb.WriteString("replace_allowed_ips=true\n")
-		}
-
-		for _, aip := range p.AllowedIPs {
-			sb.WriteString(fmt.Sprintf("allowed_ip=%s\n", aip.String()))
-		}
-	}
-	return sb.String()
+	return stats
 }
 
-func toLastHandshake(stringVar string) (time.Time, error) {
-	sec, err := strconv.ParseInt(stringVar, 10, 64)
+func endpointAddrPort(endpoint wgconn.Endpoint) (netip.AddrPort, bool) {
+	if endpoint == nil {
+		return netip.AddrPort{}, false
+	}
+	if ep, ok := endpoint.(*bind.Endpoint); ok {
+		return ep.AddrPort, true
+	}
+	addrPort, err := netip.ParseAddrPort(endpoint.DstToString())
 	if err != nil {
-		return time.Time{}, fmt.Errorf("parse handshake sec: %w", err)
+		return netip.AddrPort{}, false
 	}
-
-	// If sec is 0 (Unix epoch), return zero time instead
-	// This indicates no handshake has occurred
-	if sec == 0 {
-		return time.Time{}, nil
-	}
-
-	return time.Unix(sec, 0), nil
+	return addrPort, true
 }
 
-func toBytes(s string) (int64, error) {
-	return strconv.ParseInt(s, 10, 64)
+func validPrefixes(prefixes []netip.Prefix) ([]netip.Prefix, error) {
+	for _, prefix := range prefixes {
+		if !prefix.IsValid() {
+			return nil, fmt.Errorf("invalid allowed IP %v", prefix)
+		}
+	}
+	return normalizePrefixes(prefixes), nil
 }
 
 func getFwmark() int {
@@ -534,138 +328,3 @@ func getFwmark() int {
 	}
 	return 0
 }
-
-func hexToWireguardKey(hexKey string) (wgtypes.Key, error) {
-	// Decode hex string to bytes
-	keyBytes, err := hex.DecodeString(hexKey)
-	if err != nil {
-		return wgtypes.Key{}, fmt.Errorf("failed to decode hex key: %w", err)
-	}
-
-	// Check if we have the right number of bytes (WireGuard keys are 32 bytes)
-	if len(keyBytes) != 32 {
-		return wgtypes.Key{}, fmt.Errorf("invalid key length: expected 32 bytes, got %d", len(keyBytes))
-	}
-
-	// Convert to wgtypes.Key
-	var key wgtypes.Key
-	copy(key[:], keyBytes)
-
-	return key, nil
-}
-
-func parseStatus(deviceName, ipcStr string) (*Stats, error) {
-	stats := &Stats{DeviceName: deviceName}
-	var currentPeer *Peer
-	for _, line := range strings.Split(strings.TrimSpace(ipcStr), "\n") {
-		if line == "" {
-			continue
-		}
-		parts := strings.SplitN(line, "=", 2)
-		if len(parts) != 2 {
-			continue
-		}
-		key := parts[0]
-		val := parts[1]
-
-		switch key {
-		case privateKey:
-			key, err := hexToWireguardKey(val)
-			if err != nil {
-				log.Errorf("failed to parse private key: %v", err)
-				continue
-			}
-			stats.PublicKey = key.PublicKey().String()
-		case publicKey:
-			// Save previous peer
-			if currentPeer != nil {
-				stats.Peers = append(stats.Peers, *currentPeer)
-			}
-			key, err := hexToWireguardKey(val)
-			if err != nil {
-				log.Errorf("failed to parse public key: %v", err)
-				continue
-			}
-			currentPeer = &Peer{
-				PublicKey: key.String(),
-			}
-		case listenPort:
-			if port, err := strconv.Atoi(val); err == nil {
-				stats.ListenPort = port
-			}
-		case fwmark:
-			if fwmark, err := strconv.Atoi(val); err == nil {
-				stats.FWMark = fwmark
-			}
-		case endpoint:
-			if currentPeer == nil {
-				continue
-			}
-
-			host, portStr, err := net.SplitHostPort(val)
-			if err != nil {
-				log.Errorf("failed to parse endpoint: %v", err)
-				continue
-			}
-			port, err := strconv.Atoi(portStr)
-			if err != nil {
-				log.Errorf("failed to parse endpoint port: %v", err)
-				continue
-			}
-			currentPeer.Endpoint = net.UDPAddr{
-				IP:   net.ParseIP(host),
-				Port: port,
-			}
-		case allowedIP:
-			if currentPeer == nil {
-				continue
-			}
-			_, ipnet, err := net.ParseCIDR(val)
-			if err == nil {
-				currentPeer.AllowedIPs = append(currentPeer.AllowedIPs, *ipnet)
-			}
-		case ipcKeyTxBytes:
-			if currentPeer == nil {
-				continue
-			}
-			rxBytes, err := toBytes(val)
-			if err != nil {
-				continue
-			}
-			currentPeer.TxBytes = rxBytes
-		case ipcKeyRxBytes:
-			if currentPeer == nil {
-				continue
-			}
-			rxBytes, err := toBytes(val)
-			if err != nil {
-				continue
-			}
-			currentPeer.RxBytes = rxBytes
-
-		case ipcKeyLastHandshakeTimeSec:
-			if currentPeer == nil {
-				continue
-			}
-
-			ts, err := toLastHandshake(val)
-			if err != nil {
-				continue
-			}
-			currentPeer.LastHandshake = ts
-		case presharedKey:
-			if currentPeer == nil {
-				continue
-			}
-			if val != "" && val != "0000000000000000000000000000000000000000000000000000000000000000" {
-				if pskKey, err := hexToWireguardKey(val); err == nil {
-					currentPeer.PresharedKey = [32]byte(pskKey)
-				}
-			}
-		}
-	}
-	if currentPeer != nil {
-		stats.Peers = append(stats.Peers, *currentPeer)
-	}
-	return stats, nil
-}
diff --git a/client/iface/configurer/usp_allowedips_test.go b/client/iface/configurer/usp_allowedips_test.go
index fba0ca546..effb360e9 100644
--- a/client/iface/configurer/usp_allowedips_test.go
+++ b/client/iface/configurer/usp_allowedips_test.go
@@ -10,7 +10,6 @@ import (
 	"github.com/stretchr/testify/require"
 	wgconn "golang.zx2c4.com/wireguard/conn"
 	wgdevice "golang.zx2c4.com/wireguard/device"
-	"golang.zx2c4.com/wireguard/tun/tuntest"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
 	"github.com/netbirdio/netbird/client/iface/bind"
@@ -21,8 +20,7 @@ import (
 func newTestUSPConfigurer(t *testing.T) *WGUSPConfigurer {
 	t.Helper()
 
-	tun := tuntest.NewChannelTUN()
-	dev := wgdevice.NewDevice(tun.TUN(), wgconn.NewDefaultBind(), wgdevice.NewLogger(wgdevice.LogLevelSilent, ""))
+	dev := wgdevice.NewDevice(newIdleTUN(), wgconn.NewDefaultBind(), wgdevice.NewLogger(wgdevice.LogLevelSilent, ""))
 	t.Cleanup(dev.Close)
 
 	c := NewUSPConfigurerNoUAPI(dev, "wgtest0", bind.NewActivityRecorder())
@@ -118,27 +116,6 @@ func TestRemoveEndpointAddressDoesNotScaleWithPeerCount(t *testing.T) {
 		large, small)
 }
 
-// TestRemoveEndpointAddressFallsBackToDevice covers a peer the store never saw, which is what
-// an out-of-band reconfiguration of the device leaves behind. The device stays the source of
-// truth in that case, so the allowed IPs must still be preserved.
-func TestRemoveEndpointAddressFallsBackToDevice(t *testing.T) {
-	c := newTestUSPConfigurer(t)
-	peerKey := seedPeers(t, c, 3)[1]
-	require.NoError(t, c.AddAllowedIP(peerKey, netip.MustParsePrefix("10.20.0.0/16")), "add routed prefix")
-
-	before := peerAllowedIPs(t, c, peerKey)
-	c.allowedIPs.reset()
-
-	require.NoError(t, c.RemoveEndpointAddress(peerKey), "remove endpoint address")
-
-	assert.ElementsMatch(t, before, peerAllowedIPs(t, c, peerKey),
-		"allowed IPs recovered from the device must be preserved")
-
-	recovered, ok := c.allowedIPs.get(mustParseKey(t, peerKey))
-	assert.True(t, ok, "the fallback must seed the store so the next call skips the device dump")
-	assert.Len(t, recovered, 2, "seeded prefixes")
-}
-
 func TestRemoveAllowedIPKeepsTheOtherPrefixes(t *testing.T) {
 	c := newTestUSPConfigurer(t)
 	peerKey := seedPeers(t, c, 3)[0]
@@ -156,10 +133,8 @@ func TestRemoveAllowedIPKeepsTheOtherPrefixes(t *testing.T) {
 }
 
 // TestAddAllowedIPOnAbsentPeerDoesNotResurrectIt covers the lazy connection window documented
-// in #6863: AddAllowedIP is update-only, a silent no-op when the peer is absent, so it must not
-// leave the store claiming prefixes the device never took. RemoveEndpointAddress re-adds a peer
-// without update-only, so a phantom entry would create a peer the device had dropped, and a
-// created peer would steal those allowed IPs from whichever peer legitimately holds them.
+// in #6863: AddAllowedIP is update-only, a silent no-op when the peer is absent, and clearing
+// the endpoint of an absent peer must not create one either.
 func TestAddAllowedIPOnAbsentPeerDoesNotResurrectIt(t *testing.T) {
 	c := newTestUSPConfigurer(t)
 	seedPeers(t, c, 2)
@@ -253,16 +228,11 @@ func TestUpdatePeerDoesNotWidenAMappedPrefixOnTheDevice(t *testing.T) {
 	onDevice := peerAllowedIPs(t, c, peerKey)
 	assert.NotContains(t, onDevice, "0.0.0.0/0", "the device must not be given a catch-all allowed IP")
 	assert.Equal(t, []string{"10.1.0.0/16"}, onDevice, "the device holds the normalized prefix")
-
-	recorded, ok := c.allowedIPs.get(mustParseKey(t, peerKey))
-	require.True(t, ok, "the peer must be recorded")
-	require.Len(t, recorded, 1, "one prefix recorded")
-	assert.Equal(t, onDevice[0], recorded[0].String(), "device and store must agree")
 }
 
 // TestUpdatePeerWithAnUnusableEndpointTouchesNothing pins the ordering: the endpoint is
-// parsed before the device is configured, so a failure cannot leave the device holding a
-// peer that the store never learned about, with the prefix handover skipped along with it.
+// parsed before the device is configured, so a failure cannot leave a half-configured peer
+// on the device.
 func TestUpdatePeerWithAnUnusableEndpointTouchesNothing(t *testing.T) {
 	c := newTestUSPConfigurer(t)
 	seedPeers(t, c, 2)
@@ -279,40 +249,4 @@ func TestUpdatePeerWithAnUnusableEndpointTouchesNothing(t *testing.T) {
 	stats, err := c.FullStats()
 	require.NoError(t, err, "read device stats")
 	assert.Len(t, stats.Peers, 2, "the peer must not have reached the device")
-
-	_, ok := c.allowedIPs.get(mustParseKey(t, peerKey))
-	assert.False(t, ok, "the peer must not have been recorded either")
-}
-
-// TestRemovePeerKeepsTheRecordWhenTheDeviceRefuses covers a removal that never reached the
-// device. A single peer removal is one write, so a failure leaves the peer on the device
-// exactly as it was, and the record still describes it; dropping it would only force the
-// next caller to read the whole device back for an answer it already had.
-func TestRemovePeerKeepsTheRecordWhenTheDeviceRefuses(t *testing.T) {
-	c := newTestUSPConfigurer(t)
-	peerKey := seedPeers(t, c, 1)[0]
-	require.NoError(t, c.AddAllowedIP(peerKey, netip.MustParsePrefix("10.20.0.0/16")), "add routed prefix")
-
-	before, ok := c.allowedIPs.get(mustParseKey(t, peerKey))
-	require.True(t, ok, "the peer must be recorded before the removal")
-	require.Len(t, before, 2, "overlay address plus routed prefix")
-
-	// A closed device refuses every write, which is the shape of any failed removal.
-	c.device.Close()
-
-	require.Error(t, c.RemovePeer(peerKey), "the removal must report the failure")
-
-	after, ok := c.allowedIPs.get(mustParseKey(t, peerKey))
-	require.True(t, ok, "a peer still on the device must stay recorded")
-	assert.Equal(t, before, after, "the record must describe the peer the device kept")
-}
-
-// mustParseKey turns the textual key the configurer API takes into the form the store
-// keys on.
-func mustParseKey(t *testing.T, key string) wgtypes.Key {
-	t.Helper()
-
-	parsed, err := wgtypes.ParseKey(key)
-	require.NoError(t, err, "parse peer key")
-	return parsed
 }
diff --git a/client/iface/configurer/usp_test.go b/client/iface/configurer/usp_test.go
index e32491c54..48b5ad1f0 100644
--- a/client/iface/configurer/usp_test.go
+++ b/client/iface/configurer/usp_test.go
@@ -2,88 +2,222 @@ package configurer
 
 import (
 	"encoding/hex"
+	"net"
+	"net/netip"
+	"os"
+	"strings"
 	"testing"
+	"time"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	wgdevice "golang.zx2c4.com/wireguard/device"
+	"golang.zx2c4.com/wireguard/tun"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )
 
-var ipcFixture = `
-private_key=e84b5a6d2717c1003a13b431570353dbaca9146cf150c5f8575680feba52027a
-listen_port=12912
-public_key=b85996fecc9c7f1fc6d2572a76eda11d59bcd20be8e543b15ce4bd85a8e75a33
-preshared_key=188515093e952f5f22e865cef3012e72f8b5f0b598ac0309d5dacce3b70fcf52
-allowed_ip=192.168.4.4/32
-endpoint=[abcd:23::33%2]:51820
-public_key=58402e695ba1772b1cc9309755f043251ea77fdcf10fbe63989ceb7e19321376
-tx_bytes=38333
-rx_bytes=2224
-allowed_ip=192.168.4.6/32
-persistent_keepalive_interval=111
-endpoint=182.122.22.19:3233
-public_key=662e14fd594556f522604703340351258903b64f35553763f19426ab2a515c58
-endpoint=5.152.198.39:51820
-allowed_ip=192.168.4.10/32
-allowed_ip=192.168.4.11/32
-tx_bytes=1212111
-rx_bytes=1929999999
-protocol_version=1
-errno=0
+// idleTUN never reports an up event, so the wireguard-go device stays down: no socket is
+// opened, no peer goroutine starts, and the configuration state is all the tests observe.
+type idleTUN struct {
+	events chan tun.Event
+	closed chan struct{}
+}
 
-`
+func newIdleTUN() *idleTUN {
+	return &idleTUN{events: make(chan tun.Event), closed: make(chan struct{})}
+}
 
-func Test_parseTransfers(t *testing.T) {
-	tests := []struct {
-		name    string
-		peerKey string
-		want    WGStats
-	}{
-		{
-			name:    "single",
-			peerKey: "b85996fecc9c7f1fc6d2572a76eda11d59bcd20be8e543b15ce4bd85a8e75a33",
-			want: WGStats{
-				TxBytes: 0,
-				RxBytes: 0,
-			},
-		},
-		{
-			name:    "multiple",
-			peerKey: "58402e695ba1772b1cc9309755f043251ea77fdcf10fbe63989ceb7e19321376",
-			want: WGStats{
-				TxBytes: 38333,
-				RxBytes: 2224,
-			},
-		},
-		{
-			name:    "lastpeer",
-			peerKey: "662e14fd594556f522604703340351258903b64f35553763f19426ab2a515c58",
-			want: WGStats{
-				TxBytes: 1212111,
-				RxBytes: 1929999999,
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			res, err := hex.DecodeString(tt.peerKey)
-			require.NoError(t, err)
+func (t *idleTUN) File() *os.File { return nil }
 
-			key, err := wgtypes.NewKey(res)
-			require.NoError(t, err)
+func (t *idleTUN) Read([][]byte, []int, int) (int, error) {
+	<-t.closed
+	return 0, os.ErrClosed
+}
 
-			stats, err := parseTransfers(ipcFixture)
-			if err != nil {
-				require.NoError(t, err)
-				return
-			}
+func (t *idleTUN) Write(bufs [][]byte, _ int) (int, error) { return len(bufs), nil }
 
-			stat, ok := stats[key.String()]
-			if !ok {
-				require.True(t, ok)
-				return
-			}
+func (t *idleTUN) MTU() (int, error) { return 1420, nil }
 
-			require.Equal(t, tt.want, stat)
-		})
+func (t *idleTUN) Name() (string, error) { return "idle", nil }
+
+func (t *idleTUN) Events() <-chan tun.Event { return t.events }
+
+func (t *idleTUN) Close() error {
+	close(t.closed)
+	close(t.events)
+	return nil
+}
+
+func (t *idleTUN) BatchSize() int { return 1 }
+
+func TestConfigureInterfaceAppliesKeyAndPortAndReplacesPeers(t *testing.T) {
+	c := newTestUSPConfigurer(t)
+	seedPeers(t, c, 2)
+
+	key, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err, "generate device private key")
+	require.NoError(t, c.ConfigureInterface(key.String(), 51820), "reconfigure the interface")
+
+	stats, err := c.FullStats()
+	require.NoError(t, err, "read device stats")
+	assert.Equal(t, key.PublicKey().String(), stats.PublicKey, "device public key")
+	assert.Equal(t, 51820, stats.ListenPort, "listen port")
+	assert.Empty(t, stats.Peers, "configuring the interface replaces every peer")
+}
+
+func TestConfigureInterfaceRejectsAnInvalidPort(t *testing.T) {
+	c := newTestUSPConfigurer(t)
+
+	key, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err, "generate device private key")
+	assert.Error(t, c.ConfigureInterface(key.String(), 70000), "a port above 65535 must be rejected")
+}
+
+func TestGetStatsIsKeyedByPeerKey(t *testing.T) {
+	c := newTestUSPConfigurer(t)
+	keys := seedPeers(t, c, 3)
+
+	stats, err := c.GetStats()
+	require.NoError(t, err, "read stats")
+	require.Len(t, stats, 3, "one entry per peer")
+	for _, key := range keys {
+		entry, ok := stats[key]
+		require.True(t, ok, "peer %s must be reported", key)
+		assert.Zero(t, entry.TxBytes, "no traffic was sent")
+		assert.Zero(t, entry.RxBytes, "no traffic was received")
+		assert.True(t, entry.LastHandshake.IsZero(), "no handshake happened")
 	}
 }
+
+func TestFullStatsMatchesTheDeviceDump(t *testing.T) {
+	c := newTestUSPConfigurer(t)
+
+	priv, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err, "generate peer private key")
+	peerKey := priv.PublicKey().String()
+	psk, err := wgtypes.GenerateKey()
+	require.NoError(t, err, "generate preshared key")
+	endpoint := &net.UDPAddr{IP: net.IPv4(192, 0, 2, 10), Port: 51820}
+	prefixes := []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32"), netip.MustParsePrefix("10.20.0.0/16")}
+	require.NoError(t, c.UpdatePeer(peerKey, prefixes, 25*time.Second, endpoint, &psk), "add peer")
+
+	stats, err := c.FullStats()
+	require.NoError(t, err, "read device stats")
+	require.Len(t, stats.Peers, 1, "one peer on the device")
+	peer := stats.Peers[0]
+	assert.Equal(t, peerKey, peer.PublicKey, "peer key")
+	assert.Equal(t, "192.0.2.10:51820", peer.Endpoint.String(), "endpoint")
+	assert.Equal(t, [32]byte(psk), peer.PresharedKey, "preshared key")
+	assert.Equal(t, []string{"100.64.0.1/32", "10.20.0.0/16"}, ipNetStrings(peer.AllowedIPs), "allowed IPs")
+
+	block := uapiPeerBlock(t, c, peerKey)
+	assert.Contains(t, block, "endpoint=192.0.2.10:51820", "the dump must show the endpoint")
+	assert.Contains(t, block, "preshared_key="+hex.EncodeToString(psk[:]), "the dump must show the preshared key")
+	assert.Contains(t, block, "persistent_keepalive_interval=25", "the dump must show the keepalive")
+	assert.Contains(t, block, "allowed_ip=100.64.0.1/32", "the dump must show the first prefix")
+	assert.Contains(t, block, "allowed_ip=10.20.0.0/16", "the dump must show the second prefix")
+}
+
+func TestUpdatePeerKeepsTheEndpointZone(t *testing.T) {
+	c := newTestUSPConfigurer(t)
+
+	priv, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err, "generate peer private key")
+	peerKey := priv.PublicKey().String()
+	// The idle device opens no socket, so the zone name does not have to exist on the host.
+	endpoint := &net.UDPAddr{IP: net.ParseIP("fe80::1"), Port: 51820, Zone: "eth0"}
+	prefixes := []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32")}
+	require.NoError(t, c.UpdatePeer(peerKey, prefixes, 25*time.Second, endpoint, nil), "add peer")
+
+	assert.Contains(t, uapiPeerBlock(t, c, peerKey), "endpoint=[fe80::1%eth0]:51820",
+		"a link-local endpoint must keep its zone")
+}
+
+func TestRemoveEndpointAddressKeepsThePeerAndStopsTheKeepalive(t *testing.T) {
+	c := newTestUSPConfigurer(t)
+
+	priv, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err, "generate peer private key")
+	peerKey := priv.PublicKey().String()
+	endpoint := &net.UDPAddr{IP: net.IPv4(192, 0, 2, 10), Port: 51820}
+	prefixes := []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32")}
+	require.NoError(t, c.UpdatePeer(peerKey, prefixes, 25*time.Second, endpoint, nil), "add peer")
+	before := c.device.LookupPeer(wgdevice.NoisePublicKey(priv.PublicKey()))
+	require.NotNil(t, before, "the peer must be on the device")
+
+	require.NoError(t, c.RemoveEndpointAddress(peerKey), "remove endpoint address")
+
+	assert.Same(t, before, c.device.LookupPeer(wgdevice.NoisePublicKey(priv.PublicKey())),
+		"the peer object must survive the endpoint removal")
+	stats, err := c.FullStats()
+	require.NoError(t, err, "read device stats")
+	require.Len(t, stats.Peers, 1, "the peer stays configured")
+	assert.Nil(t, stats.Peers[0].Endpoint.IP, "the endpoint must be gone")
+	assert.Equal(t, []string{"100.64.0.1/32"}, ipNetStrings(stats.Peers[0].AllowedIPs), "allowed IPs survive")
+	assert.Contains(t, uapiPeerBlock(t, c, peerKey), "persistent_keepalive_interval=0",
+		"an endpoint-less peer must not keep sending keepalives")
+
+	require.NoError(t, c.UpdatePeer(peerKey, prefixes, 25*time.Second, endpoint, nil), "restore the endpoint")
+	block := uapiPeerBlock(t, c, peerKey)
+	assert.Contains(t, block, "endpoint=192.0.2.10:51820", "the endpoint must be back")
+	assert.Contains(t, block, "persistent_keepalive_interval=25", "the keepalive must be back")
+}
+
+func TestUpdatePeerRejectsAnInvalidPrefix(t *testing.T) {
+	c := newTestUSPConfigurer(t)
+
+	priv, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err, "generate peer private key")
+	peerKey := priv.PublicKey().String()
+
+	require.Error(t, c.UpdatePeer(peerKey, []netip.Prefix{{}}, 25*time.Second, nil, nil), "an invalid prefix must be rejected")
+
+	stats, err := c.FullStats()
+	require.NoError(t, err, "read device stats")
+	assert.Empty(t, stats.Peers, "the peer must not have reached the device")
+}
+
+func TestRemoveAllowedIPOnAbsentPeerReportsThePeer(t *testing.T) {
+	c := newTestUSPConfigurer(t)
+
+	priv, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err, "generate peer private key")
+
+	assert.ErrorIs(t, c.RemoveAllowedIP(priv.PublicKey().String(), netip.MustParsePrefix("10.20.0.0/16")), ErrPeerNotFound,
+		"removing a prefix from a peer the device does not have must report the peer")
+}
+
+func ipNetStrings(ipNets []net.IPNet) []string {
+	out := make([]string, 0, len(ipNets))
+	for _, ipNet := range ipNets {
+		out = append(out, ipNet.String())
+	}
+	return out
+}
+
+// uapiPeerBlock reads the device back through the UAPI dump, so a typed write is checked
+// against an independent view of the device.
+func uapiPeerBlock(t *testing.T, c *WGUSPConfigurer, peerKey string) []string {
+	t.Helper()
+
+	parsed, err := wgtypes.ParseKey(peerKey)
+	require.NoError(t, err, "parse peer key")
+	wanted := "public_key=" + hex.EncodeToString(parsed[:])
+
+	dump, err := c.device.IpcGet()
+	require.NoError(t, err, "dump device")
+
+	var block []string
+	inBlock := false
+	for _, line := range strings.Split(strings.TrimSpace(dump), "\n") {
+		if strings.HasPrefix(line, "public_key=") {
+			inBlock = line == wanted
+			continue
+		}
+		if inBlock {
+			block = append(block, line)
+		}
+	}
+	require.NotEmpty(t, block, "peer %s must appear in the dump", peerKey)
+	return block
+}
diff --git a/go.mod b/go.mod
index a365ffc27..fa7047bd8 100644
--- a/go.mod
+++ b/go.mod
@@ -369,7 +369,7 @@ replace github.com/kardianos/service => github.com/netbirdio/service v0.0.0-2024
 
 replace github.com/getlantern/systray => github.com/netbirdio/systray v0.0.0-20231030152038-ef1ed2a27949
 
-replace golang.zx2c4.com/wireguard => github.com/netbirdio/wireguard-go v0.0.0-20260914123147-8bf8fa968f1a
+replace golang.zx2c4.com/wireguard => github.com/netbirdio/wireguard-go v0.0.0-20261008122457-d2b1ce9bfee9
 
 replace github.com/cloudflare/circl => codeberg.org/cunicu/circl v0.0.0-20230801113412-fec58fc7b5f6
 
diff --git a/go.sum b/go.sum
index 9e3adae98..55b3edf85 100644
--- a/go.sum
+++ b/go.sum
@@ -541,8 +541,8 @@ github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45/go.mod h1:5/sjFmLb8O96B5737VCqhHyGRzNFIaN/Bu7ZodXc3qQ=
 github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260928122122-d1db5fa35318 h1:Qv2jYeucRkuqkkM9aAVFcO9avmSfPEoB+gxKKKuI4vA=
 github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260928122122-d1db5fa35318/go.mod h1:62UsqQRqanuCbFi6xElIw3/2X+yGF+TKlyiWImA5taU=
-github.com/netbirdio/wireguard-go v0.0.0-20260914123147-8bf8fa968f1a h1:Nt8BgkTkI56LGBPPEBywM406MVKJDqeDIVdgsZyYs80=
-github.com/netbirdio/wireguard-go v0.0.0-20260914123147-8bf8fa968f1a/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
+github.com/netbirdio/wireguard-go v0.0.0-20261008122457-d2b1ce9bfee9 h1:Mjt3tIBGa1/mJh1Xn8uZP30cd2VYd0NHANqTn+HBsaU=
+github.com/netbirdio/wireguard-go v0.0.0-20261008122457-d2b1ce9bfee9/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
 github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
 github.com/nxadm/tail v1.4.11 h1:8feyoE3OzPrcshW5/MJ4sGESc5cqmGkGCWlco4l0bqY=

From 5c9c64e3e0125785bfcb3a3f4b9eb1f05714e118 Mon Sep 17 00:00:00 2001
From: Zoltan Papp <zoltan.pmail@gmail.com>
Date: Mon, 12 Oct 2026 11:28:37 +0200
Subject: [PATCH 38/70] [client] Reuse one wgctrl client in the kernel
 configurer (#7912)

* [client] Reuse one wgctrl client in the kernel configurer

The kernel configurer opened a new wgctrl client for every request,
paying a socket open, a generic netlink family lookup and a close on
each peer update. With 10000 peers a single update dropped from about
37us to 10us per call once the client is kept open.

The configurer now opens the client lazily on the first request and
keeps it. A failed request drops the client so the next one opens a
fresh socket: a reply cut short mid-dump leaves stale messages in the
netlink buffer, and reusing that socket would fail every later request
on a sequence mismatch. The failed request is not retried.

Close releases the client and rejects later requests instead of
reopening a socket nobody would close. The kernel device never closed
its configurer, so it now keeps it and closes it on teardown.
---
 client/iface/configurer/kernel_unix.go      | 146 ++++++++++-------
 client/iface/configurer/kernel_unix_test.go | 167 ++++++++++++++++++++
 client/iface/device/device_kernel_unix.go   |  16 +-
 3 files changed, 271 insertions(+), 58 deletions(-)
 create mode 100644 client/iface/configurer/kernel_unix_test.go

diff --git a/client/iface/configurer/kernel_unix.go b/client/iface/configurer/kernel_unix.go
index 7b1ad9683..afe1300d5 100644
--- a/client/iface/configurer/kernel_unix.go
+++ b/client/iface/configurer/kernel_unix.go
@@ -3,10 +3,12 @@
 package configurer
 
 import (
+	"errors"
 	"fmt"
 	"net"
 	"net/netip"
 	"slices"
+	"sync"
 	"time"
 
 	log "github.com/sirupsen/logrus"
@@ -16,18 +18,38 @@ import (
 	"github.com/netbirdio/netbird/monotime"
 )
 
+var errConfigurerClosed = errors.New("configurer closed")
+
+type wgClient interface {
+	Device(name string) (*wgtypes.Device, error)
+	ConfigureDevice(name string, cfg wgtypes.Config) error
+	Close() error
+}
+
 type KernelConfigurer struct {
-	deviceName string
-	statsCache *statsCache
-	allowedIPs *allowedIPStore
+	deviceName  string
+	statsCache  *statsCache
+	allowedIPs  *allowedIPStore
+	newWgctrlFn func() (wgClient, error)
+
+	clientMu sync.Mutex
+	client   wgClient
+	closed   bool
 }
 
 // NewKernelConfigurer creates a configurer with an empty allowed IP mirror
 // and a statistics cache for the named kernel device.
 func NewKernelConfigurer(deviceName string) *KernelConfigurer {
+	return newKernelConfigurer(deviceName, func() (wgClient, error) {
+		return wgctrl.New()
+	})
+}
+
+func newKernelConfigurer(deviceName string, newWgctrlFn func() (wgClient, error)) *KernelConfigurer {
 	c := &KernelConfigurer{
-		deviceName: deviceName,
-		allowedIPs: newAllowedIPStore(),
+		deviceName:  deviceName,
+		allowedIPs:  newAllowedIPStore(),
+		newWgctrlFn: newWgctrlFn,
 	}
 	c.statsCache = newStatsCache(statsCacheTTL, c.fetchStats)
 	return c
@@ -242,7 +264,7 @@ func (c *KernelConfigurer) peerAllowedIPs(peerKey wgtypes.Key) ([]netip.Prefix,
 		return prefixes, nil
 	}
 
-	existingPeer, err := c.getPeer(c.deviceName, peerKey)
+	existingPeer, err := c.getPeer(peerKey)
 	if err != nil {
 		return nil, fmt.Errorf("get peer: %w", err)
 	}
@@ -254,21 +276,10 @@ func (c *KernelConfigurer) peerAllowedIPs(peerKey wgtypes.Key) ([]netip.Prefix,
 
 // getPeer scans the device for one peer. wgtypes.Key is an array, so the comparison is a
 // plain equality: Key.String would base64 encode into a fresh allocation for every peer.
-func (c *KernelConfigurer) getPeer(ifaceName string, peerPubKey wgtypes.Key) (wgtypes.Peer, error) {
-	wg, err := wgctrl.New()
+func (c *KernelConfigurer) getPeer(peerPubKey wgtypes.Key) (wgtypes.Peer, error) {
+	wgDevice, err := c.device()
 	if err != nil {
-		return wgtypes.Peer{}, fmt.Errorf("wgctl: %w", err)
-	}
-	defer func() {
-		err = wg.Close()
-		if err != nil {
-			log.Errorf("Got error while closing wgctl: %v", err)
-		}
-	}()
-
-	wgDevice, err := wg.Device(ifaceName)
-	if err != nil {
-		return wgtypes.Peer{}, fmt.Errorf("get device %s: %w", ifaceName, err)
+		return wgtypes.Peer{}, err
 	}
 	for _, peer := range wgDevice.Peers {
 		if peer.PublicKey == peerPubKey {
@@ -279,37 +290,73 @@ func (c *KernelConfigurer) getPeer(ifaceName string, peerPubKey wgtypes.Key) (wg
 }
 
 func (c *KernelConfigurer) configure(config wgtypes.Config) error {
-	wg, err := wgctrl.New()
+	c.clientMu.Lock()
+	defer c.clientMu.Unlock()
+
+	client, err := c.clientLocked()
 	if err != nil {
 		return err
 	}
-	defer func() {
-		if err := wg.Close(); err != nil {
-			log.Errorf("Failed to close wgctrl client: %v", err)
-		}
-	}()
-
-	return wg.ConfigureDevice(c.deviceName, config)
+	if err := client.ConfigureDevice(c.deviceName, config); err != nil {
+		c.discardLocked()
+		return err
+	}
+	return nil
 }
 
-func (c *KernelConfigurer) Close() {
+func (c *KernelConfigurer) device() (*wgtypes.Device, error) {
+	c.clientMu.Lock()
+	defer c.clientMu.Unlock()
+
+	client, err := c.clientLocked()
+	if err != nil {
+		return nil, err
+	}
+	wgDevice, err := client.Device(c.deviceName)
+	if err != nil {
+		c.discardLocked()
+		return nil, fmt.Errorf("get device %s: %w", c.deviceName, err)
+	}
+	return wgDevice, nil
 }
 
-func (c *KernelConfigurer) FullStats() (*Stats, error) {
-	wg, err := wgctrl.New()
+func (c *KernelConfigurer) clientLocked() (wgClient, error) {
+	if c.closed {
+		return nil, errConfigurerClosed
+	}
+	if c.client != nil {
+		return c.client, nil
+	}
+	client, err := c.newWgctrlFn()
 	if err != nil {
 		return nil, fmt.Errorf("wgctl: %w", err)
 	}
-	defer func() {
-		err = wg.Close()
-		if err != nil {
-			log.Errorf("Got error while closing wgctl: %v", err)
-		}
-	}()
+	c.client = client
+	return client, nil
+}
 
-	wgDevice, err := wg.Device(c.deviceName)
+func (c *KernelConfigurer) discardLocked() {
+	if c.client == nil {
+		return
+	}
+	if err := c.client.Close(); err != nil {
+		log.Warnf("failed to close wgctrl client: %v", err)
+	}
+	c.client = nil
+}
+
+func (c *KernelConfigurer) Close() {
+	c.clientMu.Lock()
+	defer c.clientMu.Unlock()
+
+	c.closed = true
+	c.discardLocked()
+}
+
+func (c *KernelConfigurer) FullStats() (*Stats, error) {
+	wgDevice, err := c.device()
 	if err != nil {
-		return nil, fmt.Errorf("get device %s: %w", c.deviceName, err)
+		return nil, err
 	}
 	fullStats := &Stats{
 		DeviceName: wgDevice.Name,
@@ -345,23 +392,12 @@ func (c *KernelConfigurer) LastActivities() map[string]monotime.Time {
 }
 
 func (c *KernelConfigurer) fetchStats() (map[string]WGStats, error) {
+	wgDevice, err := c.device()
+	if err != nil {
+		return nil, err
+	}
+
 	stats := make(map[string]WGStats)
-	wg, err := wgctrl.New()
-	if err != nil {
-		return nil, fmt.Errorf("wgctl: %w", err)
-	}
-	defer func() {
-		err = wg.Close()
-		if err != nil {
-			log.Errorf("Got error while closing wgctl: %v", err)
-		}
-	}()
-
-	wgDevice, err := wg.Device(c.deviceName)
-	if err != nil {
-		return nil, fmt.Errorf("get device %s: %w", c.deviceName, err)
-	}
-
 	for _, peer := range wgDevice.Peers {
 		stats[peer.PublicKey.String()] = WGStats{
 			LastHandshake: peer.LastHandshakeTime,
diff --git a/client/iface/configurer/kernel_unix_test.go b/client/iface/configurer/kernel_unix_test.go
new file mode 100644
index 000000000..8daa15a25
--- /dev/null
+++ b/client/iface/configurer/kernel_unix_test.go
@@ -0,0 +1,167 @@
+//go:build (linux && !android) || freebsd
+
+package configurer
+
+import (
+	"errors"
+	"sync"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+)
+
+type fakeWGClient struct {
+	configureErr error
+	deviceErr    error
+	calls        int
+	closed       bool
+}
+
+type fakeWGClientFactory struct {
+	openErr error
+	clients []*fakeWGClient
+}
+
+func (f *fakeWGClient) Device(string) (*wgtypes.Device, error) {
+	f.calls++
+	if f.deviceErr != nil {
+		return nil, f.deviceErr
+	}
+	return &wgtypes.Device{}, nil
+}
+
+func (f *fakeWGClient) ConfigureDevice(string, wgtypes.Config) error {
+	f.calls++
+	return f.configureErr
+}
+
+func (f *fakeWGClient) Close() error {
+	f.closed = true
+	return nil
+}
+
+func (f *fakeWGClientFactory) open() (wgClient, error) {
+	if f.openErr != nil {
+		return nil, f.openErr
+	}
+	client := &fakeWGClient{}
+	f.clients = append(f.clients, client)
+	return client, nil
+}
+
+func TestKernelConfigurer_ReusesClientAcrossRequests(t *testing.T) {
+	c, factory := newFakeKernelConfigurer()
+	peerKey := testPeerKey(t)
+
+	require.NoError(t, c.RemovePeer(peerKey))
+	require.NoError(t, c.RemovePeer(peerKey))
+	_, err := c.FullStats()
+	require.NoError(t, err)
+
+	require.Len(t, factory.clients, 1, "all requests should share one client")
+	assert.Equal(t, 3, factory.clients[0].calls, "every request should go through the shared client")
+	assert.False(t, factory.clients[0].closed, "a healthy client should stay open")
+}
+
+func TestKernelConfigurer_ReopensClientAfterFailedConfigure(t *testing.T) {
+	c, factory := newFakeKernelConfigurer()
+	peerKey := testPeerKey(t)
+
+	require.NoError(t, c.RemovePeer(peerKey))
+	require.Len(t, factory.clients, 1)
+
+	factory.clients[0].configureErr = errors.New("netlink down")
+	require.Error(t, c.RemovePeer(peerKey))
+	assert.True(t, factory.clients[0].closed, "the failed client should be closed")
+	assert.Len(t, factory.clients, 1, "a failure must not open a client on its own")
+
+	require.NoError(t, c.RemovePeer(peerKey))
+	require.Len(t, factory.clients, 2, "the next request should open a fresh client")
+	assert.Equal(t, 1, factory.clients[1].calls, "the request should run on the fresh client")
+	assert.False(t, factory.clients[1].closed, "the fresh client should stay open")
+}
+
+func TestKernelConfigurer_ReopensClientAfterFailedDeviceQuery(t *testing.T) {
+	c, factory := newFakeKernelConfigurer()
+
+	_, err := c.FullStats()
+	require.NoError(t, err)
+	require.Len(t, factory.clients, 1)
+
+	factory.clients[0].deviceErr = errors.New("netlink down")
+	_, err = c.FullStats()
+	require.Error(t, err)
+	assert.True(t, factory.clients[0].closed, "the failed client should be closed")
+
+	_, err = c.FullStats()
+	require.NoError(t, err)
+	assert.Len(t, factory.clients, 2, "the next request should open a fresh client")
+}
+
+func TestKernelConfigurer_RetriesOpenOnNextRequest(t *testing.T) {
+	c, factory := newFakeKernelConfigurer()
+	peerKey := testPeerKey(t)
+
+	factory.openErr = errors.New("no netlink")
+	require.Error(t, c.RemovePeer(peerKey))
+	assert.Empty(t, factory.clients, "a failed open leaves no client behind")
+
+	factory.openErr = nil
+	require.NoError(t, c.RemovePeer(peerKey))
+	assert.Len(t, factory.clients, 1, "the next request should open the client")
+}
+
+func TestKernelConfigurer_CloseRejectsFurtherRequests(t *testing.T) {
+	c, factory := newFakeKernelConfigurer()
+	peerKey := testPeerKey(t)
+
+	require.NoError(t, c.RemovePeer(peerKey))
+	require.Len(t, factory.clients, 1)
+
+	c.Close()
+	c.Close()
+	assert.True(t, factory.clients[0].closed, "Close should release the client")
+
+	require.ErrorIs(t, c.RemovePeer(peerKey), errConfigurerClosed)
+	_, err := c.FullStats()
+	require.ErrorIs(t, err, errConfigurerClosed)
+	assert.Len(t, factory.clients, 1, "a closed configurer must not open a client")
+}
+
+func TestKernelConfigurer_ConcurrentRequestsShareOneClient(t *testing.T) {
+	c, factory := newFakeKernelConfigurer()
+	peerKey := testPeerKey(t)
+
+	const workers = 16
+	errs := make(chan error, workers)
+	var wg sync.WaitGroup
+	for range workers {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			errs <- c.RemovePeer(peerKey)
+		}()
+	}
+	wg.Wait()
+	close(errs)
+	for err := range errs {
+		require.NoError(t, err)
+	}
+
+	require.Len(t, factory.clients, 1, "concurrent requests should share one client")
+	assert.Equal(t, workers, factory.clients[0].calls, "every request should reach the shared client")
+}
+
+func newFakeKernelConfigurer() (*KernelConfigurer, *fakeWGClientFactory) {
+	factory := &fakeWGClientFactory{}
+	return newKernelConfigurer("wt0", factory.open), factory
+}
+
+func testPeerKey(t *testing.T) string {
+	t.Helper()
+	key, err := wgtypes.GeneratePrivateKey()
+	require.NoError(t, err)
+	return key.PublicKey().String()
+}
diff --git a/client/iface/device/device_kernel_unix.go b/client/iface/device/device_kernel_unix.go
index 3c429fb96..ee965dd24 100644
--- a/client/iface/device/device_kernel_unix.go
+++ b/client/iface/device/device_kernel_unix.go
@@ -32,6 +32,7 @@ type TunKernelDevice struct {
 	link       *wgLink
 	udpMuxConn net.PacketConn
 	udpMux     *udpmux.UniversalUDPMuxDefault
+	configurer WGConfigurer
 }
 
 func NewKernelDevice(name string, address wgaddr.Address, wgPort int, key string, mtu uint16, transportNet transport.Net) *TunKernelDevice {
@@ -68,13 +69,18 @@ func (t *TunKernelDevice) Create() (WGConfigurer, error) {
 		return nil, fmt.Errorf("set mtu: %w", err)
 	}
 
-	configurer := configurer.NewKernelConfigurer(t.name)
+	cfg := configurer.NewKernelConfigurer(t.name)
 
-	if err := configurer.ConfigureInterface(t.key, t.wgPort); err != nil {
+	if err := cfg.ConfigureInterface(t.key, t.wgPort); err != nil {
+		cfg.Close()
 		return nil, fmt.Errorf("error configuring interface: %s", err)
 	}
 
-	return configurer, nil
+	if t.configurer != nil {
+		t.configurer.Close()
+	}
+	t.configurer = cfg
+	return cfg, nil
 }
 
 func (t *TunKernelDevice) Up() (*udpmux.UniversalUDPMuxDefault, error) {
@@ -132,6 +138,10 @@ func (t *TunKernelDevice) Close() error {
 		closErr = err
 	}
 
+	if t.configurer != nil {
+		t.configurer.Close()
+	}
+
 	if t.udpMux != nil {
 		if err := t.udpMux.Close(); err != nil {
 			log.Debugf("failed to close udp mux: %s", err)

From a7a2575bad46d02ed9a5860aa87cbb57c4a97445 Mon Sep 17 00:00:00 2001
From: Maycon Santos <mlsmaycon@gmail.com>
Date: Mon, 12 Oct 2026 12:09:09 +0200
Subject: [PATCH 39/70] [proxy] Add middleware snapshot revisions (#8114)

Version middleware snapshots so callers can reject stale policies. Existing Rebuild callers remain supported.

Validation: middleware race tests and scoped lint passed.
---
 proxy/internal/middleware/manager.go          |  63 ++++-
 .../middleware/manager_revision_test.go       | 230 ++++++++++++++++++
 2 files changed, 280 insertions(+), 13 deletions(-)
 create mode 100644 proxy/internal/middleware/manager_revision_test.go

diff --git a/proxy/internal/middleware/manager.go b/proxy/internal/middleware/manager.go
index 9b22edeff..14ed0b894 100644
--- a/proxy/internal/middleware/manager.go
+++ b/proxy/internal/middleware/manager.go
@@ -29,6 +29,10 @@ type PathTargetBinding struct {
 	Specs     []Spec
 }
 
+// Revision identifies a service's middleware binding snapshot. Zero is
+// reserved for routes that are not coupled to a manager snapshot.
+type Revision uint64
+
 // LiveServiceCheck reports whether the given service ID is still
 // present in the proxy's live mapping cache. The Manager calls it
 // during InvalidateMiddleware so a chain whose service has been
@@ -42,14 +46,16 @@ type LiveServiceCheck func(serviceID string) bool
 // InvalidateMiddleware find the chain keys that reference a given
 // middleware without scanning the whole table.
 type chainTable struct {
-	byTarget     map[string]*Chain
-	byMiddleware map[string]map[string]struct{}
+	byTarget        map[string]*Chain
+	byMiddleware    map[string]map[string]struct{}
+	serviceRevision map[string]Revision
 }
 
 func newChainTable() *chainTable {
 	return &chainTable{
-		byTarget:     make(map[string]*Chain),
-		byMiddleware: make(map[string]map[string]struct{}),
+		byTarget:        make(map[string]*Chain),
+		byMiddleware:    make(map[string]map[string]struct{}),
+		serviceRevision: make(map[string]Revision),
 	}
 }
 
@@ -65,6 +71,9 @@ func (c *chainTable) clone() *chainTable {
 		}
 		out.byMiddleware[id] = set
 	}
+	for serviceID, revision := range c.serviceRevision {
+		out.serviceRevision[serviceID] = revision
+	}
 	return out
 }
 
@@ -121,6 +130,7 @@ type Manager struct {
 	resolver         *Resolver
 	lastBindings     map[string]PathTargetBinding
 	liveServiceCheck atomic.Pointer[LiveServiceCheck]
+	nextRevision     Revision
 }
 
 // NewManager constructs a Manager with the given capture budget size.
@@ -179,14 +189,29 @@ func (m *Manager) Dispatcher() *Dispatcher {
 	return m.dispatcher
 }
 
-// Rebuild replaces every chain keyed by serviceID with the provided
-// bindings. Entries for other services are preserved. Replaced chains
-// are closed asynchronously after the atomic swap so in-flight
-// requests against the previous chain finish before middleware
-// resources are released.
+// Rebuild replaces every chain keyed by serviceID with the provided bindings.
+// It is the compatibility wrapper for callers that do not consume revisions.
 func (m *Manager) Rebuild(serviceID string, bindings []PathTargetBinding) error {
+	_, err := m.RebuildSnapshot(serviceID, bindings)
+	return err
+}
+
+// RebuildSnapshot atomically replaces a service's chains and assigns a nonzero
+// revision, including for empty bindings. Retired chains close asynchronously.
+func (m *Manager) RebuildSnapshot(serviceID string, bindings []PathTargetBinding) (Revision, error) {
+	for _, b := range bindings {
+		if b.ServiceID != serviceID {
+			return 0, fmt.Errorf("binding service %q does not match rebuild service %q", b.ServiceID, serviceID)
+		}
+	}
+
 	m.writeMu.Lock()
 	defer m.writeMu.Unlock()
+	if m.nextRevision == ^Revision(0) {
+		return 0, fmt.Errorf("middleware snapshot revision exhausted")
+	}
+	m.nextRevision++
+	revision := m.nextRevision
 
 	cur := m.chains.Load()
 	next := cur.clone()
@@ -205,9 +230,6 @@ func (m *Manager) Rebuild(serviceID string, bindings []PathTargetBinding) error
 	}
 
 	for _, b := range bindings {
-		if b.ServiceID != serviceID {
-			return fmt.Errorf("binding service %q does not match rebuild service %q", b.ServiceID, serviceID)
-		}
 		key := chainKey(b.ServiceID, b.PathID)
 		m.lastBindings[key] = cloneBinding(b)
 		chain := m.buildChain(b)
@@ -217,10 +239,11 @@ func (m *Manager) Rebuild(serviceID string, bindings []PathTargetBinding) error
 		}
 		next.addChain(key, chain)
 	}
+	next.serviceRevision[serviceID] = revision
 
 	m.chains.Store(next)
 	m.closeChainsAsync(retired)
-	return nil
+	return revision, nil
 }
 
 // Invalidate drops every chain for the given service ID.
@@ -246,6 +269,7 @@ func (m *Manager) Invalidate(serviceID string) {
 			delete(m.lastBindings, k)
 		}
 	}
+	delete(next.serviceRevision, serviceID)
 	m.chains.Store(next)
 	m.closeChainsAsync(retired)
 }
@@ -359,6 +383,19 @@ func (m *Manager) ChainFor(serviceID, pathID string) *Chain {
 	return c
 }
 
+// ChainForRevision returns a chain only if the service revision matches.
+// A matching revision with a nil chain is a coherent chainless target. Zero never matches.
+func (m *Manager) ChainForRevision(serviceID, pathID string, revision Revision) (*Chain, bool) {
+	if revision == 0 {
+		return nil, false
+	}
+	tbl := m.chains.Load()
+	if tbl == nil || tbl.serviceRevision[serviceID] != revision {
+		return nil, false
+	}
+	return tbl.byTarget[chainKey(serviceID, pathID)], true
+}
+
 // buildChain resolves each enabled spec and returns the assembled
 // chain. Returns a nil chain when no middlewares are bound; resolver
 // errors per middleware are logged and counted but do not abort the
diff --git a/proxy/internal/middleware/manager_revision_test.go b/proxy/internal/middleware/manager_revision_test.go
new file mode 100644
index 000000000..491b550c7
--- /dev/null
+++ b/proxy/internal/middleware/manager_revision_test.go
@@ -0,0 +1,230 @@
+package middleware
+
+import (
+	"context"
+	"sync"
+	"sync/atomic"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const revisionTestMiddlewareID = "revision_test"
+
+type revisionTestFactory struct {
+	builds atomic.Int64
+}
+
+func (f *revisionTestFactory) ID() string {
+	return revisionTestMiddlewareID
+}
+
+func (f *revisionTestFactory) New(_ []byte) (Middleware, error) {
+	f.builds.Add(1)
+	return revisionTestMiddleware{}, nil
+}
+
+type revisionTestMiddleware struct{}
+
+func (revisionTestMiddleware) ID() string                     { return revisionTestMiddlewareID }
+func (revisionTestMiddleware) Version() string                { return "test" }
+func (revisionTestMiddleware) Slot() Slot                     { return SlotOnRequest }
+func (revisionTestMiddleware) AcceptedContentTypes() []string { return nil }
+func (revisionTestMiddleware) MetadataKeys() []string         { return nil }
+func (revisionTestMiddleware) MutationsSupported() bool       { return false }
+func (revisionTestMiddleware) Invoke(context.Context, *Input) (*Output, error) {
+	return &Output{Decision: DecisionAllow}, nil
+}
+func (revisionTestMiddleware) Close() error { return nil }
+
+func newRevisionTestManager(t *testing.T) (*Manager, *revisionTestFactory) {
+	t.Helper()
+	factory := &revisionTestFactory{}
+	registry := NewRegistry()
+	require.NoError(t, registry.Register(factory))
+	manager := NewManager(1, nil, nil)
+	manager.SetResolver(NewResolver(registry))
+	return manager, factory
+}
+
+func revisionTestBinding(serviceID, pathID string) PathTargetBinding {
+	return PathTargetBinding{
+		ServiceID: serviceID,
+		PathID:    pathID,
+		Specs: []Spec{{
+			ID:      revisionTestMiddlewareID,
+			Slot:    SlotOnRequest,
+			Enabled: true,
+		}},
+	}
+}
+
+func TestManagerRebuildSnapshotRevisionLookup(t *testing.T) {
+	manager, _ := newRevisionTestManager(t)
+	binding := revisionTestBinding("service", "/")
+
+	revision1, err := manager.RebuildSnapshot("service", []PathTargetBinding{binding})
+	require.NoError(t, err)
+	require.NotZero(t, revision1)
+	chain1, match := manager.ChainForRevision("service", "/", revision1)
+	require.True(t, match)
+	require.NotNil(t, chain1)
+
+	revision2, err := manager.RebuildSnapshot("service", []PathTargetBinding{binding})
+	require.NoError(t, err)
+	assert.NotEqual(t, revision1, revision2)
+	chain2, match := manager.ChainForRevision("service", "/", revision2)
+	require.True(t, match)
+	require.NotNil(t, chain2)
+	assert.NotSame(t, chain1, chain2)
+
+	stale, match := manager.ChainForRevision("service", "/", revision1)
+	assert.False(t, match)
+	assert.Nil(t, stale)
+	zero, match := manager.ChainForRevision("service", "/", 0)
+	assert.False(t, match)
+	assert.Nil(t, zero)
+}
+
+func TestManagerRebuildSnapshotTracksChainlessTransitions(t *testing.T) {
+	manager, _ := newRevisionTestManager(t)
+
+	chainlessRevision, err := manager.RebuildSnapshot("service", nil)
+	require.NoError(t, err)
+	chain, match := manager.ChainForRevision("service", "/", chainlessRevision)
+	assert.True(t, match)
+	assert.Nil(t, chain)
+
+	chainRevision, err := manager.RebuildSnapshot("service", []PathTargetBinding{
+		revisionTestBinding("service", "/"),
+	})
+	require.NoError(t, err)
+	_, match = manager.ChainForRevision("service", "/", chainlessRevision)
+	assert.False(t, match)
+	chain, match = manager.ChainForRevision("service", "/", chainRevision)
+	assert.True(t, match)
+	assert.NotNil(t, chain)
+
+	chainlessRevision2, err := manager.RebuildSnapshot("service", nil)
+	require.NoError(t, err)
+	_, match = manager.ChainForRevision("service", "/", chainRevision)
+	assert.False(t, match)
+	chain, match = manager.ChainForRevision("service", "/", chainlessRevision2)
+	assert.True(t, match)
+	assert.Nil(t, chain)
+}
+
+func TestManagerInvalidateMiddlewarePreservesServiceRevision(t *testing.T) {
+	manager, factory := newRevisionTestManager(t)
+	revision, err := manager.RebuildSnapshot("service", []PathTargetBinding{
+		revisionTestBinding("service", "/"),
+	})
+	require.NoError(t, err)
+	chain1, match := manager.ChainForRevision("service", "/", revision)
+	require.True(t, match)
+	require.NotNil(t, chain1)
+
+	manager.InvalidateMiddleware(revisionTestMiddlewareID)
+
+	chain2, match := manager.ChainForRevision("service", "/", revision)
+	require.True(t, match)
+	require.NotNil(t, chain2)
+	assert.NotSame(t, chain1, chain2)
+	assert.EqualValues(t, 2, factory.builds.Load())
+}
+
+func TestManagerInvalidateRemovesRevisionAndReaddDoesNotReuseIt(t *testing.T) {
+	manager, _ := newRevisionTestManager(t)
+	revision1, err := manager.RebuildSnapshot("service", nil)
+	require.NoError(t, err)
+
+	manager.Invalidate("service")
+	_, match := manager.ChainForRevision("service", "/", revision1)
+	assert.False(t, match)
+
+	revision2, err := manager.RebuildSnapshot("service", nil)
+	require.NoError(t, err)
+	assert.NotEqual(t, revision1, revision2)
+	_, match = manager.ChainForRevision("service", "/", revision2)
+	assert.True(t, match)
+
+	manager.InvalidateAll()
+	_, match = manager.ChainForRevision("service", "/", revision2)
+	assert.False(t, match)
+
+	revision3, err := manager.RebuildSnapshot("service", nil)
+	require.NoError(t, err)
+	assert.NotEqual(t, revision1, revision3)
+	assert.NotEqual(t, revision2, revision3)
+}
+
+func TestManagerRebuildSnapshotRejectsMismatchedBindingBeforeMutation(t *testing.T) {
+	manager, _ := newRevisionTestManager(t)
+	binding := revisionTestBinding("service", "/")
+	revision1, err := manager.RebuildSnapshot("service", []PathTargetBinding{binding})
+	require.NoError(t, err)
+	chain1, match := manager.ChainForRevision("service", "/", revision1)
+	require.True(t, match)
+
+	invalid := revisionTestBinding("other-service", "/replacement")
+	revision, err := manager.RebuildSnapshot("service", []PathTargetBinding{invalid})
+	require.Error(t, err)
+	assert.Zero(t, revision)
+	chainAfter, match := manager.ChainForRevision("service", "/", revision1)
+	assert.True(t, match)
+	assert.Same(t, chain1, chainAfter)
+
+	revision2, err := manager.RebuildSnapshot("service", nil)
+	require.NoError(t, err)
+	assert.Equal(t, revision1+1, revision2, "a rejected rebuild must not consume a revision")
+}
+
+func TestManagerConcurrentRebuildSnapshotRevisionsAreUnique(t *testing.T) {
+	manager, _ := newRevisionTestManager(t)
+	const rebuilds = 64
+
+	start := make(chan struct{})
+	revisions := make(chan Revision, rebuilds)
+	errors := make(chan error, rebuilds)
+	var wg sync.WaitGroup
+	for range rebuilds {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			<-start
+			revision, err := manager.RebuildSnapshot("service", nil)
+			if err != nil {
+				errors <- err
+				return
+			}
+			revisions <- revision
+		}()
+	}
+	close(start)
+	wg.Wait()
+	close(errors)
+	close(revisions)
+
+	for err := range errors {
+		require.NoError(t, err)
+	}
+	seen := make(map[Revision]struct{}, rebuilds)
+	for revision := range revisions {
+		require.NotZero(t, revision)
+		_, duplicate := seen[revision]
+		assert.False(t, duplicate, "each successful rebuild must receive a fresh revision")
+		seen[revision] = struct{}{}
+	}
+	require.Len(t, seen, rebuilds)
+
+	matches := 0
+	for revision := range seen {
+		chain, match := manager.ChainForRevision("service", "/", revision)
+		assert.Nil(t, chain)
+		if match {
+			matches++
+		}
+	}
+	assert.Equal(t, 1, matches, "only the current immutable table revision may match")
+}

From 1161616c02c0bbc80e2364e8184ae95a86f2cc4a Mon Sep 17 00:00:00 2001
From: Maycon Santos <mlsmaycon@gmail.com>
Date: Mon, 12 Oct 2026 12:31:57 +0200
Subject: [PATCH 40/70] [proxy] Enforce per-target HTTP access actions (#8115)

Apply target access before service authentication: inherit, bypass, or block. Keep route selection and auth decisions on the same snapshot; reject stale or unavailable required middleware.

Validation: full auth/proxy race tests and scoped lint passed. Runtime regression tests remain with this layer.
---
 proxy/README.md                               |   37 +
 proxy/internal/auth/middleware.go             |  170 ++-
 proxy/internal/auth/target_access_test.go     |  278 ++++
 proxy/internal/proxy/reverseproxy.go          |   51 +-
 proxy/internal/proxy/servicemapping.go        |   54 +-
 .../proxy/target_middleware_snapshot_test.go  |  150 +++
 proxy/internal/proxy/target_resolver.go       |  300 +++++
 .../proxy/target_resolver_path_test.go        |  202 +++
 proxy/internal/proxy/target_resolver_test.go  |  336 +++++
 proxy/server.go                               |  106 +-
 proxy/target_access_control.go                |   40 +
 proxy/target_access_control_runtime_test.go   |  172 +++
 proxy/target_access_control_test.go           |  151 +++
 proxy/target_middleware_revision_test.go      |  115 ++
 shared/management/proto/proxy_service.pb.go   | 1163 +++++++++--------
 shared/management/proto/proxy_service.proto   |    7 +
 16 files changed, 2692 insertions(+), 640 deletions(-)
 create mode 100644 proxy/internal/auth/target_access_test.go
 create mode 100644 proxy/internal/proxy/target_middleware_snapshot_test.go
 create mode 100644 proxy/internal/proxy/target_resolver.go
 create mode 100644 proxy/internal/proxy/target_resolver_path_test.go
 create mode 100644 proxy/internal/proxy/target_resolver_test.go
 create mode 100644 proxy/target_access_control.go
 create mode 100644 proxy/target_access_control_runtime_test.go
 create mode 100644 proxy/target_access_control_test.go
 create mode 100644 proxy/target_middleware_revision_test.go

diff --git a/proxy/README.md b/proxy/README.md
index 6af7cadd2..47079ba0a 100644
--- a/proxy/README.md
+++ b/proxy/README.md
@@ -33,6 +33,43 @@ If any authentication methods are registered for the Host domain, then the Proxy
 If the user is successfully authenticated, their request will be forwarded through to the Proxy to be proxied to the relevant Peer.
 Successful authentication does not guarantee a successful forwarding of the request as there may be failures behind the Proxy, such as with Peer connectivity or the underlying resource.
 
+### Target access control
+
+HTTP targets have an optional `access_action` setting, configured under
+**Edit Target → Optional Settings → Access** in the dashboard:
+
+| Value | Behavior |
+| --- | --- |
+| `inherit` | Use the service's authentication settings. This is the default. A service without authentication remains public. |
+| `bypass` | Forward anonymously without prompting for service authentication. |
+| `block` | Return HTTP 403, including for authenticated users. |
+
+The longest matching Location prefix selects both the target and its access
+action. Prefixes are literal and case-sensitive: `/api` also matches `/apiv2`,
+while `/api/` only matches requests beginning with `/api/` and does not match
+`/api` itself. Wildcards and regular expressions are not supported. A blocked
+request or failed authentication never falls through to another target. Disabling
+or deleting a target removes its rule, so a less-specific target may then match.
+
+Service IP, country, and reputation restrictions still apply to bypassed paths.
+Bypass is unavailable for private services and Agent Network targets. Bypassed
+requests have no NetBird user identity; configured header-auth credentials,
+NetBird session cookies, and client-supplied NetBird identity headers are still
+removed before forwarding. Custom upstream headers remain target settings, so
+consider their effect when making a target public.
+
+Services using target access overrides reject ambiguous request paths, including
+encoded separators and traversal segments, before forwarding. Path rewriting
+continues to use the selected Location prefix after access checks.
+
+Upgrade all proxies before using target access actions. Older proxies ignore
+these actions and continue applying the service's authentication settings.
+API updates that omit an existing Location's
+`access_action` preserve its setting; send `"access_action": "inherit"` explicitly
+to restore service authentication. Requests omitting all access actions cannot
+remove or rename a controlled Location; use an updated client and explicitly
+include the intended actions when changing those targets.
+
 ## TLS
 
 Due to the authentication provided, the Proxy uses HTTPS for its endpoint, even if the underlying service is HTTP.
diff --git a/proxy/internal/auth/middleware.go b/proxy/internal/auth/middleware.go
index 647741139..735fcbac3 100644
--- a/proxy/internal/auth/middleware.go
+++ b/proxy/internal/auth/middleware.go
@@ -64,6 +64,22 @@ type DomainConfig struct {
 	// groups claim intersects this set. Empty means group membership does not
 	// restrict access.
 	AllowedGroups map[string]struct{}
+	// TargetResolver pins the target and access action used by this auth snapshot.
+	TargetResolver *proxy.TargetResolver
+}
+
+// DomainOption configures a domain authentication snapshot.
+type DomainOption func(*DomainConfig) error
+
+// WithTargetResolver attaches an immutable target-routing snapshot to a domain.
+func WithTargetResolver(resolver *proxy.TargetResolver) DomainOption {
+	return func(config *DomainConfig) error {
+		if resolver == nil {
+			return errors.New("target resolver is nil")
+		}
+		config.TargetResolver = resolver
+		return nil
+	}
 }
 
 type validationResult struct {
@@ -132,6 +148,12 @@ func (mw *Middleware) Protect(next http.Handler) http.Handler {
 			return
 		}
 
+		resolvedRequest, handled := mw.handleTargetAccess(w, r, config, next)
+		if handled {
+			return
+		}
+		r = resolvedRequest
+
 		// Private services bypass operator schemes and gate on tunnel peer.
 		if config.Private {
 			if mw.forwardWithTunnelPeer(w, r, host, config, next) {
@@ -171,6 +193,66 @@ func (mw *Middleware) Protect(next http.Handler) http.Handler {
 	})
 }
 
+func (mw *Middleware) handleTargetAccess(w http.ResponseWriter, r *http.Request, config DomainConfig, next http.Handler) (*http.Request, bool) {
+	if config.TargetResolver == nil {
+		return r, false
+	}
+	resolvedRequest, action, err := config.TargetResolver.ResolveRequest(r)
+	if err != nil {
+		mw.rejectUnsafePath(w, r, err)
+		return r, true
+	}
+	r = resolvedRequest
+	switch action {
+	case proxy.AccessActionInherit:
+		return r, false
+	case proxy.AccessActionBypass:
+		if config.Private {
+			mw.logger.Error("private domain reached a bypass target; denying")
+			denyPrivate(w)
+			return r, true
+		}
+		markAccessAction(r, action)
+		next.ServeHTTP(w, r)
+	case proxy.AccessActionBlock:
+		markAccessAction(r, action)
+		w.Header().Set("Cache-Control", "no-store")
+		denyForbidden(w, config)
+	default:
+		mw.logger.Errorf("resolved unknown access action %q; denying", action)
+		markAccessAction(r, action)
+		w.Header().Set("Cache-Control", "no-store")
+		denyForbidden(w, config)
+	}
+	return r, true
+}
+
+func (mw *Middleware) rejectUnsafePath(w http.ResponseWriter, r *http.Request, err error) {
+	mw.logger.WithFields(log.Fields{
+		"host": r.Host,
+		"path": r.URL.EscapedPath(),
+	}).Debugf("rejecting request path: %v", err)
+	if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
+		cd.SetOrigin(proxy.OriginAuth)
+		cd.SetMetadata("access_action", "invalid_path")
+	}
+	w.Header().Set("Cache-Control", "no-store")
+	http.Error(w, "Bad Request", http.StatusBadRequest)
+}
+
+func markAccessAction(r *http.Request, action proxy.AccessAction) {
+	if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
+		cd.SetMetadata("access_action", string(action))
+		switch action {
+		case proxy.AccessActionBypass:
+			cd.SetAuthMethod("path_bypass")
+		case proxy.AccessActionBlock:
+			cd.SetAuthMethod("path_block")
+			cd.SetOrigin(proxy.OriginAuth)
+		}
+	}
+}
+
 // requestIsPlainHTTP reports whether the request arrived without TLS.
 // Used to gate cookie-on-plain warnings and the OIDC plain-HTTP block.
 func requestIsPlainHTTP(r *http.Request) bool {
@@ -666,36 +748,10 @@ func wasCredentialSubmitted(r *http.Request, method auth.Method) bool {
 	return false
 }
 
-// AddDomain registers authentication schemes for the given domain. With schemes a valid session public key is required.
-// private=true forces ValidateTunnelPeer enforcement (403 on failure) regardless of the schemes list.
-// allowedGroups restricts OIDC sessions to the given group ids; empty means unrestricted.
-func (mw *Middleware) AddDomain(domain string, schemes []Scheme, publicKeyB64 string, expiration time.Duration, accountID types.AccountID, serviceID types.ServiceID, ipRestrictions *restrict.Filter, private bool, allowedGroups []string) error {
-	if len(schemes) == 0 {
-		mw.domainsMux.Lock()
-		defer mw.domainsMux.Unlock()
-		mw.domains[domain] = DomainConfig{
-			AccountID:      accountID,
-			ServiceID:      serviceID,
-			IPRestrictions: ipRestrictions,
-			Private:        private,
-			AllowedGroups:  groupSet(allowedGroups),
-		}
-		return nil
-	}
-
-	pubKeyBytes, err := base64.StdEncoding.DecodeString(publicKeyB64)
-	if err != nil {
-		return fmt.Errorf("decode session public key for domain %s: %w", domain, err)
-	}
-	if len(pubKeyBytes) != ed25519.PublicKeySize {
-		return fmt.Errorf("invalid session public key size for domain %s: got %d, want %d", domain, len(pubKeyBytes), ed25519.PublicKeySize)
-	}
-
-	mw.domainsMux.Lock()
-	defer mw.domainsMux.Unlock()
-	mw.domains[domain] = DomainConfig{
-		Schemes:           schemes,
-		SessionPublicKey:  pubKeyBytes,
+// NewDomainConfig validates and builds an immutable domain configuration.
+func NewDomainConfig(domain string, schemes []Scheme, publicKeyB64 string, expiration time.Duration, accountID types.AccountID, serviceID types.ServiceID, ipRestrictions *restrict.Filter, private bool, allowedGroups []string, opts ...DomainOption) (DomainConfig, error) {
+	config := DomainConfig{
+		Schemes:           append([]Scheme(nil), schemes...),
 		SessionExpiration: expiration,
 		AccountID:         accountID,
 		ServiceID:         serviceID,
@@ -703,9 +759,63 @@ func (mw *Middleware) AddDomain(domain string, schemes []Scheme, publicKeyB64 st
 		Private:           private,
 		AllowedGroups:     groupSet(allowedGroups),
 	}
+	if len(schemes) > 0 {
+		pubKeyBytes, err := base64.StdEncoding.DecodeString(publicKeyB64)
+		if err != nil {
+			return DomainConfig{}, fmt.Errorf("decode session public key for domain %s: %w", domain, err)
+		}
+		if len(pubKeyBytes) != ed25519.PublicKeySize {
+			return DomainConfig{}, fmt.Errorf("invalid session public key size for domain %s: got %d, want %d", domain, len(pubKeyBytes), ed25519.PublicKeySize)
+		}
+		config.SessionPublicKey = append(ed25519.PublicKey(nil), pubKeyBytes...)
+	}
+	for _, option := range opts {
+		if option == nil {
+			return DomainConfig{}, fmt.Errorf("nil domain option for domain %s", domain)
+		}
+		if err := option(&config); err != nil {
+			return DomainConfig{}, fmt.Errorf("configure domain %s: %w", domain, err)
+		}
+	}
+	if config.Private && config.TargetResolver != nil && config.TargetResolver.HasBypass() {
+		return DomainConfig{}, fmt.Errorf("authentication bypass is not allowed for private domain %s", domain)
+	}
+	return config, nil
+}
+
+// AddDomainConfig atomically publishes a validated domain configuration.
+func (mw *Middleware) AddDomainConfig(domain string, config DomainConfig) {
+	config.Schemes = append([]Scheme(nil), config.Schemes...)
+	config.SessionPublicKey = append(ed25519.PublicKey(nil), config.SessionPublicKey...)
+	config.AllowedGroups = cloneGroupSet(config.AllowedGroups)
+	mw.domainsMux.Lock()
+	defer mw.domainsMux.Unlock()
+	mw.domains[domain] = config
+}
+
+// AddDomain registers authentication schemes for the given domain. With schemes a valid session public key is required.
+// private=true forces ValidateTunnelPeer enforcement (403 on failure) regardless of the schemes list.
+// allowedGroups restricts OIDC sessions to the given group ids; empty means unrestricted.
+func (mw *Middleware) AddDomain(domain string, schemes []Scheme, publicKeyB64 string, expiration time.Duration, accountID types.AccountID, serviceID types.ServiceID, ipRestrictions *restrict.Filter, private bool, allowedGroups []string, opts ...DomainOption) error {
+	config, err := NewDomainConfig(domain, schemes, publicKeyB64, expiration, accountID, serviceID, ipRestrictions, private, allowedGroups, opts...)
+	if err != nil {
+		return err
+	}
+	mw.AddDomainConfig(domain, config)
 	return nil
 }
 
+func cloneGroupSet(groups map[string]struct{}) map[string]struct{} {
+	if groups == nil {
+		return nil
+	}
+	cloned := make(map[string]struct{}, len(groups))
+	for group := range groups {
+		cloned[group] = struct{}{}
+	}
+	return cloned
+}
+
 // RemoveDomain unregisters authentication for the given domain.
 func (mw *Middleware) RemoveDomain(domain string) {
 	mw.domainsMux.Lock()
diff --git a/proxy/internal/auth/target_access_test.go b/proxy/internal/auth/target_access_test.go
new file mode 100644
index 000000000..56f924b60
--- /dev/null
+++ b/proxy/internal/auth/target_access_test.go
@@ -0,0 +1,278 @@
+package auth
+
+import (
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	proxyauth "github.com/netbirdio/netbird/proxy/auth"
+	"github.com/netbirdio/netbird/proxy/internal/proxy"
+	"github.com/netbirdio/netbird/proxy/internal/restrict"
+)
+
+type targetAccessRoundTripFunc func(*http.Request) (*http.Response, error)
+
+func (f targetAccessRoundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
+	return f(req)
+}
+
+func targetAccessResolver(t *testing.T, action proxy.AccessAction) *proxy.TargetResolver {
+	t.Helper()
+	targetURL, err := url.Parse("http://backend.internal")
+	require.NoError(t, err)
+	resolver, err := proxy.NewTargetResolver(proxy.Mapping{
+		ID:        "service-1",
+		AccountID: "account-1",
+		Host:      "example.com",
+		Paths: map[string]*proxy.PathTarget{
+			"/selected": {
+				URL:          targetURL,
+				AccessAction: action,
+			},
+		},
+	})
+	require.NoError(t, err)
+	return resolver
+}
+
+func TestProtect_TargetAccessActions(t *testing.T) {
+	tests := []struct {
+		name             string
+		action           proxy.AccessAction
+		wantStatus       int
+		wantBackendCalls int
+		wantSchemeCalls  int
+		wantCacheControl string
+	}{
+		{
+			name:             "bypass forwards without authentication",
+			action:           proxy.AccessActionBypass,
+			wantStatus:       http.StatusNoContent,
+			wantBackendCalls: 1,
+		},
+		{
+			name:             "block rejects before authentication",
+			action:           proxy.AccessActionBlock,
+			wantStatus:       http.StatusForbidden,
+			wantSchemeCalls:  0,
+			wantCacheControl: "no-store",
+		},
+		{
+			name:            "inherit runs configured authentication",
+			action:          proxy.AccessActionInherit,
+			wantStatus:      http.StatusUnauthorized,
+			wantSchemeCalls: 1,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			mw := NewMiddleware(log.StandardLogger(), nil, nil)
+			kp := generateTestKeyPair(t)
+			schemeCalls := 0
+			scheme := &stubScheme{
+				method: proxyauth.MethodPIN,
+				authFn: func(*http.Request) (string, string, error) {
+					schemeCalls++
+					return "", "pin", nil
+				},
+			}
+			err := mw.AddDomain(
+				"example.com",
+				[]Scheme{scheme},
+				kp.PublicKey,
+				time.Hour,
+				"account-1",
+				"service-1",
+				nil,
+				false,
+				nil,
+				WithTargetResolver(targetAccessResolver(t, tt.action)),
+			)
+			require.NoError(t, err)
+
+			backendCalls := 0
+			handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+				backendCalls++
+				w.WriteHeader(http.StatusNoContent)
+			}))
+			req := httptest.NewRequest(http.MethodGet, "http://example.com/selected/status", nil)
+			rec := httptest.NewRecorder()
+
+			handler.ServeHTTP(rec, req)
+
+			assert.Equal(t, tt.wantStatus, rec.Code)
+			assert.Equal(t, tt.wantBackendCalls, backendCalls, "backend call count")
+			assert.Equal(t, tt.wantSchemeCalls, schemeCalls, "authentication scheme call count")
+			assert.Equal(t, tt.wantCacheControl, rec.Header().Get("Cache-Control"), "cache policy")
+		})
+	}
+}
+
+func TestProtect_BypassRecordsActionWithoutIdentity(t *testing.T) {
+	mw := NewMiddleware(log.StandardLogger(), nil, nil)
+	require.NoError(t, mw.AddDomain(
+		"example.com", nil, "", 0, "account-1", "service-1", nil, false, nil,
+		WithTargetResolver(targetAccessResolver(t, proxy.AccessActionBypass)),
+	))
+
+	handler := mw.Protect(newPassthroughHandler())
+	req := httptest.NewRequest(http.MethodGet, "http://example.com/selected", nil)
+	captured := proxy.NewCapturedData("request-1")
+	req = req.WithContext(proxy.WithCapturedData(req.Context(), captured))
+	rec := httptest.NewRecorder()
+
+	handler.ServeHTTP(rec, req)
+
+	assert.Equal(t, http.StatusOK, rec.Code)
+	assert.Empty(t, captured.GetUserID())
+	assert.Empty(t, captured.GetUserEmail())
+	assert.Empty(t, captured.GetUserGroups())
+	assert.Equal(t, "path_bypass", captured.GetAuthMethod())
+	assert.Equal(t, "bypass", captured.GetMetadata()["access_action"])
+}
+
+func TestProtect_TargetResolverPinsMissThroughAuthentication(t *testing.T) {
+	mw := NewMiddleware(log.StandardLogger(), nil, nil)
+	resolver := targetAccessResolver(t, proxy.AccessActionBypass)
+	require.NoError(t, mw.AddDomain(
+		"example.com", nil, "", 0, "account-1", "service-1", nil, false, nil,
+		WithTargetResolver(resolver),
+	))
+
+	forwarded := false
+	reverseProxy := proxy.NewReverseProxy(targetAccessRoundTripFunc(func(*http.Request) (*http.Response, error) {
+		forwarded = true
+		return nil, errors.New("unexpected forwarding")
+	}), "auto", nil, nil)
+	replacementURL, err := url.Parse("http://replacement.internal")
+	require.NoError(t, err)
+	reverseProxy.AddMapping(proxy.Mapping{
+		ID:        "service-1",
+		AccountID: "account-1",
+		Host:      "example.com",
+		Paths: map[string]*proxy.PathTarget{
+			"/": {URL: replacementURL},
+		},
+	})
+	handler := mw.Protect(reverseProxy)
+	req := httptest.NewRequest(http.MethodGet, "http://example.com/not-selected", nil)
+	rec := httptest.NewRecorder()
+
+	handler.ServeHTTP(rec, req)
+
+	assert.Equal(t, http.StatusNotFound, rec.Code, "a miss pinned before auth must reach the proxy unchanged")
+	assert.False(t, forwarded, "the proxy must not fall back to a newly published mapping after a pinned miss")
+}
+
+func TestProtect_UnsafePathFailsBeforeAuthentication(t *testing.T) {
+	mw := NewMiddleware(log.StandardLogger(), nil, nil)
+	kp := generateTestKeyPair(t)
+	schemeCalls := 0
+	scheme := &stubScheme{
+		method: proxyauth.MethodPIN,
+		authFn: func(*http.Request) (string, string, error) {
+			schemeCalls++
+			return "", "pin", nil
+		},
+	}
+	require.NoError(t, mw.AddDomain(
+		"example.com",
+		[]Scheme{scheme},
+		kp.PublicKey,
+		time.Hour,
+		"account-1",
+		"service-1",
+		nil,
+		false,
+		nil,
+		WithTargetResolver(targetAccessResolver(t, proxy.AccessActionBlock)),
+	))
+
+	backendCalled := false
+	handler := mw.Protect(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {
+		backendCalled = true
+	}))
+	req := httptest.NewRequest(http.MethodGet, "http://example.com/", nil)
+	req.URL.Path = "/selected/../other"
+	rec := httptest.NewRecorder()
+
+	handler.ServeHTTP(rec, req)
+
+	assert.Equal(t, http.StatusBadRequest, rec.Code)
+	assert.Equal(t, "no-store", rec.Header().Get("Cache-Control"))
+	assert.Zero(t, schemeCalls, "unsafe paths must be rejected before credentials are evaluated")
+	assert.False(t, backendCalled)
+}
+
+func TestProtect_IPRestrictionsRunBeforeTargetAccessAction(t *testing.T) {
+	mw := NewMiddleware(log.StandardLogger(), nil, nil)
+	filter := restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"10.0.0.0/8"}})
+	require.NoError(t, mw.AddDomain(
+		"example.com", nil, "", 0, "account-1", "service-1", filter, false, nil,
+		WithTargetResolver(targetAccessResolver(t, proxy.AccessActionBypass)),
+	))
+
+	backendCalled := false
+	handler := mw.Protect(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {
+		backendCalled = true
+	}))
+	req := httptest.NewRequest(http.MethodGet, "http://example.com/selected", nil)
+	req.RemoteAddr = "192.0.2.10:1234"
+	rec := httptest.NewRecorder()
+
+	handler.ServeHTTP(rec, req)
+
+	assert.Equal(t, http.StatusForbidden, rec.Code)
+	assert.False(t, backendCalled, "bypass must not bypass service IP restrictions")
+}
+
+func TestNewDomainConfig_RejectsPrivateBypass(t *testing.T) {
+	_, err := NewDomainConfig(
+		"private.example.com",
+		nil,
+		"",
+		0,
+		"account-1",
+		"service-1",
+		nil,
+		true,
+		nil,
+		WithTargetResolver(targetAccessResolver(t, proxy.AccessActionBypass)),
+	)
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "not allowed for private domain")
+}
+
+func TestAddDomainConfig_PublishesPreparedSnapshot(t *testing.T) {
+	mw := NewMiddleware(log.StandardLogger(), nil, nil)
+	config, err := NewDomainConfig(
+		"example.com",
+		nil,
+		"",
+		0,
+		"account-1",
+		"service-1",
+		nil,
+		false,
+		[]string{"group-1"},
+		WithTargetResolver(targetAccessResolver(t, proxy.AccessActionBlock)),
+	)
+	require.NoError(t, err)
+
+	mw.AddDomainConfig("example.com", config)
+	delete(config.AllowedGroups, "group-1")
+
+	published, exists := mw.getDomainConfig("example.com")
+	require.True(t, exists)
+	assert.Contains(t, published.AllowedGroups, "group-1", "published mutable fields should be copied")
+	assert.NotNil(t, published.TargetResolver)
+}
diff --git a/proxy/internal/proxy/reverseproxy.go b/proxy/internal/proxy/reverseproxy.go
index a3987fe5a..bf3ccaeb1 100644
--- a/proxy/internal/proxy/reverseproxy.go
+++ b/proxy/internal/proxy/reverseproxy.go
@@ -82,7 +82,15 @@ func NewReverseProxy(transport http.RoundTripper, forwardedProto string, trusted
 }
 
 func (p *ReverseProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	result, exists := p.findTargetForRequest(r)
+	resolution, pinned := targetResolutionFromContext(r.Context())
+	result, exists := resolution.result, resolution.matched
+	if !pinned {
+		result, exists = p.findTargetForRequest(r)
+		if result.requirePinned {
+			p.serveProxyUnavailable(w, r)
+			return
+		}
+	}
 	if !exists {
 		p.serveRouteError(w, r, http.StatusNotFound, "Service Not Found",
 			"The requested service could not be found. Please check the URL, try refreshing, or check if the peer is running. If that doesn't work, see our documentation for help.")
@@ -119,7 +127,11 @@ func (p *ReverseProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		rewriteMatchedPath = ""
 	}
 
-	chain := p.resolveChain(result)
+	chain, current := p.resolveChain(result)
+	if !current || (targetRequiresMiddleware(pt) && (chain == nil || chain.Empty())) {
+		p.serveProxyUnavailable(w, r)
+		return
+	}
 	if chain == nil || chain.Empty() {
 		p.serveDirect(w, r, ctx, result, rewriteMatchedPath)
 		return
@@ -127,6 +139,28 @@ func (p *ReverseProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	p.serveWithChain(w, r, ctx, result, chain, rewriteMatchedPath, capturedData)
 }
 
+func (p *ReverseProxy) serveProxyUnavailable(w http.ResponseWriter, r *http.Request) {
+	if cd := CapturedDataFromContext(r.Context()); cd != nil {
+		cd.SetOrigin(OriginProxyError)
+	}
+	w.Header().Set("Cache-Control", "no-store")
+	web.ServeErrorPage(w, r, http.StatusServiceUnavailable, "Service Unavailable",
+		"The requested service is being updated. Please try again shortly.", getRequestID(r),
+		web.ErrorStatus{Proxy: true, Destination: false})
+}
+
+func targetRequiresMiddleware(target *PathTarget) bool {
+	if target == nil {
+		return false
+	}
+	for _, spec := range target.Middlewares {
+		if spec.Enabled {
+			return true
+		}
+	}
+	return false
+}
+
 // serveRouteError marks the request as un-routed on any captured-data
 // context and renders the proxy error page.
 func (p *ReverseProxy) serveRouteError(w http.ResponseWriter, r *http.Request, status int, title, message string) {
@@ -455,14 +489,15 @@ func applyUpstreamHeaders(r *http.Request, rewrite *middleware.UpstreamRewrite)
 	}
 }
 
-// resolveChain returns the middleware chain registered for the
-// resolved target, or nil when middleware is disabled for the proxy
-// or the target.
-func (p *ReverseProxy) resolveChain(result targetResult) *middleware.Chain {
+// resolveChain returns a chain only from the target's routing revision.
+func (p *ReverseProxy) resolveChain(result targetResult) (*middleware.Chain, bool) {
 	if p.middlewareManager == nil {
-		return nil
+		return nil, result.middlewareRevision == 0
 	}
-	return p.middlewareManager.ChainFor(string(result.serviceID), result.matchedPath)
+	if result.middlewareRevision == 0 {
+		return p.middlewareManager.ChainFor(string(result.serviceID), result.matchedPath), true
+	}
+	return p.middlewareManager.ChainForRevision(string(result.serviceID), result.matchedPath, result.middlewareRevision)
 }
 
 // buildRequestInput gathers the per-request fields the middleware
diff --git a/proxy/internal/proxy/servicemapping.go b/proxy/internal/proxy/servicemapping.go
index 64fccc42a..40115fd9d 100644
--- a/proxy/internal/proxy/servicemapping.go
+++ b/proxy/internal/proxy/servicemapping.go
@@ -23,9 +23,22 @@ const (
 	PathRewritePreserve
 )
 
+// AccessAction controls how authentication handles requests for a target.
+type AccessAction string
+
+const (
+	// AccessActionInherit applies the service's configured authentication.
+	AccessActionInherit AccessAction = "inherit"
+	// AccessActionBypass skips the service's configured authentication.
+	AccessActionBypass AccessAction = "bypass"
+	// AccessActionBlock rejects the request before authentication.
+	AccessActionBlock AccessAction = "block"
+)
+
 // PathTarget holds a backend URL and per-target behavioral options.
 type PathTarget struct {
 	URL            *url.URL
+	AccessAction   AccessAction
 	SkipTLSVerify  bool
 	RequestTimeout time.Duration
 	PathRewrite    PathRewriteMode
@@ -61,18 +74,25 @@ type Mapping struct {
 	// StripAuthHeaders are header names used for header-based auth.
 	// These headers are stripped from requests before forwarding.
 	StripAuthHeaders []string
+	// MiddlewareRevision binds this routing snapshot to its middleware policies.
+	MiddlewareRevision middleware.Revision
 	// sortedPaths caches the paths sorted by length (longest first).
 	sortedPaths []string
+	// requirePinnedResolution prevents a mapping with target access actions
+	// from being forwarded outside the auth-owned resolver snapshot.
+	requirePinnedResolution bool
 }
 
 type targetResult struct {
-	target           *PathTarget
-	matchedPath      string
-	serviceID        types.ServiceID
-	accountID        types.AccountID
-	passHostHeader   bool
-	rewriteRedirects bool
-	stripAuthHeaders []string
+	target             *PathTarget
+	matchedPath        string
+	serviceID          types.ServiceID
+	accountID          types.AccountID
+	passHostHeader     bool
+	rewriteRedirects   bool
+	stripAuthHeaders   []string
+	middlewareRevision middleware.Revision
+	requirePinned      bool
 }
 
 func (p *ReverseProxy) findTargetForRequest(req *http.Request) (targetResult, bool) {
@@ -90,6 +110,7 @@ func (p *ReverseProxy) findTargetForRequest(req *http.Request) (targetResult, bo
 		p.logger.Debugf("no mapping found for host: %s", host)
 		return targetResult{}, false
 	}
+	baseResult := targetResult{requirePinned: m.requirePinnedResolution}
 
 	for _, path := range m.sortedPaths {
 		if strings.HasPrefix(req.URL.Path, path) {
@@ -100,18 +121,20 @@ func (p *ReverseProxy) findTargetForRequest(req *http.Request) (targetResult, bo
 			}
 			p.logger.Debugf("matched host: %s, path: %s -> %s", host, path, pt.URL)
 			return targetResult{
-				target:           pt,
-				matchedPath:      path,
-				serviceID:        m.ID,
-				accountID:        m.AccountID,
-				passHostHeader:   m.PassHostHeader,
-				rewriteRedirects: m.RewriteRedirects,
-				stripAuthHeaders: m.StripAuthHeaders,
+				target:             pt,
+				matchedPath:        path,
+				serviceID:          m.ID,
+				accountID:          m.AccountID,
+				passHostHeader:     m.PassHostHeader,
+				rewriteRedirects:   m.RewriteRedirects,
+				stripAuthHeaders:   m.StripAuthHeaders,
+				middlewareRevision: m.MiddlewareRevision,
+				requirePinned:      m.requirePinnedResolution,
 			}, true
 		}
 	}
 	p.logger.Debugf("no path match for host: %s, path: %s", host, req.URL.Path)
-	return targetResult{}, false
+	return baseResult, false
 }
 
 // AddMapping registers a host-to-backend mapping for the reverse proxy.
@@ -125,6 +148,7 @@ func (p *ReverseProxy) AddMapping(m Mapping) {
 		return len(paths[i]) > len(paths[j])
 	})
 	m.sortedPaths = paths
+	m.requirePinnedResolution = mappingHasNonDefaultAccessAction(m)
 
 	p.mappingsMux.Lock()
 	defer p.mappingsMux.Unlock()
diff --git a/proxy/internal/proxy/target_middleware_snapshot_test.go b/proxy/internal/proxy/target_middleware_snapshot_test.go
new file mode 100644
index 000000000..dbbff55c7
--- /dev/null
+++ b/proxy/internal/proxy/target_middleware_snapshot_test.go
@@ -0,0 +1,150 @@
+package proxy
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	guardrail "github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_guardrail"
+)
+
+func TestReverseProxy_PinnedTargetFailsClosedAcrossMiddlewareRevisions(t *testing.T) {
+	restrictiveGuardrail := []middleware.Spec{{
+		ID:        guardrail.ID,
+		Slot:      middleware.SlotOnRequest,
+		Enabled:   true,
+		RawConfig: []byte(`{"provider_allowlists":{"provider-1":["allowed-model"]}}`),
+	}}
+	unrestrictedGuardrail := []middleware.Spec{{
+		ID:        guardrail.ID,
+		Slot:      middleware.SlotOnRequest,
+		Enabled:   true,
+		RawConfig: []byte(`{}`),
+	}}
+
+	tests := []struct {
+		name           string
+		oldMiddlewares []middleware.Spec
+		newMiddlewares []middleware.Spec
+		oldStatus      int
+	}{
+		{
+			name:           "replacement policy cannot authorize old target",
+			oldMiddlewares: restrictiveGuardrail,
+			newMiddlewares: unrestrictedGuardrail,
+			oldStatus:      http.StatusForbidden,
+		},
+		{
+			name:           "new policy cannot run on old no-policy target",
+			newMiddlewares: unrestrictedGuardrail,
+			oldStatus:      http.StatusNoContent,
+		},
+		{
+			name:           "removed policy cannot disappear from old target",
+			oldMiddlewares: unrestrictedGuardrail,
+			oldStatus:      http.StatusNoContent,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			registry := middleware.NewRegistry()
+			require.NoError(t, registry.Register(guardrail.Factory{}))
+			manager := middleware.NewManager(0, nil, nil)
+			manager.SetResolver(middleware.NewResolver(registry))
+
+			oldTarget := &PathTarget{
+				URL:          mustTargetURL(t, "http://old-agent-backend.internal"),
+				AgentNetwork: true,
+				Middlewares:  tt.oldMiddlewares,
+			}
+			oldMapping := resolverMapping(map[string]*PathTarget{"/": oldTarget})
+			oldRevision := rebuildMiddlewareSnapshot(t, manager, &oldMapping)
+			oldResolver, err := NewTargetResolver(oldMapping)
+			require.NoError(t, err)
+
+			// Auth resolves and pins the old route and middleware revision before
+			// the replacement snapshot is installed.
+			req := httptest.NewRequest(http.MethodPost, "http://example.com/v1/chat/completions", nil)
+			oldPinnedReq, _, err := oldResolver.ResolveRequest(req)
+			require.NoError(t, err)
+
+			var upstreamHosts []string
+			rp := NewReverseProxy(resolverRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+				upstreamHosts = append(upstreamHosts, req.URL.Host)
+				return &http.Response{
+					StatusCode: http.StatusNoContent,
+					Header:     make(http.Header),
+					Body:       http.NoBody,
+				}, nil
+			}), "auto", nil, nil, WithMiddlewareManager(manager))
+
+			before := httptest.NewRecorder()
+			rp.ServeHTTP(before, oldPinnedReq.Clone(oldPinnedReq.Context()))
+			require.Equal(t, tt.oldStatus, before.Code, "the original snapshot must work before replacement")
+			if tt.oldStatus == http.StatusNoContent {
+				require.Equal(t, []string{"old-agent-backend.internal"}, upstreamHosts)
+			} else {
+				require.Empty(t, upstreamHosts)
+			}
+			upstreamHosts = nil
+
+			newTarget := &PathTarget{
+				URL:          mustTargetURL(t, "http://new-agent-backend.internal"),
+				AgentNetwork: true,
+				Middlewares:  tt.newMiddlewares,
+			}
+			newMapping := resolverMapping(map[string]*PathTarget{"/": newTarget})
+			newRevision := rebuildMiddlewareSnapshot(t, manager, &newMapping)
+			require.NotEqual(t, oldRevision, newRevision)
+
+			stale := httptest.NewRecorder()
+			rp.ServeHTTP(stale, oldPinnedReq)
+
+			assert.Equal(t, http.StatusServiceUnavailable, stale.Code,
+				"a pinned target must not use a replacement middleware revision")
+			assert.Equal(t, "no-store", stale.Header().Get("Cache-Control"))
+			assert.Empty(t, upstreamHosts,
+				"a mixed target/policy generation must never reach an upstream")
+
+			// A request resolved from the replacement route snapshot is coherent
+			// with the replacement chain and reaches only the new backend.
+			newResolver, err := NewTargetResolver(newMapping)
+			require.NoError(t, err)
+			freshReq, _, err := newResolver.ResolveRequest(
+				httptest.NewRequest(http.MethodPost, "http://example.com/v1/chat/completions", nil),
+			)
+			require.NoError(t, err)
+
+			fresh := httptest.NewRecorder()
+			rp.ServeHTTP(fresh, freshReq)
+
+			assert.Equal(t, http.StatusNoContent, fresh.Code)
+			assert.Equal(t, []string{"new-agent-backend.internal"}, upstreamHosts)
+		})
+	}
+}
+
+func rebuildMiddlewareSnapshot(t *testing.T, manager *middleware.Manager, mapping *Mapping) middleware.Revision {
+	t.Helper()
+	bindings := make([]middleware.PathTargetBinding, 0, len(mapping.Paths))
+	for path, target := range mapping.Paths {
+		if target == nil || len(target.Middlewares) == 0 {
+			continue
+		}
+		bindings = append(bindings, middleware.PathTargetBinding{
+			ServiceID: string(mapping.ID),
+			PathID:    path,
+			Specs:     target.Middlewares,
+		})
+	}
+	revision, err := manager.RebuildSnapshot(string(mapping.ID), bindings)
+	require.NoError(t, err)
+	require.NotZero(t, revision)
+	mapping.MiddlewareRevision = revision
+	return revision
+}
diff --git a/proxy/internal/proxy/target_resolver.go b/proxy/internal/proxy/target_resolver.go
new file mode 100644
index 000000000..67ce51a24
--- /dev/null
+++ b/proxy/internal/proxy/target_resolver.go
@@ -0,0 +1,300 @@
+package proxy
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"net/http"
+	"net/url"
+	"sort"
+	"strings"
+	"unicode/utf8"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/bodytap"
+)
+
+// ErrUnsafeRequestPath indicates that a request path cannot be matched safely.
+var ErrUnsafeRequestPath = errors.New("unsafe request path")
+
+// TargetResolver is an immutable routing snapshot shared by auth and forwarding.
+type TargetResolver struct {
+	mapping     Mapping
+	strictPaths bool
+	hasBypass   bool
+}
+
+type targetResolution struct {
+	result  targetResult
+	matched bool
+}
+
+type targetResolutionContextKey struct{}
+
+// NewTargetResolver builds an immutable target-routing snapshot.
+func NewTargetResolver(mapping Mapping) (*TargetResolver, error) {
+	snapshot, err := cloneResolverMapping(mapping)
+	if err != nil {
+		return nil, err
+	}
+
+	resolver := &TargetResolver{mapping: snapshot}
+	for _, target := range snapshot.Paths {
+		action := effectiveAccessAction(target.AccessAction)
+		if action != AccessActionInherit {
+			resolver.strictPaths = true
+		}
+		if action == AccessActionBypass {
+			resolver.hasBypass = true
+		}
+	}
+	return resolver, nil
+}
+
+// ResolveRequest selects and pins a target for both auth and forwarding.
+func (r *TargetResolver) ResolveRequest(req *http.Request) (*http.Request, AccessAction, error) {
+	if r == nil {
+		return req, AccessActionInherit, nil
+	}
+	if req == nil || req.URL == nil {
+		return req, AccessActionInherit, fmt.Errorf("%w: missing URL", ErrUnsafeRequestPath)
+	}
+	if r.strictPaths {
+		if err := validateAccessPath(req.URL); err != nil {
+			return req, AccessActionInherit, err
+		}
+	}
+
+	result, matched := findTargetInMapping(req.URL.Path, r.mapping)
+	resolution := targetResolution{result: result, matched: matched}
+	ctx := context.WithValue(req.Context(), targetResolutionContextKey{}, resolution)
+	resolvedReq := req.WithContext(ctx)
+	if !matched {
+		return resolvedReq, AccessActionInherit, nil
+	}
+
+	if cd := CapturedDataFromContext(ctx); cd != nil {
+		cd.SetServiceID(result.serviceID)
+		cd.SetAccountID(result.accountID)
+		cd.SetAgentNetwork(result.target.AgentNetwork)
+		cd.SetSuppressAccessLog(result.target.DisableAccessLog)
+	}
+	return resolvedReq, effectiveAccessAction(result.target.AccessAction), nil
+}
+
+// HasBypass reports whether the snapshot contains an authentication bypass.
+func (r *TargetResolver) HasBypass() bool {
+	return r != nil && r.hasBypass
+}
+
+// WithMiddlewareRevision returns a routing snapshot bound to the given policy revision.
+func (r *TargetResolver) WithMiddlewareRevision(revision middleware.Revision) *TargetResolver {
+	bound := *r
+	bound.mapping.MiddlewareRevision = revision
+	return &bound
+}
+
+func targetResolutionFromContext(ctx context.Context) (targetResolution, bool) {
+	resolution, ok := ctx.Value(targetResolutionContextKey{}).(targetResolution)
+	return resolution, ok
+}
+
+func effectiveAccessAction(action AccessAction) AccessAction {
+	if action == "" {
+		return AccessActionInherit
+	}
+	return action
+}
+
+func mappingHasNonDefaultAccessAction(mapping Mapping) bool {
+	for _, target := range mapping.Paths {
+		if target != nil && effectiveAccessAction(target.AccessAction) != AccessActionInherit {
+			return true
+		}
+	}
+	return false
+}
+
+func cloneResolverMapping(mapping Mapping) (Mapping, error) {
+	snapshot := mapping
+	snapshot.Paths = make(map[string]*PathTarget, len(mapping.Paths))
+	snapshot.StripAuthHeaders = append([]string(nil), mapping.StripAuthHeaders...)
+	snapshot.sortedPaths = make([]string, 0, len(mapping.Paths))
+
+	for path, target := range mapping.Paths {
+		if target == nil || target.URL == nil {
+			return Mapping{}, fmt.Errorf("target for path %q is incomplete", path)
+		}
+		action := effectiveAccessAction(target.AccessAction)
+		switch action {
+		case AccessActionInherit, AccessActionBypass, AccessActionBlock:
+		default:
+			return Mapping{}, fmt.Errorf("unknown access action %q for path %q", target.AccessAction, path)
+		}
+		if action == AccessActionBypass && target.AgentNetwork {
+			return Mapping{}, fmt.Errorf("authentication bypass is not allowed for Agent Network target %q", path)
+		}
+		if action != AccessActionInherit {
+			if err := validateAccessPrefix(path); err != nil {
+				return Mapping{}, fmt.Errorf("invalid access-controlled path %q: %w", path, err)
+			}
+		}
+
+		cloned := clonePathTarget(target)
+		cloned.AccessAction = action
+		snapshot.Paths[path] = cloned
+		snapshot.sortedPaths = append(snapshot.sortedPaths, path)
+	}
+	sort.Slice(snapshot.sortedPaths, func(i, j int) bool {
+		return len(snapshot.sortedPaths[i]) > len(snapshot.sortedPaths[j])
+	})
+	snapshot.requirePinnedResolution = mappingHasNonDefaultAccessAction(snapshot)
+	return snapshot, nil
+}
+
+func validateAccessPrefix(prefix string) error {
+	if strings.ContainsAny(prefix, "?#") {
+		return fmt.Errorf("%w: query or fragment delimiter", ErrUnsafeRequestPath)
+	}
+	return validateAccessPath(&url.URL{Path: prefix})
+}
+
+func clonePathTarget(target *PathTarget) *PathTarget {
+	cloned := *target
+	clonedURL := *target.URL
+	cloned.URL = &clonedURL
+	cloned.CustomHeaders = maps.Clone(target.CustomHeaders)
+	cloned.Middlewares = cloneMiddlewareSpecs(target.Middlewares)
+	cloned.CaptureConfig = cloneCaptureConfig(target.CaptureConfig)
+	return &cloned
+}
+
+func cloneMiddlewareSpecs(specs []middleware.Spec) []middleware.Spec {
+	if specs == nil {
+		return nil
+	}
+	cloned := make([]middleware.Spec, len(specs))
+	for i, spec := range specs {
+		cloned[i] = spec.Clone()
+	}
+	return cloned
+}
+
+func cloneCaptureConfig(config *bodytap.Config) *bodytap.Config {
+	if config == nil {
+		return nil
+	}
+	cloned := *config
+	cloned.ContentTypes = append([]string(nil), config.ContentTypes...)
+	return &cloned
+}
+
+func findTargetInMapping(path string, mapping Mapping) (targetResult, bool) {
+	for _, prefix := range mapping.sortedPaths {
+		if !strings.HasPrefix(path, prefix) {
+			continue
+		}
+		target := mapping.Paths[prefix]
+		if target == nil || target.URL == nil {
+			continue
+		}
+		return targetResult{
+			target:             target,
+			matchedPath:        prefix,
+			serviceID:          mapping.ID,
+			accountID:          mapping.AccountID,
+			passHostHeader:     mapping.PassHostHeader,
+			rewriteRedirects:   mapping.RewriteRedirects,
+			stripAuthHeaders:   mapping.StripAuthHeaders,
+			middlewareRevision: mapping.MiddlewareRevision,
+			requirePinned:      mapping.requirePinnedResolution,
+		}, true
+	}
+	return targetResult{requirePinned: mapping.requirePinnedResolution}, false
+}
+
+func validateAccessPath(requestURL *url.URL) error {
+	if requestURL.Opaque != "" || requestURL.Path == "" || requestURL.Path[0] != '/' {
+		return fmt.Errorf("%w: path must be absolute", ErrUnsafeRequestPath)
+	}
+	if !utf8.ValidString(requestURL.Path) {
+		return fmt.Errorf("%w: path is not valid UTF-8", ErrUnsafeRequestPath)
+	}
+	if requestURL.RawPath != "" {
+		decoded, err := url.PathUnescape(requestURL.RawPath)
+		if err != nil || decoded != requestURL.Path {
+			return fmt.Errorf("%w: invalid escaped path", ErrUnsafeRequestPath)
+		}
+	}
+	if err := validateDecodedAccessPath(requestURL.Path); err != nil {
+		return err
+	}
+	return validateEscapedAccessPath(requestURL.EscapedPath())
+}
+
+func validateDecodedAccessPath(path string) error {
+	if strings.Contains(path, "//") || strings.ContainsAny(path, "\\;?#") {
+		return fmt.Errorf("%w: ambiguous path separator", ErrUnsafeRequestPath)
+	}
+	for _, segment := range strings.Split(path, "/") {
+		if segment == "." || segment == ".." {
+			return fmt.Errorf("%w: dot segment", ErrUnsafeRequestPath)
+		}
+	}
+	for _, char := range path {
+		if char < 0x20 || char == 0x7f {
+			return fmt.Errorf("%w: control character", ErrUnsafeRequestPath)
+		}
+	}
+	return nil
+}
+
+func validateEscapedAccessPath(escapedPath string) error {
+	for i := 0; i < len(escapedPath); i++ {
+		if escapedPath[i] != '%' {
+			continue
+		}
+		if i+2 >= len(escapedPath) {
+			return fmt.Errorf("%w: truncated escape", ErrUnsafeRequestPath)
+		}
+		value, ok := decodeHexByte(escapedPath[i+1], escapedPath[i+2])
+		if !ok {
+			return fmt.Errorf("%w: invalid escape", ErrUnsafeRequestPath)
+		}
+		switch value {
+		case '/', '\\', '.', '%', 0:
+			return fmt.Errorf("%w: ambiguous escaped character", ErrUnsafeRequestPath)
+		}
+		if value < 0x20 || value == 0x7f {
+			return fmt.Errorf("%w: escaped control character", ErrUnsafeRequestPath)
+		}
+		i += 2
+	}
+	return nil
+}
+
+func decodeHexByte(high, low byte) (byte, bool) {
+	hi, ok := hexNibble(high)
+	if !ok {
+		return 0, false
+	}
+	lo, ok := hexNibble(low)
+	if !ok {
+		return 0, false
+	}
+	return hi<<4 | lo, true
+}
+
+func hexNibble(value byte) (byte, bool) {
+	switch {
+	case value >= '0' && value <= '9':
+		return value - '0', true
+	case value >= 'a' && value <= 'f':
+		return value - 'a' + 10, true
+	case value >= 'A' && value <= 'F':
+		return value - 'A' + 10, true
+	default:
+		return 0, false
+	}
+}
diff --git a/proxy/internal/proxy/target_resolver_path_test.go b/proxy/internal/proxy/target_resolver_path_test.go
new file mode 100644
index 000000000..d2c5efa35
--- /dev/null
+++ b/proxy/internal/proxy/target_resolver_path_test.go
@@ -0,0 +1,202 @@
+package proxy
+
+import (
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestValidateAccessPath(t *testing.T) {
+	tests := []struct {
+		name    string
+		url     url.URL
+		wantErr bool
+	}{
+		{name: "root", url: url.URL{Path: "/"}},
+		{name: "nested path", url: url.URL{Path: "/public/status"}},
+		{name: "trailing slash", url: url.URL{Path: "/public/"}},
+		{name: "dots within segments", url: url.URL{Path: "/.well-known/file..json"}},
+		{name: "space", url: url.URL{Path: "/file name"}},
+		{name: "unicode", url: url.URL{Path: "/unicode/é"}},
+		{name: "encoded space", url: url.URL{Path: "/file name", RawPath: "/file%20name"}},
+		{name: "encoded letter", url: url.URL{Path: "/public", RawPath: "/%70ublic"}},
+		{name: "encoded unicode", url: url.URL{Path: "/unicode/é", RawPath: "/unicode/%C3%a9"}},
+		{
+			name: "query and fragment are separate from the path",
+			url:  url.URL{Path: "/public", RawQuery: "next=/../private", Fragment: "section"},
+		},
+		{name: "empty path", url: url.URL{}, wantErr: true},
+		{name: "relative path", url: url.URL{Path: "public"}, wantErr: true},
+		{name: "opaque URL", url: url.URL{Path: "/public", Opaque: "//example.com/private"}, wantErr: true},
+		{name: "invalid UTF-8", url: url.URL{Path: "/public/\xff"}, wantErr: true},
+		{
+			name:    "encoded invalid UTF-8",
+			url:     url.URL{Path: "/public/\xff", RawPath: "/public/%ff"},
+			wantErr: true,
+		},
+		{name: "bare escape", url: url.URL{Path: "/public", RawPath: "/public%"}, wantErr: true},
+		{name: "short escape", url: url.URL{Path: "/public", RawPath: "/public%2"}, wantErr: true},
+		{name: "invalid escape", url: url.URL{Path: "/public", RawPath: "/public%GG"}, wantErr: true},
+		{name: "mismatched raw path", url: url.URL{Path: "/public", RawPath: "/private"}, wantErr: true},
+		{name: "duplicate separator", url: url.URL{Path: "/public//private"}, wantErr: true},
+		{name: "backslash", url: url.URL{Path: "/public\\private"}, wantErr: true},
+		{name: "path parameter", url: url.URL{Path: "/public;private"}, wantErr: true},
+		{name: "query delimiter in path", url: url.URL{Path: "/public?private"}, wantErr: true},
+		{name: "fragment delimiter in path", url: url.URL{Path: "/public#private"}, wantErr: true},
+		{name: "dot segment", url: url.URL{Path: "/public/./private"}, wantErr: true},
+		{name: "parent segment", url: url.URL{Path: "/public/../private"}, wantErr: true},
+		{name: "NUL", url: url.URL{Path: "/public/\x00private"}, wantErr: true},
+		{name: "control character", url: url.URL{Path: "/public/\x1fprivate"}, wantErr: true},
+		{name: "DEL", url: url.URL{Path: "/public/\x7fprivate"}, wantErr: true},
+		{
+			name:    "encoded separator",
+			url:     url.URL{Path: "/public/private", RawPath: "/public%2Fprivate"},
+			wantErr: true,
+		},
+		{
+			// The decoded dot is within a segment, so only escaped validation rejects it.
+			name:    "encoded dot within segment",
+			url:     url.URL{Path: "/file.txt", RawPath: "/file%2Etxt"},
+			wantErr: true,
+		},
+		{
+			name:    "double encoding",
+			url:     url.URL{Path: "/public/%2e%2e/private", RawPath: "/public/%252e%252e/private"},
+			wantErr: true,
+		},
+		{name: "percent without raw path", url: url.URL{Path: "/public/%2fprivate"}, wantErr: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateAccessPath(&tt.url)
+			if tt.wantErr {
+				assert.ErrorIs(t, err, ErrUnsafeRequestPath, "unsafe URL path must be rejected")
+				return
+			}
+			assert.NoError(t, err, "ordinary URL path must remain supported")
+		})
+	}
+}
+
+func TestValidateAccessPath_RejectsEncodedTraversal(t *testing.T) {
+	tests := []struct {
+		name    string
+		rawPath string
+	}{
+		{name: "encoded parent segment", rawPath: "/public/%2E%2E/private"},
+		{
+			name: "UTF-16LE encoded traversal",
+			rawPath: "%2f%00%70%00%75%00%62%00%6c%00%69%00%63%00%2f%00" +
+				"%2e%00%2e%00%2f%00%70%00%72%00%69%00%76%00%61%00%74%00%65%00",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Preserve percent-decoded bytes, including NULs, without transcoding UTF-16.
+			path, err := url.PathUnescape(tt.rawPath)
+			require.NoError(t, err)
+
+			err = validateAccessPath(&url.URL{Path: path, RawPath: tt.rawPath})
+			assert.ErrorIs(t, err, ErrUnsafeRequestPath, "encoded traversal must be rejected")
+		})
+	}
+}
+
+func TestValidateDecodedAccessPath(t *testing.T) {
+	tests := []struct {
+		name    string
+		path    string
+		wantErr bool
+	}{
+		{name: "root", path: "/"},
+		{name: "nested path", path: "/public/status"},
+		{name: "trailing slash", path: "/public/"},
+		{name: "dots within segments", path: "/.well-known/file..json/..."},
+		{name: "space boundary", path: "/file\x20name"},
+		{name: "last printable ASCII", path: "/file\x7e"},
+		{name: "unicode", path: "/unicode/é"},
+		{name: "duplicate leading separator", path: "//public", wantErr: true},
+		{name: "duplicate nested separator", path: "/public//private", wantErr: true},
+		{name: "backslash", path: "/public\\private", wantErr: true},
+		{name: "path parameter", path: "/public;private", wantErr: true},
+		{name: "query delimiter", path: "/public?private", wantErr: true},
+		{name: "fragment delimiter", path: "/public#private", wantErr: true},
+		{name: "dot segment", path: "/public/./private", wantErr: true},
+		{name: "parent segment", path: "/public/../private", wantErr: true},
+		{name: "terminal dot segment", path: "/public/.", wantErr: true},
+		{name: "terminal parent segment", path: "/public/..", wantErr: true},
+		{name: "NUL", path: "/public/\x00private", wantErr: true},
+		{name: "tab", path: "/public/\tprivate", wantErr: true},
+		{name: "newline", path: "/public/\nprivate", wantErr: true},
+		{name: "carriage return", path: "/public/\rprivate", wantErr: true},
+		{name: "last C0 control", path: "/public/\x1fprivate", wantErr: true},
+		{name: "DEL", path: "/public/\x7fprivate", wantErr: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateDecodedAccessPath(tt.path)
+			if tt.wantErr {
+				assert.ErrorIs(t, err, ErrUnsafeRequestPath, "unsafe decoded path %q must be rejected", tt.path)
+				return
+			}
+			assert.NoError(t, err, "ordinary decoded path %q must remain supported", tt.path)
+		})
+	}
+}
+
+func TestValidateEscapedAccessPath(t *testing.T) {
+	// Malformed escapes and decoded controls normally fail earlier in validateAccessPath.
+	// Exercise these guards directly so changes to that ordering cannot silently weaken them.
+	tests := []struct {
+		name    string
+		path    string
+		wantErr bool
+	}{
+		{name: "root", path: "/"},
+		{name: "unescaped path", path: "/.well-known/file.txt"},
+		{name: "encoded space boundary", path: "/file%20name"},
+		{name: "encoded last printable ASCII lowercase", path: "/file%7e"},
+		{name: "encoded last printable ASCII uppercase", path: "/file%7E"},
+		{name: "adjacent escapes", path: "/%41%42%39"},
+		{name: "mixed case unicode escapes", path: "/unicode/%C3%a9"},
+		{name: "bare escape", path: "/public/%", wantErr: true},
+		{name: "short escape", path: "/public/%2", wantErr: true},
+		{name: "invalid high nibble", path: "/public/%G0", wantErr: true},
+		{name: "invalid low nibble", path: "/public/%0g", wantErr: true},
+		{name: "encoded slash lowercase", path: "/public%2fprivate", wantErr: true},
+		{name: "encoded slash uppercase", path: "/public%2Fprivate", wantErr: true},
+		{name: "encoded backslash lowercase", path: "/public%5cprivate", wantErr: true},
+		{name: "encoded backslash uppercase", path: "/public%5Cprivate", wantErr: true},
+		{name: "encoded dot lowercase", path: "/file%2etxt", wantErr: true},
+		{name: "encoded dot uppercase", path: "/file%2Etxt", wantErr: true},
+		{name: "encoded percent", path: "/public/%25", wantErr: true},
+		{name: "double encoding", path: "/public/%252e%252e/private", wantErr: true},
+		{name: "encoded NUL", path: "/public/%00private", wantErr: true},
+		{name: "encoded first non-NUL control", path: "/public/%01private", wantErr: true},
+		{name: "encoded tab", path: "/public/%09private", wantErr: true},
+		{name: "encoded newline", path: "/public/%0aprivate", wantErr: true},
+		{name: "encoded carriage return", path: "/public/%0Dprivate", wantErr: true},
+		{name: "encoded last C0 control lowercase", path: "/public/%1fprivate", wantErr: true},
+		{name: "encoded last C0 control uppercase", path: "/public/%1Fprivate", wantErr: true},
+		{name: "encoded DEL lowercase", path: "/public/%7fprivate", wantErr: true},
+		{name: "encoded DEL uppercase", path: "/public/%7Fprivate", wantErr: true},
+		{name: "unsafe escape after valid escape", path: "/%41%2fprivate", wantErr: true},
+		{name: "malformed escape after valid escape", path: "/%41%", wantErr: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateEscapedAccessPath(tt.path)
+			if tt.wantErr {
+				assert.ErrorIs(t, err, ErrUnsafeRequestPath, "unsafe escaped path %q must be rejected", tt.path)
+				return
+			}
+			assert.NoError(t, err, "ordinary escaped path %q must remain supported", tt.path)
+		})
+	}
+}
diff --git a/proxy/internal/proxy/target_resolver_test.go b/proxy/internal/proxy/target_resolver_test.go
new file mode 100644
index 000000000..bf48d812c
--- /dev/null
+++ b/proxy/internal/proxy/target_resolver_test.go
@@ -0,0 +1,336 @@
+package proxy
+
+import (
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	guardrail "github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_guardrail"
+)
+
+type resolverRoundTripFunc func(*http.Request) (*http.Response, error)
+
+func (f resolverRoundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
+	return f(req)
+}
+
+func resolverMapping(targets map[string]*PathTarget) Mapping {
+	return Mapping{
+		ID:        "service-1",
+		AccountID: "account-1",
+		Host:      "example.com",
+		Paths:     targets,
+	}
+}
+
+func mustTargetURL(t *testing.T, rawURL string) *url.URL {
+	t.Helper()
+	targetURL, err := url.Parse(rawURL)
+	require.NoError(t, err)
+	return targetURL
+}
+
+func TestTargetResolver_LongestPrefixPinsTargetAndAction(t *testing.T) {
+	mapping := resolverMapping(map[string]*PathTarget{
+		"/": {
+			URL:          mustTargetURL(t, "http://root.internal"),
+			AccessAction: AccessActionInherit,
+		},
+		"/public": {
+			URL:           mustTargetURL(t, "http://public.internal"),
+			AccessAction:  AccessActionBypass,
+			CustomHeaders: map[string]string{"X-Target": "original"},
+		},
+	})
+	resolver, err := NewTargetResolver(mapping)
+	require.NoError(t, err)
+
+	req := httptest.NewRequest(http.MethodGet, "http://example.com/public/status", nil)
+	resolvedReq, action, err := resolver.ResolveRequest(req)
+	require.NoError(t, err)
+	assert.Equal(t, AccessActionBypass, action, "the longest matching target action should be selected")
+
+	// Mutating both the source mapping and the live proxy mapping must not
+	// change the target already selected by the auth snapshot.
+	mapping.Paths["/public"].URL.Host = "mutated.internal"
+	mapping.Paths["/public"].CustomHeaders["X-Target"] = "mutated"
+	liveMapping := resolverMapping(map[string]*PathTarget{
+		"/": {URL: mustTargetURL(t, "http://replacement.internal")},
+	})
+
+	var gotHost, gotHeader string
+	rp := NewReverseProxy(resolverRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		gotHost = req.URL.Host
+		gotHeader = req.Header.Get("X-Target")
+		return &http.Response{
+			StatusCode: http.StatusNoContent,
+			Header:     make(http.Header),
+			Body:       http.NoBody,
+		}, nil
+	}), "auto", nil, nil)
+	rp.AddMapping(liveMapping)
+	rec := httptest.NewRecorder()
+	rp.ServeHTTP(rec, resolvedReq)
+
+	assert.Equal(t, http.StatusNoContent, rec.Code)
+	assert.Equal(t, "public.internal", gotHost, "forwarding must reuse the target pinned before auth")
+	assert.Equal(t, "original", gotHeader, "resolver-owned target options must be immutable")
+}
+
+func TestTargetResolver_PinnedMissDoesNotFallBackToNewMapping(t *testing.T) {
+	resolver, err := NewTargetResolver(resolverMapping(map[string]*PathTarget{
+		"/api": {URL: mustTargetURL(t, "http://api.internal")},
+	}))
+	require.NoError(t, err)
+
+	req := httptest.NewRequest(http.MethodGet, "http://example.com/other", nil)
+	resolvedReq, action, err := resolver.ResolveRequest(req)
+	require.NoError(t, err)
+	assert.Equal(t, AccessActionInherit, action)
+
+	called := false
+	rp := NewReverseProxy(resolverRoundTripFunc(func(*http.Request) (*http.Response, error) {
+		called = true
+		return nil, errors.New("unexpected forwarding")
+	}), "auto", nil, nil)
+	rp.AddMapping(resolverMapping(map[string]*PathTarget{
+		"/": {URL: mustTargetURL(t, "http://new.internal")},
+	}))
+	rec := httptest.NewRecorder()
+	rp.ServeHTTP(rec, resolvedReq)
+
+	assert.Equal(t, http.StatusNotFound, rec.Code)
+	assert.False(t, called, "a miss pinned before auth must not be resolved again after an update")
+}
+
+func TestReverseProxy_UnpinnedNonDefaultMappingFailsClosed(t *testing.T) {
+	for _, requestPath := range []string{"/public", "/missing"} {
+		t.Run(requestPath, func(t *testing.T) {
+			called := false
+			rp := NewReverseProxy(resolverRoundTripFunc(func(*http.Request) (*http.Response, error) {
+				called = true
+				return nil, errors.New("unexpected forwarding")
+			}), "auto", nil, nil)
+			rp.AddMapping(resolverMapping(map[string]*PathTarget{
+				"/public": {
+					URL:          mustTargetURL(t, "http://public.internal"),
+					AccessAction: AccessActionBypass,
+				},
+			}))
+
+			req := httptest.NewRequest(http.MethodGet, "http://example.com"+requestPath, nil)
+			rec := httptest.NewRecorder()
+			rp.ServeHTTP(rec, req)
+
+			assert.Equal(t, http.StatusServiceUnavailable, rec.Code,
+				"both target hits and misses must require an auth-owned resolution")
+			assert.Equal(t, "no-store", rec.Header().Get("Cache-Control"),
+				"an unavailable routing snapshot must not be cached")
+			assert.False(t, called, "a target access action must never forward without an auth-owned resolution")
+		})
+	}
+}
+
+func TestReverseProxy_ConfiguredMiddlewareMissingChainFailsClosed(t *testing.T) {
+	called := false
+	manager := middleware.NewManager(0, nil, nil)
+	rp := NewReverseProxy(resolverRoundTripFunc(func(*http.Request) (*http.Response, error) {
+		called = true
+		return nil, errors.New("unexpected forwarding")
+	}), "auto", nil, nil, WithMiddlewareManager(manager))
+	rp.AddMapping(resolverMapping(map[string]*PathTarget{
+		"/": {
+			URL: mustTargetURL(t, "http://protected.internal"),
+			Middlewares: []middleware.Spec{{
+				ID:      "required-policy",
+				Slot:    middleware.SlotOnRequest,
+				Enabled: true,
+			}},
+		},
+	}))
+
+	req := httptest.NewRequest(http.MethodGet, "http://example.com/", nil)
+	rec := httptest.NewRecorder()
+	rp.ServeHTTP(rec, req)
+
+	assert.Equal(t, http.StatusServiceUnavailable, rec.Code)
+	assert.Equal(t, "no-store", rec.Header().Get("Cache-Control"))
+	assert.False(t, called, "a missing configured policy chain must never become pass-through")
+}
+
+func TestReverseProxy_PinnedTargetFailsClosedAfterMiddlewareRemoval(t *testing.T) {
+	target := &PathTarget{
+		URL:          mustTargetURL(t, "http://protected.internal"),
+		AccessAction: AccessActionInherit,
+		Middlewares: []middleware.Spec{{
+			ID:      guardrail.ID,
+			Slot:    middleware.SlotOnRequest,
+			Enabled: true,
+		}},
+	}
+	mapping := resolverMapping(map[string]*PathTarget{"/": target})
+	resolver, err := NewTargetResolver(mapping)
+	require.NoError(t, err)
+	req := httptest.NewRequest(http.MethodGet, "http://example.com/", nil)
+	resolvedReq, _, err := resolver.ResolveRequest(req)
+	require.NoError(t, err)
+
+	upstreamCalls := 0
+	registry := middleware.NewRegistry()
+	require.NoError(t, registry.Register(guardrail.Factory{}))
+	manager := middleware.NewManager(0, nil, nil)
+	manager.SetResolver(middleware.NewResolver(registry))
+	require.NoError(t, manager.Rebuild(string(mapping.ID), []middleware.PathTargetBinding{{
+		ServiceID: string(mapping.ID),
+		PathID:    "/",
+		Specs:     target.Middlewares,
+	}}))
+	require.NotNil(t, manager.ChainFor(string(mapping.ID), "/"), "the policy chain must exist before invalidation")
+	rp := NewReverseProxy(resolverRoundTripFunc(func(*http.Request) (*http.Response, error) {
+		upstreamCalls++
+		return &http.Response{
+			StatusCode: http.StatusNoContent,
+			Header:     make(http.Header),
+			Body:       http.NoBody,
+		}, nil
+	}), "auto", nil, nil, WithMiddlewareManager(manager))
+	before := httptest.NewRecorder()
+	rp.ServeHTTP(before, resolvedReq.Clone(resolvedReq.Context()))
+	require.Equal(t, http.StatusNoContent, before.Code, "the installed policy chain must allow forwarding")
+	require.Equal(t, 1, upstreamCalls, "the upstream must receive the request before invalidation")
+
+	manager.Invalidate(string(mapping.ID))
+	require.Nil(t, manager.ChainFor(string(mapping.ID), "/"), "invalidation must remove the installed chain")
+	rec := httptest.NewRecorder()
+	rp.ServeHTTP(rec, resolvedReq)
+
+	assert.Equal(t, http.StatusServiceUnavailable, rec.Code, "a removed policy chain must fail closed")
+	assert.Equal(t, "no-store", rec.Header().Get("Cache-Control"), "a removed policy chain must not be cached")
+	assert.Equal(t, 1, upstreamCalls, "a stale pinned target must not bypass a removed policy chain")
+}
+
+func TestTargetResolver_RejectsUnsafePathsWhenActionsAreConfigured(t *testing.T) {
+	resolver, err := NewTargetResolver(resolverMapping(map[string]*PathTarget{
+		"/public": {
+			URL:          mustTargetURL(t, "http://public.internal"),
+			AccessAction: AccessActionBypass,
+		},
+		"/": {URL: mustTargetURL(t, "http://root.internal")},
+	}))
+	require.NoError(t, err)
+
+	tests := []struct {
+		name    string
+		path    string
+		rawPath string
+	}{
+		{name: "dot segment", path: "/public/../private"},
+		{name: "duplicate separator", path: "/public//private"},
+		{name: "backslash", path: `/public\private`},
+		{name: "path parameter", path: "/public;ignored/private"},
+		{name: "encoded query delimiter", path: "/public?ignored", rawPath: "/public%3fignored"},
+		{name: "encoded fragment delimiter", path: "/public#ignored", rawPath: "/public%23ignored"},
+		{name: "encoded slash", path: "/public/private", rawPath: "/public%2fprivate"},
+		{name: "encoded dot", path: "/public/../private", rawPath: "/public/%2e%2e/private"},
+		{name: "double encoding", path: "/public/%2e%2e/private", rawPath: "/public/%252e%252e/private"},
+		{name: "escaped NUL", path: "/public/\x00private", rawPath: "/public/%00private"},
+		{name: "mismatched raw path", path: "/public/safe", rawPath: "/different"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := httptest.NewRequest(http.MethodGet, "http://example.com/", nil)
+			req.URL.Path = tt.path
+			req.URL.RawPath = tt.rawPath
+
+			_, _, err := resolver.ResolveRequest(req)
+
+			require.ErrorIs(t, err, ErrUnsafeRequestPath)
+		})
+	}
+
+	req := httptest.NewRequest(http.MethodGet, "http://example.com/public/file%20name", nil)
+	_, action, err := resolver.ResolveRequest(req)
+	require.NoError(t, err)
+	assert.Equal(t, AccessActionBypass, action, "ordinary percent-encoded path data should remain supported")
+}
+
+func TestTargetResolver_InheritOnlyPreservesLegacyPathHandling(t *testing.T) {
+	resolver, err := NewTargetResolver(resolverMapping(map[string]*PathTarget{
+		"/": {URL: mustTargetURL(t, "http://root.internal")},
+	}))
+	require.NoError(t, err)
+
+	req := httptest.NewRequest(http.MethodGet, "http://example.com/", nil)
+	req.URL.Path = "/legacy/../path"
+	resolvedReq, action, err := resolver.ResolveRequest(req)
+
+	require.NoError(t, err)
+	assert.Equal(t, AccessActionInherit, action)
+	_, pinned := targetResolutionFromContext(resolvedReq.Context())
+	assert.True(t, pinned, "inherit-only mappings should still pin their target snapshot")
+}
+
+func TestNewTargetResolver_RejectsInvalidAccessActions(t *testing.T) {
+	tests := []struct {
+		name   string
+		target *PathTarget
+	}{
+		{
+			name: "unknown action",
+			target: &PathTarget{
+				URL:          mustTargetURL(t, "http://target.internal"),
+				AccessAction: AccessAction("unknown"),
+			},
+		},
+		{
+			name: "Agent Network bypass",
+			target: &PathTarget{
+				URL:          mustTargetURL(t, "http://target.internal"),
+				AccessAction: AccessActionBypass,
+				AgentNetwork: true,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := NewTargetResolver(resolverMapping(map[string]*PathTarget{"/": tt.target}))
+			require.Error(t, err)
+		})
+	}
+}
+
+func TestNewTargetResolver_RejectsNoncanonicalAccessPrefixes(t *testing.T) {
+	prefixes := []string{
+		"public",
+		"/public/../private",
+		"/public//nested",
+		`/public\nested`,
+		"/public;parameter",
+		"/public%2fprivate",
+		"/public?query",
+		"/public#fragment",
+		"/public\x00nested",
+	}
+
+	for _, prefix := range prefixes {
+		t.Run(prefix, func(t *testing.T) {
+			_, err := NewTargetResolver(resolverMapping(map[string]*PathTarget{
+				prefix: {
+					URL:          mustTargetURL(t, "http://target.internal"),
+					AccessAction: AccessActionBlock,
+				},
+				"/": {URL: mustTargetURL(t, "http://root.internal")},
+			}))
+
+			require.ErrorIs(t, err, ErrUnsafeRequestPath)
+		})
+	}
+}
diff --git a/proxy/server.go b/proxy/server.go
index 762ead9b8..083449962 100644
--- a/proxy/server.go
+++ b/proxy/server.go
@@ -1644,6 +1644,22 @@ func (s *Server) addMapping(ctx context.Context, mapping *proto.ProxyMapping) er
 // state and re-applies them from the new mapping.
 func (s *Server) modifyMapping(ctx context.Context, mapping *proto.ProxyMapping) error {
 	if old := s.loadMapping(types.ServiceID(mapping.GetId())); old != nil {
+		if !types.ServiceMode(old.GetMode()).IsL4() &&
+			!types.ServiceMode(mapping.GetMode()).IsL4() &&
+			old.GetDomain() == mapping.GetDomain() &&
+			len(old.GetPath()) > 0 && len(mapping.GetPath()) > 0 {
+			if err := s.updateMapping(ctx, mapping); err != nil {
+				// Fail the whole service closed until a valid update arrives: the old
+				// policy could retain access this replacement intended to revoke.
+				// Keep the peer, but withdraw routes and the cached mapping for recovery.
+				s.cleanupMappingRoutes(old)
+				s.deleteMapping(types.ServiceID(mapping.GetId()))
+				return err
+			}
+			s.storeMapping(mapping)
+			s.hijackTracker.CloseByHost(mapping.GetDomain())
+			return nil
+		}
 		s.cleanupMappingRoutes(old)
 		if mode := types.ServiceMode(old.GetMode()); mode.IsL4() {
 			s.meter.L4ServiceRemoved(mode)
@@ -2060,13 +2076,16 @@ func (s *Server) addUDPRelay(ctx context.Context, mapping *proto.ProxyMapping, t
 }
 
 func (s *Server) updateMapping(ctx context.Context, mapping *proto.ProxyMapping) error {
-	// Very simple implementation here, we don't touch the existing peer
-	// connection or any existing TLS configuration, we simply overwrite
-	// the auth and proxy mappings.
-	// Note: this does require the management server to always send a
-	// full mapping rather than deltas during a modification.
 	accountID := types.AccountID(mapping.GetAccountId())
 	svcID := types.ServiceID(mapping.GetId())
+	m, err := s.protoToMapping(ctx, mapping)
+	if err != nil {
+		return err
+	}
+	resolver, err := proxy.NewTargetResolver(m)
+	if err != nil {
+		return fmt.Errorf("prepare target routes: %w", err)
+	}
 
 	var schemes []auth.Scheme
 	if mapping.GetAuth().GetPassword() {
@@ -2084,19 +2103,19 @@ func (s *Server) updateMapping(ctx context.Context, mapping *proto.ProxyMapping)
 	s.warnIfGeoUnavailable(mapping.GetDomain(), mapping.GetAccessRestrictions())
 
 	maxSessionAge := time.Duration(mapping.GetAuth().GetMaxSessionAgeSeconds()) * time.Second
-	if err := s.auth.AddDomain(mapping.GetDomain(), schemes, mapping.GetAuth().GetSessionKey(), maxSessionAge, accountID, svcID, ipRestrictions, mapping.GetPrivate(), mapping.GetAuth().GetAllowedGroupIds()); err != nil {
+	config, err := auth.NewDomainConfig(mapping.GetDomain(), schemes, mapping.GetAuth().GetSessionKey(), maxSessionAge, accountID, svcID, ipRestrictions, mapping.GetPrivate(), mapping.GetAuth().GetAllowedGroupIds(), auth.WithTargetResolver(resolver))
+	if err != nil {
 		return fmt.Errorf("auth setup for domain %s: %w", mapping.GetDomain(), err)
 	}
-	m := s.protoToMapping(ctx, mapping)
-	// The chain is published before the route that leads to it. A request
-	// arriving at a target whose chain has not been rebuilt yet is served
-	// straight through, so a provider update that added the route first left a
-	// window in which an inference could complete unrouted and unmetered.
-	// Rebuilding first inverts that: the worst a request in the window meets is
-	// the new chain in front of the previous target, which is still counted.
-	if err := s.rebuildMiddlewareChains(svcID, m); err != nil {
+	revision, err := s.rebuildMiddlewareChains(svcID, m)
+	if err != nil {
 		return err
 	}
+	m.MiddlewareRevision = revision
+	config.TargetResolver = resolver.WithMiddlewareRevision(revision)
+	// The auth snapshot owns its resolver, so an in-flight request cannot
+	// authorize an old target and then forward to a replacement target.
+	s.auth.AddDomainConfig(mapping.GetDomain(), config)
 	s.meter.AddMapping(m)
 	s.proxy.AddMapping(m)
 	return nil
@@ -2161,22 +2180,17 @@ func (s *Server) initMiddlewareManager(ctx context.Context) error {
 	return nil
 }
 
-// rebuildMiddlewareChains converts m into per-path bindings and calls
-// Manager.Rebuild. Short-circuits when the middleware manager is unset, which
-// is a deployment without middleware rather than a failure to install it.
-//
-// A rebuild that fails is reported rather than logged: the caller publishes
-// the route once this returns, and a route published over chains that were
-// not installed serves requests with no policy enforcement and no metering.
-func (s *Server) rebuildMiddlewareChains(svcID types.ServiceID, m proxy.Mapping) error {
+// rebuildMiddlewareChains installs the service's policies before its routing snapshot.
+func (s *Server) rebuildMiddlewareChains(svcID types.ServiceID, m proxy.Mapping) (middleware.Revision, error) {
 	if s.middlewareManager == nil {
-		return nil
+		return 0, nil
 	}
 	bindings := buildMiddlewareBindings(svcID, m)
-	if err := s.middlewareManager.Rebuild(string(svcID), bindings); err != nil {
-		return fmt.Errorf("rebuild middleware chains for service %s: %w", svcID, err)
+	revision, err := s.middlewareManager.RebuildSnapshot(string(svcID), bindings)
+	if err != nil {
+		return 0, fmt.Errorf("rebuild middleware chains for service %s: %w", svcID, err)
 	}
-	return nil
+	return revision, nil
 }
 
 // isLiveService reports whether svcID is currently present in the live
@@ -2261,10 +2275,10 @@ func (s *Server) cleanupMappingRoutes(mapping *proto.ProxyMapping) {
 		if s.acme != nil {
 			s.acme.RemoveDomain(d)
 		}
-		s.auth.RemoveDomain(host)
 		if s.proxy.RemoveMapping(proxy.Mapping{Host: host}) {
 			s.meter.RemoveMapping(proxy.Mapping{Host: host})
 		}
+		s.auth.RemoveDomain(host)
 		// Close hijacked connections (WebSocket) for this domain.
 		if n := s.hijackTracker.CloseByHost(host); n > 0 {
 			s.Logger.Debugf("closed %d hijacked connection(s) for %s", n, host)
@@ -2337,23 +2351,33 @@ func (s *Server) deleteMapping(svcID types.ServiceID) *proto.ProxyMapping {
 	return m
 }
 
-func (s *Server) protoToMapping(ctx context.Context, mapping *proto.ProxyMapping) proxy.Mapping {
+func (s *Server) protoToMapping(ctx context.Context, mapping *proto.ProxyMapping) (proxy.Mapping, error) {
+	pathMappings := mapping.GetPath()
+	actions, strictPaths, err := parseTargetAccessActions(pathMappings)
+	if err != nil {
+		return proxy.Mapping{}, err
+	}
+
 	paths := make(map[string]*proxy.PathTarget)
-	for _, pathMapping := range mapping.GetPath() {
+	for i, pathMapping := range pathMappings {
+		path := pathMapping.GetPath()
+		if strictPaths && path == "" {
+			path = "/"
+		}
+		if strictPaths {
+			if _, exists := paths[path]; exists {
+				return proxy.Mapping{}, fmt.Errorf("duplicate target location %q", path)
+			}
+		}
 		targetURL, err := url.Parse(pathMapping.GetTarget())
 		if err != nil {
-			s.Logger.WithFields(log.Fields{
-				"service_id": mapping.GetId(),
-				"account_id": mapping.GetAccountId(),
-				"domain":     mapping.GetDomain(),
-				"path":       pathMapping.GetPath(),
-				"target":     pathMapping.GetTarget(),
-			}).WithError(err).Error("failed to parse target URL for path, skipping")
-			s.notifyError(ctx, mapping, fmt.Errorf("invalid target URL %q for path %q: %w", pathMapping.GetTarget(), pathMapping.GetPath(), err))
-			continue
+			return proxy.Mapping{}, fmt.Errorf("parse target URL for location %q: %w", path, err)
+		}
+		if targetURL.Host == "" || (targetURL.Scheme != "http" && targetURL.Scheme != "https") {
+			return proxy.Mapping{}, fmt.Errorf("invalid HTTP target URL for location %q", path)
 		}
 
-		pt := &proxy.PathTarget{URL: targetURL}
+		pt := &proxy.PathTarget{URL: targetURL, AccessAction: actions[i]}
 		if opts := pathMapping.GetOptions(); opts != nil {
 			pt.SkipTLSVerify = opts.GetSkipTlsVerify()
 			pt.PathRewrite = protoToPathRewrite(opts.GetPathRewrite())
@@ -2370,7 +2394,7 @@ func (s *Server) protoToMapping(ctx context.Context, mapping *proto.ProxyMapping
 			pt.DisableAccessLog = opts.GetDisableAccessLog()
 		}
 		pt.RequestTimeout = s.clampDialTimeout(pt.RequestTimeout)
-		paths[pathMapping.GetPath()] = pt
+		paths[path] = pt
 	}
 	m := proxy.Mapping{
 		ID:               types.ServiceID(mapping.GetId()),
@@ -2383,7 +2407,7 @@ func (s *Server) protoToMapping(ctx context.Context, mapping *proto.ProxyMapping
 	for _, ha := range mapping.GetAuth().GetHeaderAuths() {
 		m.StripAuthHeaders = append(m.StripAuthHeaders, ha.GetHeader())
 	}
-	return m
+	return m, nil
 }
 
 func protoToPathRewrite(mode proto.PathRewriteMode) proxy.PathRewriteMode {
diff --git a/proxy/target_access_control.go b/proxy/target_access_control.go
new file mode 100644
index 000000000..9460375c9
--- /dev/null
+++ b/proxy/target_access_control.go
@@ -0,0 +1,40 @@
+package proxy
+
+import (
+	"fmt"
+
+	"github.com/netbirdio/netbird/proxy/internal/proxy"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+func parseTargetAccessActions(pathMappings []*proto.PathMapping) ([]proxy.AccessAction, bool, error) {
+	actions := make([]proxy.AccessAction, len(pathMappings))
+	strictPaths := false
+	for i, pathMapping := range pathMappings {
+		if pathMapping == nil {
+			return nil, false, fmt.Errorf("nil target mapping")
+		}
+		action, err := targetAccessActionFromProto(pathMapping.GetAccessAction())
+		if err != nil {
+			return nil, false, err
+		}
+		actions[i] = action
+		if action != proxy.AccessActionInherit {
+			strictPaths = true
+		}
+	}
+	return actions, strictPaths, nil
+}
+
+func targetAccessActionFromProto(action proto.TargetAccessAction) (proxy.AccessAction, error) {
+	switch action {
+	case proto.TargetAccessAction_TARGET_ACCESS_ACTION_INHERIT:
+		return proxy.AccessActionInherit, nil
+	case proto.TargetAccessAction_TARGET_ACCESS_ACTION_BYPASS:
+		return proxy.AccessActionBypass, nil
+	case proto.TargetAccessAction_TARGET_ACCESS_ACTION_BLOCK:
+		return proxy.AccessActionBlock, nil
+	default:
+		return "", fmt.Errorf("unknown target access action %d", action)
+	}
+}
diff --git a/proxy/target_access_control_runtime_test.go b/proxy/target_access_control_runtime_test.go
new file mode 100644
index 000000000..4ff3104e4
--- /dev/null
+++ b/proxy/target_access_control_runtime_test.go
@@ -0,0 +1,172 @@
+package proxy
+
+import (
+	"context"
+	"crypto/tls"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.opentelemetry.io/otel/metric/noop"
+
+	"github.com/netbirdio/netbird/proxy/internal/auth"
+	proxymetrics "github.com/netbirdio/netbird/proxy/internal/metrics"
+	internalproxy "github.com/netbirdio/netbird/proxy/internal/proxy"
+	"github.com/netbirdio/netbird/proxy/internal/roundtrip"
+	nbtcp "github.com/netbirdio/netbird/proxy/internal/tcp"
+	proxytypes "github.com/netbirdio/netbird/proxy/internal/types"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+const (
+	targetAccessAccountID = "test-account-1"
+	targetAccessCluster   = "test.proxy.io"
+	targetAccessDomain    = "target-access.test.proxy.io"
+	targetAccessHeader    = "X-Test-Key"
+	targetAccessSecret    = "valid-secret"
+)
+
+type targetAccessRequest struct {
+	path    string
+	headers http.Header
+}
+
+type targetAccessUpstream struct {
+	mu       sync.Mutex
+	requests []targetAccessRequest
+}
+
+func (u *targetAccessUpstream) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	u.mu.Lock()
+	u.requests = append(u.requests, targetAccessRequest{
+		path:    r.URL.Path,
+		headers: r.Header.Clone(),
+	})
+	u.mu.Unlock()
+	w.WriteHeader(http.StatusOK)
+}
+
+func (u *targetAccessUpstream) snapshot() []targetAccessRequest {
+	u.mu.Lock()
+	defer u.mu.Unlock()
+	return append([]targetAccessRequest(nil), u.requests...)
+}
+
+func newTargetAccessRuntime(t *testing.T) (*Server, http.Handler) {
+	t.Helper()
+
+	logger := quietLifecycleLogger()
+	meter, err := proxymetrics.New(t.Context(), noop.Meter{})
+	require.NoError(t, err)
+
+	reverseProxy := internalproxy.NewReverseProxy(http.DefaultTransport, "auto", nil, logger)
+	authMiddleware := auth.NewMiddleware(logger, nil, nil)
+	srv := &Server{
+		ctx:              t.Context(),
+		Logger:           logger,
+		proxy:            reverseProxy,
+		auth:             authMiddleware,
+		meter:            meter,
+		mainRouter:       nbtcp.NewRouter(logger, nil, &net.TCPAddr{}),
+		portRouters:      make(map[uint16]*portRouter),
+		svcPorts:         make(map[proxytypes.ServiceID][]uint16),
+		lastMappings:     make(map[proxytypes.ServiceID]*proto.ProxyMapping),
+		crowdsecServices: make(map[proxytypes.ServiceID]bool),
+		removePeer: func(context.Context, proxytypes.AccountID, roundtrip.ServiceKey) error {
+			return nil
+		},
+	}
+
+	return srv, authMiddleware.Protect(reverseProxy)
+}
+
+func applyTargetAccessMapping(t *testing.T, srv *Server, mapping *proto.ProxyMapping) {
+	t.Helper()
+	require.NoError(t, srv.updateMapping(t.Context(), mapping))
+	srv.storeMapping(mapping)
+}
+
+func targetAccessRequestTo(handler http.Handler, path, remoteAddr string, headers http.Header) *httptest.ResponseRecorder {
+	req := httptest.NewRequest(http.MethodGet, "http://"+targetAccessDomain+path, nil)
+	req.Host = targetAccessDomain
+	req.RemoteAddr = remoteAddr
+	for name, values := range headers {
+		for _, value := range values {
+			req.Header.Add(name, value)
+		}
+	}
+	recorder := httptest.NewRecorder()
+	handler.ServeHTTP(recorder, req)
+	return recorder
+}
+
+func TestModifyHTTPMappingFromEmptyPathsRegistersRoute(t *testing.T) {
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("X-Test-Upstream", "reached")
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	t.Cleanup(upstream.Close)
+
+	runtime, handler := newTargetAccessRuntime(t)
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = listener.Close() })
+
+	router := nbtcp.NewRouter(runtime.Logger, func(proxytypes.AccountID) (proxytypes.DialContextFunc, error) {
+		return func(context.Context, string, string) (net.Conn, error) {
+			return nil, net.ErrClosed
+		}, nil
+	}, listener.Addr())
+	router.SetFallback(nbtcp.Route{
+		Type:      nbtcp.RouteTCP,
+		AccountID: "fallback-account",
+		ServiceID: "fallback-service",
+		Target:    "unreachable.test:443",
+	})
+	runtime.mainRouter = router
+
+	httpServer := &http.Server{
+		Handler:           handler,
+		TLSConfig:         selfSignedTLSConfig(t),
+		ReadHeaderTimeout: time.Second,
+	}
+	t.Cleanup(func() { _ = httpServer.Close() })
+	go func() { _ = httpServer.ServeTLS(router.HTTPListener(), "", "") }()
+	go feedRouterFromListener(t.Context(), listener, router, runtime.Logger, proxytypes.AccountID(targetAccessAccountID))
+
+	previous := &proto.ProxyMapping{
+		Id:        "empty-to-routable",
+		AccountId: targetAccessAccountID,
+		Domain:    targetAccessDomain,
+	}
+	runtime.storeMapping(previous)
+	replacement := &proto.ProxyMapping{
+		Id:        previous.GetId(),
+		AccountId: previous.GetAccountId(),
+		Domain:    previous.GetDomain(),
+		Path: []*proto.PathMapping{{
+			Path:   "/",
+			Target: upstream.URL,
+		}},
+	}
+	require.NoError(t, runtime.modifyMapping(t.Context(), replacement))
+
+	transport := &http.Transport{
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: true, MinVersion: tls.VersionTLS12}, //nolint:gosec
+		DialContext: func(ctx context.Context, network, _ string) (net.Conn, error) {
+			return (&net.Dialer{}).DialContext(ctx, network, listener.Addr().String())
+		},
+	}
+	t.Cleanup(transport.CloseIdleConnections)
+	client := &http.Client{Transport: transport, Timeout: 3 * time.Second}
+	response, err := client.Get("https://" + targetAccessDomain + "/ready")
+	require.NoError(t, err, "first target must register the domain with the SNI router")
+	t.Cleanup(func() { _ = response.Body.Close() })
+	assert.Equal(t, http.StatusNoContent, response.StatusCode)
+	assert.Equal(t, "reached", response.Header.Get("X-Test-Upstream"))
+}
diff --git a/proxy/target_access_control_test.go b/proxy/target_access_control_test.go
new file mode 100644
index 000000000..a1be3a83b
--- /dev/null
+++ b/proxy/target_access_control_test.go
@@ -0,0 +1,151 @@
+package proxy
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
+
+	internalproxy "github.com/netbirdio/netbird/proxy/internal/proxy"
+	managementproto "github.com/netbirdio/netbird/shared/management/proto"
+)
+
+func TestTargetAccessActionFromProto(t *testing.T) {
+	tests := []struct {
+		name string
+		wire managementproto.TargetAccessAction
+		want internalproxy.AccessAction
+	}{
+		{"inherit", managementproto.TargetAccessAction_TARGET_ACCESS_ACTION_INHERIT, internalproxy.AccessActionInherit},
+		{"bypass", managementproto.TargetAccessAction_TARGET_ACCESS_ACTION_BYPASS, internalproxy.AccessActionBypass},
+		{"block", managementproto.TargetAccessAction_TARGET_ACCESS_ACTION_BLOCK, internalproxy.AccessActionBlock},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := targetAccessActionFromProto(tt.wire)
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, got, "wire action must retain its enforcement meaning")
+		})
+	}
+	_, err := targetAccessActionFromProto(managementproto.TargetAccessAction(99))
+	require.Error(t, err, "an unknown wire action must reject the mapping")
+}
+
+func TestProtoToMappingPreservesLegacyDuplicateLocations(t *testing.T) {
+	runtime, _ := newTargetAccessRuntime(t)
+	mapping, err := runtime.protoToMapping(t.Context(), &managementproto.ProxyMapping{
+		Id: "legacy-service", AccountId: "account", Domain: targetAccessDomain,
+		Path: []*managementproto.PathMapping{
+			{Path: "/", Target: "http://first.internal"},
+			{Path: "/", Target: "https://second.internal"},
+			{Path: "", Target: "http://empty.internal"},
+		},
+	})
+	require.NoError(t, err)
+	require.Len(t, mapping.Paths, 2, "legacy empty and slash locations must remain distinct")
+	assert.Equal(t, "second.internal", mapping.Paths["/"].URL.Host,
+		"legacy duplicate locations must retain last-entry-wins behavior")
+	assert.Equal(t, "empty.internal", mapping.Paths[""].URL.Host)
+}
+
+func TestProtoToMappingRejectsDuplicateLocationsWhenAccessControlIsActive(t *testing.T) {
+	tests := []struct {
+		name  string
+		paths []*managementproto.PathMapping
+	}{
+		{
+			name: "duplicate action location",
+			paths: []*managementproto.PathMapping{
+				{Path: "/", Target: "http://first.internal"},
+				{Path: "/", Target: "http://second.internal", AccessAction: managementproto.TargetAccessAction_TARGET_ACCESS_ACTION_BLOCK},
+			},
+		},
+		{
+			name: "root aliases",
+			paths: []*managementproto.PathMapping{
+				{Path: "", Target: "http://first.internal"},
+				{Path: "/", Target: "http://second.internal", AccessAction: managementproto.TargetAccessAction_TARGET_ACCESS_ACTION_BYPASS},
+			},
+		},
+		{
+			name: "action elsewhere",
+			paths: []*managementproto.PathMapping{
+				{Path: "/", Target: "http://first.internal"},
+				{Path: "/", Target: "http://second.internal"},
+				{Path: "/public", Target: "http://public.internal", AccessAction: managementproto.TargetAccessAction_TARGET_ACCESS_ACTION_BYPASS},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			runtime, _ := newTargetAccessRuntime(t)
+			_, err := runtime.protoToMapping(t.Context(), &managementproto.ProxyMapping{
+				Id: "guarded-service", AccountId: "account", Domain: targetAccessDomain, Path: tt.paths,
+			})
+			assert.ErrorContains(t, err, `duplicate target location "/"`)
+		})
+	}
+}
+
+func TestModifyHTTPMappingRejectsInvalidReplacement(t *testing.T) {
+	tests := []struct {
+		name   string
+		modify func(*managementproto.ProxyMapping)
+	}{
+		{"unknown action", func(m *managementproto.ProxyMapping) {
+			m.Path[0].AccessAction = managementproto.TargetAccessAction(99)
+		}},
+		{"duplicate locations", func(m *managementproto.ProxyMapping) {
+			m.Path = append(m.Path, &managementproto.PathMapping{Path: "/", Target: "http://127.0.0.1:1"})
+		}},
+		{"duplicate root aliases", func(m *managementproto.ProxyMapping) {
+			m.Path = append(m.Path, &managementproto.PathMapping{Target: "http://127.0.0.1:1"})
+		}},
+		{"nil target", func(m *managementproto.ProxyMapping) {
+			m.Path = append(m.Path, nil)
+		}},
+		{"malformed URL", func(m *managementproto.ProxyMapping) {
+			m.Path[0].Target = "http://["
+		}},
+		{"missing host", func(m *managementproto.ProxyMapping) {
+			m.Path[0].Target = "http:/backend"
+		}},
+		{"unsupported protocol", func(m *managementproto.ProxyMapping) {
+			m.Path[0].Target = "ftp://backend"
+		}},
+		{"private bypass", func(m *managementproto.ProxyMapping) {
+			m.Private = true
+			m.Path[0].AccessAction = managementproto.TargetAccessAction_TARGET_ACCESS_ACTION_BYPASS
+		}},
+		{"agent network bypass", func(m *managementproto.ProxyMapping) {
+			m.Path[0].AccessAction = managementproto.TargetAccessAction_TARGET_ACCESS_ACTION_BYPASS
+			m.Path[0].Options = &managementproto.PathTargetOptions{AgentNetwork: true}
+		}},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			runtime, handler := newTargetAccessRuntime(t)
+			original := &managementproto.ProxyMapping{
+				Id: "guarded-service", AccountId: "account", Domain: targetAccessDomain,
+				Path: []*managementproto.PathMapping{{
+					Path: "/", Target: "http://127.0.0.1:1",
+					AccessAction: managementproto.TargetAccessAction_TARGET_ACCESS_ACTION_BLOCK,
+				}},
+			}
+			applyTargetAccessMapping(t, runtime, original)
+			replacement := proto.Clone(original).(*managementproto.ProxyMapping)
+			tt.modify(replacement)
+			require.Error(t, runtime.modifyMapping(t.Context(), replacement))
+			response := targetAccessRequestTo(handler, "/protected", "192.0.2.1:1234", nil)
+			assert.Equal(t, http.StatusNotFound, response.Code,
+				"invalid replacement must withdraw the route instead of retaining a stale policy")
+			require.NoError(t, runtime.modifyMapping(t.Context(), original),
+				"a valid update must reinstall a previously withdrawn route")
+			recovered := targetAccessRequestTo(handler, "/protected", "192.0.2.1:1234", nil)
+			assert.Equal(t, http.StatusForbidden, recovered.Code, "the reinstalled block must be enforced")
+		})
+	}
+}
diff --git a/proxy/target_middleware_revision_test.go b/proxy/target_middleware_revision_test.go
new file mode 100644
index 000000000..7dd5453a2
--- /dev/null
+++ b/proxy/target_middleware_revision_test.go
@@ -0,0 +1,115 @@
+package proxy
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	protobuf "google.golang.org/protobuf/proto"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	guardrail "github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_guardrail"
+	internalproxy "github.com/netbirdio/netbird/proxy/internal/proxy"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+func TestUpdateMappingBindsMiddlewareRevisionAcrossPolicyUpdates(t *testing.T) {
+	oldUpstream := &targetAccessUpstream{}
+	oldBackend := httptest.NewServer(oldUpstream)
+	t.Cleanup(oldBackend.Close)
+	newUpstream := &targetAccessUpstream{}
+	newBackend := httptest.NewServer(newUpstream)
+	t.Cleanup(newBackend.Close)
+
+	runtime, _ := newTargetAccessRuntime(t)
+	registry := middleware.NewRegistry()
+	require.NoError(t, registry.Register(guardrail.Factory{}))
+	manager := middleware.NewManager(0, nil, runtime.Logger)
+	manager.SetResolver(middleware.NewResolver(registry))
+	manager.SetLiveServiceCheck(runtime.isLiveService)
+	t.Cleanup(manager.InvalidateAll)
+	runtime.middlewareRegistry = registry
+	runtime.middlewareManager = manager
+	runtime.proxy = internalproxy.NewReverseProxy(http.DefaultTransport, "auto", nil, runtime.Logger,
+		internalproxy.WithMiddlewareManager(manager))
+	handler := runtime.auth.Protect(runtime.proxy)
+
+	mapping := &proto.ProxyMapping{
+		Id: "middleware-revision-service", AccountId: targetAccessAccountID, Domain: targetAccessDomain,
+		Path: []*proto.PathMapping{{
+			Path: "/", Target: oldBackend.URL,
+			Options: &proto.PathTargetOptions{
+				AgentNetwork:   true,
+				DirectUpstream: true,
+				Middlewares: []*proto.MiddlewareConfig{{
+					Id:         guardrail.ID,
+					Slot:       proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_REQUEST,
+					Enabled:    true,
+					ConfigJson: []byte(`{"provider_allowlists":{"provider-1":["allowed-model"]}}`),
+				}},
+			},
+		}},
+	}
+	applyTargetAccessMapping(t, runtime, mapping)
+	initial := targetAccessRequestTo(handler, "/v1/chat/completions", "192.0.2.1:1234", nil)
+	require.Equal(t, http.StatusForbidden, initial.Code,
+		"the original guardrail must reject a request with no known model")
+	require.Empty(t, oldUpstream.snapshot(), "the original policy must prevent upstream forwarding")
+
+	// Hold the request at the auth/proxy boundary so updateMapping runs after
+	// authorization has pinned the route but before its middleware is selected.
+	captureAuthorizedRequest := func() *http.Request {
+		var pinned *http.Request
+		capture := runtime.auth.Protect(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			pinned = r
+			w.WriteHeader(http.StatusNoContent)
+		}))
+		response := targetAccessRequestTo(capture, "/v1/chat/completions", "192.0.2.1:1234", nil)
+		require.Equal(t, http.StatusNoContent, response.Code, "auth must pass the resolved request to the proxy")
+		require.NotNil(t, pinned, "the request must be captured after auth target resolution")
+		return pinned
+	}
+	staleRequest := captureAuthorizedRequest()
+	oldChain := manager.ChainFor(mapping.GetId(), "/")
+	require.NotNil(t, oldChain, "updateMapping must install the original guardrail chain")
+
+	replacement := protobuf.Clone(mapping).(*proto.ProxyMapping)
+	replacement.Path[0].Target = newBackend.URL
+	replacement.Path[0].Options.Middlewares[0].ConfigJson = []byte(`{}`)
+	applyTargetAccessMapping(t, runtime, replacement)
+	newChain := manager.ChainFor(mapping.GetId(), "/")
+	require.NotNil(t, newChain, "updateMapping must install the replacement guardrail chain")
+	require.NotSame(t, oldChain, newChain, "a policy update must replace the middleware chain")
+
+	staleResponse := httptest.NewRecorder()
+	runtime.proxy.ServeHTTP(staleResponse, staleRequest)
+	assert.Equal(t, http.StatusServiceUnavailable, staleResponse.Code,
+		"a request authorized against the old target must not execute the replacement policy")
+	assert.Equal(t, "no-store", staleResponse.Header().Get("Cache-Control"), "stale policy failures must not be cached")
+	assert.Empty(t, oldUpstream.snapshot(), "a replacement policy must never authorize the old upstream")
+	assert.Empty(t, newUpstream.snapshot(), "a stale request must not forward to the replacement upstream")
+
+	fresh := targetAccessRequestTo(handler, "/v1/chat/completions", "192.0.2.1:1234", nil)
+	require.Equal(t, http.StatusOK, fresh.Code, "fresh auth resolution must use the replacement middleware revision")
+	require.Len(t, newUpstream.snapshot(), 1, "the replacement target must receive the fresh request")
+
+	// Provider changes rebuild middleware instances without replacing the
+	// service mapping, so requests pinned to its current revision stay valid.
+	currentRequest := captureAuthorizedRequest()
+	manager.InvalidateMiddleware(guardrail.ID)
+	refreshedChain := manager.ChainFor(mapping.GetId(), "/")
+	require.NotNil(t, refreshedChain, "a live service must retain its chain after provider refresh")
+	require.NotSame(t, newChain, refreshedChain, "provider refresh must rebuild the concrete guardrail chain")
+
+	currentResponse := httptest.NewRecorder()
+	runtime.proxy.ServeHTTP(currentResponse, currentRequest)
+	assert.Equal(t, http.StatusOK, currentResponse.Code, "provider refresh must preserve the current request's revision")
+	assert.Len(t, newUpstream.snapshot(), 2, "the current request must reach the replacement target after refresh")
+
+	afterRefresh := targetAccessRequestTo(handler, "/v1/chat/completions", "192.0.2.1:1234", nil)
+	assert.Equal(t, http.StatusOK, afterRefresh.Code, "new requests must continue after provider refresh")
+	assert.Len(t, newUpstream.snapshot(), 3, "fresh requests must use the rebuilt chain and current target")
+	assert.Empty(t, oldUpstream.snapshot(), "no request may reach the retired target")
+}
diff --git a/shared/management/proto/proxy_service.pb.go b/shared/management/proto/proxy_service.pb.go
index 09dff0d36..fe5cc0125 100644
--- a/shared/management/proto/proxy_service.pb.go
+++ b/shared/management/proto/proxy_service.pb.go
@@ -117,6 +117,55 @@ func (PathRewriteMode) EnumDescriptor() ([]byte, []int) {
 	return file_proxy_service_proto_rawDescGZIP(), []int{1}
 }
 
+type TargetAccessAction int32
+
+const (
+	TargetAccessAction_TARGET_ACCESS_ACTION_INHERIT TargetAccessAction = 0
+	TargetAccessAction_TARGET_ACCESS_ACTION_BYPASS  TargetAccessAction = 1
+	TargetAccessAction_TARGET_ACCESS_ACTION_BLOCK   TargetAccessAction = 2
+)
+
+// Enum value maps for TargetAccessAction.
+var (
+	TargetAccessAction_name = map[int32]string{
+		0: "TARGET_ACCESS_ACTION_INHERIT",
+		1: "TARGET_ACCESS_ACTION_BYPASS",
+		2: "TARGET_ACCESS_ACTION_BLOCK",
+	}
+	TargetAccessAction_value = map[string]int32{
+		"TARGET_ACCESS_ACTION_INHERIT": 0,
+		"TARGET_ACCESS_ACTION_BYPASS":  1,
+		"TARGET_ACCESS_ACTION_BLOCK":   2,
+	}
+)
+
+func (x TargetAccessAction) Enum() *TargetAccessAction {
+	p := new(TargetAccessAction)
+	*p = x
+	return p
+}
+
+func (x TargetAccessAction) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (TargetAccessAction) Descriptor() protoreflect.EnumDescriptor {
+	return file_proxy_service_proto_enumTypes[2].Descriptor()
+}
+
+func (TargetAccessAction) Type() protoreflect.EnumType {
+	return &file_proxy_service_proto_enumTypes[2]
+}
+
+func (x TargetAccessAction) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use TargetAccessAction.Descriptor instead.
+func (TargetAccessAction) EnumDescriptor() ([]byte, []int) {
+	return file_proxy_service_proto_rawDescGZIP(), []int{2}
+}
+
 // MiddlewareSlot identifies where in the request lifecycle a middleware
 // runs. Mirrors proxy/internal/middleware.Slot.
 type MiddlewareSlot int32
@@ -155,11 +204,11 @@ func (x MiddlewareSlot) String() string {
 }
 
 func (MiddlewareSlot) Descriptor() protoreflect.EnumDescriptor {
-	return file_proxy_service_proto_enumTypes[2].Descriptor()
+	return file_proxy_service_proto_enumTypes[3].Descriptor()
 }
 
 func (MiddlewareSlot) Type() protoreflect.EnumType {
-	return &file_proxy_service_proto_enumTypes[2]
+	return &file_proxy_service_proto_enumTypes[3]
 }
 
 func (x MiddlewareSlot) Number() protoreflect.EnumNumber {
@@ -168,7 +217,7 @@ func (x MiddlewareSlot) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use MiddlewareSlot.Descriptor instead.
 func (MiddlewareSlot) EnumDescriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{2}
+	return file_proxy_service_proto_rawDescGZIP(), []int{3}
 }
 
 type ProxyStatus int32
@@ -213,11 +262,11 @@ func (x ProxyStatus) String() string {
 }
 
 func (ProxyStatus) Descriptor() protoreflect.EnumDescriptor {
-	return file_proxy_service_proto_enumTypes[3].Descriptor()
+	return file_proxy_service_proto_enumTypes[4].Descriptor()
 }
 
 func (ProxyStatus) Type() protoreflect.EnumType {
-	return &file_proxy_service_proto_enumTypes[3]
+	return &file_proxy_service_proto_enumTypes[4]
 }
 
 func (x ProxyStatus) Number() protoreflect.EnumNumber {
@@ -226,7 +275,7 @@ func (x ProxyStatus) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use ProxyStatus.Descriptor instead.
 func (ProxyStatus) EnumDescriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{3}
+	return file_proxy_service_proto_rawDescGZIP(), []int{4}
 }
 
 type MiddlewareConfig_FailMode int32
@@ -259,11 +308,11 @@ func (x MiddlewareConfig_FailMode) String() string {
 }
 
 func (MiddlewareConfig_FailMode) Descriptor() protoreflect.EnumDescriptor {
-	return file_proxy_service_proto_enumTypes[4].Descriptor()
+	return file_proxy_service_proto_enumTypes[5].Descriptor()
 }
 
 func (MiddlewareConfig_FailMode) Type() protoreflect.EnumType {
-	return &file_proxy_service_proto_enumTypes[4]
+	return &file_proxy_service_proto_enumTypes[5]
 }
 
 func (x MiddlewareConfig_FailMode) Number() protoreflect.EnumNumber {
@@ -777,9 +826,10 @@ type PathMapping struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Path    string             `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
-	Target  string             `protobuf:"bytes,2,opt,name=target,proto3" json:"target,omitempty"`
-	Options *PathTargetOptions `protobuf:"bytes,3,opt,name=options,proto3" json:"options,omitempty"`
+	Path         string             `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
+	Target       string             `protobuf:"bytes,2,opt,name=target,proto3" json:"target,omitempty"`
+	Options      *PathTargetOptions `protobuf:"bytes,3,opt,name=options,proto3" json:"options,omitempty"`
+	AccessAction TargetAccessAction `protobuf:"varint,4,opt,name=access_action,json=accessAction,proto3,enum=management.TargetAccessAction" json:"access_action,omitempty"`
 }
 
 func (x *PathMapping) Reset() {
@@ -835,6 +885,13 @@ func (x *PathMapping) GetOptions() *PathTargetOptions {
 	return nil
 }
 
+func (x *PathMapping) GetAccessAction() TargetAccessAction {
+	if x != nil {
+		return x.AccessAction
+	}
+	return TargetAccessAction_TARGET_ACCESS_ACTION_INHERIT
+}
+
 type HeaderAuth struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -3325,442 +3382,454 @@ var file_proxy_service_proto_rawDesc = []byte{
 	0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x63, 0x61, 0x6e, 0x4d, 0x75, 0x74, 0x61, 0x74,
 	0x65, 0x22, 0x2a, 0x0a, 0x08, 0x46, 0x61, 0x69, 0x6c, 0x4d, 0x6f, 0x64, 0x65, 0x12, 0x0d, 0x0a,
 	0x09, 0x46, 0x41, 0x49, 0x4c, 0x5f, 0x4f, 0x50, 0x45, 0x4e, 0x10, 0x00, 0x12, 0x0f, 0x0a, 0x0b,
-	0x46, 0x41, 0x49, 0x4c, 0x5f, 0x43, 0x4c, 0x4f, 0x53, 0x45, 0x44, 0x10, 0x01, 0x22, 0x72, 0x0a,
-	0x0b, 0x50, 0x61, 0x74, 0x68, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x12, 0x0a, 0x04,
-	0x70, 0x61, 0x74, 0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68,
-	0x12, 0x16, 0x0a, 0x06, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x06, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x12, 0x37, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x61, 0x74, 0x68, 0x54, 0x61, 0x72, 0x67, 0x65,
-	0x74, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e,
-	0x73, 0x22, 0x47, 0x0a, 0x0a, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x41, 0x75, 0x74, 0x68, 0x12,
-	0x16, 0x0a, 0x06, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x06, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x12, 0x21, 0x0a, 0x0c, 0x68, 0x61, 0x73, 0x68, 0x65,
-	0x64, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x68,
-	0x61, 0x73, 0x68, 0x65, 0x64, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x91, 0x02, 0x0a, 0x0e, 0x41,
-	0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1f, 0x0a,
-	0x0b, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x4b, 0x65, 0x79, 0x12, 0x35,
-	0x0a, 0x17, 0x6d, 0x61, 0x78, 0x5f, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x61, 0x67,
-	0x65, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52,
-	0x14, 0x6d, 0x61, 0x78, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x41, 0x67, 0x65, 0x53, 0x65,
-	0x63, 0x6f, 0x6e, 0x64, 0x73, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72,
-	0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72,
-	0x64, 0x12, 0x10, 0x0a, 0x03, 0x70, 0x69, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x03,
-	0x70, 0x69, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x6f, 0x69, 0x64, 0x63, 0x18, 0x05, 0x20, 0x01, 0x28,
-	0x08, 0x52, 0x04, 0x6f, 0x69, 0x64, 0x63, 0x12, 0x39, 0x0a, 0x0c, 0x68, 0x65, 0x61, 0x64, 0x65,
-	0x72, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x48, 0x65, 0x61, 0x64, 0x65,
-	0x72, 0x41, 0x75, 0x74, 0x68, 0x52, 0x0b, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x41, 0x75, 0x74,
-	0x68, 0x73, 0x12, 0x2a, 0x0a, 0x11, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x5f, 0x67, 0x72,
-	0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0f, 0x61,
-	0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x22, 0xdd,
-	0x01, 0x0a, 0x12, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x65, 0x73, 0x74, 0x72, 0x69, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x23, 0x0a, 0x0d, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64,
-	0x5f, 0x63, 0x69, 0x64, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x61, 0x6c,
-	0x6c, 0x6f, 0x77, 0x65, 0x64, 0x43, 0x69, 0x64, 0x72, 0x73, 0x12, 0x23, 0x0a, 0x0d, 0x62, 0x6c,
-	0x6f, 0x63, 0x6b, 0x65, 0x64, 0x5f, 0x63, 0x69, 0x64, 0x72, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28,
-	0x09, 0x52, 0x0c, 0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x65, 0x64, 0x43, 0x69, 0x64, 0x72, 0x73, 0x12,
-	0x2b, 0x0a, 0x11, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x5f, 0x63, 0x6f, 0x75, 0x6e, 0x74,
-	0x72, 0x69, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10, 0x61, 0x6c, 0x6c, 0x6f,
-	0x77, 0x65, 0x64, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x72, 0x69, 0x65, 0x73, 0x12, 0x2b, 0x0a, 0x11,
-	0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x65, 0x64, 0x5f, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x72, 0x69, 0x65,
-	0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10, 0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x65, 0x64,
-	0x43, 0x6f, 0x75, 0x6e, 0x74, 0x72, 0x69, 0x65, 0x73, 0x12, 0x23, 0x0a, 0x0d, 0x63, 0x72, 0x6f,
-	0x77, 0x64, 0x73, 0x65, 0x63, 0x5f, 0x6d, 0x6f, 0x64, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x0c, 0x63, 0x72, 0x6f, 0x77, 0x64, 0x73, 0x65, 0x63, 0x4d, 0x6f, 0x64, 0x65, 0x22, 0x80,
-	0x04, 0x0a, 0x0c, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12,
-	0x36, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x22, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79,
-	0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x54, 0x79, 0x70,
-	0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75,
-	0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63,
-	0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
-	0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x2b,
-	0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x61, 0x74, 0x68, 0x4d, 0x61,
-	0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x1d, 0x0a, 0x0a, 0x61,
-	0x75, 0x74, 0x68, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x09, 0x61, 0x75, 0x74, 0x68, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x2e, 0x0a, 0x04, 0x61, 0x75,
-	0x74, 0x68, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61,
-	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x04, 0x61, 0x75, 0x74, 0x68, 0x12, 0x28, 0x0a, 0x10, 0x70, 0x61,
-	0x73, 0x73, 0x5f, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x18, 0x08,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x0e, 0x70, 0x61, 0x73, 0x73, 0x48, 0x6f, 0x73, 0x74, 0x48, 0x65,
-	0x61, 0x64, 0x65, 0x72, 0x12, 0x2b, 0x0a, 0x11, 0x72, 0x65, 0x77, 0x72, 0x69, 0x74, 0x65, 0x5f,
-	0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x73, 0x18, 0x09, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x10, 0x72, 0x65, 0x77, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74,
-	0x73, 0x12, 0x12, 0x0a, 0x04, 0x6d, 0x6f, 0x64, 0x65, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x04, 0x6d, 0x6f, 0x64, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x5f,
-	0x70, 0x6f, 0x72, 0x74, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0a, 0x6c, 0x69, 0x73, 0x74,
-	0x65, 0x6e, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x4f, 0x0a, 0x13, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73,
-	0x5f, 0x72, 0x65, 0x73, 0x74, 0x72, 0x69, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x0c, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x65, 0x73, 0x74, 0x72, 0x69, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x52, 0x12, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x65, 0x73, 0x74, 0x72,
-	0x69, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x70, 0x72, 0x69, 0x76, 0x61,
-	0x74, 0x65, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74,
-	0x65, 0x22, 0x3f, 0x0a, 0x14, 0x53, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c,
-	0x6f, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x27, 0x0a, 0x03, 0x6c, 0x6f, 0x67,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52, 0x03, 0x6c,
-	0x6f, 0x67, 0x22, 0x17, 0x0a, 0x15, 0x53, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73,
-	0x4c, 0x6f, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0xa9, 0x05, 0x0a, 0x09,
-	0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x12, 0x38, 0x0a, 0x09, 0x74, 0x69, 0x6d,
-	0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67,
-	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54,
-	0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74,
-	0x61, 0x6d, 0x70, 0x12, 0x15, 0x0a, 0x06, 0x6c, 0x6f, 0x67, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x05, 0x6c, 0x6f, 0x67, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63,
-	0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09,
-	0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x72,
-	0x76, 0x69, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73,
-	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x6f, 0x73, 0x74,
-	0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x12, 0x12, 0x0a, 0x04,
-	0x70, 0x61, 0x74, 0x68, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68,
-	0x12, 0x1f, 0x0a, 0x0b, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x73, 0x18,
-	0x07, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0a, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4d,
-	0x73, 0x12, 0x16, 0x0a, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x18, 0x08, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x23, 0x0a, 0x0d, 0x72, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x09, 0x20, 0x01, 0x28, 0x05,
-	0x52, 0x0c, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x43, 0x6f, 0x64, 0x65, 0x12, 0x1b,
-	0x0a, 0x09, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x70, 0x18, 0x0a, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x08, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x70, 0x12, 0x25, 0x0a, 0x0e, 0x61,
-	0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65, 0x63, 0x68, 0x61, 0x6e, 0x69, 0x73, 0x6d, 0x18, 0x0b, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x0d, 0x61, 0x75, 0x74, 0x68, 0x4d, 0x65, 0x63, 0x68, 0x61, 0x6e, 0x69,
-	0x73, 0x6d, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x0c, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x21, 0x0a, 0x0c, 0x61,
-	0x75, 0x74, 0x68, 0x5f, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x18, 0x0d, 0x20, 0x01, 0x28,
-	0x08, 0x52, 0x0b, 0x61, 0x75, 0x74, 0x68, 0x53, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x12, 0x21,
-	0x0a, 0x0c, 0x62, 0x79, 0x74, 0x65, 0x73, 0x5f, 0x75, 0x70, 0x6c, 0x6f, 0x61, 0x64, 0x18, 0x0e,
-	0x20, 0x01, 0x28, 0x03, 0x52, 0x0b, 0x62, 0x79, 0x74, 0x65, 0x73, 0x55, 0x70, 0x6c, 0x6f, 0x61,
-	0x64, 0x12, 0x25, 0x0a, 0x0e, 0x62, 0x79, 0x74, 0x65, 0x73, 0x5f, 0x64, 0x6f, 0x77, 0x6e, 0x6c,
-	0x6f, 0x61, 0x64, 0x18, 0x0f, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0d, 0x62, 0x79, 0x74, 0x65, 0x73,
-	0x44, 0x6f, 0x77, 0x6e, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x10, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x3f, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
-	0x18, 0x11, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x2e, 0x4d, 0x65,
-	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x08, 0x6d, 0x65, 0x74,
-	0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x23, 0x0a, 0x0d, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x5f, 0x6e,
-	0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18, 0x12, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0c, 0x61, 0x67,
-	0x65, 0x6e, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x1a, 0x3b, 0x0a, 0x0d, 0x4d, 0x65,
-	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b,
-	0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a,
-	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61,
-	0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xf8, 0x01, 0x0a, 0x13, 0x41, 0x75, 0x74, 0x68,
-	0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
-	0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12,
-	0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x39,
-	0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x61,
-	0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x48, 0x00, 0x52,
-	0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x2a, 0x0a, 0x03, 0x70, 0x69, 0x6e,
-	0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x50, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x48, 0x00,
-	0x52, 0x03, 0x70, 0x69, 0x6e, 0x12, 0x40, 0x0a, 0x0b, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x5f,
-	0x61, 0x75, 0x74, 0x68, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x41, 0x75,
-	0x74, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x48, 0x00, 0x52, 0x0a, 0x68, 0x65, 0x61,
-	0x64, 0x65, 0x72, 0x41, 0x75, 0x74, 0x68, 0x42, 0x09, 0x0a, 0x07, 0x72, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x22, 0x57, 0x0a, 0x11, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x41, 0x75, 0x74, 0x68,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x21, 0x0a, 0x0c, 0x68, 0x65, 0x61, 0x64, 0x65,
-	0x72, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x68,
-	0x65, 0x61, 0x64, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x68, 0x65,
-	0x61, 0x64, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x0a, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x22, 0x2d, 0x0a, 0x0f, 0x50,
-	0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a,
-	0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x22, 0x1e, 0x0a, 0x0a, 0x50, 0x69,
-	0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x70, 0x69, 0x6e, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x70, 0x69, 0x6e, 0x22, 0x55, 0x0a, 0x14, 0x41, 0x75,
-	0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x08, 0x52, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x12, 0x23, 0x0a, 0x0d,
-	0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x54, 0x6f, 0x6b, 0x65,
-	0x6e, 0x22, 0xda, 0x02, 0x0a, 0x17, 0x53, 0x65, 0x6e, 0x64, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
-	0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a,
-	0x0a, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x09, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a,
-	0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x2f, 0x0a, 0x06, 0x73,
-	0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x17, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x53, 0x74,
-	0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x2d, 0x0a, 0x12,
-	0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x69, 0x73, 0x73, 0x75,
-	0x65, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x11, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66,
-	0x69, 0x63, 0x61, 0x74, 0x65, 0x49, 0x73, 0x73, 0x75, 0x65, 0x64, 0x12, 0x28, 0x0a, 0x0d, 0x65,
-	0x72, 0x72, 0x6f, 0x72, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x18, 0x05, 0x20, 0x01,
-	0x28, 0x09, 0x48, 0x00, 0x52, 0x0c, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x4d, 0x65, 0x73, 0x73, 0x61,
-	0x67, 0x65, 0x88, 0x01, 0x01, 0x12, 0x50, 0x0a, 0x10, 0x69, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64,
-	0x5f, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x18, 0x32, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x20, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f,
-	0x78, 0x79, 0x49, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65,
-	0x72, 0x48, 0x01, 0x52, 0x0f, 0x69, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x4c, 0x69, 0x73, 0x74,
-	0x65, 0x6e, 0x65, 0x72, 0x88, 0x01, 0x01, 0x42, 0x10, 0x0a, 0x0e, 0x5f, 0x65, 0x72, 0x72, 0x6f,
-	0x72, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x42, 0x13, 0x0a, 0x11, 0x5f, 0x69, 0x6e,
-	0x62, 0x6f, 0x75, 0x6e, 0x64, 0x5f, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x22, 0x6f,
-	0x0a, 0x14, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x49, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x4c, 0x69,
-	0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c,
-	0x5f, 0x69, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x75, 0x6e, 0x6e, 0x65,
-	0x6c, 0x49, 0x70, 0x12, 0x1d, 0x0a, 0x0a, 0x68, 0x74, 0x74, 0x70, 0x73, 0x5f, 0x70, 0x6f, 0x72,
-	0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x09, 0x68, 0x74, 0x74, 0x70, 0x73, 0x50, 0x6f,
-	0x72, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x08, 0x68, 0x74, 0x74, 0x70, 0x50, 0x6f, 0x72, 0x74, 0x22,
-	0x1a, 0x0a, 0x18, 0x53, 0x65, 0x6e, 0x64, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x55, 0x70, 0x64,
-	0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0xb8, 0x01, 0x0a, 0x16,
-	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x65, 0x65, 0x72, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63,
-	0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x72, 0x76,
-	0x69, 0x63, 0x65, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74,
-	0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75,
-	0x6e, 0x74, 0x49, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x30, 0x0a, 0x14, 0x77, 0x69,
-	0x72, 0x65, 0x67, 0x75, 0x61, 0x72, 0x64, 0x5f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b,
-	0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x77, 0x69, 0x72, 0x65, 0x67, 0x75,
-	0x61, 0x72, 0x64, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x18, 0x0a, 0x07,
-	0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x63,
-	0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x22, 0x6f, 0x0a, 0x17, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
-	0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x12, 0x18, 0x0a, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x08, 0x52, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x12, 0x28, 0x0a, 0x0d, 0x65,
-	0x72, 0x72, 0x6f, 0x72, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x48, 0x00, 0x52, 0x0c, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x4d, 0x65, 0x73, 0x73, 0x61,
-	0x67, 0x65, 0x88, 0x01, 0x01, 0x42, 0x10, 0x0a, 0x0e, 0x5f, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f,
-	0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x65, 0x0a, 0x11, 0x47, 0x65, 0x74, 0x4f, 0x49,
-	0x44, 0x43, 0x55, 0x52, 0x4c, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02,
-	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x1d, 0x0a, 0x0a,
-	0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x21, 0x0a, 0x0c, 0x72,
-	0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x0b, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x55, 0x72, 0x6c, 0x22, 0x26,
-	0x0a, 0x12, 0x47, 0x65, 0x74, 0x4f, 0x49, 0x44, 0x43, 0x55, 0x52, 0x4c, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x22, 0x7c, 0x0a, 0x16, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61,
-	0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x27, 0x0a, 0x0d, 0x73, 0x65, 0x73, 0x73,
-	0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42,
-	0x02, 0x18, 0x01, 0x52, 0x0c, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x54, 0x6f, 0x6b, 0x65,
-	0x6e, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6f, 0x64,
-	0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e,
-	0x43, 0x6f, 0x64, 0x65, 0x22, 0x81, 0x02, 0x0a, 0x17, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74,
-	0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x05, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69,
-	0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12,
-	0x1d, 0x0a, 0x0a, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x09, 0x75, 0x73, 0x65, 0x72, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x23,
-	0x0a, 0x0d, 0x64, 0x65, 0x6e, 0x69, 0x65, 0x64, 0x5f, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x18,
-	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x64, 0x65, 0x6e, 0x69, 0x65, 0x64, 0x52, 0x65, 0x61,
-	0x73, 0x6f, 0x6e, 0x12, 0x24, 0x0a, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75,
-	0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x70, 0x65, 0x65,
-	0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x28, 0x0a, 0x10, 0x70, 0x65, 0x65,
-	0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x18, 0x06, 0x20,
-	0x03, 0x28, 0x09, 0x52, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x4e, 0x61,
-	0x6d, 0x65, 0x73, 0x12, 0x23, 0x0a, 0x0d, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x74,
-	0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x65, 0x73, 0x73,
-	0x69, 0x6f, 0x6e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x22, 0x50, 0x0a, 0x19, 0x56, 0x61, 0x6c, 0x69,
-	0x64, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x5f,
-	0x69, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c,
-	0x49, 0x70, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x22, 0x84, 0x02, 0x0a, 0x1a, 0x56,
-	0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x50, 0x65, 0x65,
-	0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c,
-	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x12,
-	0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x75, 0x73, 0x65, 0x72,
-	0x5f, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x75, 0x73,
-	0x65, 0x72, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x23, 0x0a, 0x0d, 0x64, 0x65, 0x6e, 0x69, 0x65,
-	0x64, 0x5f, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c,
-	0x64, 0x65, 0x6e, 0x69, 0x65, 0x64, 0x52, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x12, 0x23, 0x0a, 0x0d,
-	0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x05, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x54, 0x6f, 0x6b, 0x65,
-	0x6e, 0x12, 0x24, 0x0a, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f,
-	0x69, 0x64, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x47,
-	0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x28, 0x0a, 0x10, 0x70, 0x65, 0x65, 0x72, 0x5f,
-	0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28,
-	0x09, 0x52, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x4e, 0x61, 0x6d, 0x65,
-	0x73, 0x22, 0x81, 0x01, 0x0a, 0x13, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e,
-	0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x32, 0x0a, 0x04, 0x69, 0x6e, 0x69,
-	0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67,
-	0x73, 0x49, 0x6e, 0x69, 0x74, 0x48, 0x00, 0x52, 0x04, 0x69, 0x6e, 0x69, 0x74, 0x12, 0x2f, 0x0a,
-	0x03, 0x61, 0x63, 0x6b, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70,
-	0x69, 0x6e, 0x67, 0x73, 0x41, 0x63, 0x6b, 0x48, 0x00, 0x52, 0x03, 0x61, 0x63, 0x6b, 0x42, 0x05,
-	0x0a, 0x03, 0x6d, 0x73, 0x67, 0x22, 0xdf, 0x01, 0x0a, 0x10, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61,
-	0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x49, 0x6e, 0x69, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x70, 0x72,
-	0x6f, 0x78, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x70, 0x72,
-	0x6f, 0x78, 0x79, 0x49, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12,
-	0x39, 0x0a, 0x0a, 0x73, 0x74, 0x61, 0x72, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52,
-	0x09, 0x73, 0x74, 0x61, 0x72, 0x74, 0x65, 0x64, 0x41, 0x74, 0x12, 0x18, 0x0a, 0x07, 0x61, 0x64,
-	0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x64, 0x64,
-	0x72, 0x65, 0x73, 0x73, 0x12, 0x41, 0x0a, 0x0c, 0x63, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69,
-	0x74, 0x69, 0x65, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x43, 0x61, 0x70,
-	0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x52, 0x0c, 0x63, 0x61, 0x70, 0x61, 0x62,
-	0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x22, 0x11, 0x0a, 0x0f, 0x53, 0x79, 0x6e, 0x63, 0x4d,
-	0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x41, 0x63, 0x6b, 0x22, 0x7e, 0x0a, 0x14, 0x53, 0x79,
-	0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x12, 0x32, 0x0a, 0x07, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x18, 0x01, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x07, 0x6d,
-	0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x32, 0x0a, 0x15, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x61,
-	0x6c, 0x5f, 0x73, 0x79, 0x6e, 0x63, 0x5f, 0x63, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x13, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x79,
-	0x6e, 0x63, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x22, 0xa9, 0x01, 0x0a, 0x1b, 0x43,
-	0x68, 0x65, 0x63, 0x6b, 0x4c, 0x4c, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x4c, 0x69, 0x6d,
-	0x69, 0x74, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63,
-	0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09,
-	0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65,
-	0x72, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72,
-	0x49, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18,
-	0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12,
-	0x1f, 0x0a, 0x0b, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x04,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x49, 0x64,
-	0x12, 0x14, 0x0a, 0x05, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x05, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x22, 0xff, 0x01, 0x0a, 0x1c, 0x43, 0x68, 0x65, 0x63, 0x6b,
-	0x4c, 0x4c, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1a, 0x0a, 0x08, 0x64, 0x65, 0x63, 0x69, 0x73,
-	0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x64, 0x65, 0x63, 0x69, 0x73,
-	0x69, 0x6f, 0x6e, 0x12, 0x2c, 0x0a, 0x12, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x65, 0x64, 0x5f,
-	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x10, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x65, 0x64, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49,
-	0x64, 0x12, 0x30, 0x0a, 0x14, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x69, 0x6f, 0x6e,
-	0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x12, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75,
-	0x70, 0x49, 0x64, 0x12, 0x25, 0x0a, 0x0e, 0x77, 0x69, 0x6e, 0x64, 0x6f, 0x77, 0x5f, 0x73, 0x65,
-	0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0d, 0x77, 0x69, 0x6e,
-	0x64, 0x6f, 0x77, 0x53, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x12, 0x1b, 0x0a, 0x09, 0x64, 0x65,
-	0x6e, 0x79, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x64,
-	0x65, 0x6e, 0x79, 0x43, 0x6f, 0x64, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x64, 0x65, 0x6e, 0x79, 0x5f,
-	0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x64, 0x65,
-	0x6e, 0x79, 0x52, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x22, 0x91, 0x02, 0x0a, 0x15, 0x52, 0x65, 0x63,
-	0x6f, 0x72, 0x64, 0x4c, 0x4c, 0x4d, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49,
-	0x64, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x19, 0x0a, 0x08, 0x67, 0x72,
-	0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x67, 0x72,
-	0x6f, 0x75, 0x70, 0x49, 0x64, 0x12, 0x25, 0x0a, 0x0e, 0x77, 0x69, 0x6e, 0x64, 0x6f, 0x77, 0x5f,
-	0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0d, 0x77,
-	0x69, 0x6e, 0x64, 0x6f, 0x77, 0x53, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x12, 0x21, 0x0a, 0x0c,
-	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x5f, 0x69, 0x6e, 0x70, 0x75, 0x74, 0x18, 0x05, 0x20, 0x01,
-	0x28, 0x03, 0x52, 0x0b, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x49, 0x6e, 0x70, 0x75, 0x74, 0x12,
-	0x23, 0x0a, 0x0d, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x5f, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74,
-	0x18, 0x06, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0c, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x4f, 0x75,
-	0x74, 0x70, 0x75, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x63, 0x6f, 0x73, 0x74, 0x5f, 0x75, 0x73, 0x64,
-	0x18, 0x07, 0x20, 0x01, 0x28, 0x01, 0x52, 0x07, 0x63, 0x6f, 0x73, 0x74, 0x55, 0x73, 0x64, 0x12,
-	0x1b, 0x0a, 0x09, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x08, 0x20, 0x03,
-	0x28, 0x09, 0x52, 0x08, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x22, 0x18, 0x0a, 0x16,
-	0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x4c, 0x4c, 0x4d, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2a, 0x64, 0x0a, 0x16, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d,
-	0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x54, 0x79, 0x70, 0x65,
-	0x12, 0x17, 0x0a, 0x13, 0x55, 0x50, 0x44, 0x41, 0x54, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f,
-	0x43, 0x52, 0x45, 0x41, 0x54, 0x45, 0x44, 0x10, 0x00, 0x12, 0x18, 0x0a, 0x14, 0x55, 0x50, 0x44,
-	0x41, 0x54, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x4d, 0x4f, 0x44, 0x49, 0x46, 0x49, 0x45,
-	0x44, 0x10, 0x01, 0x12, 0x17, 0x0a, 0x13, 0x55, 0x50, 0x44, 0x41, 0x54, 0x45, 0x5f, 0x54, 0x59,
-	0x50, 0x45, 0x5f, 0x52, 0x45, 0x4d, 0x4f, 0x56, 0x45, 0x44, 0x10, 0x02, 0x2a, 0x46, 0x0a, 0x0f,
-	0x50, 0x61, 0x74, 0x68, 0x52, 0x65, 0x77, 0x72, 0x69, 0x74, 0x65, 0x4d, 0x6f, 0x64, 0x65, 0x12,
-	0x18, 0x0a, 0x14, 0x50, 0x41, 0x54, 0x48, 0x5f, 0x52, 0x45, 0x57, 0x52, 0x49, 0x54, 0x45, 0x5f,
-	0x44, 0x45, 0x46, 0x41, 0x55, 0x4c, 0x54, 0x10, 0x00, 0x12, 0x19, 0x0a, 0x15, 0x50, 0x41, 0x54,
-	0x48, 0x5f, 0x52, 0x45, 0x57, 0x52, 0x49, 0x54, 0x45, 0x5f, 0x50, 0x52, 0x45, 0x53, 0x45, 0x52,
-	0x56, 0x45, 0x10, 0x01, 0x2a, 0x90, 0x01, 0x0a, 0x0e, 0x4d, 0x69, 0x64, 0x64, 0x6c, 0x65, 0x77,
-	0x61, 0x72, 0x65, 0x53, 0x6c, 0x6f, 0x74, 0x12, 0x1f, 0x0a, 0x1b, 0x4d, 0x49, 0x44, 0x44, 0x4c,
-	0x45, 0x57, 0x41, 0x52, 0x45, 0x5f, 0x53, 0x4c, 0x4f, 0x54, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45,
-	0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x1e, 0x0a, 0x1a, 0x4d, 0x49, 0x44, 0x44,
-	0x4c, 0x45, 0x57, 0x41, 0x52, 0x45, 0x5f, 0x53, 0x4c, 0x4f, 0x54, 0x5f, 0x4f, 0x4e, 0x5f, 0x52,
-	0x45, 0x51, 0x55, 0x45, 0x53, 0x54, 0x10, 0x01, 0x12, 0x1f, 0x0a, 0x1b, 0x4d, 0x49, 0x44, 0x44,
-	0x4c, 0x45, 0x57, 0x41, 0x52, 0x45, 0x5f, 0x53, 0x4c, 0x4f, 0x54, 0x5f, 0x4f, 0x4e, 0x5f, 0x52,
-	0x45, 0x53, 0x50, 0x4f, 0x4e, 0x53, 0x45, 0x10, 0x02, 0x12, 0x1c, 0x0a, 0x18, 0x4d, 0x49, 0x44,
-	0x44, 0x4c, 0x45, 0x57, 0x41, 0x52, 0x45, 0x5f, 0x53, 0x4c, 0x4f, 0x54, 0x5f, 0x54, 0x45, 0x52,
-	0x4d, 0x49, 0x4e, 0x41, 0x4c, 0x10, 0x03, 0x2a, 0xc8, 0x01, 0x0a, 0x0b, 0x50, 0x72, 0x6f, 0x78,
-	0x79, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x18, 0x0a, 0x14, 0x50, 0x52, 0x4f, 0x58, 0x59,
-	0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x50, 0x45, 0x4e, 0x44, 0x49, 0x4e, 0x47, 0x10,
-	0x00, 0x12, 0x17, 0x0a, 0x13, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55,
-	0x53, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x56, 0x45, 0x10, 0x01, 0x12, 0x23, 0x0a, 0x1f, 0x50, 0x52,
-	0x4f, 0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x54, 0x55, 0x4e, 0x4e, 0x45,
-	0x4c, 0x5f, 0x4e, 0x4f, 0x54, 0x5f, 0x43, 0x52, 0x45, 0x41, 0x54, 0x45, 0x44, 0x10, 0x02, 0x12,
-	0x24, 0x0a, 0x20, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f,
-	0x43, 0x45, 0x52, 0x54, 0x49, 0x46, 0x49, 0x43, 0x41, 0x54, 0x45, 0x5f, 0x50, 0x45, 0x4e, 0x44,
-	0x49, 0x4e, 0x47, 0x10, 0x03, 0x12, 0x23, 0x0a, 0x1f, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f, 0x53,
-	0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x43, 0x45, 0x52, 0x54, 0x49, 0x46, 0x49, 0x43, 0x41, 0x54,
-	0x45, 0x5f, 0x46, 0x41, 0x49, 0x4c, 0x45, 0x44, 0x10, 0x04, 0x12, 0x16, 0x0a, 0x12, 0x50, 0x52,
-	0x4f, 0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x45, 0x52, 0x52, 0x4f, 0x52,
-	0x10, 0x05, 0x32, 0xfc, 0x07, 0x0a, 0x0c, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x53, 0x65, 0x72, 0x76,
-	0x69, 0x63, 0x65, 0x12, 0x5f, 0x0a, 0x10, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e,
-	0x67, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x12, 0x23, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55,
-	0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x70,
-	0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x30, 0x01, 0x12, 0x55, 0x0a, 0x0c, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70,
-	0x69, 0x6e, 0x67, 0x73, 0x12, 0x1f, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
-	0x74, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x28, 0x01, 0x30, 0x01, 0x12, 0x54, 0x0a, 0x0d, 0x53,
-	0x65, 0x6e, 0x64, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x12, 0x20, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x41, 0x63,
-	0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x65, 0x6e, 0x64,
+	0x46, 0x41, 0x49, 0x4c, 0x5f, 0x43, 0x4c, 0x4f, 0x53, 0x45, 0x44, 0x10, 0x01, 0x22, 0xb7, 0x01,
+	0x0a, 0x0b, 0x50, 0x61, 0x74, 0x68, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x12, 0x0a,
+	0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x70, 0x61, 0x74,
+	0x68, 0x12, 0x16, 0x0a, 0x06, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x06, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x12, 0x37, 0x0a, 0x07, 0x6f, 0x70, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x61, 0x74, 0x68, 0x54, 0x61, 0x72, 0x67,
+	0x65, 0x74, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x12, 0x43, 0x0a, 0x0d, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x61, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x41, 0x63, 0x63,
+	0x65, 0x73, 0x73, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0c, 0x61, 0x63, 0x63, 0x65, 0x73,
+	0x73, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x47, 0x0a, 0x0a, 0x48, 0x65, 0x61, 0x64, 0x65,
+	0x72, 0x41, 0x75, 0x74, 0x68, 0x12, 0x16, 0x0a, 0x06, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x12, 0x21, 0x0a,
+	0x0c, 0x68, 0x61, 0x73, 0x68, 0x65, 0x64, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0b, 0x68, 0x61, 0x73, 0x68, 0x65, 0x64, 0x56, 0x61, 0x6c, 0x75, 0x65,
+	0x22, 0x91, 0x02, 0x0a, 0x0e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x12, 0x1f, 0x0a, 0x0b, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6b,
+	0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f,
+	0x6e, 0x4b, 0x65, 0x79, 0x12, 0x35, 0x0a, 0x17, 0x6d, 0x61, 0x78, 0x5f, 0x73, 0x65, 0x73, 0x73,
+	0x69, 0x6f, 0x6e, 0x5f, 0x61, 0x67, 0x65, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x14, 0x6d, 0x61, 0x78, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f,
+	0x6e, 0x41, 0x67, 0x65, 0x53, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x12, 0x1a, 0x0a, 0x08, 0x70,
+	0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x70,
+	0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x10, 0x0a, 0x03, 0x70, 0x69, 0x6e, 0x18, 0x04,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x03, 0x70, 0x69, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x6f, 0x69, 0x64,
+	0x63, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x04, 0x6f, 0x69, 0x64, 0x63, 0x12, 0x39, 0x0a,
+	0x0c, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x73, 0x18, 0x06, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+	0x2e, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x41, 0x75, 0x74, 0x68, 0x52, 0x0b, 0x68, 0x65, 0x61,
+	0x64, 0x65, 0x72, 0x41, 0x75, 0x74, 0x68, 0x73, 0x12, 0x2a, 0x0a, 0x11, 0x61, 0x6c, 0x6c, 0x6f,
+	0x77, 0x65, 0x64, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x07, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x0f, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x47, 0x72, 0x6f, 0x75,
+	0x70, 0x49, 0x64, 0x73, 0x22, 0xdd, 0x01, 0x0a, 0x12, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52,
+	0x65, 0x73, 0x74, 0x72, 0x69, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x23, 0x0a, 0x0d, 0x61,
+	0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x5f, 0x63, 0x69, 0x64, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03,
+	0x28, 0x09, 0x52, 0x0c, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x43, 0x69, 0x64, 0x72, 0x73,
+	0x12, 0x23, 0x0a, 0x0d, 0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x65, 0x64, 0x5f, 0x63, 0x69, 0x64, 0x72,
+	0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x65, 0x64,
+	0x43, 0x69, 0x64, 0x72, 0x73, 0x12, 0x2b, 0x0a, 0x11, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64,
+	0x5f, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x72, 0x69, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09,
+	0x52, 0x10, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x72, 0x69,
+	0x65, 0x73, 0x12, 0x2b, 0x0a, 0x11, 0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x65, 0x64, 0x5f, 0x63, 0x6f,
+	0x75, 0x6e, 0x74, 0x72, 0x69, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10, 0x62,
+	0x6c, 0x6f, 0x63, 0x6b, 0x65, 0x64, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x72, 0x69, 0x65, 0x73, 0x12,
+	0x23, 0x0a, 0x0d, 0x63, 0x72, 0x6f, 0x77, 0x64, 0x73, 0x65, 0x63, 0x5f, 0x6d, 0x6f, 0x64, 0x65,
+	0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x63, 0x72, 0x6f, 0x77, 0x64, 0x73, 0x65, 0x63,
+	0x4d, 0x6f, 0x64, 0x65, 0x22, 0x80, 0x04, 0x0a, 0x0c, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d, 0x61,
+	0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x36, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0e, 0x32, 0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+	0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64,
+	0x61, 0x74, 0x65, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x0e, 0x0a,
+	0x02, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x1d, 0x0a,
+	0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x16, 0x0a, 0x06,
+	0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f,
+	0x6d, 0x61, 0x69, 0x6e, 0x12, 0x2b, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x05, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x17, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x50, 0x61, 0x74, 0x68, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x04, 0x70, 0x61, 0x74,
+	0x68, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18,
+	0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x75, 0x74, 0x68, 0x54, 0x6f, 0x6b, 0x65, 0x6e,
+	0x12, 0x2e, 0x0a, 0x04, 0x61, 0x75, 0x74, 0x68, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x75, 0x74, 0x68,
+	0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x04, 0x61, 0x75, 0x74, 0x68,
+	0x12, 0x28, 0x0a, 0x10, 0x70, 0x61, 0x73, 0x73, 0x5f, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x68, 0x65,
+	0x61, 0x64, 0x65, 0x72, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0e, 0x70, 0x61, 0x73, 0x73,
+	0x48, 0x6f, 0x73, 0x74, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x12, 0x2b, 0x0a, 0x11, 0x72, 0x65,
+	0x77, 0x72, 0x69, 0x74, 0x65, 0x5f, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x73, 0x18,
+	0x09, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x72, 0x65, 0x77, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65,
+	0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x6d, 0x6f, 0x64, 0x65, 0x18,
+	0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6d, 0x6f, 0x64, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x6c,
+	0x69, 0x73, 0x74, 0x65, 0x6e, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x05,
+	0x52, 0x0a, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x4f, 0x0a, 0x13,
+	0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x72, 0x65, 0x73, 0x74, 0x72, 0x69, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x65, 0x73,
+	0x74, 0x72, 0x69, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x12, 0x61, 0x63, 0x63, 0x65, 0x73,
+	0x73, 0x52, 0x65, 0x73, 0x74, 0x72, 0x69, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x18, 0x0a,
+	0x07, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07,
+	0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x22, 0x3f, 0x0a, 0x14, 0x53, 0x65, 0x6e, 0x64, 0x41,
+	0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0x27, 0x0a, 0x03, 0x6c, 0x6f, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73,
+	0x4c, 0x6f, 0x67, 0x52, 0x03, 0x6c, 0x6f, 0x67, 0x22, 0x17, 0x0a, 0x15, 0x53, 0x65, 0x6e, 0x64,
 	0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x12, 0x51, 0x0a, 0x0c, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74,
-	0x65, 0x12, 0x1f, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41,
-	0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x20, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5d, 0x0a, 0x10, 0x53, 0x65, 0x6e, 0x64, 0x53, 0x74, 0x61, 0x74,
-	0x75, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x12, 0x23, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
-	0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x53,
-	0x74, 0x61, 0x74, 0x75, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x12, 0x5a, 0x0a, 0x0f, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f,
-	0x78, 0x79, 0x50, 0x65, 0x65, 0x72, 0x12, 0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50,
-	0x65, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72,
-	0x6f, 0x78, 0x79, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
-	0x4b, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x4f, 0x49, 0x44, 0x43, 0x55, 0x52, 0x4c, 0x12, 0x1d, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x47, 0x65, 0x74, 0x4f, 0x49,
-	0x44, 0x43, 0x55, 0x52, 0x4c, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1e, 0x2e, 0x6d,
+	0x65, 0x22, 0xa9, 0x05, 0x0a, 0x09, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x12,
+	0x38, 0x0a, 0x09, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09,
+	0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x12, 0x15, 0x0a, 0x06, 0x6c, 0x6f, 0x67,
+	0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6c, 0x6f, 0x67, 0x49, 0x64,
+	0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12,
+	0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x64, 0x12, 0x12,
+	0x0a, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x68, 0x6f,
+	0x73, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x1f, 0x0a, 0x0b, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x5f, 0x6d, 0x73, 0x18, 0x07, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0a, 0x64, 0x75, 0x72,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4d, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f,
+	0x64, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12,
+	0x23, 0x0a, 0x0d, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x5f, 0x63, 0x6f, 0x64, 0x65,
+	0x18, 0x09, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0c, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x43, 0x6f, 0x64, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69,
+	0x70, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49,
+	0x70, 0x12, 0x25, 0x0a, 0x0e, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65, 0x63, 0x68, 0x61, 0x6e,
+	0x69, 0x73, 0x6d, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x61, 0x75, 0x74, 0x68, 0x4d,
+	0x65, 0x63, 0x68, 0x61, 0x6e, 0x69, 0x73, 0x6d, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72,
+	0x5f, 0x69, 0x64, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49,
+	0x64, 0x12, 0x21, 0x0a, 0x0c, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73,
+	0x73, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x61, 0x75, 0x74, 0x68, 0x53, 0x75, 0x63,
+	0x63, 0x65, 0x73, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x62, 0x79, 0x74, 0x65, 0x73, 0x5f, 0x75, 0x70,
+	0x6c, 0x6f, 0x61, 0x64, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0b, 0x62, 0x79, 0x74, 0x65,
+	0x73, 0x55, 0x70, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x25, 0x0a, 0x0e, 0x62, 0x79, 0x74, 0x65, 0x73,
+	0x5f, 0x64, 0x6f, 0x77, 0x6e, 0x6c, 0x6f, 0x61, 0x64, 0x18, 0x0f, 0x20, 0x01, 0x28, 0x03, 0x52,
+	0x0d, 0x62, 0x79, 0x74, 0x65, 0x73, 0x44, 0x6f, 0x77, 0x6e, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x1a,
+	0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x10, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x3f, 0x0a, 0x08, 0x6d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x11, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73,
+	0x4c, 0x6f, 0x67, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72,
+	0x79, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x23, 0x0a, 0x0d, 0x61,
+	0x67, 0x65, 0x6e, 0x74, 0x5f, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18, 0x12, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x0c, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
+	0x1a, 0x3b, 0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72,
+	0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03,
+	0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xf8, 0x01,
+	0x0a, 0x13, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74,
+	0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75,
+	0x6e, 0x74, 0x49, 0x64, 0x12, 0x39, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x48, 0x00, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12,
+	0x2a, 0x0a, 0x03, 0x70, 0x69, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x69, 0x6e, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x48, 0x00, 0x52, 0x03, 0x70, 0x69, 0x6e, 0x12, 0x40, 0x0a, 0x0b, 0x68,
+	0x65, 0x61, 0x64, 0x65, 0x72, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x48, 0x65,
+	0x61, 0x64, 0x65, 0x72, 0x41, 0x75, 0x74, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x48,
+	0x00, 0x52, 0x0a, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x41, 0x75, 0x74, 0x68, 0x42, 0x09, 0x0a,
+	0x07, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x57, 0x0a, 0x11, 0x48, 0x65, 0x61, 0x64,
+	0x65, 0x72, 0x41, 0x75, 0x74, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x21, 0x0a,
+	0x0c, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0b, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65,
+	0x12, 0x1f, 0x0a, 0x0b, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x4e, 0x61, 0x6d,
+	0x65, 0x22, 0x2d, 0x0a, 0x0f, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64,
+	0x22, 0x1e, 0x0a, 0x0a, 0x50, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x10,
+	0x0a, 0x03, 0x70, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x70, 0x69, 0x6e,
+	0x22, 0x55, 0x0a, 0x14, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x73, 0x75, 0x63, 0x63,
+	0x65, 0x73, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65,
+	0x73, 0x73, 0x12, 0x23, 0x0a, 0x0d, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f,
+	0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x65, 0x73, 0x73, 0x69,
+	0x6f, 0x6e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x22, 0xda, 0x02, 0x0a, 0x17, 0x53, 0x65, 0x6e, 0x64,
+	0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x69,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49,
+	0x64, 0x12, 0x2f, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x0e, 0x32, 0x17, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50,
+	0x72, 0x6f, 0x78, 0x79, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74,
+	0x75, 0x73, 0x12, 0x2d, 0x0a, 0x12, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74,
+	0x65, 0x5f, 0x69, 0x73, 0x73, 0x75, 0x65, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x11,
+	0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x49, 0x73, 0x73, 0x75, 0x65,
+	0x64, 0x12, 0x28, 0x0a, 0x0d, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61,
+	0x67, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x0c, 0x65, 0x72, 0x72, 0x6f,
+	0x72, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x88, 0x01, 0x01, 0x12, 0x50, 0x0a, 0x10, 0x69,
+	0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x5f, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x18,
+	0x32, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x49, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x4c,
+	0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x48, 0x01, 0x52, 0x0f, 0x69, 0x6e, 0x62, 0x6f, 0x75,
+	0x6e, 0x64, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x88, 0x01, 0x01, 0x42, 0x10, 0x0a,
+	0x0e, 0x5f, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x42,
+	0x13, 0x0a, 0x11, 0x5f, 0x69, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x5f, 0x6c, 0x69, 0x73, 0x74,
+	0x65, 0x6e, 0x65, 0x72, 0x22, 0x6f, 0x0a, 0x14, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x49, 0x6e, 0x62,
+	0x6f, 0x75, 0x6e, 0x64, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x12, 0x1b, 0x0a, 0x09,
+	0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x5f, 0x69, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x08, 0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x49, 0x70, 0x12, 0x1d, 0x0a, 0x0a, 0x68, 0x74, 0x74,
+	0x70, 0x73, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x09, 0x68,
+	0x74, 0x74, 0x70, 0x73, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x68, 0x74, 0x74, 0x70,
+	0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x08, 0x68, 0x74, 0x74,
+	0x70, 0x50, 0x6f, 0x72, 0x74, 0x22, 0x1a, 0x0a, 0x18, 0x53, 0x65, 0x6e, 0x64, 0x53, 0x74, 0x61,
+	0x74, 0x75, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x22, 0xb8, 0x01, 0x0a, 0x16, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x78,
+	0x79, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a,
+	0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x09, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61,
+	0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x6f,
+	0x6b, 0x65, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e,
+	0x12, 0x30, 0x0a, 0x14, 0x77, 0x69, 0x72, 0x65, 0x67, 0x75, 0x61, 0x72, 0x64, 0x5f, 0x70, 0x75,
+	0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12,
+	0x77, 0x69, 0x72, 0x65, 0x67, 0x75, 0x61, 0x72, 0x64, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b,
+	0x65, 0x79, 0x12, 0x18, 0x0a, 0x07, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x18, 0x05, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x07, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x22, 0x6f, 0x0a, 0x17,
+	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x65, 0x65, 0x72, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65,
+	0x73, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73,
+	0x73, 0x12, 0x28, 0x0a, 0x0d, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61,
+	0x67, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x0c, 0x65, 0x72, 0x72, 0x6f,
+	0x72, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x88, 0x01, 0x01, 0x42, 0x10, 0x0a, 0x0e, 0x5f,
+	0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x65, 0x0a,
+	0x11, 0x47, 0x65, 0x74, 0x4f, 0x49, 0x44, 0x43, 0x55, 0x52, 0x4c, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02,
+	0x69, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49,
+	0x64, 0x12, 0x21, 0x0a, 0x0c, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x5f, 0x75, 0x72,
+	0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63,
+	0x74, 0x55, 0x72, 0x6c, 0x22, 0x26, 0x0a, 0x12, 0x47, 0x65, 0x74, 0x4f, 0x49, 0x44, 0x43, 0x55,
+	0x52, 0x4c, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72,
+	0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x22, 0x7c, 0x0a, 0x16,
+	0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x27,
+	0x0a, 0x0d, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x02, 0x18, 0x01, 0x52, 0x0c, 0x73, 0x65, 0x73, 0x73, 0x69,
+	0x6f, 0x6e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65, 0x73, 0x73, 0x69,
+	0x6f, 0x6e, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73,
+	0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x43, 0x6f, 0x64, 0x65, 0x22, 0x81, 0x02, 0x0a, 0x17, 0x56,
+	0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x12, 0x17, 0x0a, 0x07,
+	0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75,
+	0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x65, 0x6d,
+	0x61, 0x69, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x75, 0x73, 0x65, 0x72, 0x45,
+	0x6d, 0x61, 0x69, 0x6c, 0x12, 0x23, 0x0a, 0x0d, 0x64, 0x65, 0x6e, 0x69, 0x65, 0x64, 0x5f, 0x72,
+	0x65, 0x61, 0x73, 0x6f, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x64, 0x65, 0x6e,
+	0x69, 0x65, 0x64, 0x52, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x12, 0x24, 0x0a, 0x0e, 0x70, 0x65, 0x65,
+	0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28,
+	0x09, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12,
+	0x28, 0x0a, 0x10, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x6e, 0x61,
+	0x6d, 0x65, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x47,
+	0x72, 0x6f, 0x75, 0x70, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x12, 0x23, 0x0a, 0x0d, 0x73, 0x65, 0x73,
+	0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x0c, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x22, 0x50,
+	0x0a, 0x19, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c,
+	0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x74,
+	0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x5f, 0x69, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
+	0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x49, 0x70, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61,
+	0x69, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
+	0x22, 0x84, 0x02, 0x0a, 0x1a, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e,
+	0x6e, 0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
+	0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x05,
+	0x76, 0x61, 0x6c, 0x69, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x1d,
+	0x0a, 0x0a, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x09, 0x75, 0x73, 0x65, 0x72, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x23, 0x0a,
+	0x0d, 0x64, 0x65, 0x6e, 0x69, 0x65, 0x64, 0x5f, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x18, 0x04,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x64, 0x65, 0x6e, 0x69, 0x65, 0x64, 0x52, 0x65, 0x61, 0x73,
+	0x6f, 0x6e, 0x12, 0x23, 0x0a, 0x0d, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f,
+	0x6b, 0x65, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x65, 0x73, 0x73, 0x69,
+	0x6f, 0x6e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x24, 0x0a, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x5f,
+	0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x09, 0x52,
+	0x0c, 0x70, 0x65, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x28, 0x0a,
+	0x10, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x6e, 0x61, 0x6d, 0x65,
+	0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x47, 0x72, 0x6f,
+	0x75, 0x70, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x22, 0x81, 0x01, 0x0a, 0x13, 0x53, 0x79, 0x6e, 0x63,
+	0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0x32, 0x0a, 0x04, 0x69, 0x6e, 0x69, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x4d,
+	0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x49, 0x6e, 0x69, 0x74, 0x48, 0x00, 0x52, 0x04, 0x69,
+	0x6e, 0x69, 0x74, 0x12, 0x2f, 0x0a, 0x03, 0x61, 0x63, 0x6b, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x79,
+	0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x41, 0x63, 0x6b, 0x48, 0x00, 0x52,
+	0x03, 0x61, 0x63, 0x6b, 0x42, 0x05, 0x0a, 0x03, 0x6d, 0x73, 0x67, 0x22, 0xdf, 0x01, 0x0a, 0x10,
+	0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x49, 0x6e, 0x69, 0x74,
+	0x12, 0x19, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x07, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x49, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x76,
+	0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65,
+	0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x39, 0x0a, 0x0a, 0x73, 0x74, 0x61, 0x72, 0x74, 0x65, 0x64,
+	0x5f, 0x61, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65,
+	0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x73, 0x74, 0x61, 0x72, 0x74, 0x65, 0x64, 0x41, 0x74,
+	0x12, 0x18, 0x0a, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x41, 0x0a, 0x0c, 0x63, 0x61,
+	0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72,
+	0x6f, 0x78, 0x79, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x52,
+	0x0c, 0x63, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x22, 0x11, 0x0a,
+	0x0f, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x41, 0x63, 0x6b,
+	0x22, 0x7e, 0x0a, 0x14, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x32, 0x0a, 0x07, 0x6d, 0x61, 0x70, 0x70,
+	0x69, 0x6e, 0x67, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d, 0x61, 0x70, 0x70,
+	0x69, 0x6e, 0x67, 0x52, 0x07, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x32, 0x0a, 0x15,
+	0x69, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x79, 0x6e, 0x63, 0x5f, 0x63, 0x6f, 0x6d,
+	0x70, 0x6c, 0x65, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x13, 0x69, 0x6e, 0x69,
+	0x74, 0x69, 0x61, 0x6c, 0x53, 0x79, 0x6e, 0x63, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65,
+	0x22, 0xa9, 0x01, 0x0a, 0x1b, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x4c, 0x4c, 0x4d, 0x50, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12,
+	0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x67, 0x72, 0x6f, 0x75,
+	0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x67, 0x72, 0x6f,
+	0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x1f, 0x0a, 0x0b, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65,
+	0x72, 0x5f, 0x69, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x70, 0x72, 0x6f, 0x76,
+	0x69, 0x64, 0x65, 0x72, 0x49, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x18,
+	0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x22, 0xff, 0x01, 0x0a,
+	0x1c, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x4c, 0x4c, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x4c,
+	0x69, 0x6d, 0x69, 0x74, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1a, 0x0a,
+	0x08, 0x64, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x08, 0x64, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x2c, 0x0a, 0x12, 0x73, 0x65, 0x6c,
+	0x65, 0x63, 0x74, 0x65, 0x64, 0x5f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5f, 0x69, 0x64, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x65, 0x64, 0x50,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x64, 0x12, 0x30, 0x0a, 0x14, 0x61, 0x74, 0x74, 0x72, 0x69,
+	0x62, 0x75, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x69,
+	0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x12, 0x25, 0x0a, 0x0e, 0x77, 0x69, 0x6e,
+	0x64, 0x6f, 0x77, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x03, 0x52, 0x0d, 0x77, 0x69, 0x6e, 0x64, 0x6f, 0x77, 0x53, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73,
+	0x12, 0x1b, 0x0a, 0x09, 0x64, 0x65, 0x6e, 0x79, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x05, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x08, 0x64, 0x65, 0x6e, 0x79, 0x43, 0x6f, 0x64, 0x65, 0x12, 0x1f, 0x0a,
+	0x0b, 0x64, 0x65, 0x6e, 0x79, 0x5f, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x18, 0x06, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0a, 0x64, 0x65, 0x6e, 0x79, 0x52, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x22, 0x91,
+	0x02, 0x0a, 0x15, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x4c, 0x4c, 0x4d, 0x55, 0x73, 0x61, 0x67,
+	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f,
+	0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63,
+	0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f,
+	0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64,
+	0x12, 0x19, 0x0a, 0x08, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x07, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x12, 0x25, 0x0a, 0x0e, 0x77,
+	0x69, 0x6e, 0x64, 0x6f, 0x77, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x03, 0x52, 0x0d, 0x77, 0x69, 0x6e, 0x64, 0x6f, 0x77, 0x53, 0x65, 0x63, 0x6f, 0x6e,
+	0x64, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x5f, 0x69, 0x6e, 0x70,
+	0x75, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0b, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73,
+	0x49, 0x6e, 0x70, 0x75, 0x74, 0x12, 0x23, 0x0a, 0x0d, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x5f,
+	0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0c, 0x74, 0x6f,
+	0x6b, 0x65, 0x6e, 0x73, 0x4f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x63, 0x6f,
+	0x73, 0x74, 0x5f, 0x75, 0x73, 0x64, 0x18, 0x07, 0x20, 0x01, 0x28, 0x01, 0x52, 0x07, 0x63, 0x6f,
+	0x73, 0x74, 0x55, 0x73, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69,
+	0x64, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x49,
+	0x64, 0x73, 0x22, 0x18, 0x0a, 0x16, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x4c, 0x4c, 0x4d, 0x55,
+	0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2a, 0x64, 0x0a, 0x16,
+	0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61,
+	0x74, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x17, 0x0a, 0x13, 0x55, 0x50, 0x44, 0x41, 0x54, 0x45,
+	0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x43, 0x52, 0x45, 0x41, 0x54, 0x45, 0x44, 0x10, 0x00, 0x12,
+	0x18, 0x0a, 0x14, 0x55, 0x50, 0x44, 0x41, 0x54, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x4d,
+	0x4f, 0x44, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x01, 0x12, 0x17, 0x0a, 0x13, 0x55, 0x50, 0x44,
+	0x41, 0x54, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x52, 0x45, 0x4d, 0x4f, 0x56, 0x45, 0x44,
+	0x10, 0x02, 0x2a, 0x46, 0x0a, 0x0f, 0x50, 0x61, 0x74, 0x68, 0x52, 0x65, 0x77, 0x72, 0x69, 0x74,
+	0x65, 0x4d, 0x6f, 0x64, 0x65, 0x12, 0x18, 0x0a, 0x14, 0x50, 0x41, 0x54, 0x48, 0x5f, 0x52, 0x45,
+	0x57, 0x52, 0x49, 0x54, 0x45, 0x5f, 0x44, 0x45, 0x46, 0x41, 0x55, 0x4c, 0x54, 0x10, 0x00, 0x12,
+	0x19, 0x0a, 0x15, 0x50, 0x41, 0x54, 0x48, 0x5f, 0x52, 0x45, 0x57, 0x52, 0x49, 0x54, 0x45, 0x5f,
+	0x50, 0x52, 0x45, 0x53, 0x45, 0x52, 0x56, 0x45, 0x10, 0x01, 0x2a, 0x77, 0x0a, 0x12, 0x54, 0x61,
+	0x72, 0x67, 0x65, 0x74, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x12, 0x20, 0x0a, 0x1c, 0x54, 0x41, 0x52, 0x47, 0x45, 0x54, 0x5f, 0x41, 0x43, 0x43, 0x45, 0x53,
+	0x53, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x49, 0x4e, 0x48, 0x45, 0x52, 0x49, 0x54,
+	0x10, 0x00, 0x12, 0x1f, 0x0a, 0x1b, 0x54, 0x41, 0x52, 0x47, 0x45, 0x54, 0x5f, 0x41, 0x43, 0x43,
+	0x45, 0x53, 0x53, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x42, 0x59, 0x50, 0x41, 0x53,
+	0x53, 0x10, 0x01, 0x12, 0x1e, 0x0a, 0x1a, 0x54, 0x41, 0x52, 0x47, 0x45, 0x54, 0x5f, 0x41, 0x43,
+	0x43, 0x45, 0x53, 0x53, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x42, 0x4c, 0x4f, 0x43,
+	0x4b, 0x10, 0x02, 0x2a, 0x90, 0x01, 0x0a, 0x0e, 0x4d, 0x69, 0x64, 0x64, 0x6c, 0x65, 0x77, 0x61,
+	0x72, 0x65, 0x53, 0x6c, 0x6f, 0x74, 0x12, 0x1f, 0x0a, 0x1b, 0x4d, 0x49, 0x44, 0x44, 0x4c, 0x45,
+	0x57, 0x41, 0x52, 0x45, 0x5f, 0x53, 0x4c, 0x4f, 0x54, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43,
+	0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x1e, 0x0a, 0x1a, 0x4d, 0x49, 0x44, 0x44, 0x4c,
+	0x45, 0x57, 0x41, 0x52, 0x45, 0x5f, 0x53, 0x4c, 0x4f, 0x54, 0x5f, 0x4f, 0x4e, 0x5f, 0x52, 0x45,
+	0x51, 0x55, 0x45, 0x53, 0x54, 0x10, 0x01, 0x12, 0x1f, 0x0a, 0x1b, 0x4d, 0x49, 0x44, 0x44, 0x4c,
+	0x45, 0x57, 0x41, 0x52, 0x45, 0x5f, 0x53, 0x4c, 0x4f, 0x54, 0x5f, 0x4f, 0x4e, 0x5f, 0x52, 0x45,
+	0x53, 0x50, 0x4f, 0x4e, 0x53, 0x45, 0x10, 0x02, 0x12, 0x1c, 0x0a, 0x18, 0x4d, 0x49, 0x44, 0x44,
+	0x4c, 0x45, 0x57, 0x41, 0x52, 0x45, 0x5f, 0x53, 0x4c, 0x4f, 0x54, 0x5f, 0x54, 0x45, 0x52, 0x4d,
+	0x49, 0x4e, 0x41, 0x4c, 0x10, 0x03, 0x2a, 0xc8, 0x01, 0x0a, 0x0b, 0x50, 0x72, 0x6f, 0x78, 0x79,
+	0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x18, 0x0a, 0x14, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f,
+	0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x50, 0x45, 0x4e, 0x44, 0x49, 0x4e, 0x47, 0x10, 0x00,
+	0x12, 0x17, 0x0a, 0x13, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53,
+	0x5f, 0x41, 0x43, 0x54, 0x49, 0x56, 0x45, 0x10, 0x01, 0x12, 0x23, 0x0a, 0x1f, 0x50, 0x52, 0x4f,
+	0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x54, 0x55, 0x4e, 0x4e, 0x45, 0x4c,
+	0x5f, 0x4e, 0x4f, 0x54, 0x5f, 0x43, 0x52, 0x45, 0x41, 0x54, 0x45, 0x44, 0x10, 0x02, 0x12, 0x24,
+	0x0a, 0x20, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x43,
+	0x45, 0x52, 0x54, 0x49, 0x46, 0x49, 0x43, 0x41, 0x54, 0x45, 0x5f, 0x50, 0x45, 0x4e, 0x44, 0x49,
+	0x4e, 0x47, 0x10, 0x03, 0x12, 0x23, 0x0a, 0x1f, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f, 0x53, 0x54,
+	0x41, 0x54, 0x55, 0x53, 0x5f, 0x43, 0x45, 0x52, 0x54, 0x49, 0x46, 0x49, 0x43, 0x41, 0x54, 0x45,
+	0x5f, 0x46, 0x41, 0x49, 0x4c, 0x45, 0x44, 0x10, 0x04, 0x12, 0x16, 0x0a, 0x12, 0x50, 0x52, 0x4f,
+	0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x45, 0x52, 0x52, 0x4f, 0x52, 0x10,
+	0x05, 0x32, 0xfc, 0x07, 0x0a, 0x0c, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x53, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x12, 0x5f, 0x0a, 0x10, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67,
+	0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x12, 0x23, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70,
+	0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x6d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x70, 0x70,
+	0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x30, 0x01, 0x12, 0x55, 0x0a, 0x0c, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69,
+	0x6e, 0x67, 0x73, 0x12, 0x1f, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+	0x2e, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x28, 0x01, 0x30, 0x01, 0x12, 0x54, 0x0a, 0x0d, 0x53, 0x65,
+	0x6e, 0x64, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x12, 0x20, 0x2e, 0x6d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x63,
+	0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x41,
+	0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x51, 0x0a, 0x0c, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65,
+	0x12, 0x1f, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x75,
+	0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x20, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41,
+	0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x5d, 0x0a, 0x10, 0x53, 0x65, 0x6e, 0x64, 0x53, 0x74, 0x61, 0x74, 0x75,
+	0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x12, 0x23, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x55,
+	0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x53, 0x74,
+	0x61, 0x74, 0x75, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x12, 0x5a, 0x0a, 0x0f, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x78,
+	0x79, 0x50, 0x65, 0x65, 0x72, 0x12, 0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x65,
+	0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f,
+	0x78, 0x79, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4b,
+	0x0a, 0x0a, 0x47, 0x65, 0x74, 0x4f, 0x49, 0x44, 0x43, 0x55, 0x52, 0x4c, 0x12, 0x1d, 0x2e, 0x6d,
 	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x47, 0x65, 0x74, 0x4f, 0x49, 0x44,
-	0x43, 0x55, 0x52, 0x4c, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5a, 0x0a, 0x0f,
-	0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12,
-	0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x56, 0x61, 0x6c,
-	0x69, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x63, 0x0a, 0x12, 0x56, 0x61, 0x6c, 0x69,
-	0x64, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x12, 0x25,
+	0x43, 0x55, 0x52, 0x4c, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1e, 0x2e, 0x6d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x47, 0x65, 0x74, 0x4f, 0x49, 0x44, 0x43,
+	0x55, 0x52, 0x4c, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5a, 0x0a, 0x0f, 0x56,
+	0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x22,
 	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x56, 0x61, 0x6c, 0x69,
-	0x64, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x26, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65,
-	0x6c, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x69, 0x0a,
-	0x14, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x4c, 0x4c, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x4c,
-	0x69, 0x6d, 0x69, 0x74, 0x73, 0x12, 0x27, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x2e, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x4c, 0x4c, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63,
-	0x79, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x28,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x68, 0x65, 0x63,
-	0x6b, 0x4c, 0x4c, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x57, 0x0a, 0x0e, 0x52, 0x65, 0x63, 0x6f,
-	0x72, 0x64, 0x4c, 0x4c, 0x4d, 0x55, 0x73, 0x61, 0x67, 0x65, 0x12, 0x21, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x4c, 0x4c,
-	0x4d, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72,
-	0x64, 0x4c, 0x4c, 0x4d, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x42, 0x08, 0x5a, 0x06, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x33,
+	0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x23, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x63, 0x0a, 0x12, 0x56, 0x61, 0x6c, 0x69, 0x64,
+	0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x12, 0x25, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64,
+	0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x26, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c,
+	0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x69, 0x0a, 0x14,
+	0x43, 0x68, 0x65, 0x63, 0x6b, 0x4c, 0x4c, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x4c, 0x69,
+	0x6d, 0x69, 0x74, 0x73, 0x12, 0x27, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x4c, 0x4c, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x28, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x68, 0x65, 0x63, 0x6b,
+	0x4c, 0x4c, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x57, 0x0a, 0x0e, 0x52, 0x65, 0x63, 0x6f, 0x72,
+	0x64, 0x4c, 0x4c, 0x4d, 0x55, 0x73, 0x61, 0x67, 0x65, 0x12, 0x21, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x4c, 0x4c, 0x4d,
+	0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64,
+	0x4c, 0x4c, 0x4d, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x42, 0x08, 0x5a, 0x06, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x33,
 }
 
 var (
@@ -3775,114 +3844,116 @@ func file_proxy_service_proto_rawDescGZIP() []byte {
 	return file_proxy_service_proto_rawDescData
 }
 
-var file_proxy_service_proto_enumTypes = make([]protoimpl.EnumInfo, 5)
+var file_proxy_service_proto_enumTypes = make([]protoimpl.EnumInfo, 6)
 var file_proxy_service_proto_msgTypes = make([]protoimpl.MessageInfo, 39)
 var file_proxy_service_proto_goTypes = []interface{}{
 	(ProxyMappingUpdateType)(0),          // 0: management.ProxyMappingUpdateType
 	(PathRewriteMode)(0),                 // 1: management.PathRewriteMode
-	(MiddlewareSlot)(0),                  // 2: management.MiddlewareSlot
-	(ProxyStatus)(0),                     // 3: management.ProxyStatus
-	(MiddlewareConfig_FailMode)(0),       // 4: management.MiddlewareConfig.FailMode
-	(*ProxyCapabilities)(nil),            // 5: management.ProxyCapabilities
-	(*GetMappingUpdateRequest)(nil),      // 6: management.GetMappingUpdateRequest
-	(*GetMappingUpdateResponse)(nil),     // 7: management.GetMappingUpdateResponse
-	(*PathTargetOptions)(nil),            // 8: management.PathTargetOptions
-	(*MiddlewareConfig)(nil),             // 9: management.MiddlewareConfig
-	(*PathMapping)(nil),                  // 10: management.PathMapping
-	(*HeaderAuth)(nil),                   // 11: management.HeaderAuth
-	(*Authentication)(nil),               // 12: management.Authentication
-	(*AccessRestrictions)(nil),           // 13: management.AccessRestrictions
-	(*ProxyMapping)(nil),                 // 14: management.ProxyMapping
-	(*SendAccessLogRequest)(nil),         // 15: management.SendAccessLogRequest
-	(*SendAccessLogResponse)(nil),        // 16: management.SendAccessLogResponse
-	(*AccessLog)(nil),                    // 17: management.AccessLog
-	(*AuthenticateRequest)(nil),          // 18: management.AuthenticateRequest
-	(*HeaderAuthRequest)(nil),            // 19: management.HeaderAuthRequest
-	(*PasswordRequest)(nil),              // 20: management.PasswordRequest
-	(*PinRequest)(nil),                   // 21: management.PinRequest
-	(*AuthenticateResponse)(nil),         // 22: management.AuthenticateResponse
-	(*SendStatusUpdateRequest)(nil),      // 23: management.SendStatusUpdateRequest
-	(*ProxyInboundListener)(nil),         // 24: management.ProxyInboundListener
-	(*SendStatusUpdateResponse)(nil),     // 25: management.SendStatusUpdateResponse
-	(*CreateProxyPeerRequest)(nil),       // 26: management.CreateProxyPeerRequest
-	(*CreateProxyPeerResponse)(nil),      // 27: management.CreateProxyPeerResponse
-	(*GetOIDCURLRequest)(nil),            // 28: management.GetOIDCURLRequest
-	(*GetOIDCURLResponse)(nil),           // 29: management.GetOIDCURLResponse
-	(*ValidateSessionRequest)(nil),       // 30: management.ValidateSessionRequest
-	(*ValidateSessionResponse)(nil),      // 31: management.ValidateSessionResponse
-	(*ValidateTunnelPeerRequest)(nil),    // 32: management.ValidateTunnelPeerRequest
-	(*ValidateTunnelPeerResponse)(nil),   // 33: management.ValidateTunnelPeerResponse
-	(*SyncMappingsRequest)(nil),          // 34: management.SyncMappingsRequest
-	(*SyncMappingsInit)(nil),             // 35: management.SyncMappingsInit
-	(*SyncMappingsAck)(nil),              // 36: management.SyncMappingsAck
-	(*SyncMappingsResponse)(nil),         // 37: management.SyncMappingsResponse
-	(*CheckLLMPolicyLimitsRequest)(nil),  // 38: management.CheckLLMPolicyLimitsRequest
-	(*CheckLLMPolicyLimitsResponse)(nil), // 39: management.CheckLLMPolicyLimitsResponse
-	(*RecordLLMUsageRequest)(nil),        // 40: management.RecordLLMUsageRequest
-	(*RecordLLMUsageResponse)(nil),       // 41: management.RecordLLMUsageResponse
-	nil,                                  // 42: management.PathTargetOptions.CustomHeadersEntry
-	nil,                                  // 43: management.AccessLog.MetadataEntry
-	(*timestamppb.Timestamp)(nil),        // 44: google.protobuf.Timestamp
-	(*durationpb.Duration)(nil),          // 45: google.protobuf.Duration
+	(TargetAccessAction)(0),              // 2: management.TargetAccessAction
+	(MiddlewareSlot)(0),                  // 3: management.MiddlewareSlot
+	(ProxyStatus)(0),                     // 4: management.ProxyStatus
+	(MiddlewareConfig_FailMode)(0),       // 5: management.MiddlewareConfig.FailMode
+	(*ProxyCapabilities)(nil),            // 6: management.ProxyCapabilities
+	(*GetMappingUpdateRequest)(nil),      // 7: management.GetMappingUpdateRequest
+	(*GetMappingUpdateResponse)(nil),     // 8: management.GetMappingUpdateResponse
+	(*PathTargetOptions)(nil),            // 9: management.PathTargetOptions
+	(*MiddlewareConfig)(nil),             // 10: management.MiddlewareConfig
+	(*PathMapping)(nil),                  // 11: management.PathMapping
+	(*HeaderAuth)(nil),                   // 12: management.HeaderAuth
+	(*Authentication)(nil),               // 13: management.Authentication
+	(*AccessRestrictions)(nil),           // 14: management.AccessRestrictions
+	(*ProxyMapping)(nil),                 // 15: management.ProxyMapping
+	(*SendAccessLogRequest)(nil),         // 16: management.SendAccessLogRequest
+	(*SendAccessLogResponse)(nil),        // 17: management.SendAccessLogResponse
+	(*AccessLog)(nil),                    // 18: management.AccessLog
+	(*AuthenticateRequest)(nil),          // 19: management.AuthenticateRequest
+	(*HeaderAuthRequest)(nil),            // 20: management.HeaderAuthRequest
+	(*PasswordRequest)(nil),              // 21: management.PasswordRequest
+	(*PinRequest)(nil),                   // 22: management.PinRequest
+	(*AuthenticateResponse)(nil),         // 23: management.AuthenticateResponse
+	(*SendStatusUpdateRequest)(nil),      // 24: management.SendStatusUpdateRequest
+	(*ProxyInboundListener)(nil),         // 25: management.ProxyInboundListener
+	(*SendStatusUpdateResponse)(nil),     // 26: management.SendStatusUpdateResponse
+	(*CreateProxyPeerRequest)(nil),       // 27: management.CreateProxyPeerRequest
+	(*CreateProxyPeerResponse)(nil),      // 28: management.CreateProxyPeerResponse
+	(*GetOIDCURLRequest)(nil),            // 29: management.GetOIDCURLRequest
+	(*GetOIDCURLResponse)(nil),           // 30: management.GetOIDCURLResponse
+	(*ValidateSessionRequest)(nil),       // 31: management.ValidateSessionRequest
+	(*ValidateSessionResponse)(nil),      // 32: management.ValidateSessionResponse
+	(*ValidateTunnelPeerRequest)(nil),    // 33: management.ValidateTunnelPeerRequest
+	(*ValidateTunnelPeerResponse)(nil),   // 34: management.ValidateTunnelPeerResponse
+	(*SyncMappingsRequest)(nil),          // 35: management.SyncMappingsRequest
+	(*SyncMappingsInit)(nil),             // 36: management.SyncMappingsInit
+	(*SyncMappingsAck)(nil),              // 37: management.SyncMappingsAck
+	(*SyncMappingsResponse)(nil),         // 38: management.SyncMappingsResponse
+	(*CheckLLMPolicyLimitsRequest)(nil),  // 39: management.CheckLLMPolicyLimitsRequest
+	(*CheckLLMPolicyLimitsResponse)(nil), // 40: management.CheckLLMPolicyLimitsResponse
+	(*RecordLLMUsageRequest)(nil),        // 41: management.RecordLLMUsageRequest
+	(*RecordLLMUsageResponse)(nil),       // 42: management.RecordLLMUsageResponse
+	nil,                                  // 43: management.PathTargetOptions.CustomHeadersEntry
+	nil,                                  // 44: management.AccessLog.MetadataEntry
+	(*timestamppb.Timestamp)(nil),        // 45: google.protobuf.Timestamp
+	(*durationpb.Duration)(nil),          // 46: google.protobuf.Duration
 }
 var file_proxy_service_proto_depIdxs = []int32{
-	44, // 0: management.GetMappingUpdateRequest.started_at:type_name -> google.protobuf.Timestamp
-	5,  // 1: management.GetMappingUpdateRequest.capabilities:type_name -> management.ProxyCapabilities
-	14, // 2: management.GetMappingUpdateResponse.mapping:type_name -> management.ProxyMapping
-	45, // 3: management.PathTargetOptions.request_timeout:type_name -> google.protobuf.Duration
+	45, // 0: management.GetMappingUpdateRequest.started_at:type_name -> google.protobuf.Timestamp
+	6,  // 1: management.GetMappingUpdateRequest.capabilities:type_name -> management.ProxyCapabilities
+	15, // 2: management.GetMappingUpdateResponse.mapping:type_name -> management.ProxyMapping
+	46, // 3: management.PathTargetOptions.request_timeout:type_name -> google.protobuf.Duration
 	1,  // 4: management.PathTargetOptions.path_rewrite:type_name -> management.PathRewriteMode
-	42, // 5: management.PathTargetOptions.custom_headers:type_name -> management.PathTargetOptions.CustomHeadersEntry
-	45, // 6: management.PathTargetOptions.session_idle_timeout:type_name -> google.protobuf.Duration
-	9,  // 7: management.PathTargetOptions.middlewares:type_name -> management.MiddlewareConfig
-	2,  // 8: management.MiddlewareConfig.slot:type_name -> management.MiddlewareSlot
-	4,  // 9: management.MiddlewareConfig.fail_mode:type_name -> management.MiddlewareConfig.FailMode
-	45, // 10: management.MiddlewareConfig.timeout:type_name -> google.protobuf.Duration
-	8,  // 11: management.PathMapping.options:type_name -> management.PathTargetOptions
-	11, // 12: management.Authentication.header_auths:type_name -> management.HeaderAuth
-	0,  // 13: management.ProxyMapping.type:type_name -> management.ProxyMappingUpdateType
-	10, // 14: management.ProxyMapping.path:type_name -> management.PathMapping
-	12, // 15: management.ProxyMapping.auth:type_name -> management.Authentication
-	13, // 16: management.ProxyMapping.access_restrictions:type_name -> management.AccessRestrictions
-	17, // 17: management.SendAccessLogRequest.log:type_name -> management.AccessLog
-	44, // 18: management.AccessLog.timestamp:type_name -> google.protobuf.Timestamp
-	43, // 19: management.AccessLog.metadata:type_name -> management.AccessLog.MetadataEntry
-	20, // 20: management.AuthenticateRequest.password:type_name -> management.PasswordRequest
-	21, // 21: management.AuthenticateRequest.pin:type_name -> management.PinRequest
-	19, // 22: management.AuthenticateRequest.header_auth:type_name -> management.HeaderAuthRequest
-	3,  // 23: management.SendStatusUpdateRequest.status:type_name -> management.ProxyStatus
-	24, // 24: management.SendStatusUpdateRequest.inbound_listener:type_name -> management.ProxyInboundListener
-	35, // 25: management.SyncMappingsRequest.init:type_name -> management.SyncMappingsInit
-	36, // 26: management.SyncMappingsRequest.ack:type_name -> management.SyncMappingsAck
-	44, // 27: management.SyncMappingsInit.started_at:type_name -> google.protobuf.Timestamp
-	5,  // 28: management.SyncMappingsInit.capabilities:type_name -> management.ProxyCapabilities
-	14, // 29: management.SyncMappingsResponse.mapping:type_name -> management.ProxyMapping
-	6,  // 30: management.ProxyService.GetMappingUpdate:input_type -> management.GetMappingUpdateRequest
-	34, // 31: management.ProxyService.SyncMappings:input_type -> management.SyncMappingsRequest
-	15, // 32: management.ProxyService.SendAccessLog:input_type -> management.SendAccessLogRequest
-	18, // 33: management.ProxyService.Authenticate:input_type -> management.AuthenticateRequest
-	23, // 34: management.ProxyService.SendStatusUpdate:input_type -> management.SendStatusUpdateRequest
-	26, // 35: management.ProxyService.CreateProxyPeer:input_type -> management.CreateProxyPeerRequest
-	28, // 36: management.ProxyService.GetOIDCURL:input_type -> management.GetOIDCURLRequest
-	30, // 37: management.ProxyService.ValidateSession:input_type -> management.ValidateSessionRequest
-	32, // 38: management.ProxyService.ValidateTunnelPeer:input_type -> management.ValidateTunnelPeerRequest
-	38, // 39: management.ProxyService.CheckLLMPolicyLimits:input_type -> management.CheckLLMPolicyLimitsRequest
-	40, // 40: management.ProxyService.RecordLLMUsage:input_type -> management.RecordLLMUsageRequest
-	7,  // 41: management.ProxyService.GetMappingUpdate:output_type -> management.GetMappingUpdateResponse
-	37, // 42: management.ProxyService.SyncMappings:output_type -> management.SyncMappingsResponse
-	16, // 43: management.ProxyService.SendAccessLog:output_type -> management.SendAccessLogResponse
-	22, // 44: management.ProxyService.Authenticate:output_type -> management.AuthenticateResponse
-	25, // 45: management.ProxyService.SendStatusUpdate:output_type -> management.SendStatusUpdateResponse
-	27, // 46: management.ProxyService.CreateProxyPeer:output_type -> management.CreateProxyPeerResponse
-	29, // 47: management.ProxyService.GetOIDCURL:output_type -> management.GetOIDCURLResponse
-	31, // 48: management.ProxyService.ValidateSession:output_type -> management.ValidateSessionResponse
-	33, // 49: management.ProxyService.ValidateTunnelPeer:output_type -> management.ValidateTunnelPeerResponse
-	39, // 50: management.ProxyService.CheckLLMPolicyLimits:output_type -> management.CheckLLMPolicyLimitsResponse
-	41, // 51: management.ProxyService.RecordLLMUsage:output_type -> management.RecordLLMUsageResponse
-	41, // [41:52] is the sub-list for method output_type
-	30, // [30:41] is the sub-list for method input_type
-	30, // [30:30] is the sub-list for extension type_name
-	30, // [30:30] is the sub-list for extension extendee
-	0,  // [0:30] is the sub-list for field type_name
+	43, // 5: management.PathTargetOptions.custom_headers:type_name -> management.PathTargetOptions.CustomHeadersEntry
+	46, // 6: management.PathTargetOptions.session_idle_timeout:type_name -> google.protobuf.Duration
+	10, // 7: management.PathTargetOptions.middlewares:type_name -> management.MiddlewareConfig
+	3,  // 8: management.MiddlewareConfig.slot:type_name -> management.MiddlewareSlot
+	5,  // 9: management.MiddlewareConfig.fail_mode:type_name -> management.MiddlewareConfig.FailMode
+	46, // 10: management.MiddlewareConfig.timeout:type_name -> google.protobuf.Duration
+	9,  // 11: management.PathMapping.options:type_name -> management.PathTargetOptions
+	2,  // 12: management.PathMapping.access_action:type_name -> management.TargetAccessAction
+	12, // 13: management.Authentication.header_auths:type_name -> management.HeaderAuth
+	0,  // 14: management.ProxyMapping.type:type_name -> management.ProxyMappingUpdateType
+	11, // 15: management.ProxyMapping.path:type_name -> management.PathMapping
+	13, // 16: management.ProxyMapping.auth:type_name -> management.Authentication
+	14, // 17: management.ProxyMapping.access_restrictions:type_name -> management.AccessRestrictions
+	18, // 18: management.SendAccessLogRequest.log:type_name -> management.AccessLog
+	45, // 19: management.AccessLog.timestamp:type_name -> google.protobuf.Timestamp
+	44, // 20: management.AccessLog.metadata:type_name -> management.AccessLog.MetadataEntry
+	21, // 21: management.AuthenticateRequest.password:type_name -> management.PasswordRequest
+	22, // 22: management.AuthenticateRequest.pin:type_name -> management.PinRequest
+	20, // 23: management.AuthenticateRequest.header_auth:type_name -> management.HeaderAuthRequest
+	4,  // 24: management.SendStatusUpdateRequest.status:type_name -> management.ProxyStatus
+	25, // 25: management.SendStatusUpdateRequest.inbound_listener:type_name -> management.ProxyInboundListener
+	36, // 26: management.SyncMappingsRequest.init:type_name -> management.SyncMappingsInit
+	37, // 27: management.SyncMappingsRequest.ack:type_name -> management.SyncMappingsAck
+	45, // 28: management.SyncMappingsInit.started_at:type_name -> google.protobuf.Timestamp
+	6,  // 29: management.SyncMappingsInit.capabilities:type_name -> management.ProxyCapabilities
+	15, // 30: management.SyncMappingsResponse.mapping:type_name -> management.ProxyMapping
+	7,  // 31: management.ProxyService.GetMappingUpdate:input_type -> management.GetMappingUpdateRequest
+	35, // 32: management.ProxyService.SyncMappings:input_type -> management.SyncMappingsRequest
+	16, // 33: management.ProxyService.SendAccessLog:input_type -> management.SendAccessLogRequest
+	19, // 34: management.ProxyService.Authenticate:input_type -> management.AuthenticateRequest
+	24, // 35: management.ProxyService.SendStatusUpdate:input_type -> management.SendStatusUpdateRequest
+	27, // 36: management.ProxyService.CreateProxyPeer:input_type -> management.CreateProxyPeerRequest
+	29, // 37: management.ProxyService.GetOIDCURL:input_type -> management.GetOIDCURLRequest
+	31, // 38: management.ProxyService.ValidateSession:input_type -> management.ValidateSessionRequest
+	33, // 39: management.ProxyService.ValidateTunnelPeer:input_type -> management.ValidateTunnelPeerRequest
+	39, // 40: management.ProxyService.CheckLLMPolicyLimits:input_type -> management.CheckLLMPolicyLimitsRequest
+	41, // 41: management.ProxyService.RecordLLMUsage:input_type -> management.RecordLLMUsageRequest
+	8,  // 42: management.ProxyService.GetMappingUpdate:output_type -> management.GetMappingUpdateResponse
+	38, // 43: management.ProxyService.SyncMappings:output_type -> management.SyncMappingsResponse
+	17, // 44: management.ProxyService.SendAccessLog:output_type -> management.SendAccessLogResponse
+	23, // 45: management.ProxyService.Authenticate:output_type -> management.AuthenticateResponse
+	26, // 46: management.ProxyService.SendStatusUpdate:output_type -> management.SendStatusUpdateResponse
+	28, // 47: management.ProxyService.CreateProxyPeer:output_type -> management.CreateProxyPeerResponse
+	30, // 48: management.ProxyService.GetOIDCURL:output_type -> management.GetOIDCURLResponse
+	32, // 49: management.ProxyService.ValidateSession:output_type -> management.ValidateSessionResponse
+	34, // 50: management.ProxyService.ValidateTunnelPeer:output_type -> management.ValidateTunnelPeerResponse
+	40, // 51: management.ProxyService.CheckLLMPolicyLimits:output_type -> management.CheckLLMPolicyLimitsResponse
+	42, // 52: management.ProxyService.RecordLLMUsage:output_type -> management.RecordLLMUsageResponse
+	42, // [42:53] is the sub-list for method output_type
+	31, // [31:42] is the sub-list for method input_type
+	31, // [31:31] is the sub-list for extension type_name
+	31, // [31:31] is the sub-list for extension extendee
+	0,  // [0:31] is the sub-list for field type_name
 }
 
 func init() { file_proxy_service_proto_init() }
@@ -4353,7 +4424,7 @@ func file_proxy_service_proto_init() {
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_proxy_service_proto_rawDesc,
-			NumEnums:      5,
+			NumEnums:      6,
 			NumMessages:   39,
 			NumExtensions: 0,
 			NumServices:   1,
diff --git a/shared/management/proto/proxy_service.proto b/shared/management/proto/proxy_service.proto
index 7c5fb08eb..d988f8767 100644
--- a/shared/management/proto/proxy_service.proto
+++ b/shared/management/proto/proxy_service.proto
@@ -105,6 +105,12 @@ enum PathRewriteMode {
   PATH_REWRITE_PRESERVE = 1;
 }
 
+enum TargetAccessAction {
+  TARGET_ACCESS_ACTION_INHERIT = 0;
+  TARGET_ACCESS_ACTION_BYPASS = 1;
+  TARGET_ACCESS_ACTION_BLOCK = 2;
+}
+
 message PathTargetOptions {
   bool skip_tls_verify = 1;
   google.protobuf.Duration request_timeout = 2;
@@ -178,6 +184,7 @@ message PathMapping {
   string path = 1;
   string target = 2;
   PathTargetOptions options = 3;
+  TargetAccessAction access_action = 4;
 }
 
 message HeaderAuth {

From cd22a9d4f1182e67934649b8e6403fffe389624e Mon Sep 17 00:00:00 2001
From: Maycon Santos <mlsmaycon@gmail.com>
Date: Mon, 12 Oct 2026 12:56:17 +0200
Subject: [PATCH 41/70] [management] Configure per-target HTTP access actions
 (#8116)

Let HTTP targets inherit service authentication, bypass it, or block access. Validate and persist the action, expose it through the API, and deliver it to the proxy. Private services reject bypass.

Validation: service/manager, store, and management-to-proxy integration race tests passed; scoped lint passed.
---
 .../reverseproxy/service/manager/manager.go   |  71 ++++
 .../service/manager/target_access_test.go     | 196 +++++++++++
 .../modules/reverseproxy/service/service.go   | 159 ++++++---
 .../reverseproxy/service/service_test.go      | 312 ++++++++++++++++++
 .../reverseproxy/service/target_access.go     | 115 +++++++
 .../server/store/sql_store_service_target.go  |   9 +-
 .../server/store/sql_store_service_test.go    |   2 +
 .../target_access_control_integration_test.go | 270 +++++++++++++++
 shared/management/http/api/openapi.yml        |   6 +
 shared/management/http/api/types.gen.go       |  27 ++
 10 files changed, 1111 insertions(+), 56 deletions(-)
 create mode 100644 management/internals/modules/reverseproxy/service/manager/target_access_test.go
 create mode 100644 management/internals/modules/reverseproxy/service/target_access.go
 create mode 100644 proxy/target_access_control_integration_test.go

diff --git a/management/internals/modules/reverseproxy/service/manager/manager.go b/management/internals/modules/reverseproxy/service/manager/manager.go
index d1ed8d078..ebb52c74b 100644
--- a/management/internals/modules/reverseproxy/service/manager/manager.go
+++ b/management/internals/modules/reverseproxy/service/manager/manager.go
@@ -339,6 +339,9 @@ func (m *Manager) persistNewService(ctx context.Context, accountID string, svc *
 	}
 
 	return m.store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
+		if err := validateTargetAccessControl(svc); err != nil {
+			return err
+		}
 		if err := m.validateServiceDomain(ctx, transaction, accountID, svc, svc.ProxyCluster); err != nil {
 			return err
 		}
@@ -708,6 +711,12 @@ func (m *Manager) executeServiceUpdate(ctx context.Context, transaction store.St
 	}
 
 	m.preserveExistingAuthSecrets(service, existingService)
+	if err := preserveTargetAccessActions(service, existingService); err != nil {
+		return err
+	}
+	if err := validateTargetAccessControl(service); err != nil {
+		return err
+	}
 	if err := validateHeaderAuthValues(service.Auth.HeaderAuths); err != nil {
 		return err
 	}
@@ -745,6 +754,68 @@ func (m *Manager) validateServiceDomain(ctx context.Context, tx store.Store, acc
 	return m.clusterDeriver.ValidateServiceDomain(ctx, tx, accountID, svc.Domain, cluster)
 }
 
+func validateTargetAccessControl(svc *service.Service) error {
+	if !svc.HasTargetAccessControl() {
+		return nil
+	}
+	// Legacy requests may acquire an existing action during the update merge.
+	if err := svc.Validate(); err != nil {
+		return status.Errorf(status.InvalidArgument, "%s", err)
+	}
+	return nil
+}
+
+func preserveTargetAccessActions(updated, existing *service.Service) error {
+	if !existing.HasTargetAccessControl() {
+		return nil
+	}
+	if slices.ContainsFunc(updated.Targets, func(target *service.Target) bool {
+		return target == nil
+	}) {
+		return status.Errorf(status.InvalidArgument, "target must not be nil")
+	}
+	if len(updated.Targets) > 0 && !slices.ContainsFunc(updated.Targets, func(target *service.Target) bool {
+		return !target.AccessActionProvided
+	}) {
+		return nil
+	}
+	byPath := make(map[string]*service.Target, len(existing.Targets))
+	for _, target := range existing.Targets {
+		location := effectiveTargetPath(target)
+		if _, duplicate := byPath[location]; duplicate {
+			return status.Errorf(status.InvalidArgument,
+				"cannot preserve target access control for duplicate location %q", location)
+		}
+		byPath[location] = target
+	}
+	actionsProvided := false
+	for _, target := range updated.Targets {
+		actionsProvided = actionsProvided || target.AccessActionProvided
+		location := effectiveTargetPath(target)
+		if previous := byPath[location]; previous != nil && !target.AccessActionProvided {
+			target.AccessAction = previous.AccessAction
+		}
+		delete(byPath, location)
+	}
+	if actionsProvided {
+		return nil
+	}
+	for location, target := range byPath {
+		if target.AccessAction != "" && target.AccessAction != service.TargetAccessActionInherit {
+			return status.Errorf(status.InvalidArgument,
+				"include access_action when removing or changing controlled target location %q", location)
+		}
+	}
+	return nil
+}
+
+func effectiveTargetPath(target *service.Target) string {
+	if target.Path == nil || *target.Path == "" {
+		return "/"
+	}
+	return *target.Path
+}
+
 // validateL4PortDiffOnClusterDiff checks if custom L4 ports are configured and validates port changes across clusters.
 // It ensures no port changes if custom ports are unsupported for a given cluster and protocol mode.
 // Returns an error if validation fails, otherwise returns nil.
diff --git a/management/internals/modules/reverseproxy/service/manager/target_access_test.go b/management/internals/modules/reverseproxy/service/manager/target_access_test.go
new file mode 100644
index 000000000..e87d0c64c
--- /dev/null
+++ b/management/internals/modules/reverseproxy/service/manager/target_access_test.go
@@ -0,0 +1,196 @@
+package manager
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/server/store"
+)
+
+func TestCreateServiceTargetAccessWithoutActiveProxies(t *testing.T) {
+	for _, action := range []rpservice.TargetAccessAction{
+		rpservice.TargetAccessActionBlock,
+		rpservice.TargetAccessActionBypass,
+	} {
+		t.Run(string(action), func(t *testing.T) {
+			ctx := context.Background()
+			mgr, testStore, _ := setupL4Test(t, nil)
+			svc := &rpservice.Service{
+				Name: "target access", Domain: "target.test.netbird.io", Mode: rpservice.ModeHTTP,
+				Enabled: true,
+				Targets: []*rpservice.Target{{
+					AccountID: testAccountID, TargetId: testPeerID,
+					TargetType: rpservice.TargetTypePeer, Protocol: "http", Port: 8080,
+					Enabled: true, AccessAction: action,
+				}},
+			}
+			created, err := mgr.CreateService(ctx, testAccountID, testUserID, svc)
+			require.NoError(t, err)
+			stored, err := testStore.GetServiceByID(ctx, store.LockingStrengthNone, testAccountID, created.ID)
+			require.NoError(t, err)
+			require.Len(t, stored.Targets, 1)
+			assert.Equal(t, action, stored.Targets[0].AccessAction,
+				"accepted target actions must survive persistence")
+		})
+	}
+}
+
+func TestUpdateServicePreservesOmittedTargetAccessAction(t *testing.T) {
+	ctx := context.Background()
+	mgr, testStore, _ := setupL4Test(t, nil)
+	existing := seedService(t, testStore, "protected", "http", "target.test.netbird.io", testCluster, 0)
+	existing.Targets[0].AccessAction = rpservice.TargetAccessActionBlock
+	require.NoError(t, testStore.UpdateService(ctx, existing))
+
+	updated := existing.Copy()
+	updated.Name = "renamed by an older client"
+	updated.Targets[0].AccessAction = rpservice.TargetAccessActionInherit
+	updated.Targets[0].AccessActionProvided = false
+	rootPath := "/"
+	updated.Targets[0].Path = &rootPath
+	_, err := mgr.UpdateService(ctx, testAccountID, testUserID, updated)
+	require.NoError(t, err)
+	stored, err := testStore.GetServiceByID(ctx, store.LockingStrengthNone, testAccountID, existing.ID)
+	require.NoError(t, err)
+	assert.Equal(t, updated.Name, stored.Name, "legacy updates must still apply unrelated edits")
+	assert.Equal(t, rpservice.TargetAccessActionBlock, stored.Targets[0].AccessAction,
+		"an omitted action must preserve the stored block across equivalent root locations")
+
+	emptyPath := ""
+	updated.Targets[0].Path = &emptyPath
+	updated.Targets[0].AccessAction = rpservice.TargetAccessActionInherit
+	_, err = mgr.UpdateService(ctx, testAccountID, testUserID, updated)
+	require.NoError(t, err)
+	stored, err = testStore.GetServiceByID(ctx, store.LockingStrengthNone, testAccountID, existing.ID)
+	require.NoError(t, err)
+	assert.Equal(t, rpservice.TargetAccessActionBlock, stored.Targets[0].AccessAction,
+		"an older client's empty root location must preserve the stored block")
+
+	updated.Targets[0].AccessAction = rpservice.TargetAccessActionInherit
+	updated.Targets[0].AccessActionProvided = true
+	_, err = mgr.UpdateService(ctx, testAccountID, testUserID, updated)
+	require.NoError(t, err)
+	stored, err = testStore.GetServiceByID(ctx, store.LockingStrengthNone, testAccountID, existing.ID)
+	require.NoError(t, err)
+	assert.Equal(t, rpservice.TargetAccessActionInherit, stored.Targets[0].AccessAction,
+		"explicit inherit must clear the stored target block")
+}
+
+func TestUpdateServiceActivatesPreservedTargetAccess(t *testing.T) {
+	ctx := context.Background()
+	mgr, testStore, _ := setupL4Test(t, nil)
+	existing := seedService(t, testStore, "protected", "http", "target.test.netbird.io", testCluster, 0)
+	existing.Enabled = false
+	existing.Targets[0].AccessAction = rpservice.TargetAccessActionBlock
+	require.NoError(t, testStore.UpdateService(ctx, existing))
+
+	updated := existing.Copy()
+	updated.Enabled = true
+	updated.Targets[0].AccessAction = rpservice.TargetAccessActionInherit
+	updated.Targets[0].AccessActionProvided = false
+	_, err := mgr.UpdateService(ctx, testAccountID, testUserID, updated)
+	require.NoError(t, err)
+	stored, err := testStore.GetServiceByID(ctx, store.LockingStrengthNone, testAccountID, existing.ID)
+	require.NoError(t, err)
+	assert.True(t, stored.Enabled, "activating target access must not require an active proxy")
+	assert.Equal(t, rpservice.TargetAccessActionBlock, stored.Targets[0].AccessAction,
+		"activation must retain an omitted stored access action")
+}
+
+func TestUpdateServiceValidatesPreservedTargetAccess(t *testing.T) {
+	ctx := context.Background()
+	mgr, testStore, _ := setupL4Test(t, nil)
+	existing := seedService(t, testStore, "public", "http", "target.test.netbird.io", testCluster, 0)
+	existing.Targets[0].AccessAction = rpservice.TargetAccessActionBypass
+	require.NoError(t, testStore.UpdateService(ctx, existing))
+
+	updated := existing.Copy()
+	updated.Private = true
+	updated.AccessGroups = []string{testGroupID}
+	updated.Targets[0].AccessAction = rpservice.TargetAccessActionInherit
+	updated.Targets[0].AccessActionProvided = false
+	_, err := mgr.UpdateService(ctx, testAccountID, testUserID, updated)
+	require.ErrorContains(t, err, "bypass access_action is not supported for private services")
+
+	stored, err := testStore.GetServiceByID(ctx, store.LockingStrengthNone, testAccountID, existing.ID)
+	require.NoError(t, err)
+	assert.False(t, stored.Private, "an invalid preserved bypass must prevent the private-service update")
+	assert.Equal(t, rpservice.TargetAccessActionBypass, stored.Targets[0].AccessAction,
+		"a rejected update must retain the existing target action")
+}
+
+func TestUpdateServiceLegacyClientCannotRemoveControlledPath(t *testing.T) {
+	for _, operation := range []string{"rename", "delete"} {
+		t.Run(operation, func(t *testing.T) {
+			ctx := context.Background()
+			mgr, testStore, _ := setupL4Test(t, nil)
+			existing := seedService(t, testStore, "protected", "http", "target.test.netbird.io", testCluster, 0)
+			blockedPath := "/blocked"
+			existing.Targets = append(existing.Targets, &rpservice.Target{
+				AccountID: testAccountID, TargetId: testPeerID, TargetType: rpservice.TargetTypePeer,
+				Protocol: "http", Port: 8080, Enabled: true, Path: &blockedPath,
+				AccessAction: rpservice.TargetAccessActionBlock,
+			})
+			require.NoError(t, testStore.UpdateService(ctx, existing))
+
+			updated := existing.Copy()
+			updated.Targets[1].AccessAction = rpservice.TargetAccessActionInherit
+			if operation == "rename" {
+				renamedPath := "/renamed"
+				updated.Targets[1].Path = &renamedPath
+			} else {
+				updated.Targets = updated.Targets[:1]
+			}
+			_, err := mgr.UpdateService(ctx, testAccountID, testUserID, updated)
+			require.Error(t, err)
+			stored, err := testStore.GetServiceByID(ctx, store.LockingStrengthNone, testAccountID, existing.ID)
+			require.NoError(t, err)
+			require.Len(t, stored.Targets, 2, "a legacy structural edit must retain the controlled target")
+			var blocked *rpservice.Target
+			for _, target := range stored.Targets {
+				if effectiveTargetPath(target) == blockedPath {
+					blocked = target
+				}
+			}
+			require.NotNil(t, blocked, "the original controlled location must still exist")
+			assert.Equal(t, rpservice.TargetAccessActionBlock, blocked.AccessAction,
+				"a rejected legacy edit must not erase the block action")
+
+			updated.Targets[0].AccessAction = rpservice.TargetAccessActionInherit
+			updated.Targets[0].AccessActionProvided = true
+			_, err = mgr.UpdateService(ctx, testAccountID, testUserID, updated)
+			require.NoError(t, err)
+			stored, err = testStore.GetServiceByID(ctx, store.LockingStrengthNone, testAccountID, existing.ID)
+			require.NoError(t, err)
+			assert.False(t, stored.HasTargetAccessControl(),
+				"a feature-aware client must be able to intentionally remove or rename the controlled path")
+		})
+	}
+}
+
+func TestPreserveTargetAccessActionsExplicitUpdate(t *testing.T) {
+	existing := &rpservice.Service{Targets: []*rpservice.Target{
+		{Enabled: true, AccessAction: rpservice.TargetAccessActionBlock},
+		{Enabled: false, AccessAction: rpservice.TargetAccessActionInherit},
+	}}
+	updated := &rpservice.Service{Targets: []*rpservice.Target{
+		{Enabled: true, AccessAction: rpservice.TargetAccessActionBypass, AccessActionProvided: true},
+		{Enabled: false, AccessAction: rpservice.TargetAccessActionInherit, AccessActionProvided: true},
+	}}
+	require.NoError(t, preserveTargetAccessActions(updated, existing))
+	assert.Equal(t, rpservice.TargetAccessActionBypass, updated.Targets[0].AccessAction,
+		"explicit actions must not need an ambiguous location-based legacy merge")
+
+	updated.Targets[0].AccessActionProvided = false
+	assert.Error(t, preserveTargetAccessActions(updated, existing),
+		"an omitted action must be rejected when its stored location is ambiguous")
+
+	existing.Targets = existing.Targets[:1]
+	updated.Targets = nil
+	assert.Error(t, preserveTargetAccessActions(updated, existing),
+		"an empty target list must not count as an explicit removal of the stored block")
+}
diff --git a/management/internals/modules/reverseproxy/service/service.go b/management/internals/modules/reverseproxy/service/service.go
index ef92fbbf4..de47f1239 100644
--- a/management/internals/modules/reverseproxy/service/service.go
+++ b/management/internals/modules/reverseproxy/service/service.go
@@ -116,18 +116,20 @@ type MiddlewareConfig struct {
 }
 
 type Target struct {
-	ID            uint          `gorm:"primaryKey" json:"-"`
-	AccountID     string        `gorm:"index:idx_target_account;not null" json:"-"`
-	ServiceID     string        `gorm:"index:idx_service_targets;not null" json:"-"`
-	Path          *string       `json:"path,omitempty"`
-	Host          string        `json:"host"`
-	Port          uint16        `gorm:"index:idx_target_port" json:"port"`
-	Protocol      string        `gorm:"index:idx_target_protocol" json:"protocol"`
-	TargetId      string        `gorm:"index:idx_target_id" json:"target_id"`
-	TargetType    TargetType    `gorm:"index:idx_target_type" json:"target_type"`
-	Enabled       bool          `gorm:"index:idx_target_enabled" json:"enabled"`
-	Options       TargetOptions `gorm:"embedded" json:"options"`
-	ProxyProtocol bool          `json:"proxy_protocol"`
+	ID                   uint               `gorm:"primaryKey" json:"-"`
+	AccountID            string             `gorm:"index:idx_target_account;not null" json:"-"`
+	ServiceID            string             `gorm:"index:idx_service_targets;not null" json:"-"`
+	Path                 *string            `json:"path,omitempty"`
+	Host                 string             `json:"host"`
+	Port                 uint16             `gorm:"index:idx_target_port" json:"port"`
+	Protocol             string             `gorm:"index:idx_target_protocol" json:"protocol"`
+	TargetId             string             `gorm:"index:idx_target_id" json:"target_id"`
+	TargetType           TargetType         `gorm:"index:idx_target_type" json:"target_type"`
+	Enabled              bool               `gorm:"index:idx_target_enabled" json:"enabled"`
+	AccessAction         TargetAccessAction `gorm:"type:varchar(16);not null;default:'inherit'" json:"access_action"`
+	AccessActionProvided bool               `gorm:"-" json:"-"`
+	Options              TargetOptions      `gorm:"embedded" json:"options"`
+	ProxyProtocol        bool               `json:"proxy_protocol"`
 }
 
 type PasswordAuthConfig struct {
@@ -309,14 +311,16 @@ func (s *Service) ToAPIResponse() *api.Service {
 	// Convert internal targets to API targets
 	apiTargets := make([]api.ServiceTarget, 0, len(s.Targets))
 	for _, target := range s.Targets {
+		accessAction := api.ServiceTargetAccessAction(target.effectiveAccessAction())
 		st := api.ServiceTarget{
-			Path:       target.Path,
-			Host:       &target.Host,
-			Port:       int(target.Port),
-			Protocol:   api.ServiceTargetProtocol(target.Protocol),
-			TargetId:   target.TargetId,
-			TargetType: api.ServiceTargetTargetType(target.TargetType),
-			Enabled:    target.Enabled && !s.Terminated,
+			Path:         target.Path,
+			Host:         &target.Host,
+			Port:         int(target.Port),
+			Protocol:     api.ServiceTargetProtocol(target.Protocol),
+			TargetId:     target.TargetId,
+			TargetType:   api.ServiceTargetTargetType(target.TargetType),
+			Enabled:      target.Enabled && !s.Terminated,
+			AccessAction: &accessAction,
 		}
 		opts := targetOptionsToAPI(target.Options)
 		if opts == nil {
@@ -463,8 +467,9 @@ func (s *Service) buildPathMappings() []*proto.PathMapping {
 		}
 
 		pm := &proto.PathMapping{
-			Path:   path,
-			Target: targetURL.String(),
+			Path:         path,
+			Target:       targetURL.String(),
+			AccessAction: targetAccessActionToProto(target.effectiveAccessAction()),
 		}
 		pm.Options = targetOptionsToProto(target.Options)
 		pathMappings = append(pathMappings, pm)
@@ -727,13 +732,18 @@ func targetsFromAPI(accountID string, apiTargetsPtr *[]api.ServiceTarget) ([]*Ta
 	targets := make([]*Target, 0, len(apiTargets))
 	for i, apiTarget := range apiTargets {
 		target := &Target{
-			AccountID:  accountID,
-			Path:       apiTarget.Path,
-			Port:       uint16(apiTarget.Port), //nolint:gosec // validated by API layer
-			Protocol:   string(apiTarget.Protocol),
-			TargetId:   apiTarget.TargetId,
-			TargetType: TargetType(apiTarget.TargetType),
-			Enabled:    apiTarget.Enabled,
+			AccountID:    accountID,
+			Path:         apiTarget.Path,
+			Port:         uint16(apiTarget.Port), //nolint:gosec // validated by API layer
+			Protocol:     string(apiTarget.Protocol),
+			TargetId:     apiTarget.TargetId,
+			TargetType:   TargetType(apiTarget.TargetType),
+			Enabled:      apiTarget.Enabled,
+			AccessAction: TargetAccessActionInherit,
+		}
+		if apiTarget.AccessAction != nil {
+			target.AccessAction = TargetAccessAction(*apiTarget.AccessAction)
+			target.AccessActionProvided = true
 		}
 		if apiTarget.Host != nil {
 			target.Host = *apiTarget.Host
@@ -953,41 +963,70 @@ func (s *Service) validateTLSMode() error {
 }
 
 func (s *Service) validateHTTPTargets() error {
+	strictPaths := false
 	for i, target := range s.Targets {
-		switch target.TargetType {
-		case TargetTypePeer, TargetTypeHost, TargetTypeDomain:
-			// Host is normally overwritten by replaceHostByLookup with the
-			// resolved peer IP / resource address; operator-supplied values
-			// are honored only when DirectUpstream is set. Validate the
-			// override here so misconfigured hosts fail fast at API time.
-			if err := validateDirectUpstreamHost(i, target); err != nil {
-				return err
-			}
-		case TargetTypeSubnet:
-			if err := validateSubnetTarget(i, target); err != nil {
-				return err
-			}
-		case TargetTypeCluster:
-			if err := validateClusterTarget(i, target); err != nil {
-				return err
-			}
-		default:
-			return fmt.Errorf("target %d has invalid target_type %q", i, target.TargetType)
-		}
-		if target.TargetId == "" {
-			return fmt.Errorf("target %d has empty target_id", i)
-		}
-		if target.ProxyProtocol {
-			return fmt.Errorf("target %d: proxy_protocol is not supported for HTTP services", i)
-		}
-		if err := validateTargetOptions(i, &target.Options); err != nil {
+		if err := s.validateHTTPTarget(i, target); err != nil {
 			return err
 		}
+		if target.Enabled && target.effectiveAccessAction() != TargetAccessActionInherit {
+			strictPaths = true
+		}
+	}
+	if !strictPaths {
+		return nil
+	}
+
+	paths := make(map[string]int, len(s.Targets))
+	for i, target := range s.Targets {
+		if !target.Enabled {
+			continue
+		}
+		normalizedPath := normalizedTargetPath(target.Path)
+		if previous, ok := paths[normalizedPath]; ok {
+			return fmt.Errorf("targets %d and %d have duplicate path %q", previous, i, normalizedPath)
+		}
+		paths[normalizedPath] = i
 	}
 
 	return nil
 }
 
+func (s *Service) validateHTTPTarget(idx int, target *Target) error {
+	if target == nil {
+		return fmt.Errorf("target %d is nil", idx)
+	}
+	if err := validateTargetAccessAction(idx, target, s.Private); err != nil {
+		return err
+	}
+	switch target.TargetType {
+	case TargetTypePeer, TargetTypeHost, TargetTypeDomain:
+		// Host is normally overwritten by replaceHostByLookup with the
+		// resolved peer IP / resource address; operator-supplied values
+		// are honored only when DirectUpstream is set. Validate the
+		// override here so misconfigured hosts fail fast at API time.
+		if err := validateDirectUpstreamHost(idx, target); err != nil {
+			return err
+		}
+	case TargetTypeSubnet:
+		if err := validateSubnetTarget(idx, target); err != nil {
+			return err
+		}
+	case TargetTypeCluster:
+		if err := validateClusterTarget(idx, target); err != nil {
+			return err
+		}
+	default:
+		return fmt.Errorf("target %d has invalid target_type %q", idx, target.TargetType)
+	}
+	if target.TargetId == "" {
+		return fmt.Errorf("target %d has empty target_id", idx)
+	}
+	if target.ProxyProtocol {
+		return fmt.Errorf("target %d: proxy_protocol is not supported for HTTP services", idx)
+	}
+	return validateTargetOptions(idx, &target.Options)
+}
+
 func validateSubnetTarget(idx int, target *Target) error {
 	host := strings.TrimSpace(target.Host)
 	if host == "" {
@@ -1063,10 +1102,20 @@ func validateDirectUpstreamHost(idx int, target *Target) error {
 }
 
 func (s *Service) validateL4Target(target *Target) error {
+	if target == nil {
+		return errors.New("target 0 is nil")
+	}
 	// L4 services have a single target; per-target disable is meaningless
 	// (use the service-level Enabled flag instead). Force it on so that
 	// buildPathMappings always includes the target in the proto.
 	target.Enabled = true
+	action, err := validatedTargetAccessAction(0, target)
+	if err != nil {
+		return err
+	}
+	if action != TargetAccessActionInherit {
+		return errors.New("access_action is only supported for HTTP services")
+	}
 
 	if target.TargetId == "" {
 		return errors.New("target_id is required for L4 services")
diff --git a/management/internals/modules/reverseproxy/service/service_test.go b/management/internals/modules/reverseproxy/service/service_test.go
index 84343bcdd..756a5a915 100644
--- a/management/internals/modules/reverseproxy/service/service_test.go
+++ b/management/internals/modules/reverseproxy/service/service_test.go
@@ -62,9 +62,11 @@ func TestValidate_InvalidTargetType(t *testing.T) {
 
 func TestValidate_ResourceTarget(t *testing.T) {
 	rp := validProxy()
+	resourcePath := "/resource"
 	rp.Targets = append(rp.Targets, &Target{
 		TargetId:   "resource-1",
 		TargetType: TargetTypeHost,
+		Path:       &resourcePath,
 		Host:       "example.org",
 		Port:       443,
 		Protocol:   "https",
@@ -73,6 +75,232 @@ func TestValidate_ResourceTarget(t *testing.T) {
 	require.NoError(t, rp.Validate())
 }
 
+func TestValidateTargetAccessAction(t *testing.T) {
+	t.Run("valid actions", func(t *testing.T) {
+		for _, action := range []TargetAccessAction{
+			TargetAccessActionInherit,
+			TargetAccessActionBypass,
+			TargetAccessActionBlock,
+		} {
+			rp := validProxy()
+			rp.Targets[0].AccessAction = action
+			require.NoError(t, rp.Validate(), "action %q should be valid", action)
+		}
+	})
+
+	t.Run("unknown action", func(t *testing.T) {
+		rp := validProxy()
+		rp.Targets[0].AccessAction = "allow"
+		assert.ErrorContains(t, rp.Validate(), `unknown access_action "allow"`)
+	})
+
+	t.Run("explicit empty action", func(t *testing.T) {
+		rp := validProxy()
+		rp.Targets[0].AccessActionProvided = true
+		assert.ErrorContains(t, rp.Validate(), `unknown access_action ""`)
+	})
+
+	t.Run("private bypass", func(t *testing.T) {
+		rp := validProxy()
+		rp.Private = true
+		rp.AccessGroups = []string{"group-1"}
+		rp.Targets[0].AccessAction = TargetAccessActionBypass
+		assert.ErrorContains(t, rp.Validate(), "not supported for private services")
+	})
+
+	t.Run("Agent Network bypass", func(t *testing.T) {
+		rp := validProxy()
+		rp.Targets[0].AccessAction = TargetAccessActionBypass
+		rp.Targets[0].Options.AgentNetwork = true
+		assert.ErrorContains(t, rp.Validate(), "not supported for Agent Network targets")
+	})
+
+	t.Run("block remains available to private services", func(t *testing.T) {
+		rp := validProxy()
+		rp.Private = true
+		rp.AccessGroups = []string{"group-1"}
+		rp.Targets[0].AccessAction = TargetAccessActionBlock
+		require.NoError(t, rp.Validate())
+	})
+
+	t.Run("non HTTP service", func(t *testing.T) {
+		rp := validProxy()
+		rp.Mode = ModeTCP
+		rp.ListenPort = 8080
+		rp.Targets[0].Protocol = TargetProtoTCP
+		rp.Targets[0].AccessAction = TargetAccessActionBlock
+		assert.ErrorContains(t, rp.Validate(), "only supported for HTTP services")
+	})
+
+	t.Run("nil non HTTP target", func(t *testing.T) {
+		rp := validProxy()
+		rp.Mode = ModeTCP
+		rp.ListenPort = 8080
+		rp.Targets[0] = nil
+		assert.ErrorContains(t, rp.Validate(), "target 0 is nil")
+	})
+}
+
+func TestValidateTargetAccessActionPath(t *testing.T) {
+	for _, value := range []string{"api", "/api/../admin", "/api/./admin", "/api//admin", "/api%2Fadmin", `/api\admin`, "/api?x=1", "/api#fragment", "/api;admin", "/api/\x00"} {
+		t.Run(fmt.Sprintf("path_%q", value), func(t *testing.T) {
+			rp := validProxy()
+			rp.Targets[0].Path = &value
+			rp.Targets[0].AccessAction = TargetAccessActionBypass
+			assert.ErrorContains(t, rp.Validate(), "access_action path")
+		})
+	}
+
+	t.Run("nil path is canonical root", func(t *testing.T) {
+		rp := validProxy()
+		rp.Targets[0].AccessAction = TargetAccessActionBlock
+		require.NoError(t, rp.Validate())
+	})
+
+	t.Run("empty path is legacy root", func(t *testing.T) {
+		value := ""
+		rp := validProxy()
+		rp.Targets[0].Path = &value
+		rp.Targets[0].AccessAction = TargetAccessActionBlock
+		require.NoError(t, rp.Validate())
+	})
+
+	t.Run("trailing slash is a distinct valid prefix", func(t *testing.T) {
+		value := "/api/"
+		rp := validProxy()
+		rp.Targets[0].Path = &value
+		rp.Targets[0].AccessAction = TargetAccessActionBypass
+		require.NoError(t, rp.Validate())
+	})
+}
+
+func TestValidateDuplicateEnabledTargetPaths(t *testing.T) {
+	emptyPath := ""
+	rootPath := "/"
+	rootAliases := []struct {
+		name string
+		path *string
+	}{
+		{name: "nil", path: nil},
+		{name: "empty", path: &emptyPath},
+		{name: "slash", path: &rootPath},
+	}
+
+	for _, alias := range rootAliases {
+		t.Run("legacy all-inherit "+alias.name, func(t *testing.T) {
+			rp := validProxy()
+			rp.Targets = append(rp.Targets, &Target{
+				TargetId:   "peer-2",
+				TargetType: TargetTypePeer,
+				Path:       alias.path,
+				Host:       "10.0.0.2",
+				Port:       443,
+				Protocol:   TargetProtoHTTPS,
+				Enabled:    true,
+			})
+			require.NoError(t, rp.Validate(), "legacy all-inherit path and protocol twins must remain valid")
+		})
+
+		t.Run("access-controlled "+alias.name, func(t *testing.T) {
+			rp := validProxy()
+			rp.Targets = append(rp.Targets, &Target{
+				TargetId:     "peer-2",
+				TargetType:   TargetTypePeer,
+				Path:         alias.path,
+				Host:         "10.0.0.2",
+				Port:         80,
+				Protocol:     TargetProtoHTTP,
+				Enabled:      true,
+				AccessAction: TargetAccessActionBlock,
+			})
+			assert.ErrorContains(t, rp.Validate(), `duplicate path "/"`)
+		})
+	}
+
+	t.Run("access action elsewhere enables strict paths", func(t *testing.T) {
+		publicPath := "/public"
+		rp := validProxy()
+		rp.Targets = append(rp.Targets,
+			&Target{
+				TargetId:   "peer-2",
+				TargetType: TargetTypePeer,
+				Host:       "10.0.0.2",
+				Port:       80,
+				Protocol:   TargetProtoHTTP,
+				Enabled:    true,
+			},
+			&Target{
+				TargetId:     "peer-3",
+				TargetType:   TargetTypePeer,
+				Path:         &publicPath,
+				Host:         "10.0.0.3",
+				Port:         80,
+				Protocol:     TargetProtoHTTP,
+				Enabled:      true,
+				AccessAction: TargetAccessActionBypass,
+			},
+		)
+		assert.ErrorContains(t, rp.Validate(), `duplicate path "/"`)
+	})
+
+	t.Run("disabled action preserves legacy validation", func(t *testing.T) {
+		publicPath := "/public"
+		rp := validProxy()
+		rp.Targets = append(rp.Targets,
+			&Target{
+				TargetId:   "peer-2",
+				TargetType: TargetTypePeer,
+				Host:       "10.0.0.2",
+				Port:       80,
+				Protocol:   TargetProtoHTTP,
+				Enabled:    true,
+			},
+			&Target{
+				TargetId:     "peer-3",
+				TargetType:   TargetTypePeer,
+				Path:         &publicPath,
+				Host:         "10.0.0.3",
+				Port:         80,
+				Protocol:     TargetProtoHTTP,
+				Enabled:      false,
+				AccessAction: TargetAccessActionBlock,
+			},
+		)
+		require.NoError(t, rp.Validate())
+	})
+
+	t.Run("disabled target does not collide", func(t *testing.T) {
+		rp := validProxy()
+		rp.Targets = append(rp.Targets, &Target{
+			TargetId:   "peer-2",
+			TargetType: TargetTypePeer,
+			Host:       "10.0.0.2",
+			Port:       80,
+			Protocol:   TargetProtoHTTP,
+			Enabled:    false,
+		})
+		require.NoError(t, rp.Validate())
+	})
+
+	t.Run("trailing slash remains distinct", func(t *testing.T) {
+		apiPath := "/api"
+		apiSlashPath := "/api/"
+		rp := validProxy()
+		rp.Targets[0].Path = &apiPath
+		rp.Targets = append(rp.Targets, &Target{
+			TargetId:     "peer-2",
+			TargetType:   TargetTypePeer,
+			Path:         &apiSlashPath,
+			Host:         "10.0.0.2",
+			Port:         80,
+			Protocol:     TargetProtoHTTP,
+			Enabled:      true,
+			AccessAction: TargetAccessActionBlock,
+		})
+		require.NoError(t, rp.Validate())
+	})
+}
+
 func TestValidate_MultipleTargetsOneInvalid(t *testing.T) {
 	rp := validProxy()
 	rp.Targets = append(rp.Targets, &Target{
@@ -308,6 +536,90 @@ func TestToProtoMapping_TargetOptions(t *testing.T) {
 	assert.Equal(t, int64(30), opts.RequestTimeout.Seconds)
 }
 
+func TestTargetAccessActionConversions(t *testing.T) {
+	t.Run("API presence", func(t *testing.T) {
+		bypass := api.ServiceTargetAccessActionBypass
+		empty := api.ServiceTargetAccessAction("")
+		apiTargets := []api.ServiceTarget{
+			{
+				TargetId:   "peer-1",
+				TargetType: api.ServiceTargetTargetTypePeer,
+				Protocol:   api.ServiceTargetProtocolHttp,
+				Port:       80,
+				Enabled:    true,
+			},
+			{
+				TargetId:     "peer-2",
+				TargetType:   api.ServiceTargetTargetTypePeer,
+				Protocol:     api.ServiceTargetProtocolHttp,
+				Port:         80,
+				Enabled:      true,
+				AccessAction: &bypass,
+			},
+			{
+				TargetId:     "peer-3",
+				TargetType:   api.ServiceTargetTargetTypePeer,
+				Protocol:     api.ServiceTargetProtocolHttp,
+				Port:         80,
+				Enabled:      true,
+				AccessAction: &empty,
+			},
+		}
+
+		targets, err := targetsFromAPI("account-1", &apiTargets)
+		require.NoError(t, err)
+		require.Len(t, targets, 3)
+		assert.Equal(t, TargetAccessActionInherit, targets[0].AccessAction)
+		assert.False(t, targets[0].AccessActionProvided)
+		assert.Equal(t, TargetAccessActionBypass, targets[1].AccessAction)
+		assert.True(t, targets[1].AccessActionProvided)
+		assert.Empty(t, targets[2].AccessAction)
+		assert.True(t, targets[2].AccessActionProvided)
+
+		rp := &Service{Name: "test", Domain: "example.com", Targets: []*Target{targets[2]}}
+		assert.ErrorContains(t, rp.Validate(), `unknown access_action ""`)
+	})
+
+	t.Run("API response", func(t *testing.T) {
+		rp := validProxy()
+		rp.Targets[0].AccessAction = TargetAccessActionBlock
+		response := rp.ToAPIResponse()
+		require.Len(t, response.Targets, 1)
+		require.NotNil(t, response.Targets[0].AccessAction)
+		assert.Equal(t, api.ServiceTargetAccessActionBlock, *response.Targets[0].AccessAction)
+	})
+
+	t.Run("proto mapping", func(t *testing.T) {
+		root := "/"
+		bypassPath := "/bypass"
+		blockPath := "/block"
+		rp := &Service{
+			ID:        "svc-1",
+			AccountID: "acc-1",
+			Domain:    "example.com",
+			Targets: []*Target{
+				{Path: &root, Host: "10.0.0.1", Port: 80, Protocol: TargetProtoHTTP, Enabled: true},
+				{Path: &bypassPath, Host: "10.0.0.1", Port: 80, Protocol: TargetProtoHTTP, Enabled: true, AccessAction: TargetAccessActionBypass},
+				{Path: &blockPath, Host: "10.0.0.1", Port: 80, Protocol: TargetProtoHTTP, Enabled: true, AccessAction: TargetAccessActionBlock},
+			},
+		}
+
+		mapping := rp.ToProtoMapping(Create, "token", proxy.OIDCValidationConfig{})
+		require.Len(t, mapping.Path, 3)
+		assert.Equal(t, proto.TargetAccessAction_TARGET_ACCESS_ACTION_INHERIT, mapping.Path[0].GetAccessAction())
+		assert.Equal(t, proto.TargetAccessAction_TARGET_ACCESS_ACTION_BYPASS, mapping.Path[1].GetAccessAction())
+		assert.Equal(t, proto.TargetAccessAction_TARGET_ACCESS_ACTION_BLOCK, mapping.Path[2].GetAccessAction())
+	})
+}
+
+func TestHasTargetAccessControl(t *testing.T) {
+	rp := validProxy()
+	assert.False(t, rp.HasTargetAccessControl())
+
+	rp.Targets[0].AccessAction = TargetAccessActionBypass
+	assert.True(t, rp.HasTargetAccessControl())
+}
+
 // TestToProtoMapping_AllowedGroupIds covers the list the proxy gates session
 // cookies on: without it the proxy can only check a cookie's signature, which
 // makes a token minted for a user outside the groups a bearer credential.
diff --git a/management/internals/modules/reverseproxy/service/target_access.go b/management/internals/modules/reverseproxy/service/target_access.go
new file mode 100644
index 000000000..bd2d717fe
--- /dev/null
+++ b/management/internals/modules/reverseproxy/service/target_access.go
@@ -0,0 +1,115 @@
+package service
+
+import (
+	"fmt"
+	"strings"
+	"unicode"
+	"unicode/utf8"
+
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// TargetAccessAction controls authentication for a selected HTTP target.
+type TargetAccessAction string
+
+const (
+	TargetAccessActionInherit TargetAccessAction = "inherit"
+	TargetAccessActionBypass  TargetAccessAction = "bypass"
+	TargetAccessActionBlock   TargetAccessAction = "block"
+)
+
+func (t *Target) effectiveAccessAction() TargetAccessAction {
+	if t.AccessAction == "" {
+		return TargetAccessActionInherit
+	}
+	return t.AccessAction
+}
+
+func targetAccessActionToProto(action TargetAccessAction) proto.TargetAccessAction {
+	switch action {
+	case TargetAccessActionInherit:
+		return proto.TargetAccessAction_TARGET_ACCESS_ACTION_INHERIT
+	case TargetAccessActionBypass:
+		return proto.TargetAccessAction_TARGET_ACCESS_ACTION_BYPASS
+	case TargetAccessActionBlock:
+		return proto.TargetAccessAction_TARGET_ACCESS_ACTION_BLOCK
+	default:
+		return proto.TargetAccessAction_TARGET_ACCESS_ACTION_BLOCK
+	}
+}
+
+// HasTargetAccessControl reports whether any target overrides service authentication.
+func (s *Service) HasTargetAccessControl() bool {
+	for _, target := range s.Targets {
+		if target != nil && target.effectiveAccessAction() != TargetAccessActionInherit {
+			return true
+		}
+	}
+	return false
+}
+
+func validateTargetAccessAction(idx int, target *Target, private bool) error {
+	action, err := validatedTargetAccessAction(idx, target)
+	if err != nil {
+		return err
+	}
+	if action == TargetAccessActionBypass {
+		if private {
+			return fmt.Errorf("target %d: bypass access_action is not supported for private services", idx)
+		}
+		if target.Options.AgentNetwork {
+			return fmt.Errorf("target %d: bypass access_action is not supported for Agent Network targets", idx)
+		}
+	}
+
+	if action == TargetAccessActionInherit {
+		return nil
+	}
+	return validateAccessActionPath(idx, target.Path)
+}
+
+func validatedTargetAccessAction(idx int, target *Target) (TargetAccessAction, error) {
+	if target.AccessActionProvided && target.AccessAction == "" {
+		return "", fmt.Errorf("target %d: unknown access_action %q", idx, target.AccessAction)
+	}
+	action := target.effectiveAccessAction()
+	switch action {
+	case TargetAccessActionInherit, TargetAccessActionBypass, TargetAccessActionBlock:
+		return action, nil
+	default:
+		return "", fmt.Errorf("target %d: unknown access_action %q", idx, target.AccessAction)
+	}
+}
+
+func normalizedTargetPath(configured *string) string {
+	if configured == nil || *configured == "" {
+		return "/"
+	}
+	return *configured
+}
+
+func validateAccessActionPath(idx int, configured *string) error {
+	if configured == nil {
+		return nil
+	}
+	value := *configured
+	if value == "" {
+		return nil
+	}
+	if !strings.HasPrefix(value, "/") {
+		return fmt.Errorf("target %d: access_action path %q must start with /", idx, value)
+	}
+	if !utf8.ValidString(value) || strings.ContainsAny(value, "%\\?#;") || strings.IndexFunc(value, unicode.IsControl) >= 0 {
+		return fmt.Errorf("target %d: access_action path %q contains invalid characters", idx, value)
+	}
+	segments := strings.Split(strings.TrimPrefix(value, "/"), "/")
+	for i, segment := range segments {
+		if segment == "." || segment == ".." {
+			return fmt.Errorf("target %d: access_action path %q is not canonical", idx, value)
+		}
+		if segment == "" && value != "/" && i != len(segments)-1 {
+			return fmt.Errorf("target %d: access_action path %q is not canonical", idx, value)
+		}
+	}
+	return nil
+}
diff --git a/management/server/store/sql_store_service_target.go b/management/server/store/sql_store_service_target.go
index 5c2b99510..0f7429880 100644
--- a/management/server/store/sql_store_service_target.go
+++ b/management/server/store/sql_store_service_target.go
@@ -18,7 +18,7 @@ import (
 )
 
 const targetSelectColumns = `id, account_id, service_id, path, host, port, protocol,
-	target_id, target_type, enabled, proxy_protocol,
+	target_id, target_type, enabled, access_action, proxy_protocol,
 	skip_tls_verify, request_timeout, session_idle_timeout, path_rewrite, custom_headers,
 	direct_upstream, middlewares, capture_max_request_bytes, capture_max_response_bytes,
 	capture_content_types, agent_network, disable_access_log`
@@ -37,6 +37,7 @@ func (s *SqlStore) getServiceTargets(ctx context.Context, serviceIDs []string) (
 func scanTarget(row pgx.CollectableRow) (*rpservice.Target, error) {
 	var t rpservice.Target
 	var path sql.NullString
+	var accessAction sql.NullString
 	var pathRewrite sql.NullString
 	var proxyProtocol, skipTLSVerify, directUpstream, agentNetwork, disableAccessLog sql.NullBool
 	var requestTimeout, sessionIdleTimeout, captureMaxRequestBytes, captureMaxResponseBytes sql.NullInt64
@@ -52,6 +53,7 @@ func scanTarget(row pgx.CollectableRow) (*rpservice.Target, error) {
 		&t.TargetId,
 		&t.TargetType,
 		&t.Enabled,
+		&accessAction,
 		&proxyProtocol,
 		&skipTLSVerify,
 		&requestTimeout,
@@ -72,6 +74,11 @@ func scanTarget(row pgx.CollectableRow) (*rpservice.Target, error) {
 	if path.Valid {
 		t.Path = &path.String
 	}
+	if accessAction.Valid && accessAction.String != "" {
+		t.AccessAction = rpservice.TargetAccessAction(accessAction.String)
+	} else {
+		t.AccessAction = rpservice.TargetAccessActionInherit
+	}
 
 	t.ProxyProtocol = proxyProtocol.Bool
 	t.Options.SkipTLSVerify = skipTLSVerify.Bool
diff --git a/management/server/store/sql_store_service_test.go b/management/server/store/sql_store_service_test.go
index 0e14fbdab..f71b8c97a 100644
--- a/management/server/store/sql_store_service_test.go
+++ b/management/server/store/sql_store_service_test.go
@@ -87,6 +87,7 @@ func TestSqlStore_GetAccount_ServiceTargetOptionsRoundtrip(t *testing.T) {
 					Protocol:      "http",
 					TargetId:      "tgt-1",
 					Enabled:       true,
+					AccessAction:  rpservice.TargetAccessActionBlock,
 					ProxyProtocol: true,
 					Options: rpservice.TargetOptions{
 						SkipTLSVerify:           true,
@@ -119,6 +120,7 @@ func TestSqlStore_GetAccount_ServiceTargetOptionsRoundtrip(t *testing.T) {
 
 		require.Len(t, got.Targets, 1)
 		tg := got.Targets[0]
+		assert.Equal(t, rpservice.TargetAccessActionBlock, tg.AccessAction, "target access action")
 		assert.True(t, tg.ProxyProtocol, "target proxy protocol")
 		assert.True(t, tg.Options.SkipTLSVerify, "options skip TLS verify")
 		assert.Equal(t, 30*time.Second, tg.Options.RequestTimeout, "options request timeout")
diff --git a/proxy/target_access_control_integration_test.go b/proxy/target_access_control_integration_test.go
new file mode 100644
index 000000000..82fc6d67a
--- /dev/null
+++ b/proxy/target_access_control_integration_test.go
@@ -0,0 +1,270 @@
+package proxy
+
+import (
+	"context"
+	"crypto/ed25519"
+	"crypto/rand"
+	"encoding/base64"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
+	nbproxy "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/shared/hash/argon2id"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+func targetAccessService(t *testing.T, upstreamURL string) *service.Service {
+	t.Helper()
+
+	u, err := url.Parse(upstreamURL)
+	require.NoError(t, err)
+	host, portText, err := net.SplitHostPort(u.Host)
+	require.NoError(t, err)
+	port, err := strconv.ParseUint(portText, 10, 16)
+	require.NoError(t, err)
+
+	headerHash, err := argon2id.Hash(targetAccessSecret)
+	require.NoError(t, err)
+	publicKey, privateKey, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+
+	newTarget := func(path string, action service.TargetAccessAction) *service.Target {
+		return &service.Target{
+			Path:         strPtr(path),
+			Host:         host,
+			Port:         uint16(port),
+			Protocol:     u.Scheme,
+			TargetId:     "target-access-upstream",
+			TargetType:   service.TargetTypeCluster,
+			Enabled:      true,
+			AccessAction: action,
+			Options: service.TargetOptions{
+				DirectUpstream: true,
+			},
+		}
+	}
+
+	return &service.Service{
+		ID:                "target-access-service",
+		AccountID:         targetAccessAccountID,
+		Name:              "Target Access Control",
+		Domain:            targetAccessDomain,
+		ProxyCluster:      targetAccessCluster,
+		Enabled:           true,
+		SessionPrivateKey: base64.StdEncoding.EncodeToString(privateKey),
+		SessionPublicKey:  base64.StdEncoding.EncodeToString(publicKey),
+		Targets: []*service.Target{
+			newTarget("/", service.TargetAccessActionInherit),
+			newTarget("/public", service.TargetAccessActionBypass),
+			newTarget("/blocked", service.TargetAccessActionBlock),
+		},
+		Auth: service.AuthConfig{HeaderAuths: []*service.HeaderAuthConfig{{
+			Enabled: true,
+			Header:  targetAccessHeader,
+			Value:   headerHash,
+		}}},
+		Restrictions: service.AccessRestrictions{
+			BlockedCIDRs: []string{"203.0.113.0/24"},
+		},
+	}
+}
+
+func privateServiceCapabilities() *proto.ProxyCapabilities {
+	supported := true
+	return &proto.ProxyCapabilities{
+		SupportsPrivateService: &supported,
+	}
+}
+
+func targetAccessMappingStream(t *testing.T, setup *integrationTestSetup, proxyID string, caps *proto.ProxyCapabilities) proto.ProxyService_GetMappingUpdateClient {
+	t.Helper()
+
+	conn, err := grpc.NewClient(setup.grpcAddr, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = conn.Close() })
+
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	t.Cleanup(cancel)
+	stream, err := proto.NewProxyServiceClient(conn).GetMappingUpdate(ctx, &proto.GetMappingUpdateRequest{
+		ProxyId:      proxyID,
+		Version:      "target-access-test",
+		Address:      targetAccessCluster,
+		Capabilities: caps,
+	})
+	require.NoError(t, err)
+	return stream
+}
+
+func receiveTargetAccessSnapshot(t *testing.T, stream proto.ProxyService_GetMappingUpdateClient) map[string]*proto.ProxyMapping {
+	t.Helper()
+
+	mappings := make(map[string]*proto.ProxyMapping)
+	for {
+		msg, err := stream.Recv()
+		require.NoError(t, err)
+		for _, mapping := range msg.GetMapping() {
+			mappings[mapping.GetId()] = mapping
+		}
+		if msg.GetInitialSyncComplete() {
+			return mappings
+		}
+	}
+}
+
+func receiveTargetAccessUpdate(t *testing.T, stream proto.ProxyService_GetMappingUpdateClient, serviceID string) *proto.ProxyMapping {
+	t.Helper()
+
+	for {
+		msg, err := stream.Recv()
+		require.NoError(t, err)
+		for _, mapping := range msg.GetMapping() {
+			if mapping.GetId() == serviceID {
+				return mapping
+			}
+		}
+	}
+}
+
+func TestIntegration_TargetAccessControl_ManagementToUpstream(t *testing.T) {
+	setup := setupIntegrationTest(t)
+	t.Cleanup(setup.cleanup)
+
+	upstreamRecorder := &targetAccessUpstream{}
+	upstream := httptest.NewServer(upstreamRecorder)
+	t.Cleanup(upstream.Close)
+
+	svc := targetAccessService(t, upstream.URL)
+	require.NoError(t, setup.store.CreateService(t.Context(), svc))
+
+	stream := targetAccessMappingStream(t, setup, "target-access-proxy", nil)
+	snapshot := receiveTargetAccessSnapshot(t, stream)
+	mapping := snapshot[svc.ID]
+	require.NotNil(t, mapping, "proxy must receive the target-access service")
+
+	actions := make(map[string]proto.TargetAccessAction)
+	for _, pathMapping := range mapping.GetPath() {
+		actions[pathMapping.GetPath()] = pathMapping.GetAccessAction()
+	}
+	assert.Equal(t, proto.TargetAccessAction_TARGET_ACCESS_ACTION_INHERIT, actions["/"])
+	assert.Equal(t, proto.TargetAccessAction_TARGET_ACCESS_ACTION_BYPASS, actions["/public"])
+	assert.Equal(t, proto.TargetAccessAction_TARGET_ACCESS_ACTION_BLOCK, actions["/blocked"])
+
+	runtime, handler := newTargetAccessRuntime(t)
+	applyTargetAccessMapping(t, runtime, mapping)
+
+	before := len(upstreamRecorder.snapshot())
+	res := targetAccessRequestTo(handler, "/private", "198.51.100.10:12000", nil)
+	assert.Equal(t, http.StatusUnauthorized, res.Code, "inherit must retain service authentication")
+	assert.Len(t, upstreamRecorder.snapshot(), before, "unauthenticated inherited request must not reach upstream")
+
+	validHeader := http.Header{targetAccessHeader: []string{targetAccessSecret}}
+	res = targetAccessRequestTo(handler, "/private", "198.51.100.10:12000", validHeader)
+	assert.Equal(t, http.StatusOK, res.Code, "valid service authentication must pass an inherited target")
+	inheritedRequests := upstreamRecorder.snapshot()
+	require.Len(t, inheritedRequests, before+1)
+	assert.Empty(t, inheritedRequests[len(inheritedRequests)-1].headers.Get(targetAccessHeader),
+		"proxy authentication credential must not be forwarded upstream")
+
+	bypassHeaders := http.Header{
+		targetAccessHeader: []string{"spoofed-auth"},
+		"X-NetBird-User":   []string{"spoofed@example.com"},
+		"X-NetBird-Groups": []string{"administrators"},
+	}
+	res = targetAccessRequestTo(handler, "/public/ready", "198.51.100.10:12000", bypassHeaders)
+	assert.Equal(t, http.StatusOK, res.Code, "bypass target must reach upstream without authenticating")
+	bypassRequests := upstreamRecorder.snapshot()
+	require.Len(t, bypassRequests, before+2)
+	bypassed := bypassRequests[len(bypassRequests)-1]
+	assert.Equal(t, "/ready", bypassed.path, "routing must retain the existing literal-prefix rewrite")
+	assert.Empty(t, bypassed.headers.Get(targetAccessHeader), "configured auth header must be stripped on bypass")
+	assert.Empty(t, bypassed.headers.Get("X-NetBird-User"), "bypass must not permit spoofed identity")
+	assert.Empty(t, bypassed.headers.Get("X-NetBird-Groups"), "bypass must not permit spoofed groups")
+
+	before = len(bypassRequests)
+	res = targetAccessRequestTo(handler, "/blocked/secret", "198.51.100.10:12000", validHeader)
+	assert.Equal(t, http.StatusForbidden, res.Code, "block must win even when service authentication is valid")
+	assert.Len(t, upstreamRecorder.snapshot(), before, "blocked request must not reach upstream")
+
+	res = targetAccessRequestTo(handler, "/public/ready", "203.0.113.8:12000", nil)
+	assert.Equal(t, http.StatusForbidden, res.Code, "connection restrictions must run before bypass")
+	assert.Len(t, upstreamRecorder.snapshot(), before, "restricted bypass request must not reach upstream")
+
+	for _, target := range svc.Targets {
+		switch *target.Path {
+		case "/public":
+			target.AccessAction = service.TargetAccessActionBlock
+		case "/blocked":
+			target.AccessAction = service.TargetAccessActionBypass
+		}
+	}
+	require.NoError(t, setup.store.UpdateService(t.Context(), svc))
+	persisted, err := setup.store.GetServiceByID(t.Context(), store.LockingStrengthNone, targetAccessAccountID, svc.ID)
+	require.NoError(t, err)
+	update := persisted.ToProtoMapping(service.Update, "", nbproxy.OIDCValidationConfig{})
+	setup.proxyService.SendServiceUpdate(&proto.GetMappingUpdateResponse{Mapping: []*proto.ProxyMapping{update}})
+	receivedUpdate := receiveTargetAccessUpdate(t, stream, svc.ID)
+	applyTargetAccessMapping(t, runtime, receivedUpdate)
+
+	res = targetAccessRequestTo(handler, "/public/ready", "198.51.100.10:12000", validHeader)
+	assert.Equal(t, http.StatusForbidden, res.Code, "modified action must replace bypass with block")
+	assert.Len(t, upstreamRecorder.snapshot(), before, "newly blocked request must not reach upstream")
+
+	res = targetAccessRequestTo(handler, "/blocked/ready", "198.51.100.10:12000", nil)
+	assert.Equal(t, http.StatusOK, res.Code, "modified action must replace block with bypass")
+	assert.Len(t, upstreamRecorder.snapshot(), before+1, "newly bypassed request must reach upstream")
+
+	require.NoError(t, setup.store.DeleteService(t.Context(), targetAccessAccountID, svc.ID))
+	removed := persisted.ToProtoMapping(service.Delete, "", nbproxy.OIDCValidationConfig{})
+	setup.proxyService.SendServiceUpdate(&proto.GetMappingUpdateResponse{Mapping: []*proto.ProxyMapping{removed}})
+	receivedRemoval := receiveTargetAccessUpdate(t, stream, svc.ID)
+	runtime.removeMapping(t.Context(), receivedRemoval)
+
+	res = targetAccessRequestTo(handler, "/blocked/ready", "198.51.100.10:12000", nil)
+	assert.Equal(t, http.StatusNotFound, res.Code, "removed mapping must no longer route")
+	assert.Len(t, upstreamRecorder.snapshot(), before+1, "request after removal must not reach upstream")
+}
+
+func TestIntegration_TargetAccessControl_PrivateServiceRejectsBypass(t *testing.T) {
+	setup := setupIntegrationTest(t)
+	t.Cleanup(setup.cleanup)
+
+	upstreamRecorder := &targetAccessUpstream{}
+	upstream := httptest.NewServer(upstreamRecorder)
+	t.Cleanup(upstream.Close)
+
+	svc := targetAccessService(t, upstream.URL)
+	svc.ID = "target-access-private"
+	svc.Domain = "target-access-private.test.proxy.io"
+	svc.Private = true
+	svc.Targets = svc.Targets[1:2]
+	require.NoError(t, setup.store.CreateService(t.Context(), svc))
+
+	stream := targetAccessMappingStream(t, setup, "target-access-private", privateServiceCapabilities())
+	mapping := receiveTargetAccessSnapshot(t, stream)[svc.ID]
+	require.NotNil(t, mapping, "proxy supporting private services must receive private target-access mapping")
+
+	runtime, handler := newTargetAccessRuntime(t)
+	err := runtime.updateMapping(t.Context(), mapping)
+	require.Error(t, err, "private service with a bypass target must be rejected")
+
+	req := httptest.NewRequest(http.MethodGet, "http://"+svc.Domain+"/public/ready", nil)
+	req.Host = svc.Domain
+	req.RemoteAddr = "100.64.0.20:12000"
+	recorder := httptest.NewRecorder()
+	handler.ServeHTTP(recorder, req)
+
+	assert.Equal(t, http.StatusNotFound, recorder.Code, "rejected private mapping must not be published")
+	assert.Empty(t, upstreamRecorder.snapshot(), "rejected private mapping must not reach upstream")
+}
diff --git a/shared/management/http/api/openapi.yml b/shared/management/http/api/openapi.yml
index 7060aee4e..68de0d1f5 100644
--- a/shared/management/http/api/openapi.yml
+++ b/shared/management/http/api/openapi.yml
@@ -3104,6 +3104,12 @@ components:
           type: string
           description: URL path prefix for this target (HTTP only)
           example: "/"
+        access_action:
+          type: string
+          description: Access action applied after this target's HTTP path prefix is selected. "inherit" uses the service authentication configuration, "bypass" skips service authentication, and "block" denies access. HTTP services only.
+          enum: [inherit, bypass, block]
+          default: inherit
+          example: "inherit"
         protocol:
           type: string
           description: Protocol to use when connecting to the backend
diff --git a/shared/management/http/api/types.gen.go b/shared/management/http/api/types.gen.go
index dea9f4a14..a1f4bc530 100644
--- a/shared/management/http/api/types.gen.go
+++ b/shared/management/http/api/types.gen.go
@@ -1037,6 +1037,27 @@ func (e ServiceRequestMode) Valid() bool {
 	}
 }
 
+// Defines values for ServiceTargetAccessAction.
+const (
+	ServiceTargetAccessActionBlock   ServiceTargetAccessAction = "block"
+	ServiceTargetAccessActionBypass  ServiceTargetAccessAction = "bypass"
+	ServiceTargetAccessActionInherit ServiceTargetAccessAction = "inherit"
+)
+
+// Valid indicates whether the value is a known member of the ServiceTargetAccessAction enum.
+func (e ServiceTargetAccessAction) Valid() bool {
+	switch e {
+	case ServiceTargetAccessActionBlock:
+		return true
+	case ServiceTargetAccessActionBypass:
+		return true
+	case ServiceTargetAccessActionInherit:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ServiceTargetProtocol.
 const (
 	ServiceTargetProtocolHttp  ServiceTargetProtocol = "http"
@@ -5113,6 +5134,9 @@ type ServiceRequestMode string
 
 // ServiceTarget defines model for ServiceTarget.
 type ServiceTarget struct {
+	// AccessAction Access action applied after this target's HTTP path prefix is selected. "inherit" uses the service authentication configuration, "bypass" skips service authentication, and "block" denies access. HTTP services only.
+	AccessAction *ServiceTargetAccessAction `json:"access_action,omitempty"`
+
 	// Enabled Whether this target is enabled
 	Enabled bool `json:"enabled"`
 
@@ -5136,6 +5160,9 @@ type ServiceTarget struct {
 	TargetType ServiceTargetTargetType `json:"target_type"`
 }
 
+// ServiceTargetAccessAction Access action applied after this target's HTTP path prefix is selected. "inherit" uses the service authentication configuration, "bypass" skips service authentication, and "block" denies access. HTTP services only.
+type ServiceTargetAccessAction string
+
 // ServiceTargetProtocol Protocol to use when connecting to the backend
 type ServiceTargetProtocol string
 

From 7006113897f3a5b496c494bb764c4d3c9e1d9fb8 Mon Sep 17 00:00:00 2001
From: Pascal Fischer <32096965+pascal-fischer@users.noreply.github.com>
Date: Mon, 12 Oct 2026 13:14:19 +0200
Subject: [PATCH 42/70] [management] update reserved IP exclusion when
 generating peer IP (#8144)

---
 management/server/account.go                  |  8 ++
 management/server/account_test.go             | 21 +++++
 .../handlers/accounts/accounts_handler.go     |  2 +-
 .../accounts/accounts_handler_test.go         |  8 +-
 management/server/types/network.go            | 53 ++++++++----
 management/server/types/network_test.go       | 86 ++++++++++++++++---
 6 files changed, 144 insertions(+), 34 deletions(-)

diff --git a/management/server/account.go b/management/server/account.go
index 6de1642e5..946b9ad1c 100644
--- a/management/server/account.go
+++ b/management/server/account.go
@@ -2683,6 +2683,14 @@ func (am *DefaultAccountManager) validateIPForUpdate(account *types.Account, pee
 		return status.Errorf(status.InvalidArgument, "IP %s is not within the account network range %s", newIP.String(), account.Network.Net.String())
 	}
 
+	prefix, err := netip.ParsePrefix(account.Network.Net.String())
+	if err != nil {
+		return fmt.Errorf("parse account network %s: %w", account.Network.Net.String(), err)
+	}
+	if types.IsReservedPeerIP(prefix, newIP) {
+		return status.Errorf(status.InvalidArgument, "IP %s is reserved in the account network range %s", newIP.String(), account.Network.Net.String())
+	}
+
 	for _, peer := range peers {
 		if peer.ID != peerID && peer.IP == newIP {
 			return status.Errorf(status.InvalidArgument, "IP %s is already assigned to peer %s", newIP.String(), peer.ID)
diff --git a/management/server/account_test.go b/management/server/account_test.go
index d3ad2dfc9..7aa88ee64 100644
--- a/management/server/account_test.go
+++ b/management/server/account_test.go
@@ -4454,6 +4454,27 @@ func TestDefaultAccountManager_UpdatePeerIP(t *testing.T) {
 		assert.Contains(t, err.Error(), "not within the account network range", "error should mention network range")
 	})
 
+	t.Run("update peer IP to reserved address should fail", func(t *testing.T) {
+		account, err := manager.Store.GetAccount(context.Background(), accountID)
+		require.NoError(t, err, "unable to get account")
+
+		network := account.Network.Net
+		broadcast := make(net.IP, len(network.IP.To4()))
+		for i := range broadcast {
+			broadcast[i] = network.IP.To4()[i] | ^network.Mask[i]
+		}
+		broadcastIP, ok := netip.AddrFromSlice(broadcast)
+		require.True(t, ok, "unable to parse broadcast IP")
+		networkIP, ok := netip.AddrFromSlice(network.IP.To4())
+		require.True(t, ok, "unable to parse network IP")
+
+		for _, reserved := range []netip.Addr{networkIP, broadcastIP.Prev(), broadcastIP} {
+			err = manager.UpdatePeerIP(context.Background(), accountID, userID, peer1.ID, reserved)
+			require.Error(t, err, "should fail for reserved IP %s", reserved)
+			assert.Contains(t, err.Error(), "is reserved", "error should mention reserved IP")
+		}
+	})
+
 	t.Run("update peer IP with invalid peer ID should fail", func(t *testing.T) {
 		newAddr := netip.MustParseAddr("100.64.0.101")
 		err := manager.UpdatePeerIP(context.Background(), accountID, userID, "invalid-peer-id", newAddr)
diff --git a/management/server/http/handlers/accounts/accounts_handler.go b/management/server/http/handlers/accounts/accounts_handler.go
index 795214c31..e5d75007f 100644
--- a/management/server/http/handlers/accounts/accounts_handler.go
+++ b/management/server/http/handlers/accounts/accounts_handler.go
@@ -152,7 +152,7 @@ func calculateMaxHosts(prefix netip.Prefix) int64 {
 
 	maxHosts := int64(1) << hostBits
 	if prefix.Addr().Is4() {
-		maxHosts -= 2 // network and broadcast addresses
+		maxHosts -= 3 // network, client DNS resolver and broadcast addresses
 	}
 
 	return maxHosts
diff --git a/management/server/http/handlers/accounts/accounts_handler_test.go b/management/server/http/handlers/accounts/accounts_handler_test.go
index 06419019e..1ccac2b04 100644
--- a/management/server/http/handlers/accounts/accounts_handler_test.go
+++ b/management/server/http/handlers/accounts/accounts_handler_test.go
@@ -12,9 +12,9 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
 	"github.com/gorilla/mux"
 	"github.com/stretchr/testify/assert"
+	"go.uber.org/mock/gomock"
 
 	nbcontext "github.com/netbirdio/netbird/management/server/context"
 	"github.com/netbirdio/netbird/management/server/mock_server"
@@ -469,9 +469,9 @@ func TestCalculateMaxHosts(t *testing.T) {
 		prefix string
 		min    int64
 	}{
-		{"v4 /24", "100.64.0.0/24", 254},
-		{"v4 /16", "100.64.0.0/16", 65534},
-		{"v4 /28", "100.64.0.0/28", 14},
+		{"v4 /24", "100.64.0.0/24", 253},
+		{"v4 /16", "100.64.0.0/16", 65533},
+		{"v4 /28", "100.64.0.0/28", 13},
 		{"v6 /64", "fd00::/64", math.MaxInt64},
 		{"v6 /120", "fd00::/120", 256},
 		{"v6 /112", "fd00::/112", 65536},
diff --git a/management/server/types/network.go b/management/server/types/network.go
index 1ce6465b5..fdb8cb521 100644
--- a/management/server/types/network.go
+++ b/management/server/types/network.go
@@ -118,14 +118,9 @@ func AllocatePeerIP(prefix netip.Prefix, takenIps []netip.Addr) (netip.Addr, err
 		return netip.Addr{}, err
 	}
 
-	b := prefix.Masked().Addr().As4()
-	baseIP := binary.BigEndian.Uint32(b[:])
-	hostBits := 32 - prefix.Bits()
-	totalIPs := uint32(1 << hostBits)
+	baseIP, firstOffset, lastOffset := ipv4PeerRange(prefix)
 
-	taken := make(map[uint32]struct{}, len(takenIps)+1)
-	taken[baseIP] = struct{}{}            // reserve network IP
-	taken[baseIP+totalIPs-1] = struct{}{} // reserve broadcast IP
+	taken := make(map[uint32]struct{}, len(takenIps))
 
 	for _, ip := range takenIps {
 		if !ip.Is4() {
@@ -135,17 +130,16 @@ func AllocatePeerIP(prefix netip.Prefix, takenIps []netip.Addr) (netip.Addr, err
 		taken[binary.BigEndian.Uint32(ab[:])] = struct{}{}
 	}
 
-	maxAttempts := (int(totalIPs) - len(taken)) / 100
+	maxAttempts := (int(lastOffset-firstOffset+1) - len(taken)) / 100
 
 	for i := 0; i < maxAttempts; i++ {
-		offset := uint32(util.RandIntn(int(totalIPs-2))) + 1
-		candidate := baseIP + offset
+		candidate := baseIP + randomOffset(firstOffset, lastOffset)
 		if _, exists := taken[candidate]; !exists {
 			return uint32ToIP(candidate), nil
 		}
 	}
 
-	for offset := uint32(1); offset < totalIPs-1; offset++ {
+	for offset := firstOffset; offset <= lastOffset; offset++ {
 		candidate := baseIP + offset
 		if _, exists := taken[candidate]; !exists {
 			return uint32ToIP(candidate), nil
@@ -161,15 +155,38 @@ func AllocateRandomPeerIP(prefix netip.Prefix) (netip.Addr, error) {
 		return netip.Addr{}, err
 	}
 
+	baseIP, firstOffset, lastOffset := ipv4PeerRange(prefix)
+	return uint32ToIP(baseIP + randomOffset(firstOffset, lastOffset)), nil
+}
+
+// IsReservedPeerIP reports whether ip is an address of the IPv4 prefix that is never assigned to a peer:
+// the network address, the broadcast address or the address before it, which clients use for their DNS resolver.
+// It returns false if prefix is not a valid IPv4 peer network or ip is not within it.
+func IsReservedPeerIP(prefix netip.Prefix, ip netip.Addr) bool {
+	ip = ip.Unmap()
+	if validateIPv4Prefix(prefix) != nil || !ip.Is4() || !prefix.Contains(ip) {
+		return false
+	}
+
+	baseIP, firstOffset, lastOffset := ipv4PeerRange(prefix)
+	b := ip.As4()
+	offset := binary.BigEndian.Uint32(b[:]) - baseIP
+	return offset < firstOffset || offset > lastOffset
+}
+
+// ipv4PeerRange returns the network address of the IPv4 prefix as uint32 and the first and last offset
+// from it that can be assigned to a peer. Reserved are the network address, the broadcast address and the
+// address before it, which clients in userspace and netstack mode use for their DNS resolver.
+func ipv4PeerRange(prefix netip.Prefix) (baseIP, firstOffset, lastOffset uint32) {
 	b := prefix.Masked().Addr().As4()
-	baseIP := binary.BigEndian.Uint32(b[:])
-	hostBits := 32 - prefix.Bits()
-	totalIPs := uint32(1 << hostBits)
+	broadcastOffset := uint32(1)<<(32-prefix.Bits()) - 1
+	dnsResolverOffset := broadcastOffset - 1
+	return binary.BigEndian.Uint32(b[:]), 1, dnsResolverOffset - 1
+}
 
-	offset := uint32(util.RandIntn(int(totalIPs-2))) + 1
-
-	candidate := baseIP + offset
-	return uint32ToIP(candidate), nil
+// randomOffset returns a random offset in [firstOffset, lastOffset].
+func randomOffset(firstOffset, lastOffset uint32) uint32 {
+	return firstOffset + uint32(util.RandIntn(int(lastOffset-firstOffset+1)))
 }
 
 // AllocateRandomPeerIPv6 picks a random host address within the given IPv6 prefix.
diff --git a/management/server/types/network_test.go b/management/server/types/network_test.go
index 239f72426..aee59f7ed 100644
--- a/management/server/types/network_test.go
+++ b/management/server/types/network_test.go
@@ -42,12 +42,12 @@ func TestAllocatePeerIP(t *testing.T) {
 }
 
 func TestAllocatePeerIPSmallSubnet(t *testing.T) {
-	// Test /27 network (10.0.0.0/27) - should only have 30 usable IPs (10.0.0.1 to 10.0.0.30)
+	// Test /27 network (10.0.0.0/27) - should only have 29 usable IPs (10.0.0.1 to 10.0.0.29)
 	prefix := netip.MustParsePrefix("10.0.0.0/27")
 	var ips []netip.Addr
 
 	// Allocate all available IPs in the /27 network
-	for i := 0; i < 30; i++ {
+	for i := 0; i < 29; i++ {
 		ip, err := AllocatePeerIP(prefix, ips)
 		if err != nil {
 			t.Fatal(err)
@@ -61,7 +61,7 @@ func TestAllocatePeerIPSmallSubnet(t *testing.T) {
 		ips = append(ips, ip)
 	}
 
-	assert.Len(t, ips, 30)
+	assert.Len(t, ips, 29)
 
 	// Verify all IPs are unique
 	uniq := make(map[string]struct{})
@@ -86,13 +86,13 @@ func TestAllocatePeerIPVariousCIDRs(t *testing.T) {
 		cidr           string
 		expectedUsable int
 	}{
-		{"/30 network", "192.168.1.0/30", 2},   // 4 total - 2 reserved = 2 usable
-		{"/29 network", "192.168.1.0/29", 6},   // 8 total - 2 reserved = 6 usable
-		{"/28 network", "192.168.1.0/28", 14},  // 16 total - 2 reserved = 14 usable
-		{"/27 network", "192.168.1.0/27", 30},  // 32 total - 2 reserved = 30 usable
-		{"/26 network", "192.168.1.0/26", 62},  // 64 total - 2 reserved = 62 usable
-		{"/25 network", "192.168.1.0/25", 126}, // 128 total - 2 reserved = 126 usable
-		{"/16 network", "10.0.0.0/16", 65534},  // 65536 total - 2 reserved = 65534 usable
+		{"/30 network", "192.168.1.0/30", 1},   // 4 total - 3 reserved = 1 usable
+		{"/29 network", "192.168.1.0/29", 5},   // 8 total - 3 reserved = 5 usable
+		{"/28 network", "192.168.1.0/28", 13},  // 16 total - 3 reserved = 13 usable
+		{"/27 network", "192.168.1.0/27", 29},  // 32 total - 3 reserved = 29 usable
+		{"/26 network", "192.168.1.0/26", 61},  // 64 total - 3 reserved = 61 usable
+		{"/25 network", "192.168.1.0/25", 125}, // 128 total - 3 reserved = 125 usable
+		{"/16 network", "10.0.0.0/16", 65533},  // 65536 total - 3 reserved = 65533 usable
 	}
 
 	for _, tc := range testCases {
@@ -117,14 +117,16 @@ func TestAllocatePeerIPVariousCIDRs(t *testing.T) {
 				// Verify IP is within the correct range
 				assert.True(t, prefix.Contains(ip), "allocated IP %s is not within network %s", ip.String(), prefix.String())
 
-				// Verify IP is not network or broadcast address
+				// Verify IP is not network, DNS resolver or broadcast address
 				networkAddr := prefix.Masked().Addr()
 				hostBits := 32 - prefix.Bits()
 				b := networkAddr.As4()
 				baseIP := binary.BigEndian.Uint32(b[:])
+				dnsIP := uint32ToIP(baseIP + (1 << hostBits) - 2)
 				broadcastIP := uint32ToIP(baseIP + (1 << hostBits) - 1)
 
 				assert.NotEqual(t, networkAddr, ip, "allocated network address %s", ip.String())
+				assert.NotEqual(t, dnsIP, ip, "allocated DNS resolver address %s", ip.String())
 				assert.NotEqual(t, broadcastIP, ip, "allocated broadcast address %s", ip.String())
 
 				ips = append(ips, ip)
@@ -143,6 +145,68 @@ func TestAllocatePeerIPVariousCIDRs(t *testing.T) {
 	}
 }
 
+func TestAllocatePeerIPSkipsDNSResolverIP(t *testing.T) {
+	prefix := netip.MustParsePrefix("192.168.1.0/29")
+	ips := []netip.Addr{
+		netip.MustParseAddr("192.168.1.1"),
+		netip.MustParseAddr("192.168.1.2"),
+		netip.MustParseAddr("192.168.1.3"),
+		netip.MustParseAddr("192.168.1.4"),
+	}
+
+	ip, err := AllocatePeerIP(prefix, ips)
+	require.NoError(t, err)
+	assert.Equal(t, netip.MustParseAddr("192.168.1.5"), ip)
+
+	_, err = AllocatePeerIP(prefix, append(ips, ip))
+	assert.Error(t, err, "192.168.1.6 is the DNS resolver address and must not be allocated")
+}
+
+func TestAllocateRandomPeerIPSkipsReservedIPs(t *testing.T) {
+	for _, cidr := range []string{"192.168.1.0/30", "192.168.1.0/29"} {
+		t.Run(cidr, func(t *testing.T) {
+			prefix := netip.MustParsePrefix(cidr)
+			for i := 0; i < 1000; i++ {
+				ip, err := AllocateRandomPeerIP(prefix)
+				require.NoError(t, err)
+				require.True(t, prefix.Contains(ip), "allocated IP %s is not within network %s", ip, prefix)
+				require.False(t, IsReservedPeerIP(prefix, ip), "allocated reserved IP %s", ip)
+			}
+		})
+	}
+
+	ip, err := AllocateRandomPeerIP(netip.MustParsePrefix("192.168.1.0/30"))
+	require.NoError(t, err)
+	assert.Equal(t, netip.MustParseAddr("192.168.1.1"), ip)
+}
+
+func TestIsReservedPeerIP(t *testing.T) {
+	prefix := netip.MustParsePrefix("100.64.0.0/24")
+	testCases := []struct {
+		ip       string
+		reserved bool
+	}{
+		{"100.64.0.0", true},
+		{"100.64.0.1", false},
+		{"100.64.0.253", false},
+		{"100.64.0.254", true},
+		{"100.64.0.255", true},
+		{"::ffff:100.64.0.254", true},
+		{"100.64.1.254", false},
+		{"fd12:3456:7890:abcd::1", false},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.ip, func(t *testing.T) {
+			assert.Equal(t, tc.reserved, IsReservedPeerIP(prefix, netip.MustParseAddr(tc.ip)))
+		})
+	}
+
+	smallest := netip.MustParsePrefix("192.168.1.0/30")
+	assert.False(t, IsReservedPeerIP(smallest, netip.MustParseAddr("192.168.1.1")))
+	assert.True(t, IsReservedPeerIP(smallest, netip.MustParseAddr("192.168.1.2")))
+}
+
 func TestAllocateIPv4InvalidPrefixes(t *testing.T) {
 	prefixes := []netip.Prefix{
 		{},

From 88f1a307e364395d3bc9b498ae4e11ccf75836df Mon Sep 17 00:00:00 2001
From: Nicolas Frati <nicofrati@gmail.com>
Date: Mon, 12 Oct 2026 13:16:08 +0200
Subject: [PATCH 43/70] [signal] Stop with an error when a server fails (#8105)

Signal can report a successful start and then stop with exit code 0, or
continue without a listener, when a listener fails. Supervisors and
operators do not see the failure.

Stop at startup when the Let's Encrypt challenge listener cannot bind.
Keep a failure that occurs before the run loop waits, and return a
non-zero exit code after a server failure. A listener that is closed
during shutdown is not a failure.
---
 signal/cmd/root.go     |  3 ++-
 signal/cmd/run.go      | 12 ++++++++----
 signal/cmd/run_test.go | 40 ++++++++++++++++++++++++++++++++++++++++
 3 files changed, 50 insertions(+), 5 deletions(-)

diff --git a/signal/cmd/root.go b/signal/cmd/root.go
index 155790482..1db6faec1 100644
--- a/signal/cmd/root.go
+++ b/signal/cmd/root.go
@@ -38,7 +38,8 @@ func Execute() error {
 }
 
 func init() {
-	stopCh = make(chan int)
+	// Buffered so a server failure before the run loop waits is not dropped.
+	stopCh = make(chan int, 1)
 	defaultLogFile = "/var/log/netbird/signal.log"
 
 	if runtime.GOOS == "windows" {
diff --git a/signal/cmd/run.go b/signal/cmd/run.go
index ffb596909..5a695cb3a 100644
--- a/signal/cmd/run.go
+++ b/signal/cmd/run.go
@@ -140,7 +140,7 @@ var (
 			default:
 				certListener, err = startServerWithCertManager(certManager, grpcRootHandler)
 				if err != nil {
-					log.Errorf("LetsEncrypt challenge server not started: %v", err)
+					return err
 				}
 			}
 
@@ -184,7 +184,7 @@ var (
 
 			SetupCloseHandler()
 
-			<-stopCh
+			stopCode := <-stopCh
 			if certListener != nil {
 				_ = certListener.Close()
 				log.Infof("stopped LetsEncrypt challenge server")
@@ -211,6 +211,9 @@ var (
 
 			log.Infof("stopped Signal Service")
 
+			if stopCode != 0 {
+				return errors.New("signal service stopped after a server failure")
+			}
 			return nil
 		},
 	}
@@ -315,7 +318,8 @@ func serveHTTP(httpListener net.Listener, handler http.Handler) {
 			Handler: h2c.NewHandler(handler, &http2.Server{}),
 		}
 		err := h1s.Serve(httpListener)
-		if err != nil {
+		// Closing the listener on shutdown is not a failure.
+		if err != nil && !errors.Is(err, net.ErrClosed) {
 			notifyStop(fmt.Sprintf("failed running HTTP server %v", err))
 		}
 	}()
@@ -328,7 +332,7 @@ func serveGRPC(grpcServer *grpc.Server, port int) (net.Listener, error) {
 	}
 	go func() {
 		err := grpcServer.Serve(listener)
-		if err != nil {
+		if err != nil && !errors.Is(err, net.ErrClosed) {
 			notifyStop(fmt.Sprintf("failed running gRPC server on port %d: %v", port, err))
 		}
 	}()
diff --git a/signal/cmd/run_test.go b/signal/cmd/run_test.go
index e0a07e923..0eee82d7c 100644
--- a/signal/cmd/run_test.go
+++ b/signal/cmd/run_test.go
@@ -1,6 +1,7 @@
 package cmd
 
 import (
+	"crypto/tls"
 	"net"
 	"net/http"
 	"testing"
@@ -20,7 +21,18 @@ func setLetsencryptListen(t *testing.T, port int, address string) {
 	})
 }
 
+func drainStopCh(t *testing.T) {
+	t.Helper()
+	t.Cleanup(func() {
+		select {
+		case <-stopCh:
+		default:
+		}
+	})
+}
+
 func TestStartServerWithCertManager_CustomAddress(t *testing.T) {
+	drainStopCh(t)
 	setLetsencryptListen(t, 10000, "127.0.0.1:0")
 
 	listener, err := startServerWithCertManager(&autocert.Manager{}, http.NotFoundHandler())
@@ -50,3 +62,31 @@ func TestCertManagerTLSConfigAnswersTLSALPN01(t *testing.T) {
 	cfg := (&autocert.Manager{}).TLSConfig()
 	require.Contains(t, cfg.NextProtos, acme.ALPNProto, "cert manager TLS config should offer the ACME TLS-ALPN protocol")
 }
+
+func TestServeHTTP_ClosedListenerIsNotAFailure(t *testing.T) {
+	drainStopCh(t)
+	listener, err := tls.Listen("tcp", "127.0.0.1:0", (&autocert.Manager{}).TLSConfig())
+	require.NoError(t, err)
+
+	serveHTTP(listener, http.NotFoundHandler())
+	require.NoError(t, listener.Close())
+
+	select {
+	case code := <-stopCh:
+		t.Fatalf("closing the listener reported a failure with code %d", code)
+	case <-time.After(200 * time.Millisecond):
+	}
+}
+
+func TestNotifyStop_KeepsEarlyFailure(t *testing.T) {
+	drainStopCh(t)
+
+	notifyStop("failed before the run loop waits")
+
+	select {
+	case code := <-stopCh:
+		require.Equal(t, 1, code, "an early failure should be reported with stop code 1")
+	default:
+		t.Fatal("a failure reported before the run loop waits was dropped")
+	}
+}

From 57722d3235723527b28dccf2350b5e7677a83c90 Mon Sep 17 00:00:00 2001
From: Maycon Santos <mlsmaycon@gmail.com>
Date: Mon, 12 Oct 2026 13:23:18 +0200
Subject: [PATCH 44/70] [proxy] Exercise target access through container E2E
 (#8117)

Verify access decisions through real management and proxy containers, including upstream delivery and denial. Cover inherited auth, bypass/block, precedence, credential stripping, updates, restrictions, deletion, and private-service rejection.

Validation: container E2E and scoped lint passed locally. The workflow builds both components from the checkout.
---
 .github/workflows/reverse-proxy-e2e.yml       |  53 +++
 e2e/harness/cert.go                           |   4 +-
 e2e/harness/http_upstream.go                  | 228 ++++++++++++
 e2e/harness/proxy.go                          |  95 ++++-
 e2e/reverseproxy/README.md                    |  36 ++
 e2e/reverseproxy/main_test.go                 |  42 +++
 .../target_access_control_test.go             | 336 ++++++++++++++++++
 7 files changed, 789 insertions(+), 5 deletions(-)
 create mode 100644 .github/workflows/reverse-proxy-e2e.yml
 create mode 100644 e2e/harness/http_upstream.go
 create mode 100644 e2e/reverseproxy/README.md
 create mode 100644 e2e/reverseproxy/main_test.go
 create mode 100644 e2e/reverseproxy/target_access_control_test.go

diff --git a/.github/workflows/reverse-proxy-e2e.yml b/.github/workflows/reverse-proxy-e2e.yml
new file mode 100644
index 000000000..934a6d4c9
--- /dev/null
+++ b/.github/workflows/reverse-proxy-e2e.yml
@@ -0,0 +1,53 @@
+name: Reverse Proxy E2E
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/reverse-proxy-e2e.yml'
+      - '**/*.go'
+      - 'e2e/**'
+      - 'shared/management/**'
+      - 'combined/Dockerfile*'
+      - 'proxy/Dockerfile*'
+      - '.dockerignore'
+      - 'go.mod'
+      - 'go.sum'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  reverse-proxy:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Install Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version-file: go.mod
+
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+
+      - name: Cache Docker layers
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: /tmp/.reverse-proxy-buildx-cache
+          key: ${{ runner.os }}-reverse-proxy-e2e-${{ hashFiles('go.sum', 'combined/Dockerfile.multistage', 'proxy/Dockerfile.multistage') }}
+          restore-keys: |
+            ${{ runner.os }}-reverse-proxy-e2e-
+
+      - name: Run reverse-proxy E2E
+        env:
+          NB_E2E_BUILDX_CACHE: /tmp/.reverse-proxy-buildx-cache
+        run: go test -tags e2e -timeout 25m -v ./e2e/reverseproxy/...
diff --git a/e2e/harness/cert.go b/e2e/harness/cert.go
index c8a28e470..b322ab6d2 100644
--- a/e2e/harness/cert.go
+++ b/e2e/harness/cert.go
@@ -18,8 +18,8 @@ import (
 
 // writeSelfSignedCert generates a self-signed TLS cert/key pair covering the
 // given DNS names and writes them as tls.crt / tls.key in dir. The proxy serves
-// this for the agent-network endpoint; the client curls with -k, so validity
-// chains don't matter — the proxy just needs a usable cert to present.
+// this for the agent-network endpoint; test clients either trust the generated
+// certificate explicitly or opt out of verification inside the test network.
 func writeSelfSignedCert(dir string, dnsNames []string) error {
 	priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
 	if err != nil {
diff --git a/e2e/harness/http_upstream.go b/e2e/harness/http_upstream.go
new file mode 100644
index 000000000..3b6fb7df6
--- /dev/null
+++ b/e2e/harness/http_upstream.go
@@ -0,0 +1,228 @@
+//go:build e2e
+
+package harness
+
+import (
+	"bufio"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync/atomic"
+	"time"
+
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/go-connections/nat"
+	"github.com/testcontainers/testcontainers-go"
+	"github.com/testcontainers/testcontainers-go/wait"
+)
+
+const (
+	httpUpstreamImage   = "nginx:alpine"
+	httpUpstreamAlias   = "httpupstream"
+	httpUpstreamPort    = "8080/tcp"
+	httpUpstreamLogPath = "/tmp/e2e-access.log"
+)
+
+// httpUpstreamNginxConf returns request details from a plain HTTP upstream and
+// writes every request URI to an unbuffered file. Tests use unique path markers
+// to distinguish requests that reached the upstream from proxy-generated
+// responses with the same status.
+const httpUpstreamNginxConf = `pid /tmp/nginx.pid;
+worker_processes 1;
+events {}
+http {
+  log_format e2e escape=json '{"uri":"$request_uri"}';
+  access_log /tmp/e2e-access.log e2e;
+
+  server {
+    listen 8080;
+    location / {
+      default_type application/json;
+      return 200 '{"source":"netbird-e2e-http-upstream","path":"$uri","request_uri":"$request_uri","configured_auth":"$http_x_e2e_proxy_key","authorization":"$http_authorization","cookie":"$http_cookie","netbird_user":"$http_x_netbird_user","netbird_groups":"$http_x_netbird_groups"}';
+    }
+  }
+}
+`
+
+// HTTPUpstream is a plain HTTP server on the combined server's network. It
+// reflects selected request properties and records request URIs for tests that
+// need to distinguish proxy responses from upstream responses.
+type HTTPUpstream struct {
+	container     testcontainers.Container
+	workDir       string
+	directAddress string
+	syncSequence  atomic.Uint64
+	URL           string
+}
+
+// StartHTTPUpstream runs a request-observing nginx server on the shared network.
+func StartHTTPUpstream(ctx context.Context, c *Combined) (*HTTPUpstream, error) {
+	workDir, err := os.MkdirTemp("/tmp", "nb-e2e-http-upstream-*")
+	if err != nil {
+		return nil, fmt.Errorf("create HTTP upstream work dir: %w", err)
+	}
+	if err := os.Chmod(workDir, 0o755); err != nil { //nolint:gosec // throwaway e2e config dir, must be traversable by the container uid
+		_ = os.RemoveAll(workDir)
+		return nil, fmt.Errorf("chmod HTTP upstream dir: %w", err)
+	}
+	if err := os.WriteFile(filepath.Join(workDir, "nginx.conf"), []byte(httpUpstreamNginxConf), 0o644); err != nil { //nolint:gosec // non-secret e2e config
+		_ = os.RemoveAll(workDir)
+		return nil, fmt.Errorf("write HTTP upstream config: %w", err)
+	}
+
+	req := testcontainers.ContainerRequest{
+		Image:          httpUpstreamImage,
+		ExposedPorts:   []string{httpUpstreamPort},
+		Networks:       []string{c.network.Name},
+		NetworkAliases: map[string][]string{c.network.Name: {httpUpstreamAlias}},
+		Cmd:            []string{"nginx", "-c", "/conf/nginx.conf", "-g", "daemon off;"},
+		HostConfigModifier: func(hc *container.HostConfig) {
+			hc.Binds = append(hc.Binds, workDir+":/conf:ro")
+		},
+		WaitingFor: wait.ForListeningPort(httpUpstreamPort).WithStartupTimeout(60 * time.Second),
+	}
+
+	ctr, err := testcontainers.GenericContainer(ctx, testcontainers.GenericContainerRequest{
+		ContainerRequest: req,
+		Started:          true,
+	})
+	if err != nil {
+		cleanupHTTPUpstreamStart(ctr, workDir)
+		return nil, fmt.Errorf("start HTTP upstream container: %w", err)
+	}
+	host, err := ctr.Host(ctx)
+	if err != nil {
+		cleanupHTTPUpstreamStart(ctr, workDir)
+		return nil, fmt.Errorf("HTTP upstream container host: %w", err)
+	}
+	mapped, err := ctr.MappedPort(ctx, nat.Port(httpUpstreamPort))
+	if err != nil {
+		cleanupHTTPUpstreamStart(ctr, workDir)
+		return nil, fmt.Errorf("HTTP upstream mapped port: %w", err)
+	}
+
+	return &HTTPUpstream{
+		container:     ctr,
+		workDir:       workDir,
+		directAddress: net.JoinHostPort(host, mapped.Port()),
+		URL:           "http://" + httpUpstreamAlias + ":8080",
+	}, nil
+}
+
+func cleanupHTTPUpstreamStart(ctr testcontainers.Container, workDir string) {
+	if ctr != nil {
+		cleanupCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		_ = ctr.Terminate(cleanupCtx)
+		cancel()
+	}
+	_ = os.RemoveAll(workDir)
+}
+
+// Synchronize waits until the upstream has finalized all requests received
+// before a direct barrier request. The fixture runs one nginx worker and writes
+// access logs without buffering, so observing the barrier in the file proves
+// any earlier proxied request has also been recorded.
+func (u *HTTPUpstream) Synchronize(ctx context.Context) error {
+	marker := fmt.Sprintf("__e2e_upstream_barrier_%d__", u.syncSequence.Add(1))
+	requestURL := (&url.URL{
+		Scheme: "http",
+		Host:   u.directAddress,
+		Path:   "/" + marker,
+	}).String()
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, requestURL, nil)
+	if err != nil {
+		return fmt.Errorf("create HTTP upstream barrier request: %w", err)
+	}
+	transport := &http.Transport{}
+	defer transport.CloseIdleConnections()
+	client := &http.Client{Transport: transport, Timeout: 5 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return fmt.Errorf("send HTTP upstream barrier request: %w", err)
+	}
+	defer resp.Body.Close()
+	if _, err := io.Copy(io.Discard, resp.Body); err != nil {
+		return fmt.Errorf("read HTTP upstream barrier response: %w", err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("HTTP upstream barrier returned status %d", resp.StatusCode)
+	}
+
+	waitCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+	ticker := time.NewTicker(25 * time.Millisecond)
+	defer ticker.Stop()
+	for {
+		count, err := u.RequestCount(waitCtx, marker)
+		if err != nil {
+			return err
+		}
+		switch {
+		case count == 1:
+			return nil
+		case count > 1:
+			return fmt.Errorf("HTTP upstream recorded barrier %q %d times", marker, count)
+		}
+
+		select {
+		case <-waitCtx.Done():
+			return fmt.Errorf("wait for HTTP upstream barrier: %w", waitCtx.Err())
+		case <-ticker.C:
+		}
+	}
+}
+
+// RequestCount returns the number of recorded request URIs containing marker.
+func (u *HTTPUpstream) RequestCount(ctx context.Context, marker string) (int, error) {
+	if marker == "" {
+		return 0, fmt.Errorf("request marker is empty")
+	}
+
+	reader, err := u.container.CopyFileFromContainer(ctx, httpUpstreamLogPath)
+	if err != nil {
+		return 0, fmt.Errorf("read HTTP upstream access log: %w", err)
+	}
+	defer reader.Close()
+
+	count := 0
+	scanner := bufio.NewScanner(reader)
+	for scanner.Scan() {
+		var entry struct {
+			URI string `json:"uri"`
+		}
+		if err := json.Unmarshal(scanner.Bytes(), &entry); err != nil {
+			return 0, fmt.Errorf("decode HTTP upstream access log: %w", err)
+		}
+		if strings.Contains(entry.URI, marker) {
+			count++
+		}
+	}
+	if err := scanner.Err(); err != nil {
+		return 0, fmt.Errorf("scan HTTP upstream access log: %w", err)
+	}
+	return count, nil
+}
+
+// Logs returns the HTTP upstream container logs for failure diagnostics.
+func (u *HTTPUpstream) Logs(ctx context.Context) string {
+	return containerLogs(ctx, u.container)
+}
+
+// Terminate stops the HTTP upstream container and removes its work directory.
+func (u *HTTPUpstream) Terminate(ctx context.Context) error {
+	var err error
+	if u.container != nil {
+		err = u.container.Terminate(ctx)
+	}
+	if u.workDir != "" {
+		_ = os.RemoveAll(u.workDir)
+	}
+	return err
+}
diff --git a/e2e/harness/proxy.go b/e2e/harness/proxy.go
index ee458908b..6a4251f5e 100644
--- a/e2e/harness/proxy.go
+++ b/e2e/harness/proxy.go
@@ -5,13 +5,20 @@ package harness
 import (
 	"bytes"
 	"context"
+	"crypto/tls"
+	"crypto/x509"
 	"encoding/json"
 	"fmt"
 	"io"
+	"net"
+	"net/http"
+	"net/url"
 	"os"
+	"path/filepath"
 	"time"
 
 	"github.com/docker/docker/api/types/container"
+	"github.com/docker/go-connections/nat"
 	"github.com/testcontainers/testcontainers-go"
 	tcexec "github.com/testcontainers/testcontainers-go/exec"
 	"github.com/testcontainers/testcontainers-go/wait"
@@ -24,6 +31,7 @@ const (
 	// pulled as a published image; a bare tag is built under that name.
 	defaultProxyImage = "netbird-reverse-proxy:e2e"
 	proxyAlias        = "proxy"
+	proxyHTTPSPort    = "443/tcp"
 
 	// AgentNetworkCluster is the proxy cluster the e2e provider bootstraps and
 	// the proxy serves. It must equal the management's exposed domain
@@ -34,8 +42,10 @@ const (
 
 // Proxy is a running agent-network gateway (netbird proxy) container.
 type Proxy struct {
-	container testcontainers.Container
-	workDir   string
+	container    testcontainers.Container
+	workDir      string
+	httpsAddress string
+	tlsRootCAs   *x509.CertPool
 }
 
 // StartProxy builds the proxy image and runs it on the combined server's
@@ -63,14 +73,27 @@ func StartProxy(ctx context.Context, c *Combined, proxyToken string, envOverride
 	// MkdirTemp creates the dir 0700; widen it so the non-root proxy container
 	// can traverse the bind-mounted cert dir on Linux CI runners.
 	if err := os.Chmod(workDir, 0o755); err != nil { //nolint:gosec // throwaway e2e cert dir, must be traversable by the proxy container uid
+		_ = os.RemoveAll(workDir)
 		return nil, fmt.Errorf("chmod proxy cert dir: %w", err)
 	}
 	if err := writeSelfSignedCert(workDir, []string{"*." + AgentNetworkCluster, AgentNetworkCluster}); err != nil {
+		_ = os.RemoveAll(workDir)
 		return nil, err
 	}
+	certPEM, err := os.ReadFile(filepath.Join(workDir, "tls.crt"))
+	if err != nil {
+		_ = os.RemoveAll(workDir)
+		return nil, fmt.Errorf("read proxy certificate: %w", err)
+	}
+	tlsRootCAs := x509.NewCertPool()
+	if !tlsRootCAs.AppendCertsFromPEM(certPEM) {
+		_ = os.RemoveAll(workDir)
+		return nil, fmt.Errorf("parse proxy certificate")
+	}
 
 	req := testcontainers.ContainerRequest{
 		Image:          proxyImage,
+		ExposedPorts:   []string{proxyHTTPSPort},
 		Networks:       []string{c.network.Name},
 		NetworkAliases: map[string][]string{c.network.Name: {proxyAlias}},
 		Env: map[string]string{
@@ -112,10 +135,76 @@ func StartProxy(ctx context.Context, c *Combined, proxyToken string, envOverride
 		Started:          true,
 	})
 	if err != nil {
+		_ = os.RemoveAll(workDir)
 		return nil, fmt.Errorf("start proxy container: %w", err)
 	}
 
-	return &Proxy{container: ctr, workDir: workDir}, nil
+	host, err := ctr.Host(ctx)
+	if err != nil {
+		_ = ctr.Terminate(ctx)
+		_ = os.RemoveAll(workDir)
+		return nil, fmt.Errorf("proxy container host: %w", err)
+	}
+	mapped, err := ctr.MappedPort(ctx, nat.Port(proxyHTTPSPort))
+	if err != nil {
+		_ = ctr.Terminate(ctx)
+		_ = os.RemoveAll(workDir)
+		return nil, fmt.Errorf("proxy mapped HTTPS port: %w", err)
+	}
+
+	return &Proxy{
+		container:    ctr,
+		workDir:      workDir,
+		httpsAddress: net.JoinHostPort(host, mapped.Port()),
+		tlsRootCAs:   tlsRootCAs,
+	}, nil
+}
+
+// HTTPSGet reaches a public service through the proxy's host-mapped HTTPS
+// listener while retaining domain as the request Host and TLS server name.
+// Connections are not reused so callers can observe mapping removal without
+// an existing connection outliving the route.
+func (p *Proxy) HTTPSGet(ctx context.Context, domain, path string, headers http.Header) (int, string, error) {
+	requestURL := &url.URL{Scheme: "https", Host: domain, Path: path}
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, requestURL.String(), nil)
+	if err != nil {
+		return 0, "", fmt.Errorf("create proxy request: %w", err)
+	}
+	req.Header = headers.Clone()
+
+	dialer := &net.Dialer{Timeout: 5 * time.Second}
+	transport := &http.Transport{
+		DialContext: func(ctx context.Context, _, _ string) (net.Conn, error) {
+			return dialer.DialContext(ctx, "tcp", p.httpsAddress)
+		},
+		TLSClientConfig: &tls.Config{
+			MinVersion: tls.VersionTLS12,
+			RootCAs:    p.tlsRootCAs,
+			ServerName: domain,
+		},
+		DisableKeepAlives:     true,
+		TLSHandshakeTimeout:   5 * time.Second,
+		ResponseHeaderTimeout: 10 * time.Second,
+	}
+	defer transport.CloseIdleConnections()
+
+	client := &http.Client{
+		Transport: transport,
+		Timeout:   15 * time.Second,
+		CheckRedirect: func(*http.Request, []*http.Request) error {
+			return http.ErrUseLastResponse
+		},
+	}
+	resp, err := client.Do(req)
+	if err != nil {
+		return 0, "", fmt.Errorf("request public proxy service: %w", err)
+	}
+	defer resp.Body.Close()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return 0, "", fmt.Errorf("read public proxy response: %w", err)
+	}
+	return resp.StatusCode, string(body), nil
 }
 
 // ProxyDebugClient is one per-account embedded client the proxy runs, as the
diff --git a/e2e/reverseproxy/README.md b/e2e/reverseproxy/README.md
new file mode 100644
index 000000000..fdd5faca5
--- /dev/null
+++ b/e2e/reverseproxy/README.md
@@ -0,0 +1,36 @@
+# Reverse-proxy access E2E tests
+
+These tests run a real combined management server, reverse proxy, and HTTP
+upstream in isolated Docker containers. Services are configured through the
+management API, then requests go through the proxy's HTTPS listener. No external
+identity provider, public DNS record, or API credential is needed.
+
+Run from the repository root with Docker and Go available:
+
+```bash
+go test -tags e2e -timeout 25m -v ./e2e/reverseproxy/...
+```
+
+The harness builds the combined server and proxy from the current checkout.
+To test existing images, pass full image references:
+
+```bash
+NB_E2E_COMBINED_IMAGE=local/netbird-combined:target-access \
+NB_E2E_PROXY_IMAGE=local/netbird-proxy:target-access \
+go test -tags e2e -timeout 25m -v ./e2e/reverseproxy/...
+```
+
+Rebuild locally tagged images after backend changes. Both components must
+support target access actions; using an older management image does not test
+the feature.
+
+The suite checks inherited service authentication, anonymous bypass, blocked
+paths, longest-prefix precedence, credential stripping, live action updates,
+service restrictions, deletion, and private-service bypass rejection. Upstream
+request markers distinguish successful forwarding from proxy-generated
+responses and verify that denied requests never reach the backend.
+
+The `Reverse Proxy E2E` workflow runs this package for relevant pull requests
+and manual dispatches. It also remains part of the nightly `./e2e/...` suite.
+Dashboard browser coverage lives in the dashboard repository: it creates and
+edits services through the UI, then probes their real proxy behavior.
diff --git a/e2e/reverseproxy/main_test.go b/e2e/reverseproxy/main_test.go
new file mode 100644
index 000000000..be211510d
--- /dev/null
+++ b/e2e/reverseproxy/main_test.go
@@ -0,0 +1,42 @@
+//go:build e2e
+
+// Package reverseproxy contains container-based tests for public reverse-proxy
+// services. A real combined management server is shared across package tests;
+// each test owns and cleans up its proxy and service resources.
+package reverseproxy
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+)
+
+var srv *harness.Combined
+
+func TestMain(m *testing.M) {
+	os.Exit(run(m))
+}
+
+func run(m *testing.M) int {
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
+	defer cancel()
+
+	var err error
+	srv, err = harness.StartCombined(ctx)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "e2e: start combined server: %v\n", err)
+		return 1
+	}
+	defer func() { _ = srv.Terminate(context.Background()) }()
+
+	if _, err := srv.Bootstrap(ctx); err != nil {
+		fmt.Fprintf(os.Stderr, "e2e: bootstrap admin PAT: %v\n", err)
+		return 1
+	}
+
+	return m.Run()
+}
diff --git a/e2e/reverseproxy/target_access_control_test.go b/e2e/reverseproxy/target_access_control_test.go
new file mode 100644
index 000000000..a74ec22bc
--- /dev/null
+++ b/e2e/reverseproxy/target_access_control_test.go
@@ -0,0 +1,336 @@
+//go:build e2e
+
+package reverseproxy
+
+import (
+	"context"
+	"encoding/json"
+	"net"
+	"net/http"
+	"net/url"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+const (
+	targetAccessDomain            = "target-access." + harness.AgentNetworkCluster
+	targetAccessHeader            = "X-E2E-Proxy-Key"
+	targetAccessSecret            = "e2e-target-access-secret"
+	targetAccessEchoPrefix        = "/e2e/proxy-echo/"
+	targetAccessApplicationAuth   = "Bearer e2e-application-token"
+	targetAccessApplicationCookie = "application_session=e2e-visible"
+)
+
+type targetAccessEcho struct {
+	Source         string `json:"source"`
+	Path           string `json:"path"`
+	RequestURI     string `json:"request_uri"`
+	ConfiguredAuth string `json:"configured_auth"`
+	Authorization  string `json:"authorization"`
+	Cookie         string `json:"cookie"`
+	NetBirdUser    string `json:"netbird_user"`
+	NetBirdGroups  string `json:"netbird_groups"`
+}
+
+func TestTargetAccessControl_PrivateServiceRejectsBypass(t *testing.T) {
+	ctx, cancel := context.WithTimeout(t.Context(), 30*time.Second)
+	defer cancel()
+
+	group, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-private-target-access"})
+	require.NoError(t, err, "create private-service access group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), group.Id) })
+
+	request := targetAccessServiceRequest(t, "http://upstream.invalid:80",
+		api.ServiceTargetAccessActionBypass,
+		api.ServiceTargetAccessActionBlock,
+		nil,
+	)
+	private := true
+	accessGroups := []string{group.Id}
+	request.Domain = "private-target-access." + harness.AgentNetworkCluster
+	request.Name = "E2E private target access rejection"
+	request.Private = &private
+	request.AccessGroups = &accessGroups
+
+	created, err := srv.API().ReverseProxyServices.Create(ctx, request)
+	if created != nil {
+		t.Cleanup(func() { _ = srv.API().ReverseProxyServices.Delete(context.Background(), created.Id) })
+	}
+	assert.Nil(t, created)
+	assert.ErrorContains(t, err, "bypass access_action is not supported for private services")
+}
+
+func TestTargetAccessControl_PublicServiceLifecycle(t *testing.T) {
+	ctx, cancel := context.WithTimeout(t.Context(), 5*time.Minute)
+	defer cancel()
+
+	upstream, err := harness.StartHTTPUpstream(ctx, srv)
+	require.NoError(t, err, "start HTTP upstream")
+	t.Cleanup(func() { _ = upstream.Terminate(context.Background()) })
+
+	proxyToken, err := srv.CreateProxyTokenCLI(ctx, "e2e-target-access-proxy")
+	require.NoError(t, err, "mint global proxy token")
+	// Cluster direct-upstream targets require a private-capable proxy, while the
+	// service itself remains public through request.Private below.
+	px, err := harness.StartProxy(ctx, srv, proxyToken)
+	require.NoError(t, err, "start reverse proxy")
+	t.Cleanup(func() { _ = px.Terminate(context.Background()) })
+
+	request := targetAccessServiceRequest(t, upstream.URL,
+		api.ServiceTargetAccessActionBypass,
+		api.ServiceTargetAccessActionBlock,
+		nil,
+	)
+	created, err := srv.API().ReverseProxyServices.Create(ctx, request)
+	require.NoError(t, err, "create service with per-target access actions")
+	removed := false
+	t.Cleanup(func() {
+		if !removed {
+			_ = srv.API().ReverseProxyServices.Delete(context.Background(), created.Id)
+		}
+	})
+
+	validAuth := targetAccessForwardedHeaders(targetAccessSecret)
+	wrongAuth := http.Header{targetAccessHeader: []string{"wrong-secret"}}
+	spoofedBypass := targetAccessForwardedHeaders("wrong-secret")
+
+	// Wait for the service snapshot before issuing unique one-shot markers. A
+	// marker used while polling could reach an older mapping and make an updated
+	// block look as though it forwarded after convergence.
+	requireProxyStatus(t, ctx, px, targetAccessPath("", "warm-created"), nil,
+		http.StatusUnauthorized, "wait for created service")
+	requireProxyAttempt(t, ctx, px, upstream, "", "inherit-missing", nil,
+		http.StatusUnauthorized, 0, "inherit target without service credentials")
+	requireProxyAttempt(t, ctx, px, upstream, "", "inherit-wrong", wrongAuth,
+		http.StatusUnauthorized, 0, "inherit target with invalid service credentials")
+	requireProxyEcho(t, ctx, px, upstream, "", "inherit-valid", validAuth,
+		"inherit target with valid service credentials")
+	requireProxyEcho(t, ctx, px, upstream, "/public", "bypass-initial", spoofedBypass,
+		"bypass target without valid service credentials")
+	requireProxyAttempt(t, ctx, px, upstream, "/public/private", "nested-missing", nil,
+		http.StatusUnauthorized, 0, "nested inherit target overrides bypass parent")
+	requireProxyEcho(t, ctx, px, upstream, "/public/private", "nested-valid", validAuth,
+		"nested inherit target accepts valid service credentials")
+	requireProxyAttempt(t, ctx, px, upstream, "/blocked", "block-initial", validAuth,
+		http.StatusForbidden, 0, "block target even with valid service credentials")
+
+	request = targetAccessServiceRequest(t, upstream.URL,
+		api.ServiceTargetAccessActionBlock,
+		api.ServiceTargetAccessActionBypass,
+		nil,
+	)
+	_, err = srv.API().ReverseProxyServices.Update(ctx, created.Id, request)
+	require.NoError(t, err, "swap target access actions")
+	requireProxyStatus(t, ctx, px, targetAccessPath("/public", "warm-actions-updated"), validAuth,
+		http.StatusForbidden, "wait for target action update")
+	requireProxyAttempt(t, ctx, px, upstream, "/public", "public-updated-block", validAuth,
+		http.StatusForbidden, 0, "updated public target is blocked")
+	requireProxyEcho(t, ctx, px, upstream, "/blocked", "blocked-updated-bypass", spoofedBypass,
+		"updated blocked target bypasses authentication")
+
+	blockedCIDRs := []string{"0.0.0.0/0", "::/0"}
+	request = targetAccessServiceRequest(t, upstream.URL,
+		api.ServiceTargetAccessActionBlock,
+		api.ServiceTargetAccessActionBypass,
+		&api.AccessRestrictions{BlockedCidrs: &blockedCIDRs},
+	)
+	_, err = srv.API().ReverseProxyServices.Update(ctx, created.Id, request)
+	require.NoError(t, err, "add connection restriction")
+	requireProxyStatus(t, ctx, px, targetAccessPath("/blocked", "warm-restricted"), nil,
+		http.StatusForbidden, "wait for connection restriction")
+	requireProxyAttempt(t, ctx, px, upstream, "/blocked", "blocked-restricted", spoofedBypass,
+		http.StatusForbidden, 0, "connection restriction runs before bypass")
+
+	// Clear the restriction and prove the route is live immediately before
+	// deleting it, so a stale 403 cannot make the removal check pass.
+	request = targetAccessServiceRequest(t, upstream.URL,
+		api.ServiceTargetAccessActionBlock,
+		api.ServiceTargetAccessActionBypass,
+		&api.AccessRestrictions{},
+	)
+	_, err = srv.API().ReverseProxyServices.Update(ctx, created.Id, request)
+	require.NoError(t, err, "clear connection restriction")
+	requireProxyStatus(t, ctx, px, targetAccessPath("/blocked", "warm-restriction-cleared"), nil,
+		http.StatusOK, "wait for cleared connection restriction")
+	requireProxyEcho(t, ctx, px, upstream, "/blocked", "blocked-restriction-cleared", spoofedBypass,
+		"bypass route is live before removal")
+
+	require.NoError(t, srv.API().ReverseProxyServices.Delete(ctx, created.Id), "delete service")
+	removed = true
+	requireProxyStatus(t, ctx, px, targetAccessPath("/blocked", "warm-deleted"), nil,
+		http.StatusNotFound, "wait for service deletion")
+	requireProxyAttempt(t, ctx, px, upstream, "/blocked", "blocked-deleted", nil,
+		http.StatusNotFound, 0, "deleted service is removed from the proxy")
+}
+
+func targetAccessServiceRequest(
+	t *testing.T,
+	upstreamURL string,
+	publicAction, blockedAction api.ServiceTargetAccessAction,
+	restrictions *api.AccessRestrictions,
+) api.ServiceRequest {
+	t.Helper()
+
+	u, err := url.Parse(upstreamURL)
+	require.NoError(t, err)
+	host, portText, err := net.SplitHostPort(u.Host)
+	require.NoError(t, err)
+	port, err := strconv.Atoi(portText)
+	require.NoError(t, err)
+
+	rootPath := "/"
+	publicPath := "/public"
+	nestedPath := "/public/private"
+	blockedPath := "/blocked"
+	directUpstream := true
+	mode := api.ServiceRequestModeHttp
+	private := false
+	inherit := api.ServiceTargetAccessActionInherit
+
+	target := func(path *string, action *api.ServiceTargetAccessAction) api.ServiceTarget {
+		return api.ServiceTarget{
+			AccessAction: action,
+			Enabled:      true,
+			Host:         &host,
+			Options:      &api.ServiceTargetOptions{DirectUpstream: &directUpstream},
+			Path:         path,
+			Port:         port,
+			Protocol:     api.ServiceTargetProtocolHttp,
+			TargetId:     harness.AgentNetworkCluster,
+			TargetType:   api.ServiceTargetTargetTypeCluster,
+		}
+	}
+	targets := []api.ServiceTarget{
+		target(&rootPath, &inherit),
+		target(&publicPath, &publicAction),
+		target(&nestedPath, &inherit),
+		target(&blockedPath, &blockedAction),
+	}
+	headerAuths := []api.HeaderAuthConfig{{
+		Enabled: true,
+		Header:  targetAccessHeader,
+		Value:   targetAccessSecret,
+	}}
+
+	return api.ServiceRequest{
+		AccessRestrictions: restrictions,
+		Auth:               &api.ServiceAuthConfig{HeaderAuths: &headerAuths},
+		Domain:             targetAccessDomain,
+		Enabled:            true,
+		Mode:               &mode,
+		Name:               "E2E target access control",
+		Private:            &private,
+		Targets:            &targets,
+	}
+}
+
+func targetAccessForwardedHeaders(authValue string) http.Header {
+	return http.Header{
+		targetAccessHeader: []string{authValue},
+		"Authorization":    []string{targetAccessApplicationAuth},
+		"Cookie":           []string{"nb_session=e2e-proxy-session; " + targetAccessApplicationCookie},
+		"X-NetBird-User":   []string{"spoofed@example.com"},
+		"X-NetBird-Groups": []string{"administrators"},
+	}
+}
+
+func targetAccessPath(targetPrefix, marker string) string {
+	return targetPrefix + targetAccessEchoPrefix + marker
+}
+
+func requireProxyAttempt(
+	t *testing.T,
+	ctx context.Context,
+	px *harness.Proxy,
+	upstream *harness.HTTPUpstream,
+	targetPrefix, marker string,
+	headers http.Header,
+	wantStatus, wantUpstreamRequests int,
+	description string,
+) string {
+	t.Helper()
+
+	path := targetAccessPath(targetPrefix, marker)
+	status, body, requestErr := px.HTTPSGet(ctx, targetAccessDomain, path, headers)
+	syncErr := upstream.Synchronize(ctx)
+	count, countErr := upstream.RequestCount(ctx, marker)
+	if requestErr != nil || syncErr != nil || countErr != nil || status != wantStatus || count != wantUpstreamRequests {
+		t.Fatalf("%s: wanted status=%d upstream_requests=%d, got status=%d upstream_requests=%d body=%q request_error=%v sync_error=%v count_error=%v\n=== proxy logs ===\n%s\n=== upstream logs ===\n%s",
+			description, wantStatus, wantUpstreamRequests, status, count, body, requestErr, syncErr, countErr,
+			px.Logs(context.Background()), upstream.Logs(context.Background()))
+	}
+	return body
+}
+
+func requireProxyEcho(
+	t *testing.T,
+	ctx context.Context,
+	px *harness.Proxy,
+	upstream *harness.HTTPUpstream,
+	targetPrefix, marker string,
+	headers http.Header,
+	description string,
+) {
+	t.Helper()
+
+	body := requireProxyAttempt(t, ctx, px, upstream, targetPrefix, marker, headers,
+		http.StatusOK, 1, description)
+	var echo targetAccessEcho
+	require.NoError(t, json.Unmarshal([]byte(body), &echo), "decode HTTP upstream observation")
+	wantPath := targetAccessEchoPrefix + marker
+	assert.Equal(t, "netbird-e2e-http-upstream", echo.Source, "response must come from the test upstream")
+	assert.Equal(t, wantPath, echo.Path, "upstream must receive the routed subpath")
+	assert.Equal(t, wantPath, echo.RequestURI, "upstream request URI must not contain the matched target prefix")
+	assert.Empty(t, echo.ConfiguredAuth, "configured proxy authentication header must be stripped")
+	assert.Equal(t, targetAccessApplicationAuth, echo.Authorization, "application authorization must be preserved")
+	assert.NotContains(t, echo.Cookie, "nb_session=", "proxy session cookie must be stripped")
+	assert.Contains(t, echo.Cookie, targetAccessApplicationCookie, "application cookie must be preserved")
+	assert.Empty(t, echo.NetBirdUser, "client-supplied NetBird identity must be stripped")
+	assert.Empty(t, echo.NetBirdGroups, "client-supplied NetBird groups must be stripped")
+}
+
+func requireProxyStatus(
+	t *testing.T,
+	ctx context.Context,
+	px *harness.Proxy,
+	path string,
+	headers http.Header,
+	want int,
+	description string,
+) {
+	t.Helper()
+
+	deadline := time.Now().Add(90 * time.Second)
+	var lastCode int
+	var lastBody string
+	var lastErr error
+	for time.Now().Before(deadline) {
+		lastCode, lastBody, lastErr = px.HTTPSGet(ctx, targetAccessDomain, path, headers)
+		if lastErr == nil && lastCode == want {
+			return
+		}
+		if !waitBeforeRetry(ctx, time.Second) {
+			break
+		}
+	}
+	t.Fatalf("%s: wanted status %d, last status=%d body=%q error=%v\n=== proxy logs ===\n%s",
+		description, want, lastCode, lastBody, lastErr, px.Logs(context.Background()))
+}
+
+func waitBeforeRetry(ctx context.Context, delay time.Duration) bool {
+	timer := time.NewTimer(delay)
+	defer timer.Stop()
+	select {
+	case <-ctx.Done():
+		return false
+	case <-timer.C:
+		return true
+	}
+}

From fe7841721a24d2fb0efcddcc5a6a66e1cfecc31e Mon Sep 17 00:00:00 2001
From: Nicolas Frati <nicofrati@gmail.com>
Date: Mon, 12 Oct 2026 13:44:30 +0200
Subject: [PATCH 45/70] [management] Create HttpConfig before applying TLS flag
 overrides (#8168)

With the embedded IdP, management.json can leave out the HttpConfig
section, and ApplyEmbeddedIdPConfig creates it later. Command-line
overrides run before that, so --letsencrypt-domain, or --cert-file with
--cert-key, dereferenced a nil HttpConfig and management crashed at
startup.

Create the section only when one of those flags writes to it, so a
config without TLS flags keeps HttpConfig unset.
---
 management/cmd/management.go      | 16 ++++++++--
 management/cmd/management_test.go | 49 +++++++++++++++++++++++++++++++
 2 files changed, 62 insertions(+), 3 deletions(-)

diff --git a/management/cmd/management.go b/management/cmd/management.go
index a8f9aa321..8723d309e 100644
--- a/management/cmd/management.go
+++ b/management/cmd/management.go
@@ -214,17 +214,27 @@ func LoadMgmtConfig(ctx context.Context, mgmtConfigPath string) (*nbconfig.Confi
 // ApplyCommandLineOverrides applies command-line flag overrides to the config
 func ApplyCommandLineOverrides(cfg *nbconfig.Config) {
 	if mgmtLetsencryptDomain != "" {
-		cfg.HttpConfig.LetsEncryptDomain = mgmtLetsencryptDomain
+		ensureHttpConfig(cfg).LetsEncryptDomain = mgmtLetsencryptDomain
 	}
 	if mgmtDataDir != "" {
 		cfg.Datadir = mgmtDataDir
 	}
 	if certKey != "" && certFile != "" {
-		cfg.HttpConfig.CertFile = certFile
-		cfg.HttpConfig.CertKey = certKey
+		httpConfig := ensureHttpConfig(cfg)
+		httpConfig.CertFile = certFile
+		httpConfig.CertKey = certKey
 	}
 }
 
+// ensureHttpConfig creates the HttpConfig section only when a flag writes to
+// it, since the embedded IdP warns about any HttpConfig it finds.
+func ensureHttpConfig(cfg *nbconfig.Config) *nbconfig.HttpServerConfig {
+	if cfg.HttpConfig == nil {
+		cfg.HttpConfig = &nbconfig.HttpServerConfig{}
+	}
+	return cfg.HttpConfig
+}
+
 // ApplyEmbeddedIdPConfig populates HttpConfig and EmbeddedIdP storage from config when embedded IdP is enabled.
 // This allows users to only specify EmbeddedIdP config without duplicating values in HttpConfig.
 func ApplyEmbeddedIdPConfig(ctx context.Context, cfg *nbconfig.Config) error {
diff --git a/management/cmd/management_test.go b/management/cmd/management_test.go
index e34e1975e..bf386e4ba 100644
--- a/management/cmd/management_test.go
+++ b/management/cmd/management_test.go
@@ -80,6 +80,55 @@ func TestApplyEmbeddedIdPConfigRequiresSingleAccountDomain(t *testing.T) {
 	require.ErrorContains(t, ApplyEmbeddedIdPConfig(context.Background(), cfg), "embedded IdP requires single account mode")
 }
 
+// A config without an HttpConfig section is valid with the embedded IdP, so the
+// TLS flags must not assume the section exists.
+func TestApplyCommandLineOverridesWithoutHttpConfig(t *testing.T) {
+	previousDomain, previousCertFile, previousCertKey := mgmtLetsencryptDomain, certFile, certKey
+	t.Cleanup(func() {
+		mgmtLetsencryptDomain, certFile, certKey = previousDomain, previousCertFile, previousCertKey
+	})
+
+	tests := []struct {
+		name     string
+		domain   string
+		certFile string
+		certKey  string
+		want     nbconfig.HttpServerConfig
+	}{
+		{
+			name:   "letsencrypt domain",
+			domain: "mgmt.example.com",
+			want:   nbconfig.HttpServerConfig{LetsEncryptDomain: "mgmt.example.com"},
+		},
+		{
+			name:     "certificate files",
+			certFile: "/etc/netbird/tls/tls.crt",
+			certKey:  "/etc/netbird/tls/tls.key",
+			want:     nbconfig.HttpServerConfig{CertFile: "/etc/netbird/tls/tls.crt", CertKey: "/etc/netbird/tls/tls.key"},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			mgmtLetsencryptDomain, certFile, certKey = tt.domain, tt.certFile, tt.certKey
+			cfg := &nbconfig.Config{}
+
+			ApplyCommandLineOverrides(cfg)
+
+			require.NotNil(t, cfg.HttpConfig, "HttpConfig should be created for the TLS flags")
+			assert.Equal(t, tt.want, *cfg.HttpConfig, "HttpConfig should carry only the flag values")
+		})
+	}
+
+	t.Run("no TLS flags", func(t *testing.T) {
+		mgmtLetsencryptDomain, certFile, certKey = "", "", ""
+		cfg := &nbconfig.Config{}
+
+		ApplyCommandLineOverrides(cfg)
+
+		assert.Nil(t, cfg.HttpConfig, "HttpConfig should stay unset so the embedded IdP does not warn about it")
+	})
+}
+
 func createConfig(config string) (string, error) {
 	tmpfile, err := os.CreateTemp("", "config.json")
 	if err != nil {

From 66a28fd666834d11eac54a64cbb569e78f52eb6a Mon Sep 17 00:00:00 2001
From: Maycon Santos <mlsmaycon@gmail.com>
Date: Mon, 12 Oct 2026 13:54:15 +0200
Subject: [PATCH 46/70] [client] Add nblink, an unprivileged forwarder into the
 network (#7955)

Reaching an internal service meant installing the agent, which needs root
for a TUN device. nblink runs the embedded client in netstack mode and
forwards local HTTP listeners to upstreams inside the tunnel, so it works on
managed machines and in rootless containers. Upstream names resolve
in-process.

Forwards bind loopback unless --allow-public-bind is given. The listener
refuses rebound and cross-site browser requests and bounds stalled request
bodies. It ships as release archives and a distroless image that runs under
an arbitrary UID.

An embedded client given no StatePath now keeps its state in memory rather
than falling back to the installed agent's state file, which every embedded
client in a proxy process also shared. The state manager gets an explicit
in-memory store for it.
---
 .github/workflows/agent-network-e2e.yml      |   2 +-
 .goreleaser.yaml                             |  54 ++
 client/Dockerfile-nblink                     |  34 +
 client/embed/embed.go                        |  16 +-
 client/grpc/dialer_generic.go                |  24 +-
 client/internal/connect.go                   |  23 +-
 client/internal/statemanager/manager.go      |  63 +-
 client/internal/statemanager/manager_test.go |  65 ++
 client/internal/statemanager/store.go        |  91 +++
 client/link/README.md                        | 225 +++++++
 client/link/auth.go                          | 101 +++
 client/link/auth_test.go                     |  70 ++
 client/link/cmd/nblink/main.go               |  69 ++
 client/link/cmd/nblink/main_test.go          |  80 +++
 client/link/config.go                        | 245 +++++++
 client/link/config_test.go                   | 219 ++++++
 client/link/forward.go                       | 217 ++++++
 client/link/forward_http.go                  | 422 ++++++++++++
 client/link/forward_http_test.go             | 563 ++++++++++++++++
 client/link/forward_http_upstream_test.go    | 286 ++++++++
 client/link/forward_test.go                  | 170 +++++
 client/link/link.go                          | 253 +++++++
 client/link/link_test.go                     | 440 ++++++++++++
 e2e/agentnetwork/nblink_test.go              | 670 +++++++++++++++++++
 e2e/harness/Dockerfile.nblink                |  37 +
 e2e/harness/nblink.go                        | 508 ++++++++++++++
 e2e/harness/proxy.go                         |   7 +
 shared/management/client/grpc.go             |   8 +-
 28 files changed, 4891 insertions(+), 71 deletions(-)
 create mode 100644 client/Dockerfile-nblink
 create mode 100644 client/internal/statemanager/manager_test.go
 create mode 100644 client/internal/statemanager/store.go
 create mode 100644 client/link/README.md
 create mode 100644 client/link/auth.go
 create mode 100644 client/link/auth_test.go
 create mode 100644 client/link/cmd/nblink/main.go
 create mode 100644 client/link/cmd/nblink/main_test.go
 create mode 100644 client/link/config.go
 create mode 100644 client/link/config_test.go
 create mode 100644 client/link/forward.go
 create mode 100644 client/link/forward_http.go
 create mode 100644 client/link/forward_http_test.go
 create mode 100644 client/link/forward_http_upstream_test.go
 create mode 100644 client/link/forward_test.go
 create mode 100644 client/link/link.go
 create mode 100644 client/link/link_test.go
 create mode 100644 e2e/agentnetwork/nblink_test.go
 create mode 100644 e2e/harness/Dockerfile.nblink
 create mode 100644 e2e/harness/nblink.go

diff --git a/.github/workflows/agent-network-e2e.yml b/.github/workflows/agent-network-e2e.yml
index 9501c5fba..41bfe153d 100644
--- a/.github/workflows/agent-network-e2e.yml
+++ b/.github/workflows/agent-network-e2e.yml
@@ -52,7 +52,7 @@ jobs:
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: /tmp/.buildx-cache
-          key: ${{ runner.os }}-anet-e2e-buildx-${{ hashFiles('go.sum', 'combined/Dockerfile.multistage', 'proxy/Dockerfile.multistage', 'e2e/harness/Dockerfile.client') }}
+          key: ${{ runner.os }}-anet-e2e-buildx-${{ hashFiles('go.sum', 'combined/Dockerfile.multistage', 'proxy/Dockerfile.multistage', 'e2e/harness/Dockerfile.client', 'e2e/harness/Dockerfile.nblink') }}
           restore-keys: |
             ${{ runner.os }}-anet-e2e-buildx-
 
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 6bb4e9e8a..ebb4a8525 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -216,6 +216,29 @@ builds:
       - -s -w -X main.Version={{.Version}} -X main.Commit={{.Commit}} -X main.BuildDate={{.CommitDate}}
     mod_timestamp: "{{ .CommitTimestamp }}"
 
+  - id: nblink
+    dir: client/link/cmd/nblink
+    env: [CGO_ENABLED=0]
+    binary: nblink
+    goos:
+      - linux
+      - darwin
+      - windows
+    goarch:
+      - amd64
+      - arm64
+      - arm
+    goarm:
+      - 7
+    ignore:
+      - goos: windows
+        goarch: arm
+      - goos: darwin
+        goarch: arm
+    ldflags:
+      - -s -w -X github.com/netbirdio/netbird/version.version={{.Version}}
+    mod_timestamp: "{{ .CommitTimestamp }}"
+
   - id: netbird-idp-migrate
     dir: tools/idp-migrate
     env:
@@ -280,6 +303,15 @@ archives:
     builds:
       - netbird-mysql-migrate
     name_template: "netbird-mysql-migrate_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+  - id: nblink
+    builds:
+      - nblink
+    name_template: "nblink_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+    # goreleaser archives as tar.gz everywhere unless told otherwise, and
+    # nblink is downloaded and extracted by hand on Windows too.
+    format_overrides:
+      - goos: windows
+        format: zip
 
 nfpms:
   - maintainer: Netbird <dev@netbird.io>
@@ -619,6 +651,28 @@ dockers_v2:
        "org.opencontainers.image.revision": "{{.FullCommit}}"
        "org.opencontainers.image.source": "{{.GitURL}}"
        "maintainer": "dev@netbird.io"
+   - id: nblink
+     disable: "{{ .Env.SKIP_DOCKER_PUSH }}"
+     ids:
+       - nblink
+     images:
+       - netbirdio/nblink
+       - ghcr.io/netbirdio/nblink
+     tags:
+       - "{{ .Version }}"
+       - "{{ if eq .Env.SKIP_PUBLISH \"false\" }}latest{{ end }}"
+     dockerfile: client/Dockerfile-nblink
+     platforms:
+       - linux/amd64
+       - linux/arm64
+       - linux/arm
+     annotations:
+       "org.opencontainers.image.created": "{{.Date}}"
+       "org.opencontainers.image.title": "nblink"
+       "org.opencontainers.image.version": "{{.Version}}"
+       "org.opencontainers.image.revision": "{{.FullCommit}}"
+       "org.opencontainers.image.source": "{{.GitURL}}"
+       "maintainer": "dev@netbird.io"
    - id: proxy-ubi
      disable: "{{ .Env.SKIP_DOCKER_PUSH }}"
      ids:
diff --git a/client/Dockerfile-nblink b/client/Dockerfile-nblink
new file mode 100644
index 000000000..63177a6c0
--- /dev/null
+++ b/client/Dockerfile-nblink
@@ -0,0 +1,34 @@
+# nblink runs unprivileged: no TUN device, no capabilities, no host networking.
+#
+# The image is built for platforms that assign an arbitrary UID at run time, so
+# it must not depend on a passwd entry and its state directory has to be
+# writable by the root group rather than by one named user.
+FROM alpine:3.22 AS build
+
+# Group 0 owns the state directory so a container started as any UID in that
+# group can still persist its identity. Mode 770 rather than g=u, because the
+# directory holds the peer's keys and nothing outside owner and group should
+# read them, including when the path is bind-mounted from a host.
+RUN mkdir -p /tmp/state/nblink \
+    && chgrp -R 0 /tmp/state/nblink \
+    && chmod -R 770 /tmp/state/nblink
+
+FROM gcr.io/distroless/static-debian13:nonroot
+
+ARG TARGETPLATFORM
+COPY ${TARGETPLATFORM}/nblink /usr/local/bin/nblink
+# COPY of a directory copies its contents and creates the target with mode
+# 755, which group 0 cannot write. Copying the parent makes nblink/ itself the
+# copied entry, so its mode survives.
+COPY --from=build --chown=65532:0 /tmp/state/ /var/lib/
+
+# Numeric so the runtime can substitute its own UID without a passwd lookup.
+USER 65532:0
+
+# No NB_STATE_DIR by default: state stays in memory, so the image runs on a
+# read-only root filesystem without a volume. Set NB_STATE_DIR=/var/lib/nblink
+# and mount a volume there to keep the peer identity; a volume mounted over
+# the directory starts out with its group-0 ownership.
+ENV NB_LOG_LEVEL=info
+
+ENTRYPOINT ["/usr/local/bin/nblink"]
diff --git a/client/embed/embed.go b/client/embed/embed.go
index 5a3d540ec..6fdddab48 100644
--- a/client/embed/embed.go
+++ b/client/embed/embed.go
@@ -54,6 +54,9 @@ type Client struct {
 	jwtToken   string
 	connect    *internal.ConnectClient
 	recorder   *peer.Status
+	// inMemoryState is set when no StatePath was given in netstack mode,
+	// where the client changes nothing on the host that needs restoring.
+	inMemoryState bool
 }
 
 // Options configures a new Client.
@@ -78,7 +81,8 @@ type Options struct {
 	NoUserspace bool
 	// ConfigPath is the path to the netbird config file. If empty, the config will be stored in memory and not persisted.
 	ConfigPath string
-	// StatePath is the path to the netbird state file
+	// StatePath is the path to the netbird state file. When empty in netstack
+	// mode, state is kept in memory; with NoUserspace the default path is used.
 	StatePath string
 	// DisableClientRoutes disables the client routes
 	DisableClientRoutes bool
@@ -193,7 +197,6 @@ func New(opts Options) (*Client, error) {
 	}
 
 	if opts.StatePath != "" {
-		// TODO: Disable state if path not provided
 		if err := os.Setenv("NB_DNS_STATE_FILE", opts.StatePath); err != nil {
 			return nil, fmt.Errorf("setenv: %w", err)
 		}
@@ -261,6 +264,9 @@ func New(opts Options) (*Client, error) {
 		jwtToken:   opts.JWTToken,
 		config:     config,
 		recorder:   peer.NewRecorder(config.ManagementURL.String()),
+		// Without a path the default would be the installed agent's state
+		// file, which this client must neither read nor overwrite.
+		inMemoryState: opts.StatePath == "" && !opts.NoUserspace,
 	}, nil
 }
 
@@ -292,7 +298,11 @@ func (c *Client) Start(startCtx context.Context) error {
 	if err, _ := authClient.Login(ctx, c.setupKey, c.jwtToken); err != nil {
 		return fmt.Errorf("login: %w", err)
 	}
-	client := internal.NewConnectClient(ctx, c.config, c.recorder)
+	var connectOpts []internal.ConnectClientOption
+	if c.inMemoryState {
+		connectOpts = append(connectOpts, internal.WithInMemoryState())
+	}
+	client := internal.NewConnectClient(ctx, c.config, c.recorder, connectOpts...)
 	client.SetSyncResponsePersistence(true)
 
 	// either startup error (permanent backoff err) or nil err (successful engine up)
diff --git a/client/grpc/dialer_generic.go b/client/grpc/dialer_generic.go
index 737787223..72b3538ba 100644
--- a/client/grpc/dialer_generic.go
+++ b/client/grpc/dialer_generic.go
@@ -6,12 +6,9 @@ import (
 	"context"
 	"fmt"
 	"net"
-	"os/user"
+	"os"
 	"runtime"
 
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-
 	log "github.com/sirupsen/logrus"
 	"google.golang.org/grpc"
 
@@ -45,18 +42,13 @@ func WithSweeper(sweeper Sweeper) grpc.DialOption {
 }
 
 func dialContext(ctx context.Context, addr string) (net.Conn, error) {
-	if runtime.GOOS == "linux" {
-		currentUser, err := user.Current()
-		if err != nil {
-			return nil, status.Errorf(codes.FailedPrecondition, "failed to get current user: %v", err)
-		}
-
-		// the custom dialer requires root permissions which are not required for use cases run as non-root
-		if currentUser.Uid != "0" {
-			log.Debug("Not running as root, using standard dialer")
-			dialer := &net.Dialer{}
-			return dialer.DialContext(ctx, "tcp", addr)
-		}
+	// The custom dialer requires root permissions which are not required for
+	// use cases run as non-root. The effective UID is read directly: a passwd
+	// lookup fails without cgo for a UID that has no entry, as on OpenShift.
+	if runtime.GOOS == "linux" && os.Geteuid() != 0 {
+		log.Debug("Not running as root, using standard dialer")
+		dialer := &net.Dialer{}
+		return dialer.DialContext(ctx, "tcp", addr)
 	}
 
 	conn, err := nbnet.NewDialer().DialContext(ctx, "tcp", addr)
diff --git a/client/internal/connect.go b/client/internal/connect.go
index de7f46b2e..7173f6875 100644
--- a/client/internal/connect.go
+++ b/client/internal/connect.go
@@ -72,6 +72,9 @@ type ConnectClient struct {
 	updateManager *updater.Manager
 
 	persistSyncResponse bool
+	// inMemoryState keeps the state manager off disk, for clients that change
+	// nothing on the host that a later run would have to restore.
+	inMemoryState bool
 
 	// netMgr gates every reconnection loop on OS-reported network
 	// availability and sweeps connections on network change.
@@ -84,6 +87,12 @@ type ConnectClient struct {
 // ConnectClientOption configures optional ConnectClient behavior.
 type ConnectClientOption func(*ConnectClient)
 
+// WithInMemoryState keeps client state in memory instead of the default state
+// file, so the client neither reads nor writes another installation's state.
+func WithInMemoryState() ConnectClientOption {
+	return func(c *ConnectClient) { c.inMemoryState = true }
+}
+
 // WithNetEvents injects the OS network event handling.
 func WithNetEvents(events *netevents.Manager) ConnectClientOption {
 	return func(c *ConnectClient) { c.netMgr = events }
@@ -272,8 +281,15 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 		return err
 	}
 
+	// path stays alongside the manager because the engine derives StateDir
+	// from it; an in-memory client leaves it empty.
 	var path string
-	if runtime.GOOS == "ios" || runtime.GOOS == "android" {
+	var stateManager *statemanager.Manager
+	switch {
+	case c.inMemoryState:
+		log.Debugf("client state is kept in memory")
+		stateManager = statemanager.NewInMemory()
+	case runtime.GOOS == "ios" || runtime.GOOS == "android":
 		// On mobile, use the provided state file path directly
 		if !fileExists(mobileDependency.StateFilePath) {
 			if err := createFile(mobileDependency.StateFilePath); err != nil {
@@ -282,11 +298,12 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 			}
 		}
 		path = mobileDependency.StateFilePath
-	} else {
+		stateManager = statemanager.New(path)
+	default:
 		sm := profilemanager.NewServiceManager("")
 		path = sm.GetStatePath()
+		stateManager = statemanager.New(path)
 	}
-	stateManager := statemanager.New(path)
 	stateManager.RegisterState(&sshconfig.ShutdownState{})
 
 	if c.updateManager != nil {
diff --git a/client/internal/statemanager/manager.go b/client/internal/statemanager/manager.go
index ca4194690..413c910f0 100644
--- a/client/internal/statemanager/manager.go
+++ b/client/internal/statemanager/manager.go
@@ -1,13 +1,9 @@
 package statemanager
 
 import (
-	"bytes"
 	"context"
 	"encoding/json"
-	"errors"
 	"fmt"
-	"io/fs"
-	"os"
 	"reflect"
 	"sync"
 	"time"
@@ -17,7 +13,6 @@ import (
 	"golang.org/x/exp/maps"
 
 	nberrors "github.com/netbirdio/netbird/client/errors"
-	"github.com/netbirdio/netbird/util"
 )
 
 const (
@@ -56,7 +51,7 @@ type Manager struct {
 	cancel context.CancelFunc
 	done   chan struct{}
 
-	filePath string
+	store store
 	// holds the states that are registered with the manager and that are to be persisted
 	states map[string]State
 	// holds the state names that have been updated and need to be persisted with the next save
@@ -65,10 +60,20 @@ type Manager struct {
 	stateTypes map[string]reflect.Type
 }
 
-// New creates a new Manager instance
+// New creates a Manager that persists its states to filePath.
 func New(filePath string) *Manager {
+	return newManager(&fileStore{path: filePath})
+}
+
+// NewInMemory creates a Manager that persists nothing, for a client that
+// changes nothing on the host and so has no state a later run must restore.
+func NewInMemory() *Manager {
+	return newManager(memoryStore{})
+}
+
+func newManager(s store) *Manager {
 	return &Manager{
-		filePath:   filePath,
+		store:      s,
 		states:     make(map[string]State),
 		dirty:      make(map[string]struct{}),
 		stateTypes: make(map[string]reflect.Type),
@@ -274,7 +279,7 @@ func (m *Manager) PersistState(ctx context.Context) error {
 	done := make(chan error, 1)
 	start := time.Now()
 	go func() {
-		done <- util.WriteBytesWithRestrictedPermission(ctx, m.filePath, bs)
+		done <- m.store.save(ctx, bs)
 	}()
 
 	select {
@@ -293,45 +298,9 @@ func (m *Manager) PersistState(ctx context.Context) error {
 	return nil
 }
 
-// loadStateFile reads and unmarshals the state file into a map of raw JSON messages
+// loadStateFile returns the states an earlier run persisted.
 func (m *Manager) loadStateFile(deleteCorrupt bool) (map[string]json.RawMessage, error) {
-	data, err := os.ReadFile(m.filePath)
-	if err != nil {
-		if errors.Is(err, fs.ErrNotExist) {
-			log.Debugf("state file %s does not exist", m.filePath)
-			return nil, nil // nolint:nilnil
-		}
-		return nil, fmt.Errorf("read state file: %w", err)
-	}
-
-	var rawStates map[string]json.RawMessage
-	if err := json.Unmarshal(data, &rawStates); err != nil {
-		if len(bytes.TrimSpace(data)) == 0 {
-			log.Warnf("state file %s is empty (%d bytes)", m.filePath, len(data))
-		} else {
-			log.Warnf("state file %s has malformed content (%d bytes)", m.filePath, len(data))
-		}
-		m.handleCorruptedState(deleteCorrupt)
-		return nil, fmt.Errorf("unmarshal states: %w", err)
-	}
-
-	return rawStates, nil
-}
-
-// handleCorruptedState creates a backup of a corrupted state file by moving it
-func (m *Manager) handleCorruptedState(deleteCorrupt bool) {
-	if !deleteCorrupt {
-		return
-	}
-	log.Warn("State file appears to be corrupted, attempting to back it up")
-
-	backupPath := fmt.Sprintf("%s.corrupted.%d", m.filePath, time.Now().UnixNano())
-	if err := os.Rename(m.filePath, backupPath); err != nil {
-		log.Errorf("Failed to backup corrupted state file: %v", err)
-		return
-	}
-
-	log.Infof("Created backup of corrupted state file at: %s", backupPath)
+	return m.store.load(deleteCorrupt)
 }
 
 // loadSingleRawState unmarshals a raw state into a concrete state object
diff --git a/client/internal/statemanager/manager_test.go b/client/internal/statemanager/manager_test.go
new file mode 100644
index 000000000..52b9ac585
--- /dev/null
+++ b/client/internal/statemanager/manager_test.go
@@ -0,0 +1,65 @@
+package statemanager
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type testState struct {
+	Value string `json:"value"`
+}
+
+func (s *testState) Name() string { return "test_state" }
+
+func TestInMemoryManagerNeverTouchesDisk(t *testing.T) {
+	// Run from an empty directory, so a write to a relative or empty path
+	// would leave a file behind here.
+	dir := t.TempDir()
+	t.Chdir(dir)
+
+	m := NewInMemory()
+	m.RegisterState(&testState{})
+	require.NoError(t, m.UpdateState(&testState{Value: "kept"}))
+	require.NoError(t, m.PersistState(context.Background()), "persisting in memory must succeed")
+
+	entries, err := os.ReadDir(dir)
+	require.NoError(t, err)
+	assert.Empty(t, entries, "an in-memory manager must not write a state file")
+
+	assert.Equal(t, &testState{Value: "kept"}, m.GetState(&testState{}), "the state must still be held in memory")
+	assert.NoError(t, m.LoadState(&testState{}), "loading with nothing on disk must succeed")
+
+	names, err := m.GetSavedStateNames()
+	require.NoError(t, err)
+	assert.Empty(t, names, "an in-memory manager has no saved states")
+}
+
+// An empty path is a misconfiguration rather than a request for memory: the
+// in-memory manager has its own constructor, so a path that resolved to
+// nothing must surface instead of silently discarding every write.
+func TestManagerWithoutAPathFailsToPersist(t *testing.T) {
+	m := New("")
+	m.RegisterState(&testState{})
+	require.NoError(t, m.UpdateState(&testState{Value: "kept"}))
+
+	assert.Error(t, m.PersistState(context.Background()),
+		"an empty path must report that it cannot persist, not quietly drop the state")
+}
+
+func TestManagerPersistsToItsFile(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "state.json")
+
+	m := New(path)
+	m.RegisterState(&testState{})
+	require.NoError(t, m.UpdateState(&testState{Value: "kept"}))
+	require.NoError(t, m.PersistState(context.Background()))
+
+	names, err := New(path).GetSavedStateNames()
+	require.NoError(t, err)
+	assert.Equal(t, []string{"test_state"}, names, "a manager with a path must write its state there")
+}
diff --git a/client/internal/statemanager/store.go b/client/internal/statemanager/store.go
new file mode 100644
index 000000000..fffa38396
--- /dev/null
+++ b/client/internal/statemanager/store.go
@@ -0,0 +1,91 @@
+package statemanager
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/util"
+)
+
+// store is where a Manager keeps its states between runs.
+type store interface {
+	// load returns the states persisted by an earlier run, or an empty map
+	// when there are none. deleteCorrupt asks the store to move a state it
+	// cannot parse out of the way.
+	load(deleteCorrupt bool) (map[string]json.RawMessage, error)
+	// save replaces the persisted states with data.
+	save(ctx context.Context, data []byte) error
+}
+
+// fileStore persists states to a file, which is what an installed agent needs:
+// it changes routing, DNS and firewall rules on the host, and a later run has
+// to know what to put back.
+type fileStore struct {
+	path string
+}
+
+// memoryStore keeps nothing. An embedded client in netstack mode changes
+// nothing on the host, so there is no state a later run has to restore, and
+// writing one would mean reading and overwriting another installation's file.
+type memoryStore struct{}
+
+func (f *fileStore) load(deleteCorrupt bool) (map[string]json.RawMessage, error) {
+	data, err := os.ReadFile(f.path)
+	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			log.Debugf("state file %s does not exist", f.path)
+			return nil, nil //nolint:nilnil // no file is not a failure, there is simply nothing to load
+		}
+		return nil, fmt.Errorf("read state file: %w", err)
+	}
+
+	var rawStates map[string]json.RawMessage
+	if err := json.Unmarshal(data, &rawStates); err != nil {
+		if len(bytes.TrimSpace(data)) == 0 {
+			log.Warnf("state file %s is empty (%d bytes)", f.path, len(data))
+		} else {
+			log.Warnf("state file %s has malformed content (%d bytes)", f.path, len(data))
+		}
+		f.handleCorrupted(deleteCorrupt)
+		return nil, fmt.Errorf("unmarshal states: %w", err)
+	}
+
+	return rawStates, nil
+}
+
+func (f *fileStore) save(ctx context.Context, data []byte) error {
+	return util.WriteBytesWithRestrictedPermission(ctx, f.path, data)
+}
+
+// handleCorrupted moves a state file that cannot be parsed aside, so the next
+// run starts from nothing rather than failing on the same content forever.
+func (f *fileStore) handleCorrupted(deleteCorrupt bool) {
+	if !deleteCorrupt {
+		return
+	}
+	log.Warn("State file appears to be corrupted, attempting to back it up")
+
+	backupPath := fmt.Sprintf("%s.corrupted.%d", f.path, time.Now().UnixNano())
+	if err := os.Rename(f.path, backupPath); err != nil {
+		log.Errorf("Failed to backup corrupted state file: %v", err)
+		return
+	}
+
+	log.Infof("Created backup of corrupted state file at: %s", backupPath)
+}
+
+func (memoryStore) load(bool) (map[string]json.RawMessage, error) {
+	return map[string]json.RawMessage{}, nil
+}
+
+func (memoryStore) save(context.Context, []byte) error {
+	return nil
+}
diff --git a/client/link/README.md b/client/link/README.md
new file mode 100644
index 000000000..ffd08c7ad
--- /dev/null
+++ b/client/link/README.md
@@ -0,0 +1,225 @@
+# nblink
+
+`nblink` forwards local ports into a NetBird network from an unprivileged
+process. It runs the client in userspace mode, so there is no TUN device to
+create and no elevated privileges to grant. That lets it run on managed
+machines and in rootless containers where the normal agent cannot.
+
+Overlay names on the upstream side are resolved inside the tunnel, so
+`/etc/resolv.conf` is never touched.
+
+## Install
+
+Download the archive for your platform, extract it, and run the binary. There
+is no installer and no service to register.
+
+## Use
+
+A forward is one self-describing argument, and the flag repeats:
+
+```sh
+nblink --forward 'http://8080=https://grafana.internal'
+```
+
+The scheme on the left selects the listener type. The right side is the
+upstream reached over the network. Giving only a port binds loopback, so the
+example above listens on `127.0.0.1:8080`.
+
+Without a setup key, `nblink` opens a browser to log in and prints the URL so
+it also works over SSH.
+
+```sh
+# several forwards from one session
+nblink --forward 'http://8080=https://grafana.internal' \
+       --forward 'http://9090=https://prometheus.internal'
+
+# non-interactive
+nblink --forward 'http://8080=https://grafana.internal' --setup-key "$NB_SETUP_KEY"
+
+# check the configuration without touching the network
+nblink --forward 'http://8080=https://grafana.internal' --check
+```
+
+Port `0` asks the operating system for a free port. The address actually bound
+is printed at startup.
+
+## Container
+
+Every flag has a matching `NB_`-prefixed environment variable, which is how the
+image is configured. `NB_FORWARD` takes a comma separated list.
+
+```sh
+docker run --rm -p 127.0.0.1:8080:8080 \
+  --mount type=bind,src="$(pwd)/nb_setup_key",dst=/run/secrets/nb_setup_key,readonly \
+  -e NB_SETUP_KEY=file:/run/secrets/nb_setup_key \
+  -e NB_FORWARD='http://0.0.0.0:8080=https://grafana.internal' \
+  -e NB_ALLOW_PUBLIC_BIND=true \
+  netbirdio/nblink
+```
+
+The key file has to exist before the run and be readable by the container
+user, which is UID 65532 in group 0. A bind mount keeps the host file's owner
+and mode, so a root-owned key written with the usual `chmod 600` is not
+readable and the run fails on startup with `permission denied`. Either give the
+file to that UID (`chown 65532`) or keep it mode `640` in group 0
+(`chgrp 0`). If the source path does not exist, `--mount` refuses to start the
+container; the older `-v` form creates a directory there instead, which the read
+then reports as a directory.
+
+The image needs no `--privileged`, no `--cap-add NET_ADMIN`, no
+`--device /dev/net/tun` and no host networking.
+
+Inside a container the listener has to bind `0.0.0.0`, because a published
+port arrives on the container's own interface rather than its loopback. That
+still requires `NB_ALLOW_PUBLIC_BIND`, so exposing a forward is always
+something the operator wrote down. Publish it on the host's loopback as above:
+a bare `-p 8080:8080` publishes on every host interface, which hands the
+peer's identity to anyone on the network who can reach the port.
+
+A public listener accepts requests addressed to `localhost` or to an IP
+address. Any name other machines use to reach it, such as a DNS name or a
+Kubernetes Service name, has to be listed with `--allowed-host`
+(`NB_ALLOWED_HOST`). See [Limits](#limits) for why.
+
+The image keeps its state in memory, so it runs on a read-only root filesystem
+and each start registers a new peer. To keep one identity across restarts, set
+`NB_STATE_DIR=/var/lib/nblink` and mount a volume there:
+
+```sh
+docker run --rm --read-only -p 127.0.0.1:8080:8080 \
+  -v nblink-state:/var/lib/nblink -e NB_STATE_DIR=/var/lib/nblink \
+  ...
+```
+
+Without a state directory, use an ephemeral setup key so the peers left behind
+by earlier starts are removed once they go offline, rather than piling up.
+
+A kept identity is not yet a kept login. Without a setup key every start runs
+the browser flow, even when the peer's session is still valid, because the
+token is resolved before the stored profile is opened. Give a restart that has
+to be unattended a setup key.
+
+## Kubernetes and OpenShift
+
+The image fits OpenShift's `restricted-v2` SCC and the Kubernetes `restricted`
+Pod Security Standard as it is:
+
+- It runs as any UID. OpenShift assigns one from the namespace range and adds
+  group 0, and everything the process writes is owned by group 0.
+- It needs no capabilities, no privilege escalation, no TUN device and no host
+  networking, so `capabilities: {drop: [ALL]}` and
+  `allowPrivilegeEscalation: false` hold.
+- With state in memory it needs no writable path, so
+  `readOnlyRootFilesystem: true` holds.
+
+The simplest shape is a sidecar. The application in the same pod reaches the
+forward on `localhost`, so the listener stays on loopback and needs neither
+`NB_ALLOW_PUBLIC_BIND` nor a Service:
+
+```yaml
+containers:
+  - name: nblink
+    image: netbirdio/nblink
+    env:
+      - name: NB_FORWARD
+        value: http://8080=https://grafana.internal
+      - name: NB_SETUP_KEY
+        value: file:/run/secrets/nblink/setup-key
+    volumeMounts:
+      - name: nblink-key
+        mountPath: /run/secrets/nblink
+        readOnly: true
+    securityContext:
+      allowPrivilegeEscalation: false
+      readOnlyRootFilesystem: true
+      runAsNonRoot: true
+      capabilities: {drop: [ALL]}
+      seccompProfile: {type: RuntimeDefault}
+volumes:
+  - name: nblink-key
+    secret:
+      secretName: nblink-setup-key
+      defaultMode: 0440
+```
+
+A Secret volume is owned by the pod's `fsGroup`, which OpenShift sets for
+every pod, so mode `0440` is readable by the container and by nothing else.
+
+To keep the identity across pod restarts, mount a persistent volume at
+`/var/lib/nblink` and set `NB_STATE_DIR` to it. `fsGroup` makes the volume
+writable by the arbitrary UID. A `Deployment` with more than one replica
+cannot share one state directory: every replica is its own peer, so give
+each one its own volume through a `StatefulSet`, or keep state in memory with
+an ephemeral setup key.
+
+Serving a forward to other pods through a Service needs `NB_ALLOW_PUBLIC_BIND`
+and every name callers use in `NB_ALLOWED_HOST`, for example
+`grafana-link,grafana-link.monitoring.svc,grafana-link.monitoring.svc.cluster.local`.
+Each caller acts under the forwarder peer's identity, so restrict who can
+reach the Service with a `NetworkPolicy`. Do not expose it through a Route or
+an Ingress.
+
+## Configuration
+
+| Flag | Environment | Default | Purpose |
+| --- | --- | --- | --- |
+| `--forward` | `NB_FORWARD` | | Forward spec, repeatable. Comma separated in the environment. |
+| `--setup-key` | `NB_SETUP_KEY` | | Non-interactive login. Accepts a `file:` prefix. |
+| `--management-url` | `NB_MANAGEMENT_URL` | NetBird cloud | Management server. |
+| `--hostname` | `NB_HOSTNAME` | host name | Peer name in the network. |
+| `--state-dir` | `NB_STATE_DIR` | memory | Where identity and state persist. |
+| `--log-level` | `NB_LOG_LEVEL` | `info` | Log level. |
+| `--allow-public-bind` | `NB_ALLOW_PUBLIC_BIND` | `false` | Required before binding a non-loopback address. |
+| `--allowed-host` | `NB_ALLOWED_HOST` | | Extra name a listener accepts in `Host`, repeatable. Comma separated in the environment. |
+| `--no-browser` | `NB_NO_BROWSER` | `false` | Print the login URL instead of opening a browser. |
+| `--check` | `NB_CHECK` | `false` | Validate, print the effective forwards, exit. |
+
+A secret given as `file:/path` is read from that file, so a container can mount
+it instead of exposing it in the process environment.
+
+## Limits
+
+`nblink` only dials out. It refuses inbound connections and does not reach the
+host's own network, so the peer cannot become a route into the machine it runs
+on.
+
+A loopback forward answers only requests whose `Host` names the loopback
+interface or a name listed with `--allowed-host`, and refuses any request a
+browser marks as belonging to another page, through either a cross-origin
+`Origin` or a cross-site `Sec-Fetch-Site`. A page the user visits can point its
+own hostname at `127.0.0.1` or embed the address directly, and without those
+checks the browser could reach the upstream through this listener under the
+peer's identity. Ordinary callers send neither header and are unaffected.
+
+A public forward applies the same checks, and also accepts any IP address in
+`Host`, since a page cannot rebind an address. The `Host` check matters there
+too: a container port published on the host's loopback is reached by a
+rebound page with a matching `Origin`, and its unlisted name is the only thing
+that gives it away.
+
+A name listed with `--allowed-host` is trusted rather than merely permitted,
+and the list applies to every forward in the process, loopback ones included.
+`Host` is the one signal a rebound page cannot forge, and listing a name gives
+that up for it: a page served on that name can resolve it to the listener and
+send a matching `Host` and `Origin`, which the browser then marks same-origin.
+List only names you control, and prefer a fully qualified one, since a
+single-label name can be answered by anything on the local network.
+
+A forward on `0.0.0.0` listens on IPv4 only, and one on `::` on IPv6 only.
+
+`nblink` does not ask the local router for a port mapping through UPnP,
+NAT-PMP or PCP, since an unprivileged forwarder should not reconfigure the
+network it runs on. Connections are still established through hole punching
+or the relay. Set `NB_DISABLE_NAT_MAPPER=false` to allow it.
+
+A browser too old to send `Sec-Fetch-Site`, which browsers have sent since
+2020, can still reach a loopback forward with an embedded no-cors GET.
+
+Userspace mode carries TCP, UDP and ping only. It cannot act as an exit node or
+a routing peer and does not take over system DNS. Ports below 1024 need
+privileges the process usually does not have, though some container runtimes
+lower that boundary.
+
+This build forwards HTTP. The `tcp`, `udp` and `socks5` schemes are reserved by
+the grammar and rejected with a message saying so, so adding them later needs
+no change to how a forward is written.
diff --git a/client/link/auth.go b/client/link/auth.go
new file mode 100644
index 000000000..91aa0a426
--- /dev/null
+++ b/client/link/auth.go
@@ -0,0 +1,101 @@
+package link
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/auth"
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/util"
+)
+
+// credentials carries exactly one proof of identity to the embedded client.
+type credentials struct {
+	setupKey string
+	jwtToken string
+}
+
+// resolveCredentials returns a setup key when one was supplied, and otherwise
+// drives the interactive login flow.
+//
+// The embedded client accepts a setup key or an already-issued token, so the
+// browser flow is run here and only its result is handed over.
+func resolveCredentials(ctx context.Context, cfg *Config) (credentials, error) {
+	if cfg.SetupKey != "" {
+		log.Info("authenticating with the configured setup key")
+		return credentials{setupKey: cfg.SetupKey}, nil
+	}
+
+	log.Info("no setup key configured, starting interactive login")
+	token, err := interactiveLogin(ctx, cfg)
+	if err != nil {
+		return credentials{}, err
+	}
+	return credentials{jwtToken: token}, nil
+}
+
+// interactiveLogin runs the standard browser login and returns the token to
+// authenticate the peer with.
+func interactiveLogin(ctx context.Context, cfg *Config) (string, error) {
+	// The flow only needs somewhere to read the management URL from and a key
+	// to talk to it with. The peer identity the client ends up using is
+	// created separately, so this config is deliberately not persisted.
+	flowConfig, err := profilemanager.CreateInMemoryConfig(profilemanager.ConfigInput{
+		ManagementURL: cfg.ManagementURL,
+	})
+	if err != nil {
+		return "", fmt.Errorf("prepare login: %w", err)
+	}
+
+	flow, err := auth.NewOAuthFlow(ctx, flowConfig, util.HasGraphicalSession(), false, "", false)
+	if err != nil {
+		return "", fmt.Errorf("start login: %w", err)
+	}
+
+	info, err := flow.RequestAuthInfo(ctx)
+	if err != nil {
+		return "", fmt.Errorf("request login: %w", err)
+	}
+
+	promptLogin(os.Stderr, util.OpenBrowser, info, cfg.NoBrowser)
+
+	token, err := flow.WaitToken(ctx, info)
+	if err != nil {
+		return "", fmt.Errorf("wait for login: %w", err)
+	}
+
+	return token.GetTokenToUse(), nil
+}
+
+// promptLogin writes the verification URL to out, which the caller points at
+// stderr so stdout stays clean for piping, and opens a browser unless asked not
+// to. The URL is always printed so the flow still works over SSH where no
+// browser can open.
+func promptLogin(out io.Writer, openBrowser func(string) error, info auth.AuthFlowInfo, noBrowser bool) {
+	uri := info.VerificationURIComplete
+	if uri == "" {
+		uri = info.VerificationURI
+	}
+
+	var b strings.Builder
+	fmt.Fprintf(&b, "\nOpen this URL to log in:\n\n    %s\n", uri)
+	if info.UserCode != "" && !strings.Contains(uri, info.UserCode) {
+		fmt.Fprintf(&b, "\n    and enter the code %s\n", info.UserCode)
+	}
+	b.WriteString("\n")
+	if _, err := io.WriteString(out, b.String()); err != nil {
+		log.Warnf("print login URL: %v", err)
+	}
+
+	if noBrowser {
+		return
+	}
+	if err := openBrowser(uri); err != nil {
+		log.Debugf("could not open a browser: %v", err)
+	}
+}
diff --git a/client/link/auth_test.go b/client/link/auth_test.go
new file mode 100644
index 000000000..69920a96c
--- /dev/null
+++ b/client/link/auth_test.go
@@ -0,0 +1,70 @@
+package link
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/auth"
+)
+
+// browserSpy records the URLs a login prompt tried to open.
+type browserSpy struct {
+	opened []string
+	err    error
+}
+
+func (b *browserSpy) open(uri string) error {
+	b.opened = append(b.opened, uri)
+	return b.err
+}
+
+func TestPromptLoginPrintsURLAndOpensBrowser(t *testing.T) {
+	var out strings.Builder
+	browser := &browserSpy{}
+	info := auth.AuthFlowInfo{VerificationURIComplete: "https://login.example/device?code=ABCD-EFGH", UserCode: "ABCD-EFGH"}
+
+	promptLogin(&out, browser.open, info, false)
+
+	assert.Contains(t, out.String(), info.VerificationURIComplete, "the URL must be printed")
+	assert.NotContains(t, out.String(), "enter the code", "a code already in the URL must not be repeated")
+	assert.Equal(t, []string{info.VerificationURIComplete}, browser.opened, "the browser must be opened on the same URL")
+}
+
+func TestPromptLoginNoBrowserStillPrintsURL(t *testing.T) {
+	var out strings.Builder
+	browser := &browserSpy{}
+	info := auth.AuthFlowInfo{VerificationURI: "https://login.example/device", UserCode: "WXYZ-1234"}
+
+	promptLogin(&out, browser.open, info, true)
+
+	assert.Contains(t, out.String(), "https://login.example/device", "the URL must be printed even without a browser")
+	assert.Contains(t, out.String(), "enter the code WXYZ-1234", "a code missing from the URL must be printed")
+	assert.Empty(t, browser.opened, "--no-browser must not open a browser")
+}
+
+func TestPromptLoginSurvivesBrowserFailure(t *testing.T) {
+	var out strings.Builder
+	browser := &browserSpy{err: errors.New("no display")}
+	info := auth.AuthFlowInfo{VerificationURIComplete: "https://login.example/authorize"}
+
+	promptLogin(&out, browser.open, info, false)
+
+	assert.Contains(t, out.String(), "https://login.example/authorize",
+		"the URL must be printed so the login still works where no browser opens")
+}
+
+func TestResolveCredentialsUsesSetupKeyWithoutLogin(t *testing.T) {
+	// An unroutable management URL: a login attempt would fail, so success
+	// proves the setup key path never starts one.
+	cfg := &Config{SetupKey: "11111111-2222-3333-4444-555555555555", ManagementURL: "https://management.invalid"}
+
+	creds, err := resolveCredentials(context.Background(), cfg)
+	require.NoError(t, err)
+	assert.Equal(t, cfg.SetupKey, creds.setupKey, "the configured key must be used")
+	assert.Empty(t, creds.jwtToken, "exactly one proof of identity must be handed over")
+}
diff --git a/client/link/cmd/nblink/main.go b/client/link/cmd/nblink/main.go
new file mode 100644
index 000000000..6ee580c7b
--- /dev/null
+++ b/client/link/cmd/nblink/main.go
@@ -0,0 +1,69 @@
+// Command nblink forwards local listeners into a NetBird network from an
+// unprivileged process.
+package main
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"os/signal"
+	"syscall"
+
+	"github.com/spf13/cobra"
+
+	"github.com/netbirdio/netbird/client/link"
+	"github.com/netbirdio/netbird/util"
+	"github.com/netbirdio/netbird/version"
+)
+
+func main() {
+	if err := rootCmd().Execute(); err != nil {
+		fmt.Fprintf(os.Stderr, "nblink: %v\n", err)
+		os.Exit(1)
+	}
+}
+
+func rootCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "nblink",
+		Short: "Forward local ports into a NetBird network",
+		Long: "nblink runs a NetBird peer in userspace and forwards local listeners\n" +
+			"into the network. It needs no TUN device and no elevated privileges,\n" +
+			"so it runs on managed machines and in rootless containers.\n\n" +
+			"Every flag can also be set through an NB_-prefixed environment variable\n" +
+			"of the same name, which is how the container image is configured.",
+		Example: "  nblink --forward 'http://8080=https://grafana.internal'\n" +
+			"  nblink --forward 'http://127.0.0.1:8080=https://grafana.internal' --setup-key file:/run/secrets/key",
+		Version: version.NetbirdVersion(),
+		// A stray positional argument is a mistake, most often a forward spec
+		// that lost its --forward, and must not start the forwarder anyway.
+		Args: cobra.NoArgs,
+		// main prints the error, so cobra must not print it a second time.
+		SilenceUsage:  true,
+		SilenceErrors: true,
+	}
+
+	raw := link.BindFlags(cmd)
+
+	cmd.RunE = func(cmd *cobra.Command, _ []string) error {
+		if err := link.SetFlagsFromEnvVars(cmd); err != nil {
+			return err
+		}
+
+		cfg, err := raw.Resolve()
+		if err != nil {
+			return err
+		}
+
+		if err := util.InitLog(cfg.LogLevel, util.LogConsole); err != nil {
+			return fmt.Errorf("init log: %w", err)
+		}
+
+		ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+		defer stop()
+
+		return link.Run(ctx, cfg)
+	}
+
+	return cmd
+}
diff --git a/client/link/cmd/nblink/main_test.go b/client/link/cmd/nblink/main_test.go
new file mode 100644
index 000000000..46bd158e6
--- /dev/null
+++ b/client/link/cmd/nblink/main_test.go
@@ -0,0 +1,80 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/version"
+)
+
+// TestMain clears the ambient NB_ environment before any test runs.
+//
+// Every flag reads an NB_-prefixed variable, so a developer who has nblink
+// configured in their own shell would otherwise hand these commands a
+// configuration the test never asked for: an inherited NB_FORWARD alone makes
+// the missing-forward case resolve successfully and the test fail. Clearing
+// here rather than in execute keeps t.Setenv working for the tests that do
+// want a variable set.
+func TestMain(m *testing.M) {
+	for _, entry := range os.Environ() {
+		name, _, _ := strings.Cut(entry, "=")
+		if strings.HasPrefix(name, "NB_") {
+			if err := os.Unsetenv(name); err != nil {
+				fmt.Fprintf(os.Stderr, "unset %s: %v\n", name, err)
+				os.Exit(1)
+			}
+		}
+	}
+	os.Exit(m.Run())
+}
+
+func execute(t *testing.T, args ...string) (string, error) {
+	t.Helper()
+	cmd := rootCmd()
+	var out strings.Builder
+	cmd.SetOut(&out)
+	cmd.SetErr(&out)
+	cmd.SetArgs(args)
+	err := cmd.Execute()
+	return out.String(), err
+}
+
+// A forward spec that lost its --forward is the usual stray argument, and it
+// must not start a forwarder with whatever else was configured.
+func TestRejectsPositionalArguments(t *testing.T) {
+	_, err := execute(t, "--check", "--forward", "http://8080=https://grafana.internal", "http://9090=https://prometheus.internal")
+	require.Error(t, err, "a positional argument must be refused")
+	assert.Contains(t, err.Error(), "unknown command", "the error must point at the stray argument")
+}
+
+func TestRejectsInvalidEnvironmentValue(t *testing.T) {
+	t.Setenv("NB_ALLOW_PUBLIC_BIND", "maybe")
+	_, err := execute(t, "--check", "--forward", "http://8080=https://grafana.internal")
+	require.Error(t, err, "an unparseable environment value must stop the start")
+	assert.Contains(t, err.Error(), "NB_ALLOW_PUBLIC_BIND", "the error must name the variable")
+}
+
+func TestEnvironmentConfiguresAFullCheck(t *testing.T) {
+	t.Setenv("NB_FORWARD", "http://8080=https://grafana.internal,http://0.0.0.0:9090=https://prometheus.internal")
+	t.Setenv("NB_ALLOW_PUBLIC_BIND", "true")
+	t.Setenv("NB_CHECK", "true")
+	_, err := execute(t)
+	assert.NoError(t, err, "a complete environment configuration must pass the check without flags")
+}
+
+func TestRequiresAForward(t *testing.T) {
+	_, err := execute(t, "--check")
+	require.Error(t, err, "a run with no forward must be refused")
+	assert.Contains(t, err.Error(), "NB_FORWARD", "the error must name the environment variable too")
+}
+
+func TestPrintsVersion(t *testing.T) {
+	out, err := execute(t, "--version")
+	require.NoError(t, err)
+	assert.Contains(t, out, version.NetbirdVersion(), "--version must print the build version")
+}
diff --git a/client/link/config.go b/client/link/config.go
new file mode 100644
index 000000000..1f86965f7
--- /dev/null
+++ b/client/link/config.go
@@ -0,0 +1,245 @@
+package link
+
+import (
+	"fmt"
+	"net/netip"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+)
+
+// envPrefix matches the prefix the agent uses, so an operator who already sets
+// NB_SETUP_KEY or NB_MANAGEMENT_URL for the agent can reuse them here.
+const envPrefix = "NB_"
+
+// fileScheme marks a flag value that holds a path to read the real value from,
+// so a container can pass a secret as a mounted file instead of an environment
+// variable visible to anything that can read the process environment.
+const fileScheme = "file:"
+
+// hostnamePattern matches a DNS name per RFC 1123 section 2.1: dot-separated
+// labels of letters, digits and inner hyphens.
+var hostnamePattern = regexp.MustCompile(`^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$`)
+
+// Config is the resolved runtime configuration.
+type Config struct {
+	Forwards        []Forward
+	AllowedHosts    []string
+	SetupKey        string
+	ManagementURL   string
+	Hostname        string
+	StateDir        string
+	LogLevel        string
+	AllowPublicBind bool
+	NoBrowser       bool
+	Check           bool
+}
+
+// rawConfig holds flag values before parsing and validation.
+type rawConfig struct {
+	forwards        []string
+	allowedHosts    []string
+	setupKey        string
+	managementURL   string
+	hostname        string
+	stateDir        string
+	logLevel        string
+	allowPublicBind bool
+	noBrowser       bool
+	check           bool
+}
+
+// Resolve validates the raw flag values and produces a runtime configuration.
+// It reports every problem it can rather than stopping at the first, so an
+// operator fixing a container environment sees the whole list in one run.
+func (r *rawConfig) Resolve() (*Config, error) {
+	cfg := &Config{
+		ManagementURL:   r.managementURL,
+		Hostname:        r.hostname,
+		StateDir:        r.stateDir,
+		LogLevel:        r.logLevel,
+		AllowPublicBind: r.allowPublicBind,
+		NoBrowser:       r.noBrowser,
+		Check:           r.check,
+	}
+
+	setupKey, err := resolveSecret(r.setupKey)
+	if err != nil {
+		return nil, fmt.Errorf("setup key: %w", err)
+	}
+	cfg.SetupKey = setupKey
+
+	if len(r.forwards) == 0 {
+		return nil, fmt.Errorf("at least one --forward is required (env %s)", FlagNameToEnvVar("forward"))
+	}
+
+	var problems []string
+	cfg.AllowedHosts, problems = parseAllowedHosts(r.allowedHosts)
+
+	seen := make(map[string]string, len(r.forwards))
+	for _, spec := range r.forwards {
+		fwd, err := ParseForward(spec)
+		if err != nil {
+			problems = append(problems, err.Error())
+			continue
+		}
+		// Port 0 means the OS assigns one, so several such forwards do not
+		// collide even though they share a spec.
+		if prev, dup := seen[fwd.Listen]; dup && !strings.HasSuffix(fwd.Listen, ":0") {
+			problems = append(problems, fmt.Sprintf("forward %q: %s is already bound by %q", spec, fwd.Listen, prev))
+			continue
+		}
+		if !cfg.AllowPublicBind && !isLoopback(fwd.Listen) {
+			problems = append(problems, fmt.Sprintf(
+				"forward %q: %s is not loopback, pass --allow-public-bind (env %s) to expose it",
+				spec, fwd.Listen, FlagNameToEnvVar("allow-public-bind")))
+			continue
+		}
+		seen[fwd.Listen] = spec
+		fwd.AllowedHosts = cfg.AllowedHosts
+		cfg.Forwards = append(cfg.Forwards, fwd)
+	}
+
+	if len(problems) > 0 {
+		return nil, fmt.Errorf("invalid configuration:\n  %s", strings.Join(problems, "\n  "))
+	}
+
+	return cfg, nil
+}
+
+// ConfigPath returns where the peer identity is persisted, or an empty string
+// when the client should keep it in memory only.
+func (c *Config) ConfigPath() string {
+	if c.StateDir == "" {
+		return ""
+	}
+	return filepath.Join(c.StateDir, "config.json")
+}
+
+// StatePath returns where runtime state is persisted, or an empty string when
+// no state directory was configured.
+func (c *Config) StatePath() string {
+	if c.StateDir == "" {
+		return ""
+	}
+	return filepath.Join(c.StateDir, "state.json")
+}
+
+// BindFlags registers nblink's flags on cmd and returns the backing values.
+// Every flag gains an NB_-prefixed environment variable of the same name, so
+// the container configuration cannot drift from the command line.
+func BindFlags(cmd *cobra.Command) *rawConfig {
+	raw := &rawConfig{}
+	f := cmd.PersistentFlags()
+
+	f.StringSliceVar(&raw.forwards, "forward", nil,
+		"forward spec scheme://[host:]port=upstream, repeatable (env: comma separated)")
+	f.StringSliceVar(&raw.allowedHosts, "allowed-host", nil,
+		"extra name a listener may be reached under, repeatable (env: comma separated)")
+	f.StringVar(&raw.setupKey, "setup-key", "",
+		"setup key for non-interactive login, accepts a file: prefix")
+	f.StringVar(&raw.managementURL, "management-url", profilemanager.DefaultManagementURL,
+		"management server URL")
+	f.StringVar(&raw.hostname, "hostname", "", "peer name in the network")
+	f.StringVar(&raw.stateDir, "state-dir", "",
+		"directory for config and state, kept in memory when empty")
+	f.StringVar(&raw.logLevel, "log-level", "info", "log level")
+	f.BoolVar(&raw.allowPublicBind, "allow-public-bind", false,
+		"permit forwards that bind an address other than loopback")
+	f.BoolVar(&raw.noBrowser, "no-browser", false,
+		"print the login URL instead of opening a browser")
+	f.BoolVar(&raw.check, "check", false,
+		"validate configuration, print the effective forwards and exit")
+
+	return raw
+}
+
+// SetFlagsFromEnvVars fills unset flags from NB_-prefixed environment
+// variables derived from each flag name, so --management-url reads
+// NB_MANAGEMENT_URL. A flag given on the command line wins.
+//
+// A value that does not parse is an error rather than a warning, so a
+// container cannot start with a configuration other than the one it was given.
+func SetFlagsFromEnvVars(cmd *cobra.Command) error {
+	flags := cmd.PersistentFlags()
+	var err error
+	flags.VisitAll(func(f *pflag.Flag) {
+		if err != nil || f.Changed {
+			return
+		}
+		env := FlagNameToEnvVar(f.Name)
+		value, ok := os.LookupEnv(env)
+		if !ok {
+			return
+		}
+		if setErr := flags.Set(f.Name, value); setErr != nil {
+			err = fmt.Errorf("%s: %w", env, setErr)
+		}
+	})
+	return err
+}
+
+// FlagNameToEnvVar converts a flag name to its environment variable, so
+// allow-public-bind becomes NB_ALLOW_PUBLIC_BIND.
+func FlagNameToEnvVar(name string) string {
+	return envPrefix + strings.ToUpper(strings.ReplaceAll(name, "-", "_"))
+}
+
+// parseAllowedHosts normalizes the names given with --allowed-host and reports
+// every entry that is not a plain hostname.
+func parseAllowedHosts(raw []string) ([]string, []string) {
+	var hosts, problems []string
+	for _, entry := range raw {
+		name := normalizeHostname(entry)
+		if _, err := netip.ParseAddr(name); err == nil {
+			problems = append(problems, fmt.Sprintf(
+				"allowed host %q: addresses are already accepted on a public listener, list names only", entry))
+			continue
+		}
+		if !hostnamePattern.MatchString(name) {
+			problems = append(problems, fmt.Sprintf(
+				"allowed host %q: must be a hostname, without scheme, port or wildcard", entry))
+			continue
+		}
+		hosts = append(hosts, name)
+	}
+	return hosts, problems
+}
+
+// normalizeHostname lowercases a name and drops a trailing root dot, so the
+// spellings a client may send compare equal.
+func normalizeHostname(name string) string {
+	return strings.TrimSuffix(strings.ToLower(strings.TrimSpace(name)), ".")
+}
+
+// resolveSecret reads a value that may carry a file: prefix naming the file
+// that holds it. Whitespace around the file contents is trimmed so a trailing
+// newline from the usual tooling does not become part of the secret.
+func resolveSecret(value string) (string, error) {
+	path, ok := strings.CutPrefix(value, fileScheme)
+	if !ok {
+		return value, nil
+	}
+	if path == "" {
+		return "", fmt.Errorf("%s prefix with no path", fileScheme)
+	}
+
+	content, err := os.ReadFile(path)
+	if err != nil {
+		return "", fmt.Errorf("read %s: %w", path, err)
+	}
+
+	// An empty file would otherwise look like no secret at all, silently
+	// turning a non-interactive start into a login that waits for a browser.
+	secret := strings.TrimSpace(string(content))
+	if secret == "" {
+		return "", fmt.Errorf("%s is empty", path)
+	}
+	return secret, nil
+}
diff --git a/client/link/config_test.go b/client/link/config_test.go
new file mode 100644
index 000000000..72b238873
--- /dev/null
+++ b/client/link/config_test.go
@@ -0,0 +1,219 @@
+package link
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// newTestCommand wires the flags the same way the binary does, so the tests
+// exercise the real flag and environment plumbing.
+func newTestCommand() (*cobra.Command, *rawConfig) {
+	cmd := &cobra.Command{Use: "nblink"}
+	return cmd, BindFlags(cmd)
+}
+
+func TestFlagNameToEnvVar(t *testing.T) {
+	assert.Equal(t, "NB_FORWARD", FlagNameToEnvVar("forward"))
+	assert.Equal(t, "NB_ALLOW_PUBLIC_BIND", FlagNameToEnvVar("allow-public-bind"))
+	assert.Equal(t, "NB_MANAGEMENT_URL", FlagNameToEnvVar("management-url"))
+}
+
+func TestSetFlagsFromEnvVars(t *testing.T) {
+	cmd, raw := newTestCommand()
+	t.Setenv("NB_FORWARD", "http://8080=https://a.internal,http://8081=https://b.internal")
+	t.Setenv("NB_MANAGEMENT_URL", "https://mgmt.example:443")
+
+	require.NoError(t, SetFlagsFromEnvVars(cmd))
+
+	assert.Equal(t, []string{"http://8080=https://a.internal", "http://8081=https://b.internal"},
+		raw.forwards, "NB_FORWARD should split on commas into repeated forwards")
+	assert.Equal(t, "https://mgmt.example:443", raw.managementURL)
+}
+
+// A value given on the command line must win over the environment, otherwise a
+// container's baked-in defaults could not be overridden at run time.
+func TestFlagBeatsEnvVar(t *testing.T) {
+	cmd, raw := newTestCommand()
+	require.NoError(t, cmd.PersistentFlags().Set("log-level", "debug"))
+	t.Setenv("NB_LOG_LEVEL", "error")
+
+	require.NoError(t, SetFlagsFromEnvVars(cmd))
+
+	assert.Equal(t, "debug", raw.logLevel, "an explicit flag should not be overwritten by the environment")
+}
+
+// A container must not start with a configuration other than the one it was
+// given, so an unparseable value stops startup instead of leaving the default.
+func TestSetFlagsFromEnvVarsRejectsInvalidValue(t *testing.T) {
+	cmd, raw := newTestCommand()
+	t.Setenv("NB_ALLOW_PUBLIC_BIND", "yes-please")
+
+	err := SetFlagsFromEnvVars(cmd)
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "NB_ALLOW_PUBLIC_BIND", "the error should name the variable at fault")
+	assert.False(t, raw.allowPublicBind, "the default must not be silently kept in effect")
+}
+
+func TestResolveRequiresForward(t *testing.T) {
+	_, raw := newTestCommand()
+
+	_, err := raw.Resolve()
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "at least one --forward")
+}
+
+func TestResolveGatesPublicBind(t *testing.T) {
+	_, raw := newTestCommand()
+	raw.forwards = []string{"http://0.0.0.0:8080=https://grafana.internal"}
+
+	_, err := raw.Resolve()
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "allow-public-bind",
+		"binding a public address should require the explicit opt-in")
+}
+
+func TestResolveAllowsPublicBindWhenOptedIn(t *testing.T) {
+	_, raw := newTestCommand()
+	raw.forwards = []string{"http://0.0.0.0:8080=https://grafana.internal"}
+	raw.allowPublicBind = true
+
+	cfg, err := raw.Resolve()
+
+	require.NoError(t, err)
+	require.Len(t, cfg.Forwards, 1)
+	assert.Equal(t, "0.0.0.0:8080", cfg.Forwards[0].Listen)
+}
+
+func TestResolveRejectsDuplicateListener(t *testing.T) {
+	_, raw := newTestCommand()
+	raw.forwards = []string{
+		"http://8080=https://a.internal",
+		"http://127.0.0.1:8080=https://b.internal",
+	}
+
+	_, err := raw.Resolve()
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "already bound",
+		"two forwards on one address should be caught before binding")
+}
+
+// Every bad spec should be reported together, so fixing a container
+// environment does not take one deploy per mistake.
+func TestResolveReportsEveryProblem(t *testing.T) {
+	_, raw := newTestCommand()
+	raw.forwards = []string{
+		"http://70000=https://a.internal",
+		"gopher://8081=https://b.internal",
+	}
+
+	_, err := raw.Resolve()
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "out of range")
+	assert.Contains(t, err.Error(), "unknown scheme")
+}
+
+func TestResolveAllowedHosts(t *testing.T) {
+	_, raw := newTestCommand()
+	raw.forwards = []string{"http://0.0.0.0:8080=https://a.internal", "http://8081=https://b.internal"}
+	raw.allowPublicBind = true
+	raw.allowedHosts = []string{"NBLink.LAN.", "svc.ns.svc.cluster.local"}
+
+	cfg, err := raw.Resolve()
+
+	require.NoError(t, err)
+	assert.Equal(t, []string{"nblink.lan", "svc.ns.svc.cluster.local"}, cfg.AllowedHosts,
+		"allowed hosts must be stored in the form they are compared in")
+	for _, f := range cfg.Forwards {
+		assert.Equal(t, cfg.AllowedHosts, f.AllowedHosts, "every forward must carry the allowed hosts")
+	}
+}
+
+func TestResolveRejectsMalformedAllowedHosts(t *testing.T) {
+	_, raw := newTestCommand()
+	raw.forwards = []string{"http://8080=https://a.internal"}
+	raw.allowedHosts = []string{"http://nblink.lan", "nblink.lan:8080", "*.lan", "10.0.0.5", ""}
+
+	_, err := raw.Resolve()
+
+	require.Error(t, err)
+	for _, entry := range []string{`"http://nblink.lan"`, `"nblink.lan:8080"`, `"*.lan"`, `""`} {
+		assert.Contains(t, err.Error(), entry, "every malformed entry must be reported")
+	}
+	assert.Contains(t, err.Error(), "addresses are already accepted", "an address must be explained, not just refused")
+}
+
+func TestResolveSetupKeyFromFile(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "key")
+	// The trailing newline mirrors what a mounted secret usually contains.
+	require.NoError(t, os.WriteFile(path, []byte("A1B2C3D4-SETUP-KEY\n"), 0o600))
+
+	_, raw := newTestCommand()
+	raw.forwards = []string{"http://8080=https://a.internal"}
+	raw.setupKey = "file:" + path
+
+	cfg, err := raw.Resolve()
+
+	require.NoError(t, err)
+	assert.Equal(t, "A1B2C3D4-SETUP-KEY", cfg.SetupKey, "a mounted secret should be trimmed")
+}
+
+// Each port-0 forward gets its own OS-assigned port, so sharing the spec is
+// not a collision.
+func TestResolveAllowsSeveralEphemeralPorts(t *testing.T) {
+	_, raw := newTestCommand()
+	raw.forwards = []string{
+		"http://0=https://a.internal",
+		"http://0=https://b.internal",
+	}
+
+	cfg, err := raw.Resolve()
+
+	require.NoError(t, err)
+	assert.Len(t, cfg.Forwards, 2, "two ephemeral forwards should both be kept")
+}
+
+func TestResolveSetupKeyFileEmpty(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "key")
+	require.NoError(t, os.WriteFile(path, []byte("   \n"), 0o600))
+
+	_, raw := newTestCommand()
+	raw.forwards = []string{"http://8080=https://a.internal"}
+	raw.setupKey = "file:" + path
+
+	_, err := raw.Resolve()
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "is empty",
+		"an empty secret should fail rather than fall back to interactive login")
+}
+
+func TestResolveSetupKeyFileMissing(t *testing.T) {
+	_, raw := newTestCommand()
+	raw.forwards = []string{"http://8080=https://a.internal"}
+	raw.setupKey = "file:" + filepath.Join(t.TempDir(), "absent")
+
+	_, err := raw.Resolve()
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "setup key")
+}
+
+func TestStatePathsFollowStateDir(t *testing.T) {
+	cfg := &Config{}
+	assert.Empty(t, cfg.ConfigPath(), "an unset state dir should keep identity in memory")
+	assert.Empty(t, cfg.StatePath())
+
+	cfg.StateDir = "/var/lib/nblink"
+	assert.Equal(t, filepath.Join("/var/lib/nblink", "config.json"), cfg.ConfigPath())
+	assert.Equal(t, filepath.Join("/var/lib/nblink", "state.json"), cfg.StatePath())
+}
diff --git a/client/link/forward.go b/client/link/forward.go
new file mode 100644
index 000000000..25d272931
--- /dev/null
+++ b/client/link/forward.go
@@ -0,0 +1,217 @@
+// Package link implements nblink, an unprivileged forwarder that exposes local
+// listeners and carries their traffic into the NetBird overlay.
+//
+// The process runs the embedded client in netstack mode, so it needs no TUN
+// device and no elevated privileges. Overlay names on the upstream side are
+// resolved inside the tunnel rather than through the host resolver.
+package link
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"net/netip"
+	"net/url"
+	"regexp"
+	"strconv"
+	"strings"
+)
+
+// defaultBindHost is used when a forward spec gives a port but no bind address.
+// Binding loopback by default keeps the overlay unreachable from the rest of
+// the network until the operator opts in.
+const defaultBindHost = "127.0.0.1"
+
+// ProtoHTTP forwards HTTP requests to an upstream URL over the overlay.
+const ProtoHTTP = "http"
+
+// supportedProtos lists the forward schemes this build accepts. Specs naming a
+// known but unimplemented scheme are rejected with a clearer message than an
+// unknown one would produce.
+var (
+	supportedProtos = map[string]bool{ProtoHTTP: true}
+	plannedProtos   = map[string]bool{"tcp": true, "udp": true, "socks5": true}
+
+	// schemePrefix matches a URL scheme at the start of a string, per RFC 3986
+	// section 3.1.
+	schemePrefix = regexp.MustCompile(`^[a-zA-Z][a-zA-Z0-9+.\-]*://`)
+
+	// urlPassword matches the password half of a URL's userinfo. Errors quote
+	// the spec the operator typed, which would otherwise echo a password back
+	// to the terminal and into whatever captured it.
+	//
+	// The password runs to the last '@' of the authority, which is where
+	// net/url ends the userinfo, so a password containing an '@' is covered
+	// whole. The username ends at the first ':', as net/url splits it.
+	urlPassword = regexp.MustCompile(`(//[^/:\s]*):[^/\s]*@`)
+)
+
+// Forward is one local listener and the overlay address it carries traffic to.
+type Forward struct {
+	// Proto is the listener type, taken from the scheme on the left of the spec.
+	Proto string
+	// Listen is the local bind address as host:port.
+	Listen string
+	// Upstream is the target reached over the overlay.
+	Upstream *url.URL
+	// Spec is the original text, used in logs and errors so the operator sees
+	// what they typed rather than a normalized form.
+	Spec string
+	// AllowedHosts are names, beyond loopback names and addresses, that the
+	// listener accepts in the Host header.
+	AllowedHosts []string
+}
+
+// String returns the forward in the spec form the operator wrote.
+func (f Forward) String() string {
+	return fmt.Sprintf("%s://%s=%s", f.Proto, f.Listen, f.Upstream)
+}
+
+// ParseForward parses a forward spec of the form scheme://[host:]port=upstream.
+//
+// The scheme on the left selects the listener type, the right side is the
+// overlay target. A spec that gives only a port binds loopback.
+func ParseForward(spec string) (Forward, error) {
+	spec = strings.TrimSpace(spec)
+	if spec == "" {
+		return Forward{}, fmt.Errorf("empty forward spec")
+	}
+
+	schemeEnd := strings.Index(spec, "://")
+	if schemeEnd < 0 {
+		return Forward{}, fmt.Errorf("forward %q: missing scheme, want scheme://[host:]port=upstream", redactSpec(spec))
+	}
+	proto := strings.ToLower(spec[:schemeEnd])
+
+	// The left side cannot contain '=', so the first one always separates the
+	// listener from the upstream even when the upstream carries a query string.
+	sep := strings.Index(spec, "=")
+	if sep < 0 || sep < schemeEnd {
+		return Forward{}, fmt.Errorf("forward %q: missing '=' between listener and upstream", redactSpec(spec))
+	}
+
+	if !supportedProtos[proto] {
+		if plannedProtos[proto] {
+			return Forward{}, fmt.Errorf("forward %q: %s forwarding is not supported yet, this build handles %s", redactSpec(spec), proto, ProtoHTTP)
+		}
+		return Forward{}, fmt.Errorf("forward %q: unknown scheme %q", redactSpec(spec), proto)
+	}
+
+	listen, err := parseListen(spec[schemeEnd+len("://") : sep])
+	if err != nil {
+		return Forward{}, fmt.Errorf("forward %q: %w", redactSpec(spec), err)
+	}
+
+	upstream, err := parseUpstream(spec[sep+1:])
+	if err != nil {
+		return Forward{}, fmt.Errorf("forward %q: %w", redactSpec(spec), err)
+	}
+
+	return Forward{Proto: proto, Listen: listen, Upstream: upstream, Spec: spec}, nil
+}
+
+// redactSpec replaces any password inside a forward spec, so an error may
+// still name the spec it refers to.
+func redactSpec(spec string) string {
+	return urlPassword.ReplaceAllString(spec, "$1:xxxxx@")
+}
+
+// parseListen normalizes the listener side of a spec to host:port, defaulting
+// the host to loopback when only a port is given.
+func parseListen(raw string) (string, error) {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return "", fmt.Errorf("missing listen address")
+	}
+
+	host, port := defaultBindHost, raw
+	if strings.Contains(raw, ":") {
+		h, p, err := net.SplitHostPort(raw)
+		if err != nil {
+			return "", fmt.Errorf("parse listen address %q: %w", raw, err)
+		}
+		if h != "" {
+			host = h
+		}
+		port = p
+	}
+
+	// Only literal addresses are accepted. A name would be resolved once by
+	// the loopback check and again by the bind, and an answer that changed in
+	// between would put a listener on a public address without the opt-in. A
+	// zone suffix stays allowed: it is part of the literal, resolved the same
+	// way at both points, and link-local addresses cannot be bound without it.
+	if strings.EqualFold(host, "localhost") {
+		host = defaultBindHost
+	}
+	if _, err := netip.ParseAddr(host); err != nil {
+		return "", fmt.Errorf("listen host %q must be an IP address or localhost", host)
+	}
+
+	n, err := strconv.Atoi(port)
+	if err != nil {
+		return "", fmt.Errorf("listen port %q is not a number", port)
+	}
+	// Port 0 asks the OS for a free port. The bound address is printed at
+	// startup, so the operator still learns where to point a client.
+	if n < 0 || n > 65535 {
+		return "", fmt.Errorf("listen port %d out of range 0-65535", n)
+	}
+
+	return net.JoinHostPort(host, port), nil
+}
+
+// parseUpstream validates the overlay target of an HTTP forward. The host is
+// resolved later, inside the tunnel, so only the shape is checked here.
+func parseUpstream(raw string) (*url.URL, error) {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return nil, fmt.Errorf("missing upstream")
+	}
+	// Only a leading scheme counts. A "://" inside a path or query, as in a
+	// redirect parameter, belongs to the target rather than to this URL.
+	if !schemePrefix.MatchString(raw) {
+		raw = "https://" + raw
+	}
+
+	u, err := url.Parse(raw)
+	if err != nil {
+		// url.Error carries the whole URL, password included, so only the
+		// reason inside it is reported alongside the redacted form.
+		var parseErr *url.Error
+		if errors.As(err, &parseErr) {
+			err = parseErr.Err
+		}
+		return nil, fmt.Errorf("parse upstream %q: %w", redactSpec(raw), err)
+	}
+	if u.Scheme != "http" && u.Scheme != "https" {
+		return nil, fmt.Errorf("upstream scheme %q must be http or https", u.Scheme)
+	}
+	if u.Hostname() == "" {
+		return nil, fmt.Errorf("upstream %q has no host", redactSpec(raw))
+	}
+	// Credentials in the upstream would reach the logs and the --check output,
+	// and the forwarder does not use them to authenticate anything.
+	if u.User != nil {
+		return nil, fmt.Errorf("upstream %q must not carry credentials", u.Redacted())
+	}
+
+	return u, nil
+}
+
+// isLoopback reports whether addr binds only the loopback interface. The host
+// is always a literal address, because parseListen rejects names, so this
+// decides the same address the bind will use.
+func isLoopback(addr string) bool {
+	host, _, err := net.SplitHostPort(addr)
+	if err != nil {
+		return false
+	}
+	ip, err := netip.ParseAddr(host)
+	if err != nil {
+		return false
+	}
+	// Unmap first, so a v4-mapped form such as ::ffff:127.0.0.1 is recognised
+	// as the loopback address it is.
+	return ip.Unmap().IsLoopback()
+}
diff --git a/client/link/forward_http.go b/client/link/forward_http.go
new file mode 100644
index 000000000..463de5134
--- /dev/null
+++ b/client/link/forward_http.go
@@ -0,0 +1,422 @@
+package link
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"net/netip"
+	"net/url"
+	"os"
+	"strings"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	// dialTimeout bounds connection establishment only. Request and response
+	// bodies stream without a deadline so long downloads are not cut off.
+	dialTimeout = 30 * time.Second
+
+	// readHeaderTimeout bounds how long a caller may take to send request
+	// headers.
+	readHeaderTimeout = 10 * time.Second
+
+	// fetchSiteHeader is the browser's own account of how a request was
+	// initiated. It is the only one of the three guard signals that a no-cors
+	// GET carries.
+	fetchSiteHeader = "Sec-Fetch-Site"
+
+	// defaultHTTPPort fills in the port an origin leaves implicit.
+	defaultHTTPPort = "80"
+
+	idleConnTimeout       = 90 * time.Second
+	tlsHandshakeTimeout   = 10 * time.Second
+	expectContinueTimeout = time.Second
+	maxIdleConns          = 100
+
+	// maxHeaderBytes caps the request headers a caller may send.
+	maxHeaderBytes = 32 << 10
+
+	// maxLoggedPath caps how much of a caller-supplied path reaches the log.
+	maxLoggedPath = 128
+)
+
+// bodyIdleTimeout bounds how long a request body may stall without delivering
+// more bytes. It is a variable so tests can shorten it.
+var bodyIdleTimeout = 30 * time.Second
+
+// foreignFetchSites are the Sec-Fetch-Site values a browser sends when a page
+// other than this listener's own initiated the request. A page on another port
+// is same-site here, because a bare address or localhost is its own site, yet
+// it is a different application with no more claim on this listener than any
+// other page has.
+var foreignFetchSites = map[string]bool{"cross-site": true, "same-site": true}
+
+// DialFunc establishes a connection inside the overlay. The embedded client
+// supplies the real implementation; tests supply their own.
+type DialFunc func(ctx context.Context, network, addr string) (net.Conn, error)
+
+// httpForwarder serves one local HTTP listener and proxies what it accepts to
+// an upstream reached over the overlay.
+type httpForwarder struct {
+	forward  Forward
+	server   *http.Server
+	listener net.Listener
+}
+
+// idleTimeoutBody applies a fresh read deadline before every read, so a
+// transfer that keeps progressing runs as long as it needs while a stalled one
+// is cut off.
+type idleTimeoutBody struct {
+	io.ReadCloser
+	controller *http.ResponseController
+	idle       time.Duration
+}
+
+// newHTTPForwarder binds the local listener and prepares the reverse proxy.
+// Binding happens here rather than in Serve so a port clash is reported before
+// any forward is announced as ready.
+func newHTTPForwarder(fwd Forward, dial DialFunc) (*httpForwarder, error) {
+	listener, err := net.Listen(listenNetwork(fwd.Listen), fwd.Listen)
+	if err != nil {
+		return nil, fmt.Errorf("listen on %s: %w", fwd.Listen, bindHint(fwd.Listen, err))
+	}
+
+	upstream := fwd.Upstream
+	proxy := &httputil.ReverseProxy{
+		Rewrite: func(r *httputil.ProxyRequest) {
+			r.SetURL(upstream)
+			// The upstream decides routing and TLS verification from Host, and
+			// it must see its own name rather than the local bind address.
+			r.Out.Host = upstream.Host
+		},
+		Transport: &http.Transport{
+			DialContext:       boundedDial(dial),
+			ForceAttemptHTTP2: true,
+			MaxIdleConns:      maxIdleConns,
+			// Without this the per-host default of two applies and MaxIdleConns
+			// never binds, so concurrent requests re-dial the overlay instead
+			// of reusing a connection.
+			MaxIdleConnsPerHost:   maxIdleConns,
+			IdleConnTimeout:       idleConnTimeout,
+			TLSHandshakeTimeout:   tlsHandshakeTimeout,
+			ExpectContinueTimeout: expectContinueTimeout,
+		},
+		ErrorHandler: func(w http.ResponseWriter, r *http.Request, err error) {
+			if errors.Is(err, context.Canceled) {
+				return
+			}
+			log.Debugf("%s %s %s: %v", fwd.Listen, r.Method, truncatePath(r.URL.Path), err)
+			// No upstream answered, so the connection is closed rather than
+			// kept for a next request. What is left of the body is still
+			// drained afterwards, bounded by the deadline armed in
+			// withBodyIdleTimeout.
+			rejectRequest(w, "upstream unreachable over the overlay", http.StatusBadGateway)
+		},
+	}
+
+	return &httpForwarder{
+		forward:  fwd,
+		listener: listener,
+		server: &http.Server{
+			Handler: withBodyIdleTimeout(guardRebinding(proxy, isLoopback(fwd.Listen), fwd.AllowedHosts)),
+			// Bound how long a caller may take to send headers, so a slow
+			// sender cannot hold a connection and its goroutine open
+			// indefinitely. Neither deadline limits body streaming, so large
+			// uploads and downloads still run as long as they need.
+			ReadHeaderTimeout: readHeaderTimeout,
+			IdleTimeout:       idleConnTimeout,
+			// Go's default allows about a megabyte of headers per connection,
+			// which a caller on a published port can spend freely.
+			MaxHeaderBytes: maxHeaderBytes,
+		},
+	}, nil
+}
+
+// Addr returns the address actually bound, which differs from the spec when
+// the operator asked for port 0.
+func (f *httpForwarder) Addr() string {
+	return f.listener.Addr().String()
+}
+
+// Serve runs until the forwarder is closed.
+func (f *httpForwarder) Serve() error {
+	if err := f.server.Serve(f.listener); err != nil && !errors.Is(err, http.ErrServerClosed) {
+		return fmt.Errorf("serve %s: %w", f.forward.Listen, err)
+	}
+	return nil
+}
+
+// Close stops the listener and waits for in-flight requests to finish, up to
+// the deadline carried by ctx.
+//
+// Shutdown only closes listeners the server has taken over in Serve, so the
+// raw listener is closed here as well. Otherwise a forwarder that was built
+// but never served, which happens when a later bind in the same set fails,
+// would hold its socket until the process exits.
+func (f *httpForwarder) Close(ctx context.Context) error {
+	shutdownErr := f.server.Shutdown(ctx)
+	if err := f.listener.Close(); err != nil && !errors.Is(err, net.ErrClosed) {
+		return err
+	}
+	return shutdownErr
+}
+
+func (b *idleTimeoutBody) Read(p []byte) (int, error) {
+	if err := b.setDeadline(time.Now().Add(b.idle)); err != nil {
+		return 0, err
+	}
+
+	n, err := b.ReadCloser.Read(p)
+	if errors.Is(err, io.EOF) {
+		// The body arrived in full, so its deadline has to go with it. The
+		// server keeps reading the connection while the handler streams its
+		// reply, and a deadline left over from the body would cut that reply
+		// off partway through.
+		//
+		// Only EOF clears it. On any other error the caller stalled or the
+		// connection broke, and the deadline is what stops the server from
+		// blocking forever as it drains what was never sent.
+		b.clearDeadline()
+	}
+	return n, err
+}
+
+func (b *idleTimeoutBody) setDeadline(t time.Time) error {
+	// A connection that cannot carry a deadline, which the controller reports
+	// as unsupported, still reads normally rather than failing the request.
+	if err := b.controller.SetReadDeadline(t); err != nil && !errors.Is(err, http.ErrNotSupported) {
+		return err
+	}
+	return nil
+}
+
+// clearDeadline removes any read deadline. A failure here cannot be acted on
+// and must not mask the error the caller is already returning.
+func (b *idleTimeoutBody) clearDeadline() {
+	if err := b.setDeadline(time.Time{}); err != nil {
+		log.Debugf("clear read deadline: %v", err)
+	}
+}
+
+// listenNetwork pins the address family to the literal the operator wrote.
+// Plain "tcp" turns 0.0.0.0 into a dual-stack wildcard that also accepts IPv6,
+// which exposes more than the spec asked for. A "6" network binds IPv6 only.
+func listenNetwork(addr string) string {
+	host, _, err := net.SplitHostPort(addr)
+	if err != nil {
+		return "tcp"
+	}
+	ip, err := netip.ParseAddr(host)
+	if err != nil {
+		return "tcp"
+	}
+	if ip.Is4() {
+		return "tcp4"
+	}
+	return "tcp6"
+}
+
+// boundedDial applies dialTimeout to connection establishment without
+// constraining the lifetime of the connection it returns.
+func boundedDial(dial DialFunc) DialFunc {
+	return func(ctx context.Context, network, addr string) (net.Conn, error) {
+		ctx, cancel := context.WithTimeout(ctx, dialTimeout)
+		defer cancel()
+
+		start := time.Now()
+		conn, err := dial(ctx, network, addr)
+		if err != nil {
+			log.Debugf("dial %s over the overlay failed after %s: %v",
+				addr, time.Since(start).Truncate(time.Millisecond), err)
+			return nil, err
+		}
+		log.Debugf("dial %s over the overlay took %s, remote %s",
+			addr, time.Since(start).Truncate(time.Millisecond), conn.RemoteAddr())
+		return conn, nil
+	}
+}
+
+// bindHint adds the likely cause when a bind fails for a reason an operator
+// can act on. The privileged-port boundary is detected from the error rather
+// than assumed from the port number, because containers often lower it to zero.
+func bindHint(addr string, err error) error {
+	if errors.Is(err, os.ErrPermission) {
+		return fmt.Errorf("%w (nblink runs unprivileged, so %s likely needs a port above 1023)", err, addr)
+	}
+	return err
+}
+
+// withBodyIdleTimeout cuts off a caller that sends request headers and then
+// stops sending the body.
+//
+// ReadHeaderTimeout covers only the headers, and IdleTimeout applies between
+// requests rather than during one, so without this a caller could hold a
+// connection and its handler open indefinitely. A total ReadTimeout would
+// close that gap but would also break legitimate long uploads, so the deadline
+// is refreshed on every read that makes progress instead.
+func withBodyIdleTimeout(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Body != nil && r.Body != http.NoBody {
+			b := &idleTimeoutBody{
+				ReadCloser: r.Body,
+				controller: http.NewResponseController(w),
+				idle:       bodyIdleTimeout,
+			}
+			// Armed before the handler runs rather than on the first read,
+			// because it is the only bound on the drain the server performs
+			// after the handler returns. That drain reads the connection
+			// directly and no response header suppresses it, so a handler
+			// that never touches the body would otherwise leave the
+			// connection and its goroutine held until the caller goes away.
+			//
+			// Replacing r.Body also hides it from net/http's own type-based
+			// checks, which short-circuit that drain for a body it recognises,
+			// so this deadline stands in for those too.
+			if err := b.setDeadline(time.Now().Add(b.idle)); err != nil {
+				log.Debugf("arm request body deadline: %v", err)
+			}
+			r.Body = b
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+// guardRebinding rejects requests that a browser issued on behalf of some
+// other site, and requests that reached a loopback listener under a name that
+// is not its own.
+//
+// A loopback forwarder is reachable from any page the user visits. A site can
+// point its own hostname at 127.0.0.1, and it can also embed the loopback
+// address directly in an img, script or iframe URL. Either way the browser
+// sends the request, and this listener would otherwise proxy it into the
+// network under the peer's identity.
+//
+// Three signals separate those from a local caller. Host carries the
+// attacker's name in the rebinding variant. Origin is present on any
+// cross-origin fetch. Sec-Fetch-Site covers what the first two miss: the
+// browser states how the request was initiated, including on the no-cors GETs
+// that carry no Origin at all. Non-browser callers send none of the latter
+// two and are unaffected.
+//
+// A browser too old to send Sec-Fetch-Site can still reach a loopback forward
+// with an embedded no-cors GET. Browsers have sent it since 2020, so this
+// residual needs a deliberately outdated one.
+//
+// The Host check holds on a publicly bound listener too, which is how a
+// container port published to the host is reached. There a rebound page sends
+// its own name with a matching Origin, so Host is the only signal left. Other
+// machines reach a public listener by address, which is accepted; any name
+// they use instead has to be listed with --allowed-host.
+func guardRebinding(next http.Handler, loopbackOnly bool, allowedHosts []string) http.Handler {
+	allowed := make(map[string]bool, len(allowedHosts))
+	for _, h := range allowedHosts {
+		allowed[normalizeHostname(h)] = true
+	}
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if !isAllowedHost(hostnameOf(r.Host), loopbackOnly, allowed) {
+			rejectRequest(w, "unexpected Host for this listener, list it with --allowed-host", http.StatusMisdirectedRequest)
+			return
+		}
+		if !isLocalCaller(r) {
+			rejectRequest(w, "cross-origin request refused", http.StatusForbidden)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+// rejectRequest answers a request the forwarder will not proxy and closes the
+// connection.
+//
+// Closing stops the connection being reused; it does not stop the server
+// draining what is left of the request body. That drain runs from
+// finishRequest whatever the response said, and it reads the original body
+// rather than the handler's wrapper, so the only thing bounding it is the
+// deadline withBodyIdleTimeout arms on the connection before the handler
+// chain runs. Without that deadline a caller that stopped sending holds the
+// connection and its goroutine even though the answer already went out.
+func rejectRequest(w http.ResponseWriter, msg string, code int) {
+	w.Header().Set("Connection", "close")
+	http.Error(w, msg, code)
+}
+
+// isLocalCaller reports whether a request may be proxied, from what the
+// browser says about where it came from.
+func isLocalCaller(r *http.Request) bool {
+	if foreignFetchSites[strings.ToLower(r.Header.Get(fetchSiteHeader))] {
+		return false
+	}
+
+	// Only a browser sets Origin, and a legitimate one for this listener is
+	// same-origin. Anything else is a cross-site caller.
+	origin := r.Header.Get("Origin")
+	return origin == "" || isSameOrigin(origin, r.Host)
+}
+
+// hostnameOf strips any port from a Host header value.
+func hostnameOf(host string) string {
+	if h, _, err := net.SplitHostPort(host); err == nil {
+		return h
+	}
+	return host
+}
+
+// isAllowedHost reports whether a request may arrive under host. Loopback
+// names always may and listed names always may. A public listener also
+// accepts any address, since a page cannot rebind an address it does not
+// control.
+func isAllowedHost(host string, loopbackOnly bool, allowed map[string]bool) bool {
+	if isLocalName(host) || allowed[normalizeHostname(host)] {
+		return true
+	}
+	if loopbackOnly {
+		return false
+	}
+	_, err := netip.ParseAddr(strings.Trim(host, "[]"))
+	return err == nil
+}
+
+// isLocalName reports whether host names this machine's loopback interface.
+func isLocalName(host string) bool {
+	if strings.EqualFold(host, "localhost") {
+		return true
+	}
+	ip, err := netip.ParseAddr(strings.Trim(host, "[]"))
+	return err == nil && ip.Unmap().IsLoopback()
+}
+
+// isSameOrigin reports whether an Origin header names this listener. Scheme,
+// host and port all have to match: the forwarder serves plaintext HTTP, and a
+// page on another loopback port is a different origin like any other.
+func isSameOrigin(origin, host string) bool {
+	u, err := url.Parse(origin)
+	if err != nil || u.Scheme != "http" {
+		return false
+	}
+	return normalizeAuthority(u.Host) == normalizeAuthority(host)
+}
+
+// normalizeAuthority reduces an authority to a comparable host:port, so two
+// spellings of one origin match.
+func normalizeAuthority(authority string) string {
+	host, port, err := net.SplitHostPort(authority)
+	if err != nil {
+		host, port = authority, defaultHTTPPort
+	}
+	return strings.ToLower(strings.Trim(host, "[]")) + ":" + port
+}
+
+// truncatePath shortens a caller-supplied path so a log line cannot be made
+// arbitrarily long by the request that produced it.
+func truncatePath(path string) string {
+	if len(path) <= maxLoggedPath {
+		return path
+	}
+	return path[:maxLoggedPath] + "..."
+}
diff --git a/client/link/forward_http_test.go b/client/link/forward_http_test.go
new file mode 100644
index 000000000..1518a565a
--- /dev/null
+++ b/client/link/forward_http_test.go
@@ -0,0 +1,563 @@
+package link
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// errDialNotExpected marks a test that must never reach the overlay, so a dial
+// that does happen fails the test rather than passing silently.
+var errDialNotExpected = errors.New("dial not expected in this test")
+
+func refuseDial(context.Context, string, string) (net.Conn, error) {
+	return nil, errDialNotExpected
+}
+
+// overlayDialer stands in for the embedded client. It records what the
+// forwarder asked to reach and then connects to a local test server, which
+// lets the whole proxy path be exercised without a live network.
+type overlayDialer struct {
+	target string
+	calls  atomic.Int64
+	asked  atomic.Value
+}
+
+func (d *overlayDialer) dial(ctx context.Context, network, addr string) (net.Conn, error) {
+	d.calls.Add(1)
+	d.asked.Store(addr)
+	var dialer net.Dialer
+	return dialer.DialContext(ctx, network, d.target)
+}
+
+func (d *overlayDialer) lastAsked() string {
+	v, _ := d.asked.Load().(string)
+	return v
+}
+
+// startForwarder wires a forwarder in front of upstream and returns its local
+// base URL.
+func startForwarder(t *testing.T, upstream *httptest.Server) (string, *overlayDialer) {
+	t.Helper()
+
+	upstreamURL, err := url.Parse(upstream.URL)
+	require.NoError(t, err)
+
+	// The spec names a hostname that does not resolve on this machine, proving
+	// the forwarder hands resolution to the dialer instead of the host.
+	fwd, err := ParseForward("http://127.0.0.1:0=http://grafana.internal")
+	require.NoError(t, err)
+
+	dialer := &overlayDialer{target: upstreamURL.Host}
+	f, err := newHTTPForwarder(fwd, dialer.dial)
+	require.NoError(t, err)
+
+	go func() { _ = f.Serve() }()
+	t.Cleanup(func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+		_ = f.Close(ctx)
+	})
+
+	return "http://" + f.Addr(), dialer
+}
+
+func TestForwarderProxiesThroughOverlayDialer(t *testing.T) {
+	var gotHost, gotPath string
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotHost, gotPath = r.Host, r.URL.RequestURI()
+		_, _ = io.WriteString(w, "reached upstream")
+	}))
+	defer upstream.Close()
+
+	base, dialer := startForwarder(t, upstream)
+
+	resp, err := http.Get(base + "/dashboard?orgId=1")
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	body, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+	assert.Equal(t, "reached upstream", string(body))
+	assert.Equal(t, "/dashboard?orgId=1", gotPath, "path and query should be forwarded unchanged")
+	assert.Equal(t, "grafana.internal", gotHost,
+		"upstream must see its own Host, not the local bind address")
+	assert.Equal(t, int64(1), dialer.calls.Load(), "the overlay dialer should carry the request")
+	assert.Equal(t, "grafana.internal:80", dialer.lastAsked(),
+		"the overlay dialer should be asked for the upstream name, so it resolves in the tunnel")
+}
+
+func TestForwarderForwardsRequestBodyAndMethod(t *testing.T) {
+	var gotMethod, gotBody string
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod = r.Method
+		b, _ := io.ReadAll(r.Body)
+		gotBody = string(b)
+		w.WriteHeader(http.StatusCreated)
+	}))
+	defer upstream.Close()
+
+	base, _ := startForwarder(t, upstream)
+
+	resp, err := http.Post(base+"/api", "application/json", strings.NewReader(`{"k":"v"}`))
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	assert.Equal(t, http.StatusCreated, resp.StatusCode)
+	assert.Equal(t, http.MethodPost, gotMethod)
+	assert.Equal(t, `{"k":"v"}`, gotBody, "request bodies should reach the upstream intact")
+}
+
+// A forward whose upstream cannot be reached must answer 502 rather than hang
+// or leak the dial error to the caller.
+func TestForwarderReportsUnreachableUpstream(t *testing.T) {
+	fwd, err := ParseForward("http://127.0.0.1:0=http://grafana.internal")
+	require.NoError(t, err)
+
+	refuse := func(context.Context, string, string) (net.Conn, error) {
+		return nil, &net.OpError{Op: "dial", Err: net.UnknownNetworkError("no route in overlay")}
+	}
+	f, err := newHTTPForwarder(fwd, refuse)
+	require.NoError(t, err)
+	go func() { _ = f.Serve() }()
+	t.Cleanup(func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+		_ = f.Close(ctx)
+	})
+
+	resp, err := http.Get("http://" + f.Addr())
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	assert.Equal(t, http.StatusBadGateway, resp.StatusCode)
+}
+
+// Binding must fail at construction so a port clash surfaces before any
+// forward is announced as ready.
+func TestNewHTTPForwarderReportsBindConflict(t *testing.T) {
+	busy, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	defer busy.Close()
+
+	fwd, err := ParseForward("http://" + busy.Addr().String() + "=https://grafana.internal")
+	require.NoError(t, err)
+
+	_, err = newHTTPForwarder(fwd, refuseDial)
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "listen on")
+}
+
+// A forwarder that was built but never served still owns its socket. The
+// bind-all-then-serve path closes earlier forwarders when a later bind fails,
+// so Close has to release the port even though Serve never ran.
+func TestCloseReleasesAnUnservedListener(t *testing.T) {
+	fwd, err := ParseForward("http://127.0.0.1:0=https://grafana.internal")
+	require.NoError(t, err)
+
+	f, err := newHTTPForwarder(fwd, refuseDial)
+	require.NoError(t, err)
+	addr := f.Addr()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	require.NoError(t, f.Close(ctx))
+
+	// The port is free again only if the listener was actually closed.
+	reclaimed, err := net.Listen("tcp", addr)
+	require.NoError(t, err, "Close should have released the listener")
+	require.NoError(t, reclaimed.Close())
+}
+
+// A caller that sends headers and then stalls its body must be cut off.
+// ReadHeaderTimeout does not cover the body and IdleTimeout applies only
+// between requests, so without the idle read deadline this connection would be
+// held open indefinitely.
+func TestStalledRequestBodyIsCutOff(t *testing.T) {
+	previous := bodyIdleTimeout
+	bodyIdleTimeout = 150 * time.Millisecond
+	t.Cleanup(func() { bodyIdleTimeout = previous })
+
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = io.Copy(io.Discard, r.Body)
+	}))
+	defer upstream.Close()
+
+	base, _ := startForwarder(t, upstream)
+
+	conn, err := net.Dial("tcp", strings.TrimPrefix(base, "http://"))
+	require.NoError(t, err)
+	defer conn.Close()
+
+	// Announce a body, send one byte of it, then go quiet.
+	_, err = conn.Write([]byte("POST / HTTP/1.1\r\nHost: localhost\r\nContent-Length: 1000\r\n\r\nx"))
+	require.NoError(t, err)
+
+	require.NoError(t, conn.SetReadDeadline(time.Now().Add(10*time.Second)))
+	_, err = io.ReadAll(conn)
+
+	// The server closes the connection rather than waiting on the rest of the
+	// body, so the read ends well before the generous deadline above.
+	require.NoError(t, err, "the connection should be closed by the server, not time out in the test")
+}
+
+func TestRedactSpec(t *testing.T) {
+	assert.Equal(t, "http://8080=https://user:xxxxx@a.internal",
+		redactSpec("http://8080=https://user:hunter2@a.internal"),
+		"a password must not survive into an error message")
+	assert.Equal(t, "http://8080=https://a.internal",
+		redactSpec("http://8080=https://a.internal"),
+		"a spec without credentials should be unchanged")
+}
+
+// The error that rejects a credential-bearing upstream quotes the spec, which
+// must not carry the password back to the terminal.
+func TestParseForwardDoesNotEchoPassword(t *testing.T) {
+	_, err := ParseForward("http://8080=https://user:hunter2@a.internal")
+
+	require.Error(t, err)
+	assert.NotContains(t, err.Error(), "hunter2", "the password must not appear anywhere in the error")
+	assert.Contains(t, err.Error(), "must not carry credentials")
+}
+
+// A POST whose body is fully delivered must still receive its whole response,
+// even when the upstream takes longer to answer than the body idle timeout.
+// The deadline that guards the body must not outlive it.
+func TestCompletedUploadGetsFullResponse(t *testing.T) {
+	previous := bodyIdleTimeout
+	bodyIdleTimeout = 200 * time.Millisecond
+	t.Cleanup(func() { bodyIdleTimeout = previous })
+
+	payload := strings.Repeat("y", 4096)
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = io.Copy(io.Discard, r.Body)
+		time.Sleep(600 * time.Millisecond)
+		_, _ = io.WriteString(w, payload)
+	}))
+	defer upstream.Close()
+
+	base, _ := startForwarder(t, upstream)
+
+	resp, err := http.Post(base+"/upload", "text/plain", strings.NewReader(strings.Repeat("x", 2048)))
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	require.NoError(t, err, "the response must not be cut off once the body was fully read")
+	assert.Equal(t, len(payload), len(body), "the whole response body should arrive")
+}
+
+// A page that points its own hostname at this loopback listener must not be
+// able to reach the upstream through it.
+func TestLoopbackForwarderRejectsForeignHost(t *testing.T) {
+	var reached bool
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		reached = true
+	}))
+	defer upstream.Close()
+
+	base, _ := startForwarder(t, upstream)
+
+	req, err := http.NewRequest(http.MethodGet, base, nil)
+	require.NoError(t, err)
+	req.Host = "attacker.example"
+
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	assert.Equal(t, http.StatusMisdirectedRequest, resp.StatusCode)
+	assert.False(t, reached, "the upstream must not be reached under a foreign Host")
+}
+
+func TestLoopbackForwarderRejectsCrossOrigin(t *testing.T) {
+	var reached bool
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		reached = true
+	}))
+	defer upstream.Close()
+
+	base, _ := startForwarder(t, upstream)
+
+	req, err := http.NewRequest(http.MethodGet, base, nil)
+	require.NoError(t, err)
+	req.Header.Set("Origin", "https://attacker.example")
+
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	assert.Equal(t, http.StatusForbidden, resp.StatusCode)
+	assert.False(t, reached, "the upstream must not be reached from a cross-site page")
+}
+
+// The ordinary local callers must keep working: no Origin at all, and a
+// same-origin browser request.
+func TestLoopbackForwarderAllowsLocalCallers(t *testing.T) {
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = io.WriteString(w, "ok")
+	}))
+	defer upstream.Close()
+
+	base, _ := startForwarder(t, upstream)
+
+	for _, origin := range []string{"", "http://" + strings.TrimPrefix(base, "http://")} {
+		req, err := http.NewRequest(http.MethodGet, base, nil)
+		require.NoError(t, err)
+		if origin != "" {
+			req.Header.Set("Origin", origin)
+		}
+
+		resp, err := http.DefaultClient.Do(req)
+		require.NoError(t, err)
+		body, err := io.ReadAll(resp.Body)
+		require.NoError(t, err)
+		_ = resp.Body.Close()
+
+		assert.Equal(t, http.StatusOK, resp.StatusCode, "origin %q should be allowed", origin)
+		assert.Equal(t, "ok", string(body))
+	}
+}
+
+// A malformed upstream fails in the URL parser rather than in the credential
+// check, so both error layers have to be redacted.
+func TestParseForwardRedactsMalformedUpstream(t *testing.T) {
+	for _, spec := range []string{
+		"http://8080=https://user:hunter2@a.internal:bad",
+		"http://8080=https://user:hunter2@a.internal/%zz",
+	} {
+		_, err := ParseForward(spec)
+		require.Error(t, err)
+		assert.NotContains(t, err.Error(), "hunter2",
+			"a password must not survive a parse failure either")
+	}
+}
+
+// An embedded <img> or <script> aimed straight at the loopback address carries
+// a loopback Host and no Origin, so Sec-Fetch-Site is the only signal that the
+// request came from a page.
+func TestLoopbackForwarderRejectsCrossSiteFetch(t *testing.T) {
+	for _, site := range []string{"cross-site", "same-site", "Cross-Site"} {
+		var reached bool
+		upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			reached = true
+		}))
+
+		base, _ := startForwarder(t, upstream)
+
+		req, err := http.NewRequest(http.MethodGet, base, nil)
+		require.NoError(t, err)
+		req.Header.Set("Sec-Fetch-Site", site)
+
+		resp, err := http.DefaultClient.Do(req)
+		require.NoError(t, err)
+		_ = resp.Body.Close()
+		upstream.Close()
+
+		assert.Equal(t, http.StatusForbidden, resp.StatusCode, "Sec-Fetch-Site %q should be refused", site)
+		assert.False(t, reached, "the upstream must not be reached from a %s page", site)
+	}
+}
+
+// A browser reaches the listener legitimately when the user navigated to it or
+// when the page it serves calls back into it.
+func TestLoopbackForwarderAllowsFirstPartyFetch(t *testing.T) {
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = io.WriteString(w, "ok")
+	}))
+	defer upstream.Close()
+
+	base, _ := startForwarder(t, upstream)
+
+	for _, site := range []string{"none", "same-origin"} {
+		req, err := http.NewRequest(http.MethodGet, base, nil)
+		require.NoError(t, err)
+		req.Header.Set("Sec-Fetch-Site", site)
+
+		resp, err := http.DefaultClient.Do(req)
+		require.NoError(t, err)
+		_ = resp.Body.Close()
+
+		assert.Equal(t, http.StatusOK, resp.StatusCode, "Sec-Fetch-Site %q should be allowed", site)
+	}
+}
+
+// A page served from another loopback port is a different origin, however
+// local it is.
+func TestLoopbackForwarderRejectsAnotherLocalPort(t *testing.T) {
+	var reached bool
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		reached = true
+	}))
+	defer upstream.Close()
+
+	base, _ := startForwarder(t, upstream)
+
+	req, err := http.NewRequest(http.MethodGet, base, nil)
+	require.NoError(t, err)
+	req.Header.Set("Origin", "http://localhost:3000")
+
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	assert.Equal(t, http.StatusForbidden, resp.StatusCode)
+	assert.False(t, reached, "a page on another local port must not reach the upstream")
+}
+
+// A rejected request is never read, so the deadline that bounds an accepted
+// upload never arms for it. Closing the connection is what stops the server
+// from draining a body the caller stopped sending.
+func TestRejectedRequestClosesTheConnection(t *testing.T) {
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}))
+	defer upstream.Close()
+
+	base, _ := startForwarder(t, upstream)
+
+	body, writer := io.Pipe()
+	t.Cleanup(func() { _ = writer.Close() })
+
+	req, err := http.NewRequest(http.MethodPost, base, body)
+	require.NoError(t, err)
+	req.Host = "attacker.example"
+
+	// The request is answered on another goroutine, so a server that waits on
+	// the stalled body fails the test by timing out rather than hanging it.
+	type rejection struct {
+		status     int
+		closesConn bool
+	}
+	done := make(chan rejection, 1)
+	go func() {
+		resp, err := http.DefaultClient.Do(req)
+		if err != nil {
+			return
+		}
+		defer resp.Body.Close()
+		done <- rejection{status: resp.StatusCode, closesConn: resp.Close}
+	}()
+
+	select {
+	case got := <-done:
+		assert.Equal(t, http.StatusMisdirectedRequest, got.status)
+		assert.True(t, got.closesConn, "the server must close a connection it rejected rather than drain the body")
+	case <-time.After(5 * time.Second):
+		t.Fatal("the rejected request was not answered while its body stalled")
+	}
+}
+
+// net/url ends the userinfo at the last '@', so a password containing one must
+// be redacted whole rather than up to its first '@'.
+func TestRedactSpecCoversPasswordWithAtSign(t *testing.T) {
+	redacted := redactSpec("http://8080=https://user:pa@ss@a.internal/%zz")
+
+	assert.Equal(t, "http://8080=https://user:xxxxx@a.internal/%zz", redacted)
+	assert.NotContains(t, redacted, "ss@a.internal", "no part of the password may survive")
+}
+
+func TestParseForwardRedactsPasswordWithAtSign(t *testing.T) {
+	_, err := ParseForward("http://8080=https://user:pa@ss@a.internal/%zz")
+
+	require.Error(t, err)
+	assert.NotContains(t, err.Error(), "ss@", "no part of the password may reach the error")
+}
+
+// stalledBodyProbe sends a request whose declared body is only partly
+// delivered and then stops, as a caller holding a connection open would. It
+// returns the status line, or an empty string when nothing came back inside
+// wait.
+//
+// It speaks raw HTTP rather than using the client, because the shape that
+// matters is an explicit Content-Length the sender never satisfies: a body
+// handed to http.Client is sent chunked, which exercises a different path in
+// the server's post-handler drain.
+func stalledBodyProbe(t *testing.T, addr, host string, wait time.Duration) (status string, released bool) {
+	t.Helper()
+
+	conn, err := net.Dial("tcp", addr)
+	require.NoError(t, err, "connect to the forwarder")
+	t.Cleanup(func() { _ = conn.Close() })
+
+	req := fmt.Sprintf("POST / HTTP/1.1\r\nHost: %s\r\nContent-Length: 100\r\n\r\n0123456789", host)
+	_, err = conn.Write([]byte(req))
+	require.NoError(t, err, "send the partial request")
+
+	require.NoError(t, conn.SetReadDeadline(time.Now().Add(wait)))
+	buf := make([]byte, 1024)
+	n, err := conn.Read(buf)
+	if err != nil {
+		return "", false
+	}
+	status = strings.SplitN(string(buf[:n]), "\r\n", 2)[0]
+
+	// Read on until the connection ends. The answer going out is not the same
+	// thing as the connection being let go: the server drains the rest of the
+	// body afterwards, and that drain is where a stalled caller actually holds
+	// a descriptor and a goroutine. A timeout here means it is still held.
+	for {
+		if _, err := conn.Read(buf); err != nil {
+			var timeout net.Error
+			return status, !(errors.As(err, &timeout) && timeout.Timeout())
+		}
+	}
+}
+
+// A caller that declares a body and then stops sending must still be answered,
+// on every path that does not read it. The server drains an unread body before
+// reusing the connection, and that drain has no deadline of its own: whatever
+// the forwarder leaves on the connection is what bounds it.
+//
+// Without this, a few thousand such connections exhaust the forwarder's file
+// descriptors while each one holds a goroutine parked in that drain.
+func TestStalledRequestBodyIsAnsweredOnEveryPath(t *testing.T) {
+	// The dial target refuses, so a request that passes the guard reaches the
+	// proxy's error handler instead of an upstream.
+	// Shortened so the test observes the bound rather than waiting out the
+	// production one.
+	previous := bodyIdleTimeout
+	bodyIdleTimeout = time.Second
+	t.Cleanup(func() { bodyIdleTimeout = previous })
+
+	base := serveForward(t, "http://127.0.0.1:0=http://grafana.internal", "127.0.0.1:1")
+	addr := strings.TrimPrefix(base, "http://")
+
+	cases := []struct {
+		name string
+		host string
+		want string
+	}{
+		{
+			name: "the guard rejects it",
+			host: "attacker.example",
+			want: "HTTP/1.1 421 Misdirected Request",
+		},
+		{
+			name: "the overlay dial fails",
+			host: "127.0.0.1",
+			want: "HTTP/1.1 502 Bad Gateway",
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got, released := stalledBodyProbe(t, addr, tc.host, 8*time.Second)
+			assert.Equal(t, tc.want, got,
+				"the caller must be answered rather than left waiting out a drain with no deadline")
+			assert.True(t, released,
+				"the connection must be let go as well as answered, or a stalled caller still holds it")
+		})
+	}
+}
diff --git a/client/link/forward_http_upstream_test.go b/client/link/forward_http_upstream_test.go
new file mode 100644
index 000000000..c240a7826
--- /dev/null
+++ b/client/link/forward_http_upstream_test.go
@@ -0,0 +1,286 @@
+package link
+
+import (
+	"bufio"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"syscall"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// serveForward starts a forwarder for spec in front of target and returns its
+// local base URL.
+func serveForward(t *testing.T, spec, target string) string {
+	t.Helper()
+
+	fwd, err := ParseForward(spec)
+	require.NoError(t, err)
+	dialer := &overlayDialer{target: target}
+	f, err := newHTTPForwarder(fwd, dialer.dial)
+	require.NoError(t, err)
+
+	go func() { _ = f.Serve() }()
+	t.Cleanup(func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+		_ = f.Close(ctx)
+	})
+	return "http://" + f.Addr()
+}
+
+func TestForwarderVerifiesUpstreamCertificate(t *testing.T) {
+	var reached atomic.Bool
+	upstream := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		reached.Store(true)
+		_, _ = io.WriteString(w, "should not be served")
+	}))
+	defer upstream.Close()
+
+	// The test server's certificate is signed by a CA no trust store holds, so
+	// a forwarder that verifies its upstream must refuse it.
+	u, err := url.Parse(upstream.URL)
+	require.NoError(t, err)
+	base := serveForward(t, "http://127.0.0.1:0=https://grafana.internal", u.Host)
+
+	resp, err := http.Get(base + "/")
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	body, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+
+	assert.Equal(t, http.StatusBadGateway, resp.StatusCode, "an untrusted upstream certificate must fail the request")
+	assert.Contains(t, string(body), "upstream unreachable over the overlay", "the 502 must be the forwarder's own answer")
+	assert.False(t, reached.Load(), "no request may reach an upstream whose certificate was not verified")
+}
+
+func TestForwarderJoinsUpstreamBasePath(t *testing.T) {
+	var gotURI string
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotURI = r.URL.RequestURI()
+	}))
+	defer upstream.Close()
+
+	u, err := url.Parse(upstream.URL)
+	require.NoError(t, err)
+	base := serveForward(t, "http://127.0.0.1:0=http://grafana.internal/api", u.Host)
+
+	resp, err := http.Get(base + "/v1/query?q=up")
+	require.NoError(t, err)
+	_ = resp.Body.Close()
+
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+	assert.Equal(t, "/api/v1/query?q=up", gotURI, "the upstream's path must prefix the request path")
+}
+
+// An LLM reply streamed as server-sent events must reach the caller event by
+// event. A forwarder that buffered the body would hold the first event until
+// the upstream finished, which here never happens until the test has read it.
+func TestForwarderStreamsEventsAsTheyArrive(t *testing.T) {
+	release := make(chan struct{})
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "text/event-stream")
+		_, _ = io.WriteString(w, "data: first\n\n")
+		w.(http.Flusher).Flush()
+		<-release
+		_, _ = io.WriteString(w, "data: second\n\n")
+	}))
+	defer upstream.Close()
+	defer close(release)
+
+	u, err := url.Parse(upstream.URL)
+	require.NoError(t, err)
+	base := serveForward(t, "http://127.0.0.1:0=http://llm.internal", u.Host)
+
+	resp, err := http.Get(base + "/v1/chat/completions")
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	firstLine := make(chan string, 1)
+	go func(body io.Reader) {
+		line, _ := bufio.NewReader(body).ReadString('\n')
+		firstLine <- line
+	}(resp.Body)
+
+	select {
+	case line := <-firstLine:
+		assert.Equal(t, "data: first\n", line, "the first event must arrive before the stream ends")
+	case <-time.After(5 * time.Second):
+		t.Fatal("the first event was buffered instead of streamed")
+	}
+}
+
+func TestForwarderServesConcurrentRequests(t *testing.T) {
+	var served atomic.Int64
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		served.Add(1)
+		_, _ = io.WriteString(w, r.URL.Query().Get("n"))
+	}))
+	defer upstream.Close()
+
+	u, err := url.Parse(upstream.URL)
+	require.NoError(t, err)
+	base := serveForward(t, "http://127.0.0.1:0=http://grafana.internal", u.Host)
+
+	const callers = 32
+	var wg sync.WaitGroup
+	errs := make(chan error, callers)
+	for i := range callers {
+		wg.Add(1)
+		go func(n int) {
+			defer wg.Done()
+			resp, err := http.Get(fmt.Sprintf("%s/?n=%d", base, n))
+			if err != nil {
+				errs <- err
+				return
+			}
+			defer resp.Body.Close()
+			body, err := io.ReadAll(resp.Body)
+			if err != nil {
+				errs <- err
+				return
+			}
+			if got := string(body); got != fmt.Sprint(n) {
+				errs <- fmt.Errorf("caller %d got the answer for %q", n, got)
+			}
+		}(i)
+	}
+	wg.Wait()
+	close(errs)
+
+	for err := range errs {
+		assert.NoError(t, err, "every concurrent caller must get its own answer")
+	}
+	assert.Equal(t, int64(callers), served.Load(), "every request must reach the upstream once")
+}
+
+// A container port published to the host is a public listener, and a page
+// that rebinds its own name to that port sends a matching Origin and
+// Sec-Fetch-Site. Host is the only signal that tells it apart, so a public
+// listener accepts addresses and listed names only.
+func TestGuardOnPublicListener(t *testing.T) {
+	next := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	})
+	allowed := []string{"nblink.lan"}
+
+	cases := []struct {
+		name         string
+		loopbackOnly bool
+		host         string
+		headers      map[string]string
+		want         int
+	}{
+		{name: "public listener under a listed name", host: "nblink.lan:8080", want: http.StatusOK},
+		{name: "public listener under a listed name, other spelling", host: "NBLINK.LAN.:8080", want: http.StatusOK},
+		{name: "public listener under its LAN address", host: "192.168.1.20:8080", want: http.StatusOK},
+		{name: "public listener under an IPv6 address", host: "[fd00::20]:8080", want: http.StatusOK},
+		{name: "public listener under localhost", host: "localhost:8080", want: http.StatusOK},
+		{name: "public listener under an unlisted name", host: "printer.lan:8080", want: http.StatusMisdirectedRequest},
+		{
+			name: "public listener, rebound page", host: "attacker.example:8080",
+			headers: map[string]string{"Origin": "http://attacker.example:8080", fetchSiteHeader: "same-origin"},
+			want:    http.StatusMisdirectedRequest,
+		},
+		{name: "loopback listener under a listed name", loopbackOnly: true, host: "nblink.lan:8080", want: http.StatusOK},
+		{name: "loopback listener under a LAN address", loopbackOnly: true, host: "192.168.1.20:8080", want: http.StatusMisdirectedRequest},
+		{
+			name: "public listener, cross-origin fetch", host: "nblink.lan:8080",
+			headers: map[string]string{"Origin": "https://attacker.example"}, want: http.StatusForbidden,
+		},
+		{
+			name: "public listener, cross-site no-cors GET", host: "nblink.lan:8080",
+			headers: map[string]string{fetchSiteHeader: "cross-site"}, want: http.StatusForbidden,
+		},
+		{
+			name: "public listener, same-origin page", host: "nblink.lan:8080",
+			headers: map[string]string{"Origin": "http://nblink.lan:8080"}, want: http.StatusOK,
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			req := httptest.NewRequest(http.MethodGet, "http://"+tc.host+"/", nil)
+			for k, v := range tc.headers {
+				req.Header.Set(k, v)
+			}
+			rec := httptest.NewRecorder()
+			guardRebinding(next, tc.loopbackOnly, allowed).ServeHTTP(rec, req)
+			assert.Equal(t, tc.want, rec.Code, "%s must be answered %d", tc.name, tc.want)
+		})
+	}
+}
+
+func TestListenNetwork(t *testing.T) {
+	cases := map[string]string{
+		"0.0.0.0:8080":      "tcp4",
+		"127.0.0.1:8080":    "tcp4",
+		"[::]:8080":         "tcp6",
+		"[::1]:8080":        "tcp6",
+		"[fe80::1%en0]:808": "tcp6",
+	}
+	for addr, want := range cases {
+		assert.Equal(t, want, listenNetwork(addr), "%s must bind %s only", addr, want)
+	}
+}
+
+// 0.0.0.0 asks for every IPv4 interface. Go's plain "tcp" would also accept
+// IPv6, which the operator did not write.
+func TestIPv4WildcardDoesNotListenOnIPv6(t *testing.T) {
+	probe, err := net.Listen("tcp6", "[::1]:0")
+	if err != nil {
+		t.Skip("no IPv6 loopback on this host")
+	}
+	_ = probe.Close()
+
+	fwd, err := ParseForward("http://0.0.0.0:0=http://grafana.internal")
+	require.NoError(t, err)
+	f, err := newHTTPForwarder(fwd, refuseDial)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = f.Close(context.Background()) })
+
+	_, port, err := net.SplitHostPort(f.Addr())
+	require.NoError(t, err)
+	assert.Equal(t, "0.0.0.0:"+port, f.Addr(), "the listener must report the IPv4 wildcard it was asked for")
+
+	conn, err := net.DialTimeout("tcp6", net.JoinHostPort("::1", port), time.Second)
+	if err == nil {
+		_ = conn.Close()
+	}
+	assert.Error(t, err, "an IPv4 wildcard must not accept IPv6 connections")
+}
+
+func TestBindHint(t *testing.T) {
+	denied := &net.OpError{Op: "listen", Err: os.NewSyscallError("bind", syscall.EACCES)}
+	err := bindHint("0.0.0.0:80", denied)
+	assert.ErrorIs(t, err, os.ErrPermission, "the hint must keep the original error")
+	assert.Contains(t, err.Error(), "needs a port above 1023", "a permission error must suggest an unprivileged port")
+
+	inUse := errors.New("address already in use")
+	assert.Equal(t, inUse, bindHint("127.0.0.1:8080", inUse), "other errors must pass through unchanged")
+}
+
+func TestForwardStringRoundTrips(t *testing.T) {
+	fwd, err := ParseForward("http://8080=https://grafana.internal/d")
+	require.NoError(t, err)
+	assert.Equal(t, "http://127.0.0.1:8080=https://grafana.internal/d", fwd.String(),
+		"String must print the normalized spec")
+
+	again, err := ParseForward(fwd.String())
+	require.NoError(t, err)
+	assert.Equal(t, fwd.Listen, again.Listen, "the printed spec must parse back to the same listener")
+	assert.Equal(t, fwd.Upstream.String(), again.Upstream.String(), "and to the same upstream")
+	assert.False(t, strings.Contains(fwd.String(), "  "), "the spec must not carry stray whitespace")
+}
diff --git a/client/link/forward_test.go b/client/link/forward_test.go
new file mode 100644
index 000000000..fd1697b6d
--- /dev/null
+++ b/client/link/forward_test.go
@@ -0,0 +1,170 @@
+package link
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseForward(t *testing.T) {
+	tests := []struct {
+		name         string
+		spec         string
+		wantListen   string
+		wantUpstream string
+	}{
+		{
+			name:         "full listen address",
+			spec:         "http://127.0.0.1:8080=https://grafana.internal",
+			wantListen:   "127.0.0.1:8080",
+			wantUpstream: "https://grafana.internal",
+		},
+		{
+			name:         "bare port defaults to loopback",
+			spec:         "http://8080=https://grafana.internal",
+			wantListen:   "127.0.0.1:8080",
+			wantUpstream: "https://grafana.internal",
+		},
+		{
+			name:         "empty host defaults to loopback",
+			spec:         "http://:8080=https://grafana.internal",
+			wantListen:   "127.0.0.1:8080",
+			wantUpstream: "https://grafana.internal",
+		},
+		{
+			name:         "upstream without scheme assumes https",
+			spec:         "http://8080=grafana.internal",
+			wantListen:   "127.0.0.1:8080",
+			wantUpstream: "https://grafana.internal",
+		},
+		{
+			name:         "plain http upstream is preserved",
+			spec:         "http://8080=http://grafana.internal:3000",
+			wantListen:   "127.0.0.1:8080",
+			wantUpstream: "http://grafana.internal:3000",
+		},
+		{
+			name:         "upstream query string survives the separator split",
+			spec:         "http://8080=https://grafana.internal/d?orgId=1",
+			wantListen:   "127.0.0.1:8080",
+			wantUpstream: "https://grafana.internal/d?orgId=1",
+		},
+		{
+			name:         "explicit public bind is parsed, gating happens later",
+			spec:         "http://0.0.0.0:8080=https://grafana.internal",
+			wantListen:   "0.0.0.0:8080",
+			wantUpstream: "https://grafana.internal",
+		},
+		{
+			name:         "ipv6 listen address",
+			spec:         "http://[::1]:8080=https://grafana.internal",
+			wantListen:   "[::1]:8080",
+			wantUpstream: "https://grafana.internal",
+		},
+		{
+			name:         "port zero asks the OS for a free port",
+			spec:         "http://0=https://grafana.internal",
+			wantListen:   "127.0.0.1:0",
+			wantUpstream: "https://grafana.internal",
+		},
+		{
+			name:         "localhost normalizes to a literal address",
+			spec:         "http://localhost:8080=https://grafana.internal",
+			wantListen:   "127.0.0.1:8080",
+			wantUpstream: "https://grafana.internal",
+		},
+		{
+			// A zone is part of the literal and is resolved the same way at
+			// the check and at the bind, and link-local cannot be bound
+			// without it.
+			name:         "zone scoped ipv6 listen address",
+			spec:         "http://[fe80::1%eth0]:8080=https://grafana.internal",
+			wantListen:   "[fe80::1%eth0]:8080",
+			wantUpstream: "https://grafana.internal",
+		},
+		{
+			name:         "a scheme inside the query is not mistaken for the upstream scheme",
+			spec:         "http://8080=grafana.internal/login?next=https://grafana.internal/d",
+			wantListen:   "127.0.0.1:8080",
+			wantUpstream: "https://grafana.internal/login?next=https://grafana.internal/d",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := ParseForward(tc.spec)
+			require.NoError(t, err)
+			assert.Equal(t, ProtoHTTP, got.Proto, "scheme should select the HTTP forwarder")
+			assert.Equal(t, tc.wantListen, got.Listen, "listen address should be normalized")
+			assert.Equal(t, tc.wantUpstream, got.Upstream.String(), "upstream should round-trip")
+		})
+	}
+}
+
+func TestParseForwardErrors(t *testing.T) {
+	tests := []struct {
+		name    string
+		spec    string
+		wantMsg string
+	}{
+		{name: "empty", spec: "", wantMsg: "empty forward spec"},
+		{name: "no scheme", spec: "8080=grafana.internal", wantMsg: "missing scheme"},
+		{name: "no separator", spec: "http://8080", wantMsg: "missing '='"},
+		{name: "unknown scheme", spec: "gopher://8080=grafana.internal", wantMsg: "unknown scheme"},
+		{name: "port out of range", spec: "http://70000=grafana.internal", wantMsg: "out of range"},
+		{name: "port not a number", spec: "http://http=grafana.internal", wantMsg: "not a number"},
+		{name: "missing upstream", spec: "http://8080=", wantMsg: "missing upstream"},
+		{name: "bad upstream scheme", spec: "http://8080=ftp://grafana.internal", wantMsg: "must be http or https"},
+		{name: "listen host is a name", spec: "http://grafana.internal:8080=https://a.internal", wantMsg: "must be an IP address or localhost"},
+		{name: "upstream carries credentials", spec: "http://8080=https://user:pass@grafana.internal", wantMsg: "must not carry credentials"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := ParseForward(tc.spec)
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), tc.wantMsg, "error should name the actual problem")
+		})
+	}
+}
+
+// Schemes the grammar reserves for later must fail with a message that says so,
+// rather than looking like a typo.
+func TestParseForwardPlannedSchemes(t *testing.T) {
+	for _, proto := range []string{"tcp", "udp", "socks5"} {
+		t.Run(proto, func(t *testing.T) {
+			_, err := ParseForward(proto + "://5432=db.internal:5432")
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), "not supported yet",
+				"a reserved scheme should report that it is unimplemented")
+		})
+	}
+}
+
+func TestIsLoopback(t *testing.T) {
+	tests := []struct {
+		addr string
+		want bool
+	}{
+		{"127.0.0.1:8080", true},
+		{"127.0.0.53:8080", true},
+		{"[::1]:8080", true},
+		{"0.0.0.0:8080", false},
+		{"192.168.1.10:8080", false},
+		{"[::]:8080", false},
+		{"not-an-address", false},
+		// A v4-mapped form is still the loopback address.
+		{"[::ffff:127.0.0.1]:8080", true},
+		// Link-local is not loopback, so it stays behind the opt-in.
+		{"[fe80::1%eth0]:8080", false},
+		// Names never reach this check, because parseListen rejects them.
+		{"localhost:8080", false},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.addr, func(t *testing.T) {
+			assert.Equal(t, tc.want, isLoopback(tc.addr))
+		})
+	}
+}
diff --git a/client/link/link.go b/client/link/link.go
new file mode 100644
index 000000000..0856b5a53
--- /dev/null
+++ b/client/link/link.go
@@ -0,0 +1,253 @@
+package link
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/signal"
+	"strconv"
+	"strings"
+	"syscall"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	embed "github.com/netbirdio/netbird/client/embed"
+)
+
+const (
+	// startTimeout bounds the wait for the overlay session to come up.
+	startTimeout = 90 * time.Second
+	// shutdownTimeout bounds draining in-flight requests and closing the session.
+	shutdownTimeout = 10 * time.Second
+
+	// natMapperEnv is the embedded client's switch for UPnP, NAT-PMP and PCP
+	// port mapping on the local router.
+	natMapperEnv = "NB_DISABLE_NAT_MAPPER"
+)
+
+// Run starts the overlay session, serves every configured forward, and blocks
+// until the process is signalled or a forward fails.
+func Run(ctx context.Context, cfg *Config) error {
+	if cfg.Check {
+		return printEffectiveConfig(os.Stdout, cfg)
+	}
+
+	creds, err := resolveCredentials(ctx, cfg)
+	if err != nil {
+		return interruptedOr(ctx, err)
+	}
+
+	if err := disableNATMapperUnlessSet(); err != nil {
+		return err
+	}
+
+	client, err := embed.New(embed.Options{
+		DeviceName:    cfg.Hostname,
+		SetupKey:      creds.setupKey,
+		JWTToken:      creds.jwtToken,
+		ManagementURL: cfg.ManagementURL,
+		ConfigPath:    cfg.ConfigPath(),
+		StatePath:     cfg.StatePath(),
+		LogLevel:      cfg.LogLevel,
+		// nblink only dials out. Refusing inbound connections and host network
+		// access keeps the peer from becoming a route into the machine it runs on.
+		BlockInbound:   true,
+		BlockLANAccess: true,
+	})
+	if err != nil {
+		return fmt.Errorf("create client: %w", err)
+	}
+
+	log.Infof("connecting to %s", cfg.ManagementURL)
+	if err := startSession(ctx, client.Start, func() { stopClient(client) }); err != nil {
+		return interruptedOr(ctx, err)
+	}
+	logSession(client)
+
+	forwards, err := startForwards(cfg, client.DialContext)
+	if err != nil {
+		stopClient(client)
+		return err
+	}
+
+	err = waitForShutdown(ctx, forwards)
+
+	shutdownCtx, cancelShutdown := context.WithTimeout(context.Background(), shutdownTimeout)
+	defer cancelShutdown()
+	closeForwards(shutdownCtx, forwards)
+	stopClient(client)
+
+	return err
+}
+
+// disableNATMapperUnlessSet keeps the embedded client from asking the local
+// router for a port mapping. An unprivileged forwarder should not change the
+// network it runs on, and ICE and the relay connect without it. An operator
+// who sets the variable keeps their choice.
+func disableNATMapperUnlessSet() error {
+	// An operator keeps their choice only when the value is one the consumer
+	// can read. Empty and unparseable values reach the consumer as false,
+	// which would enable the mapper rather than leave the default in place.
+	if val := os.Getenv(natMapperEnv); val != "" {
+		if _, err := strconv.ParseBool(val); err == nil {
+			return nil
+		}
+		log.Warnf("failed to parse %s=%q, disabling the NAT mapper", natMapperEnv, val)
+	}
+	if err := os.Setenv(natMapperEnv, "true"); err != nil {
+		return fmt.Errorf("set %s: %w", natMapperEnv, err)
+	}
+	return nil
+}
+
+// startSession runs start under startTimeout and returns as soon as ctx ends,
+// even if start has not.
+//
+// The management dial inside the embedded client does not observe
+// cancellation, so waiting for start to return would hold a signal during
+// startup until the dial times out. A start that completes after the caller
+// gave up is stopped in the background instead of left running.
+func startSession(ctx context.Context, start func(context.Context) error, stop func()) error {
+	startCtx, cancel := context.WithTimeout(ctx, startTimeout)
+	done := make(chan error, 1)
+	go func() {
+		defer cancel()
+		done <- start(startCtx)
+	}()
+
+	select {
+	case err := <-done:
+		if err != nil {
+			return fmt.Errorf("start client: %w", err)
+		}
+		return nil
+	case <-ctx.Done():
+		go func() {
+			if err := <-done; err == nil {
+				stop()
+			}
+		}()
+		return ctx.Err()
+	}
+}
+
+// interruptedOr reports a signal during startup or login as a clean shutdown
+// rather than a failure, and passes any other error through.
+func interruptedOr(ctx context.Context, err error) error {
+	select {
+	case <-ctx.Done():
+		log.Infof("interrupted before the session was up, shutting down")
+		return nil
+	default:
+		return err
+	}
+}
+
+// startForwards binds every forward before serving any of them, so a clash on
+// the last one does not leave the earlier ones running.
+func startForwards(cfg *Config, dial DialFunc) ([]*httpForwarder, error) {
+	forwards := make([]*httpForwarder, 0, len(cfg.Forwards))
+	for _, fwd := range cfg.Forwards {
+		f, err := newHTTPForwarder(fwd, dial)
+		if err != nil {
+			closeForwards(context.Background(), forwards)
+			return nil, err
+		}
+		forwards = append(forwards, f)
+	}
+
+	for _, f := range forwards {
+		log.Infof("forwarding http://%s to %s over the overlay", f.Addr(), f.forward.Upstream)
+	}
+	return forwards, nil
+}
+
+// waitForShutdown blocks until a signal arrives, the context ends, or a
+// forward stops serving.
+func waitForShutdown(ctx context.Context, forwards []*httpForwarder) error {
+	serveErr := make(chan error, len(forwards))
+	for _, f := range forwards {
+		go func(f *httpForwarder) {
+			if err := f.Serve(); err != nil {
+				serveErr <- err
+			}
+		}(f)
+	}
+
+	stop := make(chan os.Signal, 1)
+	signal.Notify(stop, syscall.SIGINT, syscall.SIGTERM)
+	defer signal.Stop(stop)
+
+	select {
+	case err := <-serveErr:
+		return err
+	case sig := <-stop:
+		log.Infof("received %s, shutting down", sig)
+		return nil
+	case <-ctx.Done():
+		// The caller's context also ends on a signal, and select picks either
+		// ready case, so this path reports the shutdown too.
+		log.Infof("shutting down")
+		return nil
+	}
+}
+
+func closeForwards(ctx context.Context, forwards []*httpForwarder) {
+	for _, f := range forwards {
+		if err := f.Close(ctx); err != nil && !errors.Is(err, context.Canceled) {
+			log.Warnf("close forward %s: %v", f.forward.Listen, err)
+		}
+	}
+}
+
+func stopClient(client *embed.Client) {
+	ctx, cancel := context.WithTimeout(context.Background(), shutdownTimeout)
+	defer cancel()
+	if err := client.Stop(ctx); err != nil && !errors.Is(err, embed.ErrClientNotStarted) {
+		log.Warnf("stop client: %v", err)
+	}
+}
+
+// logSession reports control-plane state once the session is up, so a failure
+// to reach an upstream later can be told apart from a session that never
+// connected. The peer name and address stay at debug level, where the rest of
+// the client keeps identifying details.
+func logSession(client *embed.Client) {
+	status, err := client.Status()
+	if err != nil {
+		log.Infof("connected (status unavailable: %v)", err)
+		return
+	}
+	log.Infof("connected, management %t, signal %t, %d peers",
+		status.ManagementState.Connected, status.SignalState.Connected, len(status.Peers))
+	log.Debugf("peer %s has address %s", status.LocalPeerState.FQDN, status.LocalPeerState.IP)
+}
+
+// printEffectiveConfig writes the parsed forwards and exits without touching
+// the network, so a container configuration can be checked before deploying it.
+func printEffectiveConfig(out io.Writer, cfg *Config) error {
+	var b strings.Builder
+	fmt.Fprintf(&b, "management-url: %s\n", cfg.ManagementURL)
+	fmt.Fprintf(&b, "state-dir: %s\n", orDefault(cfg.StateDir, "(memory)"))
+	fmt.Fprintf(&b, "hostname: %s\n", orDefault(cfg.Hostname, "(host default)"))
+	fmt.Fprintf(&b, "setup-key: %t\n", cfg.SetupKey != "")
+	fmt.Fprintf(&b, "allowed-hosts: %s\n", orDefault(strings.Join(cfg.AllowedHosts, ","), "(none)"))
+	fmt.Fprintf(&b, "forwards: %d\n", len(cfg.Forwards))
+	for _, f := range cfg.Forwards {
+		fmt.Fprintf(&b, "  %s -> %s\n", f.Listen, f.Upstream)
+	}
+	if _, err := io.WriteString(out, b.String()); err != nil {
+		return fmt.Errorf("write configuration: %w", err)
+	}
+	return nil
+}
+
+func orDefault(value, fallback string) string {
+	if value == "" {
+		return fallback
+	}
+	return value
+}
diff --git a/client/link/link_test.go b/client/link/link_test.go
new file mode 100644
index 000000000..374e27adc
--- /dev/null
+++ b/client/link/link_test.go
@@ -0,0 +1,440 @@
+package link
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"strconv"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// freePort asks the OS for a port and releases it, so the caller can name that
+// port in a spec and still be the one that binds it.
+func freePort(t *testing.T) string {
+	t.Helper()
+
+	l, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	_, port, err := net.SplitHostPort(l.Addr().String())
+	require.NoError(t, err)
+	require.NoError(t, l.Close())
+	return port
+}
+
+// mustParse builds a Forward from a spec, failing the test if the spec is bad.
+func mustParse(t *testing.T, spec string) Forward {
+	t.Helper()
+
+	fwd, err := ParseForward(spec)
+	require.NoError(t, err, "spec %q must parse", spec)
+	return fwd
+}
+
+// One session serves every forward it was given, which is the whole point of
+// the flag repeating: a user logs in once and reaches several services.
+func TestStartForwardsServesEveryForward(t *testing.T) {
+	first := mustParse(t, "http://127.0.0.1:0=https://a.internal")
+	second := mustParse(t, "http://127.0.0.1:0=https://b.internal")
+
+	forwards, err := startForwards(&Config{Forwards: []Forward{first, second}}, refuseDial)
+	require.NoError(t, err)
+	t.Cleanup(func() { closeForwards(context.Background(), forwards) })
+
+	require.Len(t, forwards, 2, "both forwards should be bound")
+	for _, f := range forwards {
+		go func() { _ = f.Serve() }()
+	}
+
+	// Each listener answers on its own address. The dialer refuses, so a 502
+	// is the proof the request reached that forwarder and was routed onward,
+	// rather than the port belonging to something else.
+	for _, f := range forwards {
+		resp, rerr := http.Get("http://" + f.Addr())
+		require.NoError(t, rerr, "forward on %s must accept a request", f.Addr())
+		_, _ = io.Copy(io.Discard, resp.Body)
+		_ = resp.Body.Close()
+		assert.Equal(t, http.StatusBadGateway, resp.StatusCode,
+			"a forward whose dialer refuses should answer 502, not fail to serve")
+	}
+}
+
+// Ports are bound before any forward is announced, so a clash on the last spec
+// must not leave the earlier ones holding their sockets. The observable is the
+// port: it has to be free again once startForwards has returned the error.
+func TestStartForwardsReleasesEarlierPortsOnFailure(t *testing.T) {
+	firstPort := freePort(t)
+	clashPort := freePort(t)
+
+	// Something else already holds the second forward's port.
+	blocker, err := net.Listen("tcp", "127.0.0.1:"+clashPort)
+	require.NoError(t, err)
+	defer func() { _ = blocker.Close() }()
+
+	forwards, err := startForwards(&Config{Forwards: []Forward{
+		mustParse(t, "http://127.0.0.1:"+firstPort+"=https://a.internal"),
+		mustParse(t, "http://127.0.0.1:"+clashPort+"=https://b.internal"),
+	}}, refuseDial)
+
+	require.Error(t, err, "a clash on the second forward must fail the whole set")
+	assert.Nil(t, forwards, "no forwarder should be returned alongside the error")
+	assert.Contains(t, err.Error(), clashPort, "the error should name the port that clashed")
+
+	// The first forward's port is free again, which it would not be if its
+	// listener had been left open.
+	reclaimed, err := net.Listen("tcp", "127.0.0.1:"+firstPort)
+	require.NoError(t, err, "the first forward's port must be released when a later bind fails")
+	_ = reclaimed.Close()
+}
+
+// closeForwards releases every listener it is given, so a shutdown does not
+// depend on the process exiting.
+func TestCloseForwardsReleasesEveryPort(t *testing.T) {
+	port := freePort(t)
+
+	forwards, err := startForwards(&Config{Forwards: []Forward{
+		mustParse(t, "http://127.0.0.1:"+port+"=https://a.internal"),
+	}}, refuseDial)
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	closeForwards(ctx, forwards)
+
+	reclaimed, err := net.Listen("tcp", "127.0.0.1:"+port)
+	require.NoError(t, err, "the port must be free once the forward is closed")
+	_ = reclaimed.Close()
+}
+
+// captureStdout runs fn with os.Stdout redirected and returns what was written.
+func captureStdout(t *testing.T, fn func()) string {
+	t.Helper()
+
+	r, w, err := os.Pipe()
+	require.NoError(t, err)
+
+	original := os.Stdout
+	os.Stdout = w
+	done := make(chan string, 1)
+	go func() {
+		var sb strings.Builder
+		_, _ = io.Copy(&sb, r)
+		done <- sb.String()
+	}()
+
+	fn()
+
+	os.Stdout = original
+	require.NoError(t, w.Close())
+	out := <-done
+	_ = r.Close()
+	return out
+}
+
+// --check is what an operator runs to validate a container's configuration
+// before deploying it, so it has to report the forwards it would serve and
+// return without touching the network.
+func TestCheckReportsTheEffectiveForwards(t *testing.T) {
+	cfg := &Config{
+		Check:         true,
+		ManagementURL: "https://mgmt.example:443",
+		Hostname:      "nblink-1",
+		Forwards: []Forward{
+			mustParse(t, "http://8080=https://grafana.internal"),
+			mustParse(t, "http://127.0.0.1:9090=https://prometheus.internal"),
+		},
+	}
+
+	var err error
+	out := captureStdout(t, func() { err = Run(context.Background(), cfg) })
+
+	require.NoError(t, err, "--check must succeed on a valid configuration")
+	assert.Contains(t, out, "https://mgmt.example:443")
+	assert.Contains(t, out, "nblink-1")
+	assert.Contains(t, out, "forwards: 2")
+	assert.Contains(t, out, "127.0.0.1:8080 -> https://grafana.internal",
+		"the listen address must be reported as resolved, not as it was typed")
+	assert.Contains(t, out, "127.0.0.1:9090 -> https://prometheus.internal")
+	assert.Contains(t, out, "state-dir: (memory)", "an unset state dir must be named, not left blank")
+}
+
+// --check reports only whether a setup key is configured. Printing the key
+// itself would put a credential on the terminal and into whatever captured it,
+// which is the one thing this output must never do.
+func TestCheckDoesNotPrintTheSetupKey(t *testing.T) {
+	cfg := &Config{
+		Check:         true,
+		ManagementURL: "https://mgmt.example:443",
+		SetupKey:      "EEE7B5B1-1F8C-4C9A-9E2D-0123456789AB",
+		Forwards:      []Forward{mustParse(t, "http://8080=https://grafana.internal")},
+	}
+
+	var err error
+	out := captureStdout(t, func() { err = Run(context.Background(), cfg) })
+
+	require.NoError(t, err)
+	assert.NotContains(t, out, cfg.SetupKey, "the setup key must never be printed")
+	assert.Contains(t, out, "setup-key: true", "its presence should still be reported")
+}
+
+// namedDialer routes each overlay name to its own local server, so a test can
+// tell which upstream a request actually reached.
+type namedDialer struct {
+	mu      sync.Mutex
+	targets map[string]string
+	asked   []string
+}
+
+func (d *namedDialer) dial(ctx context.Context, network, addr string) (net.Conn, error) {
+	d.mu.Lock()
+	d.asked = append(d.asked, addr)
+	target, ok := d.targets[addr]
+	d.mu.Unlock()
+	if !ok {
+		return nil, fmt.Errorf("no route to %s", addr)
+	}
+	var dialer net.Dialer
+	return dialer.DialContext(ctx, network, target)
+}
+
+func namedUpstream(t *testing.T, name string) string {
+	t.Helper()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = io.WriteString(w, name)
+	}))
+	t.Cleanup(srv.Close)
+	u, err := url.Parse(srv.URL)
+	require.NoError(t, err)
+	return u.Host
+}
+
+// Every forward shares the one overlay dialer and asks it for its own
+// upstream, so two specs reach two different services rather than the same one.
+func TestStartForwardsRouteEachToItsOwnUpstream(t *testing.T) {
+	dialer := &namedDialer{targets: map[string]string{
+		"grafana.internal:80":    namedUpstream(t, "grafana"),
+		"prometheus.internal:80": namedUpstream(t, "prometheus"),
+	}}
+
+	cfg := &Config{}
+	for _, spec := range []string{
+		"http://127.0.0.1:0=http://grafana.internal",
+		"http://127.0.0.1:0=http://prometheus.internal",
+	} {
+		fwd, err := ParseForward(spec)
+		require.NoError(t, err)
+		cfg.Forwards = append(cfg.Forwards, fwd)
+	}
+
+	forwards, err := startForwards(cfg, dialer.dial)
+	require.NoError(t, err)
+	require.Len(t, forwards, 2, "every configured forward must be started")
+	t.Cleanup(func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+		closeForwards(ctx, forwards)
+	})
+	for _, f := range forwards {
+		go func(f *httpForwarder) { _ = f.Serve() }(f)
+	}
+	require.NotEqual(t, forwards[0].Addr(), forwards[1].Addr(), "each forward must bind its own port")
+
+	for i, want := range []string{"grafana", "prometheus"} {
+		resp, err := http.Get("http://" + forwards[i].Addr() + "/")
+		require.NoError(t, err)
+		body, err := io.ReadAll(resp.Body)
+		_ = resp.Body.Close()
+		require.NoError(t, err)
+		assert.Equal(t, http.StatusOK, resp.StatusCode, "forward %d must be served", i)
+		assert.Equal(t, want, string(body), "forward %d must reach its own upstream", i)
+	}
+
+	dialer.mu.Lock()
+	defer dialer.mu.Unlock()
+	assert.ElementsMatch(t, []string{"grafana.internal:80", "prometheus.internal:80"}, dialer.asked,
+		"both forwards must share the one overlay dialer, each asking for its own name")
+}
+
+func TestPrintEffectiveConfig(t *testing.T) {
+	const key = "11111111-2222-3333-4444-555555555555"
+	cfg := &Config{ManagementURL: "https://management.invalid", SetupKey: key}
+	for _, spec := range []string{
+		"http://8080=https://grafana.internal",
+		"http://127.0.0.1:0=http://prometheus.internal:9090/api",
+	} {
+		fwd, err := ParseForward(spec)
+		require.NoError(t, err)
+		cfg.Forwards = append(cfg.Forwards, fwd)
+	}
+
+	var out strings.Builder
+	require.NoError(t, printEffectiveConfig(&out, cfg))
+
+	assert.Equal(t, "management-url: https://management.invalid\n"+
+		"state-dir: (memory)\n"+
+		"hostname: (host default)\n"+
+		"setup-key: true\n"+
+		"allowed-hosts: (none)\n"+
+		"forwards: 2\n"+
+		"  127.0.0.1:8080 -> https://grafana.internal\n"+
+		"  127.0.0.1:0 -> http://prometheus.internal:9090/api\n",
+		out.String(), "the check must print the effective configuration")
+	assert.NotContains(t, out.String(), key, "the check must report a key is set, never the key")
+}
+
+// The embedded client's management dial ignores cancellation, so a start that
+// does the same must not hold a signal until it gives up on its own.
+func TestStartSessionReturnsWhenInterrupted(t *testing.T) {
+	release := make(chan error)
+	start := func(context.Context) error { return <-release }
+	var stopped atomic.Bool
+
+	ctx, cancel := context.WithCancel(context.Background())
+	result := make(chan error, 1)
+	go func() { result <- startSession(ctx, start, func() { stopped.Store(true) }) }()
+
+	cancel()
+	select {
+	case err := <-result:
+		assert.ErrorIs(t, err, context.Canceled, "an interrupted start must report the cancellation")
+	case <-time.After(2 * time.Second):
+		t.Fatal("startSession waited for a start that ignores cancellation")
+	}
+
+	// The start completes after the caller gave up. Its session must not be
+	// left running.
+	release <- nil
+	assert.Eventually(t, stopped.Load, 2*time.Second, 10*time.Millisecond,
+		"a session that came up after the interrupt must be stopped")
+}
+
+func TestStartSessionReportsStartFailure(t *testing.T) {
+	failure := errors.New("login: permission denied")
+	err := startSession(context.Background(), func(context.Context) error { return failure }, func() {
+		t.Error("a session that never started must not be stopped")
+	})
+	assert.ErrorIs(t, err, failure, "the start error must be returned")
+	assert.Contains(t, err.Error(), "start client", "the error must say which step failed")
+}
+
+func TestStartSessionBoundsTheStart(t *testing.T) {
+	var deadline time.Time
+	err := startSession(context.Background(), func(ctx context.Context) error {
+		deadline, _ = ctx.Deadline()
+		return nil
+	}, func() {})
+	require.NoError(t, err)
+	assert.WithinDuration(t, time.Now().Add(startTimeout), deadline, 5*time.Second,
+		"the start must run under startTimeout")
+}
+
+func TestInterruptedOr(t *testing.T) {
+	failure := errors.New("wait for login: context canceled")
+
+	ctx, cancel := context.WithCancel(context.Background())
+	assert.Equal(t, failure, interruptedOr(ctx, failure), "an error while running must be returned")
+	cancel()
+	assert.NoError(t, interruptedOr(ctx, failure), "an error caused by a signal must be a clean exit")
+}
+
+func TestWaitForShutdownReturnsWhenAForwardStops(t *testing.T) {
+	fwd, err := ParseForward("http://127.0.0.1:0=http://grafana.internal")
+	require.NoError(t, err)
+	f, err := newHTTPForwarder(fwd, refuseDial)
+	require.NoError(t, err)
+
+	// Closing the raw listener under a serving forwarder is how a forward
+	// dies on its own, and the process must not keep running without it.
+	result := make(chan error, 1)
+	go func() { result <- waitForShutdown(context.Background(), []*httpForwarder{f}) }()
+	time.Sleep(100 * time.Millisecond)
+	require.NoError(t, f.listener.Close())
+
+	select {
+	case err := <-result:
+		assert.Error(t, err, "a forward that stopped serving must end the run with an error")
+	case <-time.After(5 * time.Second):
+		t.Fatal("waitForShutdown kept running after its only forward stopped")
+	}
+	_ = f.Close(context.Background())
+}
+
+func TestWaitForShutdownReturnsWhenContextEnds(t *testing.T) {
+	fwd, err := ParseForward("http://127.0.0.1:0=http://grafana.internal")
+	require.NoError(t, err)
+	f, err := newHTTPForwarder(fwd, refuseDial)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = f.Close(context.Background()) })
+
+	ctx, cancel := context.WithCancel(context.Background())
+	result := make(chan error, 1)
+	go func() { result <- waitForShutdown(ctx, []*httpForwarder{f}) }()
+	cancel()
+
+	select {
+	case err := <-result:
+		assert.NoError(t, err, "a cancelled context is a clean shutdown")
+	case <-time.After(5 * time.Second):
+		t.Fatal("waitForShutdown ignored the cancelled context")
+	}
+}
+
+func TestDisableNATMapperUnlessSet(t *testing.T) {
+	t.Setenv(natMapperEnv, "")
+	require.NoError(t, os.Unsetenv(natMapperEnv))
+	require.NoError(t, disableNATMapperUnlessSet())
+	assert.Equal(t, "true", os.Getenv(natMapperEnv), "an unset mapper switch must be turned off")
+
+	t.Setenv(natMapperEnv, "false")
+	require.NoError(t, disableNATMapperUnlessSet())
+	assert.Equal(t, "false", os.Getenv(natMapperEnv), "an operator's explicit choice must be kept")
+}
+
+// The consumer parses this variable with strconv.ParseBool and reads anything
+// it cannot parse as false, which enables the mapper. A value that would not
+// survive that parse must not count as an operator's choice, or an orchestrator
+// passing the name through empty turns the mapper on.
+func TestDisableNATMapperIgnoresAValueTheConsumerCannotRead(t *testing.T) {
+	for _, value := range []string{"", "yes", "on", "0.5"} {
+		t.Run("value "+strconv.Quote(value), func(t *testing.T) {
+			t.Setenv(natMapperEnv, value)
+			require.NoError(t, disableNATMapperUnlessSet())
+			assert.Equal(t, "true", os.Getenv(natMapperEnv),
+				"%q does not parse as a bool, so the mapper must stay off", value)
+		})
+	}
+
+	// Everything ParseBool does accept is a real choice and is left alone.
+	for _, value := range []string{"0", "f", "FALSE", "1", "t", "True"} {
+		t.Run("value "+strconv.Quote(value), func(t *testing.T) {
+			t.Setenv(natMapperEnv, value)
+			require.NoError(t, disableNATMapperUnlessSet())
+			assert.Equal(t, value, os.Getenv(natMapperEnv), "a parseable value is the operator's choice")
+		})
+	}
+}
+
+func TestRunCheckReturnsWithoutConnecting(t *testing.T) {
+	fwd, err := ParseForward("http://127.0.0.1:0=https://grafana.internal")
+	require.NoError(t, err)
+	// An unroutable management URL and no setup key: a run that tried to log
+	// in would block on the browser flow or fail to connect, not return nil.
+	cfg := &Config{ManagementURL: "https://management.invalid", Check: true, Forwards: []Forward{fwd}}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	assert.NoError(t, Run(ctx, cfg), "a check must return before any network access")
+	assert.NoError(t, ctx.Err(), "a check must return immediately")
+}
diff --git a/e2e/agentnetwork/nblink_test.go b/e2e/agentnetwork/nblink_test.go
new file mode 100644
index 000000000..c3302f870
--- /dev/null
+++ b/e2e/agentnetwork/nblink_test.go
@@ -0,0 +1,670 @@
+//go:build e2e
+
+package agentnetwork
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+const (
+	// nblinkSecondPort serves a second forward to the same endpoint from the
+	// same process, so one login is shown to serve more than one listener.
+	nblinkSecondPort = 8081
+	// nblinkDeadPort forwards to a name nothing in the overlay serves.
+	nblinkDeadPort = 8082
+	// nblinkPublicPort binds every interface, so it is reachable from other
+	// containers on the network, which the loopback forwards are not.
+	nblinkPublicPort = 8083
+	// nblinkDeadUpstream is under the overlay's own domain, so the lookup is
+	// answered by the in-process resolver rather than by anything outside.
+	nblinkDeadUpstream = "https://nothing-serves-this.netbird.local"
+
+	// nblinkUnreachableBody is what the forwarder itself answers when the dial
+	// over the overlay fails.
+	nblinkUnreachableBody = "upstream unreachable over the overlay"
+)
+
+// TestNBLinkReachesAgentNetwork proves an agent-network endpoint can be
+// consumed from a process that has no privileges at all:
+//
+//	curl --> nblink (loopback, userspace peer) --tunnel--> proxy --http--> vllm
+//
+// The regular agent needs NET_ADMIN and a TUN device to put the endpoint on
+// the network. nblink runs the same client in netstack mode and hands the
+// endpoint to whatever can reach a loopback port, so the container is granted
+// no capabilities and mounts no device — the whole point of the binary, and
+// what fails first if netstack mode regresses.
+//
+// Three things are being proved together, and none of them holds on its own:
+//
+//   - The forward reaches the endpoint, which means the endpoint's name
+//     resolved inside the process. Nothing on the container can resolve it:
+//     the synthesized zone is served by the in-process DNS, /etc/resolv.conf
+//     is never touched, and a name that leaked to the host resolver would be
+//     NXDOMAIN.
+//   - The forwarder's peer is a peer like any other. Its request is authorized
+//     against the policy that names its group, metered, and written to the
+//     access log under its own identity.
+//   - The loopback listener still refuses what a browser can aim at it, which
+//     is the one new attack surface a forward on localhost creates.
+//
+// One forwarder carries most of the cases, because each one costs a session:
+// it serves three forwards, reads its setup key from a file, and keeps its
+// identity on a volume so the last case can restart it.
+func TestNBLinkReachesAgentNetwork(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 25*time.Minute)
+	defer cancel()
+
+	vllm, err := harness.StartVLLM(ctx, srv)
+	require.NoError(t, err, "start mock vLLM server")
+	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
+
+	// allowed holds the forwarder's peer and is named by the policy. denied
+	// holds a second forwarder's peer and is named by nothing, so the proxy
+	// has no policy to authorize it under.
+	allowed, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-nblink-allowed"})
+	require.NoError(t, err, "create allowed group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), allowed.Id) })
+
+	denied, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-nblink-denied"})
+	require.NoError(t, err, "create denied group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), denied.Id) })
+
+	allowedKey := mintSetupKey(ctx, t, "e2e-nblink-allowed-key", allowed.Id)
+	deniedKey := mintSetupKey(ctx, t, "e2e-nblink-denied-key", denied.Id)
+
+	dummyKey := "sk-nblink-e2e"
+	prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+		Name:        "nblink-vllm",
+		ProviderId:  "vllm",
+		UpstreamUrl: vllm.URL,
+		ApiKey:      &dummyKey,
+		Enabled:     ptr(true),
+		Models: &[]api.AgentNetworkProviderModel{
+			{Id: harness.VLLMModel, InputPer1k: 0.001, OutputPer1k: 0.002},
+		},
+	})
+	require.NoError(t, err, "create provider")
+	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
+
+	// A second provider on the mock's streaming listener, which answers every
+	// request as server-sent events.
+	streamProv, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+		Name:        "nblink-stream",
+		ProviderId:  "anthropic_api",
+		UpstreamUrl: vllm.StreamURL,
+		ApiKey:      &dummyKey,
+		Enabled:     ptr(true),
+		Models: &[]api.AgentNetworkProviderModel{
+			{Id: streamedModel, InputPer1k: streamInRate, OutputPer1k: streamOutRate},
+		},
+	})
+	require.NoError(t, err, "create streaming provider")
+	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), streamProv.Id) })
+
+	// Caps far above what this test drives, so the limit never blocks but
+	// usage metering is switched on — that is what writes consumption rows.
+	pol, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-nblink-allow",
+		Enabled:                ptr(true),
+		SourceGroups:           []string{allowed.Id},
+		DestinationProviderIds: []string{prov.Id, streamProv.Id},
+		Limits: &api.AgentNetworkPolicyLimits{
+			TokenLimit: api.AgentNetworkPolicyTokenLimit{
+				Enabled:       true,
+				GroupCap:      10_000_000,
+				UserCap:       10_000_000,
+				WindowSeconds: 60,
+			},
+		},
+	})
+	require.NoError(t, err, "create policy")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), pol.Id) })
+
+	settings, err := srv.GetSettings(ctx)
+	require.NoError(t, err, "read settings")
+	require.NotEmpty(t, settings.Endpoint, "endpoint must be assigned")
+
+	proxyToken, err := srv.CreateProxyTokenCLI(ctx, "e2e-nblink-proxy")
+	require.NoError(t, err, "mint proxy token")
+	px, err := harness.StartProxy(ctx, srv, proxyToken)
+	require.NoError(t, err, "start proxy")
+	t.Cleanup(func() { _ = px.Terminate(context.Background()) })
+
+	stateVolume := fmt.Sprintf("e2e-nblink-state-%d", time.Now().UnixNano())
+	t.Cleanup(func() { _ = harness.RemoveDockerVolume(context.Background(), stateVolume) })
+
+	// The upstream is the endpoint itself, over HTTPS. nblink verifies the
+	// certificate like any Go client, so it needs the proxy's self-signed cert
+	// — the curl helpers elsewhere in this suite sidestep that with -k.
+	forward := nblinkForward(harness.NBLinkPort, "https://"+settings.Endpoint)
+	nbOpts := []harness.NBLinkOption{
+		harness.WithNBLinkForwards(
+			nblinkForward(nblinkSecondPort, "https://"+settings.Endpoint),
+			nblinkForward(nblinkDeadPort, nblinkDeadUpstream),
+			fmt.Sprintf("http://0.0.0.0:%d=https://%s", nblinkPublicPort, settings.Endpoint),
+		),
+		harness.WithNBLinkEnv("NB_ALLOW_PUBLIC_BIND", "true"),
+		// The name other containers use for the public forward.
+		harness.WithNBLinkEnv("NB_ALLOWED_HOST", "nblink"),
+		harness.WithNBLinkSetupKeyFile(),
+		harness.WithNBLinkStateVolume(stateVolume),
+	}
+	nb, err := harness.StartNBLink(ctx, srv, allowedKey, forward, px.CACertPath(), nbOpts...)
+	require.NoError(t, err, "start nblink")
+	// nb is replaced by the restart case, so the cleanup reads the variable
+	// rather than the first value.
+	t.Cleanup(func() { _ = nb.Terminate(context.Background()) })
+
+	diag := func() string {
+		return "\n=== nblink logs ===\n" + nb.Logs(context.Background()) +
+			"\n=== proxy logs ===\n" + px.Logs(context.Background())
+	}
+
+	before, _ := srv.ListAccessLogs(ctx)
+	sessionID := "e2e-session-nblink"
+
+	// Retry to absorb the beat between the session coming up and the proxy
+	// peer being reachable; the forward itself is already bound by now.
+	code, body := chatUntil(ctx, t, nb, 200, 120*time.Second, sessionID)
+	require.Equal(t, 200, code,
+		"a chat through the nblink forward must be served; body: %s%s", body, diag())
+	require.Contains(t, body, "chat.completion",
+		"the body should be the upstream's OpenAI-compatible completion; got: %s", body)
+
+	var peer api.Peer
+	t.Run("the peer registers under its hostname", func(t *testing.T) {
+		peers := peersWithHostname(ctx, t, nb.Hostname())
+		require.Len(t, peers, 1, "exactly one peer must carry the forwarder's hostname %q", nb.Hostname())
+		peer = peers[0]
+		assert.True(t, peerInGroup(peer, allowed.Id),
+			"the setup key read from the file must have joined the peer to its auto-group")
+	})
+
+	t.Run("the request is attributed to the forwarder's own peer", func(t *testing.T) {
+		require.NotEmpty(t, peer.Ip, "the peer lookup must have run first")
+
+		var row *api.AgentNetworkAccessLog
+		require.Eventually(t, func() bool {
+			logs, lerr := srv.ListAccessLogs(ctx)
+			if lerr != nil || logs.TotalRecords <= before.TotalRecords {
+				return false
+			}
+			for i, r := range logs.Data {
+				if r.SessionId != nil && *r.SessionId == sessionID {
+					row = &logs.Data[i]
+					return true
+				}
+			}
+			return false
+		}, 30*time.Second, 2*time.Second,
+			"session %q must reach the access log; a forward is not a way around accounting%s", sessionID, diag())
+		require.NotNil(t, row.SourceIp, "the access log row must carry the caller's overlay address")
+		assert.Equal(t, peer.Ip, *row.SourceIp,
+			"the access log must name the forwarder's peer as the caller")
+
+		require.Eventually(t, func() bool {
+			rows, lerr := srv.ListConsumption(ctx)
+			if lerr != nil {
+				return false
+			}
+			for _, r := range rows {
+				if r.TokensInput > 0 && r.TokensOutput > 0 {
+					return true
+				}
+			}
+			return false
+		}, 60*time.Second, 3*time.Second, "the upstream's usage must be metered into a consumption row")
+	})
+
+	t.Run("every forward in one process serves over the same session", func(t *testing.T) {
+		scode, sbody, serr := nb.PostOn(ctx, nblinkSecondPort, harness.ChatPath,
+			harness.ChatBody(harness.VLLMModel, "Reply with exactly: pong"), nil)
+		require.NoError(t, serr, "the probe must reach the second listener")
+		assert.Equal(t, 200, scode, "the second forward must be served too; body: %s%s", sbody, diag())
+		assert.Contains(t, sbody, "chat.completion", "the second forward must carry the upstream completion back")
+	})
+
+	t.Run("an upstream nothing serves answers 502 without hanging", func(t *testing.T) {
+		start := time.Now()
+		dcode, dbody, derr := nb.PostOn(ctx, nblinkDeadPort, harness.ChatPath,
+			harness.ChatBody(harness.VLLMModel, "Reply with exactly: pong"), nil)
+		elapsed := time.Since(start)
+		require.NoError(t, derr, "the probe must reach the third listener")
+		assert.Equal(t, 502, dcode, "a forward whose upstream cannot be dialled must answer 502; body: %s", dbody)
+		assert.Contains(t, dbody, nblinkUnreachableBody, "the 502 must be the forwarder's own answer")
+		// The forwarder bounds a dial at 30s; anything near curl's 90s limit
+		// means a request was left hanging.
+		assert.Less(t, elapsed, 40*time.Second, "an unreachable upstream must fail fast, took %s", elapsed)
+	})
+
+	t.Run("a streamed reply arrives as events and is metered", func(t *testing.T) {
+		streamSession := "e2e-session-nblink-stream"
+		body := fmt.Sprintf(`{"model":%q,"max_tokens":64,"stream":true,"messages":[{"role":"user","content":"Reply with exactly: pong"}]}`, streamedModel)
+		scode, sbody, serr := nb.Post(ctx, "/v1/messages", body,
+			[]string{"anthropic-version: 2023-06-01", "x-session-id: " + streamSession})
+		require.NoError(t, serr, "the probe must reach the listener")
+		require.Equal(t, 200, scode, "a streamed request must be served; body: %s%s", sbody, diag())
+		assert.Contains(t, sbody, "event: message_start", "the caller must receive the event stream itself")
+		assert.Contains(t, sbody, "message_stop", "the stream must arrive complete")
+
+		row := findAccessLogBySession(t, ctx, streamSession)
+		assert.Equal(t, harness.VLLMStreamInputTokens, int(row.InputTokens),
+			"the proxy must meter a stream carried by the forwarder like any other")
+		assert.Equal(t, harness.VLLMStreamOutputTokens, int(row.OutputTokens),
+			"output tokens must be metered from the stream")
+	})
+
+	t.Run("only the public forward is reachable from the network", func(t *testing.T) {
+		chat := harness.ChatBody(harness.VLLMModel, "Reply with exactly: pong")
+
+		pcode, pbody, perr := nb.PostFromNetwork(ctx, nblinkPublicPort, harness.ChatPath, chat, nil)
+		require.NoError(t, perr, "the public forward must accept a connection from another container")
+		assert.Equal(t, 200, pcode, "the public forward must serve a caller under a listed name; body: %s", pbody)
+
+		// The shape a rebound page sends: its own name, with Origin and
+		// Sec-Fetch-Site agreeing that the request is same-origin.
+		rcode, rbody, rerr := nb.PostFromNetwork(ctx, nblinkPublicPort, harness.ChatPath, chat, []string{
+			"Host: attacker.example:8083", "Origin: http://attacker.example:8083", "Sec-Fetch-Site: same-origin",
+		})
+		require.NoError(t, rerr)
+		assert.Equal(t, 421, rcode, "a public forward must refuse a name it was not given; body: %s", rbody)
+		assert.Contains(t, nb.Logs(ctx), fmt.Sprintf("forwarding http://0.0.0.0:%d", nblinkPublicPort),
+			"a 0.0.0.0 forward must bind the IPv4 wildcard, not the dual-stack one")
+
+		// The Host check only protects loopback listeners, but the browser
+		// checks still hold on a public one.
+		ocode, _, oerr := nb.PostFromNetwork(ctx, nblinkPublicPort, harness.ChatPath, chat,
+			[]string{"Origin: https://attacker.example"})
+		require.NoError(t, oerr)
+		assert.Equal(t, 403, ocode, "a cross-origin browser request must be refused on a public forward too")
+
+		_, _, lerr := nb.PostFromNetwork(ctx, harness.NBLinkPort, harness.ChatPath, chat, nil)
+		assert.Error(t, lerr, "a loopback forward must refuse connections from other machines")
+	})
+
+	t.Run("the logs show no secrets and no side effects on the host", func(t *testing.T) {
+		// The suite runs at debug level, the most an operator can turn on.
+		logs := nb.Logs(ctx)
+		require.Contains(t, logs, "over the overlay", "the logs must have been read")
+		assert.NotContains(t, logs, allowedKey, "the setup key must not be logged")
+		assert.Contains(t, logs, "NAT port mapper disabled", "nblink must not ask the router for a port mapping")
+		assert.NotContains(t, logs, "/var/lib/netbird", "nblink must not touch an installed agent's state")
+		assert.NotContains(t, logs, "failed to login to Management Service",
+			"registering a new peer must not log an error")
+	})
+
+	t.Run("a peer no policy names cannot reach the endpoint", func(t *testing.T) {
+		other, oerr := harness.StartNBLink(ctx, srv, deniedKey, forward, px.CACertPath(),
+			harness.WithNBLinkName("nblink-denied"))
+		require.NoError(t, oerr, "start the second forwarder")
+		t.Cleanup(func() { _ = other.Terminate(context.Background()) })
+		otherDiag := func() string {
+			return "\n=== denied nblink logs ===\n" + other.Logs(context.Background()) +
+				"\n=== proxy logs ===\n" + px.Logs(context.Background())
+		}
+
+		// Management gives the endpoint's DNS record, the proxy peer and the
+		// rule allowing 443 to it only to peers in an enabled policy's source
+		// groups. This peer gets none of them, so it is refused in the overlay
+		// itself and the request never reaches the proxy's router. The
+		// forwarder reports that as its own 502.
+		//
+		// Keep asking for as long as the allowed forwarder needed to be served,
+		// so a 502 cannot be blamed on a tunnel that had not settled yet.
+		deniedSession := "e2e-session-nblink-denied"
+		deadline := time.Now().Add(60 * time.Second)
+		var ocode int
+		var obody string
+		for time.Now().Before(deadline) {
+			ocode, obody, _ = other.Chat(ctx, harness.VLLMModel, "Reply with exactly: pong", deniedSession)
+			if ocode != 502 {
+				break
+			}
+			time.Sleep(5 * time.Second)
+		}
+		assert.Equal(t, 502, ocode,
+			"a forwarder whose peer is in no policy's source group must not get through; body: %s%s", obody, otherDiag())
+		assert.Contains(t, obody, nblinkUnreachableBody,
+			"the refusal must be the forwarder failing to dial, not an answer from the proxy; body: %s", obody)
+		assert.NotContains(t, obody, "chat.completion", "the refusal must not carry an upstream completion")
+
+		// The forwarder logs why the dial failed at debug level, which this
+		// suite runs at. Finding the line ties the 502 to this upstream rather
+		// than to some other failure inside the forwarder.
+		dialFailure := fmt.Sprintf("dial %s:443 over the overlay failed", settings.Endpoint)
+		logs := other.Logs(ctx)
+		require.Contains(t, logs, dialFailure, "the 502 must come from the overlay dial; logs:\n%s", logs)
+		for _, line := range strings.Split(logs, "\n") {
+			if strings.Contains(line, dialFailure) {
+				t.Logf("denied forwarder: %s", strings.TrimSpace(line))
+				break
+			}
+		}
+
+		// The allowed forwarder is still served at the same moment, so the
+		// refusal is about this peer and not about the endpoint being down.
+		acode, abody := chatUntil(ctx, t, nb, 200, 30*time.Second, "")
+		assert.Equal(t, 200, acode, "the allowed forwarder must still be served; body: %s", abody)
+
+		rows, lerr := srv.ListAccessLogs(ctx)
+		require.NoError(t, lerr, "list access logs")
+		for _, r := range rows.Data {
+			assert.False(t, r.SessionId != nil && *r.SessionId == deniedSession,
+				"a request that never reached the proxy must leave no access log row")
+		}
+	})
+
+	t.Run("the loopback listener refuses browser-driven callers", func(t *testing.T) {
+		// A page the user visits can aim a request at a loopback listener in
+		// several shapes. Each must be refused before anything is proxied
+		// under the peer's identity, while an ordinary local caller is
+		// unaffected.
+		cases := []struct {
+			name    string
+			headers []string
+			want    int
+		}{
+			{
+				name:    "a foreign Host, which is DNS rebinding",
+				headers: []string{"Host: attacker.example"},
+				want:    421,
+			},
+			{
+				name:    "a cross-origin fetch",
+				headers: []string{"Origin: https://attacker.example"},
+				want:    403,
+			},
+			{
+				name: "a page on another local port, which is cross-origin too",
+				// Same machine, different origin: localhost:3000 has no more
+				// claim on this listener than any other site.
+				headers: []string{"Origin: http://localhost:3000"},
+				want:    403,
+			},
+			{
+				name: "an embedded no-cors GET, which carries no Origin at all",
+				// The shape the Host and Origin checks both miss: a loopback
+				// Host and no Origin. Sec-Fetch-Site is the only signal left.
+				headers: []string{"Sec-Fetch-Site: cross-site"},
+				want:    403,
+			},
+		}
+		// Every case sends the request already proven to return 200, so the
+		// only difference between a refusal and a success is the header under
+		// test.
+		body := harness.ChatBody(harness.VLLMModel, "Reply with exactly: pong")
+		for _, tc := range cases {
+			t.Run(tc.name, func(t *testing.T) {
+				gcode, gbody, gerr := nb.Post(ctx, harness.ChatPath, body, tc.headers)
+				require.NoError(t, gerr, "the probe itself must reach the listener")
+				assert.Equal(t, tc.want, gcode,
+					"%s must be refused by the listener, not proxied; body: %s", tc.name, gbody)
+				assert.NotContains(t, gbody, "chat.completion",
+					"a refused request must never carry an upstream completion back")
+			})
+		}
+
+		// The control: the same request with none of those headers is served,
+		// so the cases above prove a guard rather than a broken forward.
+		gcode, gbody, gerr := nb.Post(ctx, harness.ChatPath, body, nil)
+		require.NoError(t, gerr)
+		assert.Equal(t, 200, gcode,
+			"a plain local caller must still be served; body: %s%s", gbody, diag())
+	})
+
+	t.Run("an upstream whose certificate is not trusted is refused", func(t *testing.T) {
+		// No CA mounted: the proxy's self-signed certificate is unknown to the
+		// forwarder, which must refuse it rather than proxy in the clear.
+		untrusted, uerr := harness.StartNBLink(ctx, srv, allowedKey, forward, "",
+			harness.WithNBLinkName("nblink-untrusted"))
+		require.NoError(t, uerr, "start the forwarder without the proxy's CA")
+		t.Cleanup(func() { _ = untrusted.Terminate(context.Background()) })
+
+		// Until the tunnel settles the dial itself fails with the same 502, so
+		// wait for the handshake failure specifically.
+		var ucode int
+		var ubody string
+		require.Eventually(t, func() bool {
+			ucode, ubody, _ = untrusted.Chat(ctx, harness.VLLMModel, "Reply with exactly: pong", "")
+			return strings.Contains(untrusted.Logs(ctx), "x509")
+		}, 120*time.Second, 5*time.Second, "the forwarder must reach the TLS handshake and fail it; logs:\n%s", untrusted.Logs(ctx))
+		assert.Equal(t, 502, ucode, "an unverified upstream must not be served; body: %s", ubody)
+		assert.NotContains(t, ubody, "chat.completion", "no completion may come back over an unverified connection")
+	})
+
+	t.Run("an arbitrary UID in group 0 keeps its identity on a volume", func(t *testing.T) {
+		// OpenShift's restricted SCC runs the image as a UID from the
+		// namespace range with group 0. The state directory is group 0 and
+		// group-writable, and a fresh volume inherits that.
+		const name = "nblink-openshift"
+		volume := fmt.Sprintf("e2e-nblink-openshift-%d", time.Now().UnixNano())
+		t.Cleanup(func() { _ = harness.RemoveDockerVolume(context.Background(), volume) })
+		opts := []harness.NBLinkOption{
+			harness.WithNBLinkName(name),
+			harness.WithNBLinkUser("1000770000:0"),
+			harness.WithNBLinkStateVolume(volume),
+			harness.WithNBLinkSetupKeyFile(),
+		}
+
+		for range 2 {
+			fwdr, oerr := harness.StartNBLink(ctx, srv, allowedKey, forward, px.CACertPath(), opts...)
+			require.NoError(t, oerr, "start the forwarder as an arbitrary UID")
+			// Registered before the assertions below so a failure between here
+			// and the explicit Terminate cannot leave a container holding the
+			// volume the cleanup above tries to remove.
+			t.Cleanup(func() { _ = fwdr.Terminate(context.Background()) })
+			ocode, obody := chatUntil(ctx, t, fwdr, 200, 120*time.Second, "")
+			assert.Equal(t, 200, ocode, "the forwarder must serve as an arbitrary UID; body: %s", obody)
+			require.NoError(t, fwdr.Terminate(ctx), "stop the forwarder")
+		}
+		assert.Len(t, peersWithHostname(ctx, t, name), 1,
+			"an arbitrary UID must be able to persist the identity it registered")
+	})
+
+	t.Run("without a state dir every start is a new peer", func(t *testing.T) {
+		const name = "nblink-ephemeral"
+		for range 2 {
+			eph, eerr := harness.StartNBLink(ctx, srv, allowedKey, forward, px.CACertPath(), harness.WithNBLinkName(name))
+			require.NoError(t, eerr, "start the in-memory forwarder")
+			t.Cleanup(func() { _ = eph.Terminate(context.Background()) })
+			require.NoError(t, eph.Terminate(ctx), "stop the in-memory forwarder")
+		}
+		peers := peersWithHostname(ctx, t, name)
+		assert.Len(t, peers, 2, "each in-memory start must register its own peer, as the README warns")
+	})
+
+	// Last, because it replaces the forwarder every case above used.
+	t.Run("a state dir keeps the same peer across restarts", func(t *testing.T) {
+		require.NotEmpty(t, peer.Id, "the peer lookup must have run first")
+
+		// docker stop sends SIGTERM. The forwarder must drain and exit cleanly
+		// well inside the grace period rather than be killed at its end.
+		exitCode, took, serr := nb.Stop(ctx, 30*time.Second)
+		require.NoError(t, serr, "stop the first forwarder")
+		assert.Equal(t, 0, exitCode, "SIGTERM must be a clean exit")
+		assert.Less(t, took, 15*time.Second, "shutdown must not wait out the grace period")
+		assert.Contains(t, nb.Logs(ctx), "shutting down", "the forwarder must log the signal it handled")
+		require.NoError(t, nb.Terminate(ctx), "remove the first forwarder")
+
+		restarted, rerr := harness.StartNBLink(ctx, srv, allowedKey, forward, px.CACertPath(), nbOpts...)
+		require.NoError(t, rerr, "start the forwarder again on the same volume")
+		nb = restarted
+
+		peers := peersWithHostname(ctx, t, nb.Hostname())
+		require.Len(t, peers, 1,
+			"a restart on the same state dir must not register a second peer; got %d", len(peers))
+		assert.Equal(t, peer.Id, peers[0].Id, "the restarted forwarder must come back as the same peer")
+
+		rcode, rbody := chatUntil(ctx, t, nb, 200, 120*time.Second, "")
+		assert.Equal(t, 200, rcode, "the restarted forwarder must be served again; body: %s%s", rbody, diag())
+	})
+}
+
+// TestNBLinkWithoutManagement covers a forwarder that can never bring its
+// session up. It must fail rather than hang, and a signal while it is trying
+// must stop it straight away.
+func TestNBLinkWithoutManagement(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
+	defer cancel()
+
+	env := map[string]string{
+		"NB_MANAGEMENT_URL": "https://management.invalid",
+		"NB_SETUP_KEY":      "11111111-2222-3333-4444-555555555555",
+		"NB_FORWARD":        "http://8080=https://grafana.netbird.cloud",
+	}
+
+	t.Run("an unreachable management server fails the start", func(t *testing.T) {
+		start := time.Now()
+		res, err := harness.RunNBLinkIsolated(ctx, env)
+		took := time.Since(start)
+		require.NoError(t, err, "run the forwarder")
+		assert.NotEqual(t, 0, res.ExitCode, "a session that cannot come up must be an error; stderr: %s", res.Stderr)
+		assert.Contains(t, res.Stderr, "start client", "the error must say the session did not start")
+		assert.NotContains(t, res.Stderr, "over the overlay", "no forward may be announced without a session")
+		// startTimeout is 90s; past that something is waiting without a bound.
+		assert.Less(t, took, 120*time.Second, "the start must give up within its timeout")
+	})
+
+	t.Run("SIGTERM during startup exits at once", func(t *testing.T) {
+		exitCode, took, logs, err := harness.StopNBLinkDuringStartup(ctx, env, 3*time.Second, 30*time.Second)
+		require.NoError(t, err, "start and stop the forwarder")
+		assert.Equal(t, 0, exitCode, "a signal during startup is a clean exit; logs:\n%s", logs)
+		assert.Less(t, took, 5*time.Second, "the signal must not wait for the management dial to time out")
+	})
+}
+
+// TestNBLinkCheck runs the image with --check, which must validate the
+// configuration and print it without starting a session. The container has no
+// network, so a run that tried to reach management could not exit 0.
+func TestNBLinkCheck(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
+	defer cancel()
+
+	setupKey := "11111111-2222-3333-4444-555555555555"
+
+	t.Run("a valid configuration prints its forwards and exits 0", func(t *testing.T) {
+		res, err := harness.RunNBLinkCheck(ctx, map[string]string{
+			"NB_MANAGEMENT_URL": "https://management.invalid",
+			"NB_SETUP_KEY":      setupKey,
+			"NB_FORWARD":        "http://8080=https://one.netbird.cloud,http://127.0.0.1:0=http://two.netbird.cloud:8000/v1",
+		})
+		require.NoError(t, err, "run the check")
+		require.Equal(t, 0, res.ExitCode, "a valid configuration must pass; stderr: %s", res.Stderr)
+		assert.Contains(t, res.Stdout, "forwards: 2", "both comma-separated forwards must be parsed")
+		assert.Contains(t, res.Stdout, "127.0.0.1:8080 -> https://one.netbird.cloud",
+			"a port-only spec must bind loopback")
+		assert.Contains(t, res.Stdout, "127.0.0.1:0 -> http://two.netbird.cloud:8000/v1",
+			"the second forward must be printed as given")
+		assert.Contains(t, res.Stdout, "setup-key: true", "the check must report that a key is set")
+		assert.NotContains(t, res.Stdout+res.Stderr, setupKey, "the check must never print the key itself")
+		assert.NotContains(t, res.Stderr, "connecting to", "the check must not start a session")
+	})
+
+	t.Run("an unsupported forward exits non-zero and prints nothing", func(t *testing.T) {
+		res, err := harness.RunNBLinkCheck(ctx, map[string]string{
+			"NB_SETUP_KEY": setupKey,
+			"NB_FORWARD":   "http://8080=https://one.netbird.cloud,tcp://5432=db.netbird.cloud:5432",
+		})
+		require.NoError(t, err, "run the check")
+		assert.NotEqual(t, 0, res.ExitCode, "a bad spec must fail the check")
+		assert.Empty(t, strings.TrimSpace(res.Stdout), "a failed check must not print a configuration")
+		assert.Contains(t, res.Stderr, "tcp forwarding is not supported yet",
+			"the error must name the spec that failed")
+	})
+
+	t.Run("a public bind without the opt-in exits non-zero", func(t *testing.T) {
+		res, err := harness.RunNBLinkCheck(ctx, map[string]string{
+			"NB_FORWARD": "http://0.0.0.0:8080=https://one.netbird.cloud",
+		})
+		require.NoError(t, err, "run the check")
+		assert.NotEqual(t, 0, res.ExitCode, "binding beyond loopback must need --allow-public-bind")
+		assert.Contains(t, res.Stderr, "NB_ALLOW_PUBLIC_BIND", "the error must say how to opt in")
+	})
+}
+
+// nblinkForward builds a forward spec: a loopback listener on port, proxying
+// to upstream over the overlay.
+//
+// The listener stays on loopback, so --allow-public-bind is never passed and
+// the default an operator gets is what the suite exercises.
+func nblinkForward(port int, upstream string) string {
+	return fmt.Sprintf("http://127.0.0.1:%d=%s", port, upstream)
+}
+
+// peersWithHostname returns every peer registered under hostname.
+func peersWithHostname(ctx context.Context, t *testing.T, hostname string) []api.Peer {
+	t.Helper()
+
+	peers, err := srv.API().Peers.List(ctx)
+	require.NoError(t, err, "list peers")
+	var matched []api.Peer
+	for _, p := range peers {
+		if p.Hostname == hostname {
+			matched = append(matched, p)
+		}
+	}
+	return matched
+}
+
+func peerInGroup(p api.Peer, groupID string) bool {
+	for _, g := range p.Groups {
+		if g.Id == groupID {
+			return true
+		}
+	}
+	return false
+}
+
+// mintSetupKey creates a reusable setup key that auto-joins its peer to one
+// group, which is how a forwarder's peer lands in (or out of) a policy's
+// source groups.
+func mintSetupKey(ctx context.Context, t *testing.T, name, groupID string) string {
+	t.Helper()
+
+	ephemeral := false
+	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
+		Name:       name,
+		Type:       "reusable",
+		ExpiresIn:  86400,
+		UsageLimit: 0,
+		AutoGroups: []string{groupID},
+		Ephemeral:  &ephemeral,
+	})
+	require.NoError(t, err, "mint setup key %s", name)
+	require.NotEmpty(t, sk.Key, "setup key plaintext")
+	return sk.Key
+}
+
+// chatUntil retries a chat through the forwarder until it answers with want,
+// returning the last status and body either way.
+func chatUntil(ctx context.Context, t *testing.T, nb *harness.NBLink, want int, timeout time.Duration, sessionID string) (int, string) {
+	t.Helper()
+
+	var code int
+	var body string
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		c, b, err := nb.Chat(ctx, harness.VLLMModel, "Reply with exactly: pong", sessionID)
+		if err == nil {
+			code, body = c, b
+			if code == want {
+				return code, body
+			}
+		}
+		if !waitBeforeRetry(ctx, 5*time.Second) {
+			break
+		}
+	}
+	return code, body
+}
diff --git a/e2e/harness/Dockerfile.nblink b/e2e/harness/Dockerfile.nblink
new file mode 100644
index 000000000..dac3aceec
--- /dev/null
+++ b/e2e/harness/Dockerfile.nblink
@@ -0,0 +1,37 @@
+# Multistage build for nblink, used in e2e tests. The release image
+# (client/Dockerfile-nblink) packages a goreleaser artifact, so this compiles
+# from source the way Dockerfile.client does for the agent, while keeping the
+# release image's runtime shape: distroless, non-root, numeric UID.
+#
+# The runtime stage deliberately grants nothing. nblink's claim is that it
+# needs no TUN device and no capabilities, so an image or a container request
+# that quietly hands it NET_ADMIN would make the suite prove the opposite of
+# what it is for.
+
+FROM golang:1.26.7-bookworm AS builder
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN --mount=type=cache,target=/go/pkg/mod go mod download
+COPY . .
+RUN --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target=/root/.cache/go-build \
+    CGO_ENABLED=0 GOOS=linux go build -o /out/nblink ./client/link/cmd/nblink \
+    && mkdir -p /out/state/nblink && chmod 770 /out/state/nblink
+
+FROM gcr.io/distroless/static-debian13:nonroot
+
+# Same state directory as the release image, so a volume mounted over it
+# starts out owned by 65532:0 and the identity-persistence case runs against
+# the ownership the release image ships.
+COPY --from=builder --chown=65532:0 /out/state/ /var/lib/
+
+# Numeric, as in the release image: the runtime may substitute its own UID and
+# there is no passwd entry to look up.
+USER 65532:0
+
+# No NB_STATE_DIR by default. State stays in memory and each run registers a
+# fresh peer; the persistence case sets it explicitly with a volume.
+ENV NB_LOG_LEVEL=info
+
+COPY --from=builder /out/nblink /usr/local/bin/nblink
+ENTRYPOINT ["/usr/local/bin/nblink"]
diff --git a/e2e/harness/nblink.go b/e2e/harness/nblink.go
new file mode 100644
index 000000000..1c5cc7ab0
--- /dev/null
+++ b/e2e/harness/nblink.go
@@ -0,0 +1,508 @@
+//go:build e2e
+
+package harness
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"os/exec"
+	"strings"
+	"time"
+
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/mount"
+	"github.com/testcontainers/testcontainers-go"
+	"github.com/testcontainers/testcontainers-go/wait"
+)
+
+const (
+	nblinkDockerfile = "e2e/harness/Dockerfile.nblink"
+	// defaultNBLinkImage is the local tag nblink is built under from
+	// nblinkDockerfile. Override with NB_E2E_NBLINK_IMAGE: a value with a "/"
+	// is pulled as a published image; a bare tag is built under that name.
+	defaultNBLinkImage = "netbird-nblink:e2e"
+	nblinkAlias        = "nblink"
+
+	// NBLinkPort is the loopback port every forwarder in this suite listens
+	// on. Tests reach it from a sidecar container sharing the forwarder's
+	// network namespace, so loopback is enough and --allow-public-bind stays
+	// off — the default an operator gets.
+	NBLinkPort = 8080
+
+	// nblinkCAPath is where the proxy's self-signed cert is mounted. nblink
+	// verifies its upstream like any Go HTTP client, so without this the
+	// forward fails the TLS handshake rather than reaching the endpoint.
+	nblinkCAPath = "/etc/nblink/upstream-ca.crt"
+
+	// nblinkReadyLog is the line startForwards writes once the overlay session
+	// is up and every forward is bound.
+	nblinkReadyLog = "over the overlay"
+
+	// nblinkSecretsDir holds the setup key for WithNBLinkSetupKeyFile, mounted
+	// read-only the way the README's container example mounts it.
+	nblinkSecretsDir = "/run/secrets"
+	nblinkKeyFile    = "nb_setup_key"
+	nblinkKeyPath    = nblinkSecretsDir + "/" + nblinkKeyFile
+	// keyWriterImage writes the key into its volume. The file is root-owned
+	// and readable by group 0 only, the ownership the README tells operators a
+	// key needs for UID 65532:0 to read it.
+	keyWriterImage = "alpine:3.22"
+
+	// nblinkStateDir is the state directory both images create, owned by
+	// 65532:0, so a volume mounted over it inherits that ownership.
+	nblinkStateDir = "/var/lib/nblink"
+)
+
+// ChatPath and ChatBody are the request the forwarder is driven with. They are
+// exported so a test can send the very same request with one header changed
+// and attribute the difference in the answer to that header alone.
+const ChatPath = "/v1/chat/completions"
+
+// NBLink is a running nblink container: a NetBird peer in userspace mode
+// forwarding a local port to an upstream reached inside the tunnel.
+type NBLink struct {
+	container testcontainers.Container
+	keyVolume string
+	network   string
+	name      string
+	port      int
+}
+
+// nblinkOptions is what the NBLinkOption values assemble.
+type nblinkOptions struct {
+	name        string
+	port        int
+	extra       []string
+	keyAsFile   bool
+	stateVolume string
+	env         map[string]string
+	user        string
+}
+
+// NBLinkOption adjusts how StartNBLink runs the forwarder.
+type NBLinkOption func(*nblinkOptions)
+
+// NBLinkCheckResult is what a --check run printed and how it exited.
+type NBLinkCheckResult struct {
+	Stdout   string
+	Stderr   string
+	ExitCode int
+}
+
+// StartNBLink builds the nblink image and runs it on the combined server's
+// network, joining with the given setup key and serving one HTTP forward.
+//
+// forward is a complete spec (scheme://[host:]port=upstream). caCertPath is a
+// PEM file on the host holding the upstream's certificate, mounted in and
+// pointed at with SSL_CERT_FILE; pass "" when the upstream needs no extra
+// trust.
+//
+// The container is granted no capabilities and no TUN device. That is the
+// assertion, not an oversight: nblink that needed either would not be able to
+// run where it claims to.
+func StartNBLink(ctx context.Context, c *Combined, setupKey, forward, caCertPath string, opts ...NBLinkOption) (*NBLink, error) {
+	o := nblinkOptions{name: nblinkAlias, port: NBLinkPort}
+	for _, opt := range opts {
+		opt(&o)
+	}
+
+	image, err := nblinkImage(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	env := map[string]string{
+		"NB_MANAGEMENT_URL": combinedExposedURL,
+		"NB_SETUP_KEY":      setupKey,
+		"NB_FORWARD":        strings.Join(append([]string{forward}, o.extra...), ","),
+		"NB_HOSTNAME":       o.name,
+		"NB_LOG_LEVEL":      "debug",
+		// Match the agent and the proxy: the combined relay is WebSocket-only,
+		// so the embedded client must use WS to hold a stable relay link.
+		"NB_RELAY_TRANSPORT": "ws",
+	}
+	if caCertPath != "" {
+		env["SSL_CERT_FILE"] = nblinkCAPath
+	}
+	var keyVolume string
+	if o.keyAsFile {
+		// The root filesystem is read-only, so the key cannot be copied in; it
+		// is mounted, as it would be in production.
+		keyVolume = fmt.Sprintf("e2e-nblink-key-%s-%d", o.name, time.Now().UnixNano())
+		if err := writeKeyVolume(ctx, keyVolume, setupKey); err != nil {
+			return nil, err
+		}
+		env["NB_SETUP_KEY"] = "file:" + nblinkKeyPath
+	}
+	if o.stateVolume != "" {
+		env["NB_STATE_DIR"] = nblinkStateDir
+	}
+	for k, v := range o.env {
+		env[k] = v
+	}
+
+	req := testcontainers.ContainerRequest{
+		Image: image,
+		// The embedded client reports the container hostname to management, so
+		// this is the name the peer is addressable by in the API.
+		Hostname:       o.name,
+		User:           o.user,
+		Networks:       []string{c.network.Name},
+		NetworkAliases: map[string][]string{c.network.Name: {o.name}},
+		Env:            env,
+		HostConfigModifier: func(hc *container.HostConfig) {
+			hardenNBLink(hc)
+			if caCertPath != "" {
+				hc.Binds = append(hc.Binds, caCertPath+":"+nblinkCAPath+":ro")
+			}
+			if keyVolume != "" {
+				hc.Mounts = append(hc.Mounts, mount.Mount{
+					Type:     mount.TypeVolume,
+					Source:   keyVolume,
+					Target:   nblinkSecretsDir,
+					ReadOnly: true,
+				})
+			}
+			if o.stateVolume != "" {
+				hc.Mounts = append(hc.Mounts, mount.Mount{
+					Type:   mount.TypeVolume,
+					Source: o.stateVolume,
+					Target: nblinkStateDir,
+				})
+			}
+		},
+		// The session has 90s of its own to come up, so the wait has to outlast
+		// that or a slow handshake reads as a missing log line.
+		WaitingFor: wait.ForLog(nblinkReadyLog).WithStartupTimeout(150 * time.Second),
+	}
+
+	ctr, err := testcontainers.GenericContainer(ctx, testcontainers.GenericContainerRequest{
+		ContainerRequest: req,
+		Started:          true,
+	})
+	if err != nil {
+		if ctr != nil {
+			_ = ctr.Terminate(context.Background())
+		}
+		if keyVolume != "" {
+			_ = RemoveDockerVolume(context.Background(), keyVolume)
+		}
+		return nil, fmt.Errorf("start nblink container: %w", err)
+	}
+	return &NBLink{container: ctr, keyVolume: keyVolume, network: c.network.Name, name: o.name, port: o.port}, nil
+}
+
+// Hostname returns the container hostname the embedded client reports to
+// management — the name the registered peer appears under in the peers API.
+func (n *NBLink) Hostname() string {
+	return n.name
+}
+
+// Post issues a JSON POST to the forwarder's primary listener and returns the
+// HTTP status and response body.
+func (n *NBLink) Post(ctx context.Context, path, body string, extraHeaders []string) (int, string, error) {
+	return n.do(ctx, n.port, http.MethodPost, path, body, extraHeaders)
+}
+
+// PostOn issues a JSON POST to the forwarder's listener on port, for a forward
+// added with WithNBLinkForwards.
+func (n *NBLink) PostOn(ctx context.Context, port int, path, body string, extraHeaders []string) (int, string, error) {
+	return n.do(ctx, port, http.MethodPost, path, body, extraHeaders)
+}
+
+// Get issues a GET to the forwarder's primary listener.
+func (n *NBLink) Get(ctx context.Context, path string, extraHeaders []string) (int, string, error) {
+	return n.do(ctx, n.port, http.MethodGet, path, "", extraHeaders)
+}
+
+// Chat issues an OpenAI-shaped chat completion to the forwarder, which proxies
+// it to the agent-network endpoint over the tunnel. A non-empty sessionID is
+// sent as the x-session-id header the proxy records.
+func (n *NBLink) Chat(ctx context.Context, model, prompt, sessionID string) (int, string, error) {
+	return n.Post(ctx, ChatPath, ChatBody(model, prompt), withSessionID(nil, sessionID))
+}
+
+// do runs curl in a throwaway container sharing the forwarder's network
+// namespace, so the request arrives on its loopback listener exactly as a
+// process running beside it would send one.
+//
+// Nothing here pins or rewrites Host: the loopback listener refuses a Host
+// that is not its own, and a test that papered over that would stop covering
+// it. Callers that want a foreign Host pass it in extraHeaders on purpose.
+func (n *NBLink) do(ctx context.Context, port int, method, path, body string, extraHeaders []string) (int, string, error) {
+	url := fmt.Sprintf("http://127.0.0.1:%d%s", port, path)
+	return curlStatus(ctx, []string{"--network", "container:" + n.container.GetContainerID()}, url, method, body, extraHeaders)
+}
+
+// PostFromNetwork issues a JSON POST to the forwarder by its network alias from
+// a separate container on the same network, the way another machine would
+// reach a publicly bound forward. A connection that is refused comes back as
+// an error, not a status.
+func (n *NBLink) PostFromNetwork(ctx context.Context, port int, path, body string, extraHeaders []string) (int, string, error) {
+	url := fmt.Sprintf("http://%s:%d%s", n.name, port, path)
+	return curlStatus(ctx, []string{"--network", n.network}, url, http.MethodPost, body, extraHeaders)
+}
+
+// Stop sends the forwarder SIGTERM, the way docker stop and an orchestrator
+// do, and reports how it exited and how long it took. The container is left
+// stopped for Logs; Terminate removes it.
+func (n *NBLink) Stop(ctx context.Context, grace time.Duration) (int, time.Duration, error) {
+	start := time.Now()
+	if err := n.container.Stop(ctx, &grace); err != nil {
+		return 0, 0, fmt.Errorf("stop nblink: %w", err)
+	}
+	took := time.Since(start)
+	state, err := n.container.State(ctx)
+	if err != nil {
+		return 0, took, fmt.Errorf("inspect nblink: %w", err)
+	}
+	return state.ExitCode, took, nil
+}
+
+// Logs returns the nblink container logs, for diagnostics on failure.
+func (n *NBLink) Logs(ctx context.Context) string {
+	return containerLogs(ctx, n.container)
+}
+
+// Terminate stops the nblink container.
+func (n *NBLink) Terminate(ctx context.Context) error {
+	if n.container == nil {
+		return nil
+	}
+	err := n.container.Terminate(ctx)
+	if n.keyVolume != "" {
+		// Not ctx: a cancelled or expired ctx is the likeliest reason the
+		// terminate above failed, and the volume has to go either way.
+		err = errors.Join(err, RemoveDockerVolume(context.Background(), n.keyVolume))
+	}
+	return err
+}
+
+// WithNBLinkName names the forwarder, setting both its network alias and its
+// container hostname. The hostname is what the peer registers under, so it is
+// the name the peer appears beneath in the peers API.
+//
+// Required to run a second forwarder against the same server: the default name
+// is shared and two containers cannot hold one alias on a network.
+func WithNBLinkName(name string) NBLinkOption {
+	return func(o *nblinkOptions) { o.name = name }
+}
+
+// WithNBLinkForwards adds forwards to the one StartNBLink is given. They are
+// passed in the same comma-separated NB_FORWARD, so one process serves all of
+// them over one session.
+func WithNBLinkForwards(specs ...string) NBLinkOption {
+	return func(o *nblinkOptions) { o.extra = append(o.extra, specs...) }
+}
+
+// WithNBLinkSetupKeyFile delivers the setup key as a file in the container and
+// points NB_SETUP_KEY at it with the file: prefix, instead of putting the key
+// itself in the environment.
+func WithNBLinkSetupKeyFile() NBLinkOption {
+	return func(o *nblinkOptions) { o.keyAsFile = true }
+}
+
+// WithNBLinkStateVolume mounts the named Docker volume as the state directory
+// and sets NB_STATE_DIR, so the peer identity outlives the container. The
+// volume is created on first use; RemoveDockerVolume deletes it.
+func WithNBLinkStateVolume(volume string) NBLinkOption {
+	return func(o *nblinkOptions) { o.stateVolume = volume }
+}
+
+// WithNBLinkUser runs the forwarder as uid:gid instead of the image's user,
+// the way OpenShift assigns an arbitrary UID in group 0.
+func WithNBLinkUser(user string) NBLinkOption {
+	return func(o *nblinkOptions) { o.user = user }
+}
+
+// WithNBLinkEnv sets an extra environment variable on the forwarder, for
+// settings such as NB_ALLOW_PUBLIC_BIND that have no option of their own.
+func WithNBLinkEnv(key, value string) NBLinkOption {
+	return func(o *nblinkOptions) {
+		if o.env == nil {
+			o.env = map[string]string{}
+		}
+		o.env[key] = value
+	}
+}
+
+// ChatBody builds an OpenAI-shaped chat completion request body.
+func ChatBody(model, prompt string) string {
+	return fmt.Sprintf(`{"model":%q,"messages":[{"role":"user","content":%q}]}`, model, prompt)
+}
+
+// RunNBLinkCheck runs the nblink image with --check and the given environment.
+// The container gets no network at all, so a run that tried to reach
+// management would fail rather than quietly succeed.
+func RunNBLinkCheck(ctx context.Context, env map[string]string) (NBLinkCheckResult, error) {
+	return RunNBLinkIsolated(ctx, env, "--check")
+}
+
+// RunNBLinkIsolated runs the nblink image to completion with no network and
+// the given environment and arguments, the way a forwarder behaves when
+// management cannot be reached.
+func RunNBLinkIsolated(ctx context.Context, env map[string]string, extraArgs ...string) (NBLinkCheckResult, error) {
+	image, err := nblinkImage(ctx)
+	if err != nil {
+		return NBLinkCheckResult{}, err
+	}
+
+	args := append(isolatedRunArgs("--rm"), envArgs(env)...)
+	args = append(args, image)
+	args = append(args, extraArgs...)
+
+	cmd := exec.CommandContext(ctx, "docker", args...)
+	var stdout, stderr strings.Builder
+	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
+	res := NBLinkCheckResult{}
+	err = cmd.Run()
+	res.Stdout, res.Stderr = stdout.String(), stderr.String()
+
+	var exitErr *exec.ExitError
+	if errors.As(err, &exitErr) {
+		res.ExitCode = exitErr.ExitCode()
+		return res, nil
+	}
+	if err != nil {
+		return res, fmt.Errorf("run nblink: %w", err)
+	}
+	return res, nil
+}
+
+// StopNBLinkDuringStartup starts the nblink image with no network, so the
+// session can never come up, sends it SIGTERM after wait, and reports how it
+// exited, how long the stop took, and what it logged.
+func StopNBLinkDuringStartup(ctx context.Context, env map[string]string, wait, grace time.Duration) (int, time.Duration, string, error) {
+	image, err := nblinkImage(ctx)
+	if err != nil {
+		return 0, 0, "", err
+	}
+
+	args := append(isolatedRunArgs("-d"), envArgs(env)...)
+	out, err := exec.CommandContext(ctx, "docker", append(args, image)...).Output()
+	if err != nil {
+		return 0, 0, "", fmt.Errorf("start nblink: %w", err)
+	}
+	id := strings.TrimSpace(string(out))
+	defer func() { _ = exec.Command("docker", "rm", "-f", id).Run() }()
+
+	timer := time.NewTimer(wait)
+	defer timer.Stop()
+	select {
+	case <-timer.C:
+	case <-ctx.Done():
+		return 0, 0, "", ctx.Err()
+	}
+
+	start := time.Now()
+	stop := exec.CommandContext(ctx, "docker", "stop", "-t", fmt.Sprint(int(grace.Seconds())), id)
+	if out, err := stop.CombinedOutput(); err != nil {
+		return 0, 0, "", fmt.Errorf("stop nblink: %w: %s", err, out)
+	}
+	took := time.Since(start)
+
+	state, err := exec.CommandContext(ctx, "docker", "inspect", "-f", "{{.State.ExitCode}}", id).Output()
+	if err != nil {
+		return 0, took, "", fmt.Errorf("inspect nblink: %w", err)
+	}
+	exitCode := 0
+	_, _ = fmt.Sscanf(strings.TrimSpace(string(state)), "%d", &exitCode)
+	logs, err := exec.CommandContext(ctx, "docker", "logs", id).CombinedOutput()
+	if err != nil {
+		return exitCode, took, "", fmt.Errorf("read nblink logs: %w", err)
+	}
+	return exitCode, took, string(logs), nil
+}
+
+// RemoveDockerVolume deletes a volume created by WithNBLinkStateVolume.
+func RemoveDockerVolume(ctx context.Context, volume string) error {
+	if out, err := exec.CommandContext(ctx, "docker", "volume", "rm", "-f", volume).CombinedOutput(); err != nil {
+		return fmt.Errorf("remove volume %s: %w: %s", volume, err, out)
+	}
+	return nil
+}
+
+// writeKeyVolume creates a volume holding the setup key as a root-owned file
+// of mode 0440. The key goes in on stdin so it never appears in a process
+// listing.
+func writeKeyVolume(ctx context.Context, volume, key string) error {
+	if out, err := exec.CommandContext(ctx, "docker", "volume", "create", volume).CombinedOutput(); err != nil {
+		return fmt.Errorf("create key volume: %w: %s", err, out)
+	}
+	script := fmt.Sprintf("cat > /k/%[1]s && chown 0:0 /k/%[1]s && chmod 440 /k/%[1]s", nblinkKeyFile)
+	cmd := exec.CommandContext(ctx, "docker", "run", "--rm", "-i", "-v", volume+":/k", keyWriterImage, "sh", "-c", script)
+	cmd.Stdin = strings.NewReader(key + "\n")
+	if out, err := cmd.CombinedOutput(); err != nil {
+		_ = RemoveDockerVolume(context.Background(), volume)
+		return fmt.Errorf("write key volume: %w: %s", err, out)
+	}
+	return nil
+}
+
+// hardenNBLink takes away what Docker grants a container by default: every
+// capability, a writable root filesystem, and the ability to gain privileges.
+// nblink claims to need none of them, and this is where that claim is held to.
+// State, when kept, goes to a mounted volume.
+func hardenNBLink(hc *container.HostConfig) {
+	hc.CapDrop = []string{"ALL"}
+	hc.ReadonlyRootfs = true
+	hc.SecurityOpt = append(hc.SecurityOpt, "no-new-privileges")
+}
+
+func nblinkImage(ctx context.Context) (string, error) {
+	root, err := repoRoot(ctx)
+	if err != nil {
+		return "", err
+	}
+	return resolveImage(ctx, root, "NB_E2E_NBLINK_IMAGE", defaultNBLinkImage, nblinkDockerfile)
+}
+
+// curlStatus runs curl in a throwaway container with the given docker run
+// network arguments and returns the status and body.
+func curlStatus(ctx context.Context, network []string, url, method, body string, extraHeaders []string) (int, string, error) {
+	args := append([]string{"run", "--rm"}, network...)
+	args = append(args,
+		curlImage,
+		"-s", "--connect-timeout", "5", "--max-time", "90",
+		"-o", "/dev/stderr", "-w", "%{http_code}",
+		"-X", method, url,
+		"-H", "Content-Type: application/json",
+	)
+	for _, h := range extraHeaders {
+		args = append(args, "-H", h)
+	}
+	if body != "" {
+		args = append(args, "--data", body)
+	}
+
+	cmd := exec.CommandContext(ctx, "docker", args...)
+	// -w writes the status to stdout, -o /dev/stderr the body to stderr, so
+	// the two come back separately.
+	var stdout, stderr strings.Builder
+	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
+	if err := cmd.Run(); err != nil {
+		return 0, stderr.String(), fmt.Errorf("curl through nblink: %w", err)
+	}
+
+	code := 0
+	_, _ = fmt.Sscanf(strings.TrimSpace(stdout.String()), "%d", &code)
+	return code, stderr.String(), nil
+}
+
+// isolatedRunArgs is docker run with no network and the same hardening
+// StartNBLink applies.
+func isolatedRunArgs(mode string) []string {
+	return []string{"run", mode, "--network", "none", "--cap-drop", "ALL", "--read-only", "--security-opt", "no-new-privileges"}
+}
+
+func envArgs(env map[string]string) []string {
+	var args []string
+	for k, v := range env {
+		args = append(args, "-e", k+"="+v)
+	}
+	return args
+}
diff --git a/e2e/harness/proxy.go b/e2e/harness/proxy.go
index 6a4251f5e..185aafa8b 100644
--- a/e2e/harness/proxy.go
+++ b/e2e/harness/proxy.go
@@ -242,6 +242,13 @@ func (p *Proxy) DebugClients(ctx context.Context) ([]ProxyDebugClient, error) {
 	return resp.Clients, nil
 }
 
+// CACertPath returns the host path of the self-signed certificate the proxy
+// serves for the agent-network endpoint. A client that verifies TLS properly —
+// nblink does, where the curl helpers pass -k — needs it in its trust store.
+func (p *Proxy) CACertPath() string {
+	return filepath.Join(p.workDir, "tls.crt")
+}
+
 // Logs returns the proxy container logs, for diagnostics on failure.
 func (p *Proxy) Logs(ctx context.Context) string {
 	return containerLogs(ctx, p.container)
diff --git a/shared/management/client/grpc.go b/shared/management/client/grpc.go
index c007020f5..6aa9855d4 100644
--- a/shared/management/client/grpc.go
+++ b/shared/management/client/grpc.go
@@ -621,7 +621,13 @@ func (c *GrpcClient) login(req *proto.LoginRequest) (*proto.LoginResponse, error
 
 	err = backoff.Retry(operation, nbgrpc.Backoff(c.ctx))
 	if err != nil {
-		log.Errorf("failed to login to Management Service: %v", err)
+		// PermissionDenied is how management asks an unknown peer to register,
+		// which the caller does next, so it is not an error worth reporting.
+		if s, ok := gstatus.FromError(err); ok && s.Code() == codes.PermissionDenied {
+			log.Debugf("login to Management Service refused: %v", err)
+		} else {
+			log.Errorf("failed to login to Management Service: %v", err)
+		}
 		return nil, err
 	}
 

From f6cfa775f87a6fb04beba787377326c0abdb8693 Mon Sep 17 00:00:00 2001
From: Pascal Fischer <32096965+pascal-fischer@users.noreply.github.com>
Date: Mon, 12 Oct 2026 14:01:37 +0200
Subject: [PATCH 47/70] [management] setting to return error on name collision
 during AddPeer (#8154)

---
 management/server/account.go                  |  11 +
 management/server/activity/codes.go           |  11 +-
 .../handlers/accounts/accounts_handler.go     |   4 +
 .../accounts/accounts_handler_test.go         |   9 +
 management/server/peer.go                     | 101 +++++++--
 management/server/peer_test.go                | 211 ++++++++++++++++++
 management/server/store/sql_store_account.go  |   6 +
 .../server/store/sql_store_account_test.go    |   2 +-
 management/server/store/sql_store_peer.go     |   5 +-
 management/server/types/settings.go           |   5 +
 shared/management/http/api/openapi.yml        |   4 +
 shared/management/http/api/types.gen.go       |   3 +
 12 files changed, 344 insertions(+), 28 deletions(-)

diff --git a/management/server/account.go b/management/server/account.go
index 946b9ad1c..0a8ec9a59 100644
--- a/management/server/account.go
+++ b/management/server/account.go
@@ -459,6 +459,7 @@ func (am *DefaultAccountManager) UpdateAccountSettings(ctx context.Context, acco
 	am.handleAutoUpdateAlwaysSettings(ctx, oldSettings, newSettings, userID, accountID)
 	am.handlePeerExposeSettings(ctx, oldSettings, newSettings, userID, accountID)
 	am.handleMetricsPushSettings(ctx, oldSettings, newSettings, userID, accountID)
+	am.handlePeerHostnameCollisionSettings(ctx, oldSettings, newSettings, userID, accountID)
 	if err = am.handleInactivityExpirationSettings(ctx, oldSettings, newSettings, userID, accountID); err != nil {
 		return nil, err
 	}
@@ -644,6 +645,16 @@ func (am *DefaultAccountManager) handleMetricsPushSettings(ctx context.Context,
 	}
 }
 
+func (am *DefaultAccountManager) handlePeerHostnameCollisionSettings(ctx context.Context, oldSettings, newSettings *types.Settings, userID, accountID string) {
+	if oldSettings.PeerHostnameCollisionRejected != newSettings.PeerHostnameCollisionRejected {
+		if newSettings.PeerHostnameCollisionRejected {
+			am.StoreEvent(ctx, userID, accountID, accountID, activity.AccountPeerHostnameCollisionRejectionEnabled, nil)
+		} else {
+			am.StoreEvent(ctx, userID, accountID, accountID, activity.AccountPeerHostnameCollisionRejectionDisabled, nil)
+		}
+	}
+}
+
 func (am *DefaultAccountManager) handlePeerLoginExpirationSettings(ctx context.Context, oldSettings, newSettings *types.Settings, userID, accountID string) {
 	if oldSettings.PeerLoginExpirationEnabled != newSettings.PeerLoginExpirationEnabled {
 		event := activity.AccountPeerLoginExpirationEnabled
diff --git a/management/server/activity/codes.go b/management/server/activity/codes.go
index dca043027..11c309ef4 100644
--- a/management/server/activity/codes.go
+++ b/management/server/activity/codes.go
@@ -287,6 +287,11 @@ const (
 	// CustomDomainValidationExpired indicates that an unvalidated domain registration expired.
 	CustomDomainValidationExpired Activity = 143
 
+	// AccountPeerHostnameCollisionRejectionEnabled indicates that a user enabled rejecting peer hostname collisions for the account
+	AccountPeerHostnameCollisionRejectionEnabled Activity = 144
+	// AccountPeerHostnameCollisionRejectionDisabled indicates that a user disabled rejecting peer hostname collisions for the account
+	AccountPeerHostnameCollisionRejectionDisabled Activity = 145
+
 	AccountDeleted Activity = 99999
 )
 
@@ -461,8 +466,10 @@ var activityMap = map[Activity]Code{
 	AgentNetworkSettingsUpdated: {"Agent Network settings updated", "agent_network.settings.update"},
 	AgentNetworkSettingsDeleted: {"Agent Network settings deleted", "agent_network.settings.delete"},
 
-	AccountMetricsPushEnabled:  {"Account metrics push enabled", "account.setting.metrics.push.enable"},
-	AccountMetricsPushDisabled: {"Account metrics push disabled", "account.setting.metrics.push.disable"},
+	AccountMetricsPushEnabled:                     {"Account metrics push enabled", "account.setting.metrics.push.enable"},
+	AccountMetricsPushDisabled:                    {"Account metrics push disabled", "account.setting.metrics.push.disable"},
+	AccountPeerHostnameCollisionRejectionEnabled:  {"Account peer hostname collision rejection enabled", "account.setting.peer.hostname.collision.rejection.enable"},
+	AccountPeerHostnameCollisionRejectionDisabled: {"Account peer hostname collision rejection disabled", "account.setting.peer.hostname.collision.rejection.disable"},
 
 	DomainAdded:                   {"Domain added", "domain.add"},
 	DomainDeleted:                 {"Domain deleted", "domain.delete"},
diff --git a/management/server/http/handlers/accounts/accounts_handler.go b/management/server/http/handlers/accounts/accounts_handler.go
index e5d75007f..797815685 100644
--- a/management/server/http/handlers/accounts/accounts_handler.go
+++ b/management/server/http/handlers/accounts/accounts_handler.go
@@ -286,6 +286,9 @@ func (h *handler) updateAccountRequestSettings(req api.PutApiAccountsAccountIdJS
 	if req.Settings.MetricsPushEnabled != nil {
 		returnSettings.MetricsPushEnabled = *req.Settings.MetricsPushEnabled
 	}
+	if req.Settings.PeerHostnameCollisionRejected != nil {
+		returnSettings.PeerHostnameCollisionRejected = *req.Settings.PeerHostnameCollisionRejected
+	}
 	if req.Settings.AgentNetworkOnly != nil {
 		returnSettings.AgentNetworkOnly = *req.Settings.AgentNetworkOnly
 	}
@@ -432,6 +435,7 @@ func toAccountResponse(accountID string, settings *types.Settings, meta *types.A
 		AutoUpdateAlways:                &settings.AutoUpdateAlways,
 		Ipv6EnabledGroups:               &settings.IPv6EnabledGroups,
 		MetricsPushEnabled:              &settings.MetricsPushEnabled,
+		PeerHostnameCollisionRejected:   &settings.PeerHostnameCollisionRejected,
 		AgentNetworkOnly:                &settings.AgentNetworkOnly,
 		EmbeddedIdpEnabled:              &settings.EmbeddedIdpEnabled,
 		LocalAuthDisabled:               &settings.LocalAuthDisabled,
diff --git a/management/server/http/handlers/accounts/accounts_handler_test.go b/management/server/http/handlers/accounts/accounts_handler_test.go
index 1ccac2b04..588258003 100644
--- a/management/server/http/handlers/accounts/accounts_handler_test.go
+++ b/management/server/http/handlers/accounts/accounts_handler_test.go
@@ -130,6 +130,7 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
 				MetricsPushEnabled:              br(false),
+				PeerHostnameCollisionRejected:   br(false),
 				AgentNetworkOnly:                br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
@@ -159,6 +160,7 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
 				MetricsPushEnabled:              br(false),
+				PeerHostnameCollisionRejected:   br(false),
 				AgentNetworkOnly:                br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
@@ -188,6 +190,7 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr("latest"),
 				MetricsPushEnabled:              br(false),
+				PeerHostnameCollisionRejected:   br(false),
 				AgentNetworkOnly:                br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
@@ -217,6 +220,7 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
 				MetricsPushEnabled:              br(false),
+				PeerHostnameCollisionRejected:   br(false),
 				AgentNetworkOnly:                br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
@@ -246,6 +250,7 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
 				MetricsPushEnabled:              br(false),
+				PeerHostnameCollisionRejected:   br(false),
 				AgentNetworkOnly:                br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
@@ -275,6 +280,7 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
 				MetricsPushEnabled:              br(false),
+				PeerHostnameCollisionRejected:   br(false),
 				AgentNetworkOnly:                br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
@@ -304,6 +310,7 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
 				MetricsPushEnabled:              br(false),
+				PeerHostnameCollisionRejected:   br(false),
 				AgentNetworkOnly:                br(true),
 				DashboardFeatures: &api.AccountDashboardFeatures{
 					AgentNetwork: br(true),
@@ -345,6 +352,7 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
 				MetricsPushEnabled:              br(false),
+				PeerHostnameCollisionRejected:   br(false),
 				AgentNetworkOnly:                br(false),
 				DashboardFeatures: &api.AccountDashboardFeatures{
 					AgentNetwork: br(true),
@@ -377,6 +385,7 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
 				MetricsPushEnabled:              br(false),
+				PeerHostnameCollisionRejected:   br(false),
 				AgentNetworkOnly:                br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
diff --git a/management/server/peer.go b/management/server/peer.go
index f3a5ebf46..c60737535 100644
--- a/management/server/peer.go
+++ b/management/server/peer.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"crypto/sha256"
 	b64 "encoding/base64"
+	"errors"
 	"fmt"
 	"net"
 	"net/netip"
@@ -14,6 +15,7 @@ import (
 	"github.com/rs/xid"
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/exp/maps"
+	"gorm.io/gorm"
 
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/management/server/idp"
@@ -288,19 +290,34 @@ func (am *DefaultAccountManager) UpdatePeer(ctx context.Context, accountID, user
 			var newLabel string
 
 			newLabel, err = nbdns.GetParsedDomainLabel(update.Name)
-			if err != nil {
-				newLabel = ""
-			} else {
-				_, err := transaction.GetPeerIdByLabel(ctx, store.LockingStrengthNone, accountID, newLabel)
-				if err == nil {
-					newLabel = ""
-				}
-			}
-
-			if newLabel == "" {
-				newLabel, err = getPeerIPDNSLabel(peer.IP, update.Name)
+			if settings.PeerHostnameCollisionRejected {
 				if err != nil {
-					return fmt.Errorf("failed to get free DNS label: %w", err)
+					return status.Errorf(status.InvalidArgument, "invalid peer name: %v", err)
+				}
+				if newLabel != peer.DNSLabel {
+					taken, err := peerLabelTaken(ctx, transaction, accountID, newLabel)
+					if err != nil {
+						return err
+					}
+					if taken {
+						return errPeerHostnameInUse(update.Name)
+					}
+				}
+			} else {
+				if err != nil {
+					newLabel = ""
+				} else {
+					_, err := transaction.GetPeerIdByLabel(ctx, store.LockingStrengthNone, accountID, newLabel)
+					if err == nil {
+						newLabel = ""
+					}
+				}
+
+				if newLabel == "" {
+					newLabel, err = getPeerIPDNSLabel(peer.IP, update.Name)
+					if err != nil {
+						return fmt.Errorf("failed to get free DNS label: %w", err)
+					}
 				}
 			}
 			peer.Name = update.Name
@@ -336,6 +353,9 @@ func (am *DefaultAccountManager) UpdatePeer(ctx context.Context, accountID, user
 		return transaction.SavePeer(ctx, accountID, peer)
 	})
 	if err != nil {
+		if peerLabelChanged && isUniqueConstraintError(err) {
+			return nil, errPeerHostnameInUse(peer.Name)
+		}
 		return nil, err
 	}
 
@@ -832,6 +852,14 @@ func (am *DefaultAccountManager) AddPeer(ctx context.Context, accountID, setupKe
 		return nil, nil, nil, false, fmt.Errorf("failed getting network: %w", err)
 	}
 
+	hostLabel, err := nbdns.GetParsedDomainLabel(peer.Meta.Hostname)
+	if err != nil {
+		return nil, nil, nil, false, status.Errorf(status.InvalidArgument, "invalid peer hostname: %v", err)
+	}
+	rejectLabelCollision := settings.PeerHostnameCollisionRejected
+	labelTaken := false
+
+	var insertErr error
 	maxAttempts := 10
 	for attempt := 1; attempt <= maxAttempts; attempt++ {
 		netPrefix, err := netip.ParsePrefix(network.Net.String())
@@ -843,17 +871,12 @@ func (am *DefaultAccountManager) AddPeer(ctx context.Context, accountID, setupKe
 			return nil, nil, nil, false, fmt.Errorf("failed to get free IP: %w", err)
 		}
 
-		var freeLabel string
-		if ephemeral || attempt > 1 {
+		freeLabel := hostLabel
+		if !rejectLabelCollision && (ephemeral || labelTaken) {
 			freeLabel, err = getPeerIPDNSLabel(freeIP, peer.Meta.Hostname)
 			if err != nil {
 				return nil, nil, nil, false, fmt.Errorf("failed to get free DNS label: %w", err)
 			}
-		} else {
-			freeLabel, err = nbdns.GetParsedDomainLabel(peer.Meta.Hostname)
-			if err != nil {
-				return nil, nil, nil, false, fmt.Errorf("failed to get free DNS label: %w", err)
-			}
 		}
 		newPeer.DNSLabel = freeLabel
 		newPeer.IP = freeIP
@@ -884,7 +907,7 @@ func (am *DefaultAccountManager) AddPeer(ctx context.Context, accountID, setupKe
 			}
 		}
 
-		err = am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
+		insertErr = am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
 			err = transaction.AddPeerToAccount(ctx, newPeer)
 			if err != nil {
 				return err
@@ -942,16 +965,28 @@ func (am *DefaultAccountManager) AddPeer(ctx context.Context, accountID, setupKe
 			log.WithContext(ctx).Debugf("Peer %s added to account %s", newPeer.ID, accountID)
 			return nil
 		})
-		if err == nil {
+		if insertErr == nil {
 			break
 		}
 
-		if isUniqueConstraintError(err) {
-			log.WithContext(ctx).WithFields(log.Fields{"dns_label": freeLabel, "ip": freeIP}).Tracef("Failed to add peer in attempt %d, retrying: %v", attempt, err)
+		if isUniqueConstraintError(insertErr) {
+			if freeLabel == hostLabel {
+				labelTaken, err = peerLabelTaken(ctx, am.Store, accountID, hostLabel)
+				if err != nil {
+					return nil, nil, nil, false, err
+				}
+				if labelTaken && rejectLabelCollision {
+					return nil, nil, nil, false, errPeerHostnameInUse(peer.Meta.Hostname)
+				}
+			}
+			log.WithContext(ctx).WithFields(log.Fields{"dns_label": freeLabel, "ip": freeIP}).Tracef("Failed to add peer in attempt %d, retrying: %v", attempt, insertErr)
 			continue
 		}
 
-		return nil, nil, nil, false, fmt.Errorf("failed to add peer to database: %w", err)
+		return nil, nil, nil, false, fmt.Errorf("failed to add peer to database: %w", insertErr)
+	}
+	if insertErr != nil {
+		return nil, nil, nil, false, fmt.Errorf("add peer after %d attempts: %w", maxAttempts, insertErr)
 	}
 	if newPeer == nil {
 		return nil, nil, nil, false, fmt.Errorf("new peer is nil")
@@ -985,6 +1020,24 @@ func (am *DefaultAccountManager) AddPeer(ctx context.Context, accountID, setupKe
 	return newPeer, network, postureChecks, enableSSH, nil
 }
 
+// peerLabelTaken reports whether a peer of the account already uses the DNS label.
+func peerLabelTaken(ctx context.Context, s store.Store, accountID, label string) (bool, error) {
+	_, err := s.GetPeerIdByLabel(ctx, store.LockingStrengthNone, accountID, label)
+	switch {
+	case err == nil:
+		return true, nil
+	case errors.Is(err, gorm.ErrRecordNotFound):
+		return false, nil
+	default:
+		return false, fmt.Errorf("check peer DNS label: %w", err)
+	}
+}
+
+// errPeerHostnameInUse is a PermissionDenied error because the client treats only that gRPC code as a permanent login failure instead of retrying.
+func errPeerHostnameInUse(hostname string) error {
+	return status.Errorf(status.PermissionDenied, "peer with hostname %q is already registered", hostname)
+}
+
 func getPeerIPDNSLabel(ip netip.Addr, peerHostName string) (string, error) {
 	if !ip.Is4() {
 		return "", fmt.Errorf("DNS label generation requires an IPv4 address, got %s", ip)
diff --git a/management/server/peer_test.go b/management/server/peer_test.go
index fa3be9a58..93f38f25e 100644
--- a/management/server/peer_test.go
+++ b/management/server/peer_test.go
@@ -3050,3 +3050,214 @@ func TestResolvePeerLocation(t *testing.T) {
 		})
 	}
 }
+
+func TestAddPeer_HostnameCollisionRejected(t *testing.T) {
+	manager, _, err := createManager(t)
+	require.NoError(t, err)
+
+	account := newAccountWithId(context.Background(), "test-account", "owner", "", "", "", false)
+	account.Settings.PeerHostnameCollisionRejected = true
+	require.NoError(t, manager.Store.SaveAccount(context.Background(), account))
+
+	setupKey, err := manager.CreateSetupKey(context.Background(), account.Id, "key", types.SetupKeyReusable, time.Hour, nil, 100, "owner", false, false)
+	require.NoError(t, err)
+	ephemeralKey, err := manager.CreateSetupKey(context.Background(), account.Id, "ephemeral", types.SetupKeyReusable, time.Hour, nil, 100, "owner", true, false)
+	require.NoError(t, err)
+
+	addPeer := func(hostname, key string) (*nbpeer.Peer, error) {
+		wgKey, err := wgtypes.GenerateKey()
+		require.NoError(t, err)
+		peer := &nbpeer.Peer{
+			Key:  wgKey.PublicKey().String(),
+			Meta: nbpeer.PeerSystemMeta{Hostname: hostname, OS: "linux"},
+		}
+		added, _, _, _, err := manager.AddPeer(context.Background(), "", key, "", peer, false)
+		return added, err
+	}
+
+	first, err := addPeer("my-host", setupKey.Key)
+	require.NoError(t, err)
+	assert.Equal(t, "my-host", first.DNSLabel)
+
+	_, err = addPeer("My-Host", setupKey.Key)
+	require.Error(t, err)
+	e, ok := status.FromError(err)
+	require.True(t, ok)
+	assert.Equal(t, status.PermissionDenied, e.Type())
+
+	other, err := addPeer("other-host", setupKey.Key)
+	require.NoError(t, err)
+	assert.Equal(t, "other-host", other.DNSLabel)
+
+	_, err = addPeer("my-host", ephemeralKey.Key)
+	require.Error(t, err)
+	e, ok = status.FromError(err)
+	require.True(t, ok)
+	assert.Equal(t, status.PermissionDenied, e.Type())
+
+	ephemeral, err := addPeer("ephemeral-host", ephemeralKey.Key)
+	require.NoError(t, err)
+	assert.Equal(t, "ephemeral-host", ephemeral.DNSLabel)
+
+	account.Settings.PeerHostnameCollisionRejected = false
+	require.NoError(t, manager.Store.SaveAccountSettings(context.Background(), account.Id, account.Settings))
+
+	suffixed, err := addPeer("my-host", setupKey.Key)
+	require.NoError(t, err)
+	assert.True(t, strings.HasPrefix(suffixed.DNSLabel, "my-host-"))
+}
+
+func TestUpdatePeer_HostnameCollisionRejected(t *testing.T) {
+	manager, _, err := createManager(t)
+	require.NoError(t, err)
+
+	account := newAccountWithId(context.Background(), "test-account", "owner", "", "", "", false)
+	account.Settings.PeerHostnameCollisionRejected = true
+	require.NoError(t, manager.Store.SaveAccount(context.Background(), account))
+
+	addPeer := func(hostname string) *nbpeer.Peer {
+		wgKey, err := wgtypes.GenerateKey()
+		require.NoError(t, err)
+		added, _, _, _, err := manager.AddPeer(context.Background(), "", "", "owner", &nbpeer.Peer{
+			Key:  wgKey.PublicKey().String(),
+			Meta: nbpeer.PeerSystemMeta{Hostname: hostname, OS: "linux"},
+		}, false)
+		require.NoError(t, err)
+		return added
+	}
+	first := addPeer("web-server")
+	second := addPeer("old-name")
+
+	update := second.Copy()
+	update.Name = "Web-Server"
+	_, err = manager.UpdatePeer(context.Background(), account.Id, "owner", update)
+	require.Error(t, err)
+	e, ok := status.FromError(err)
+	require.True(t, ok)
+	assert.Equal(t, status.PermissionDenied, e.Type())
+
+	update = second.Copy()
+	update.Name = "api-server.example.com"
+	updated, err := manager.UpdatePeer(context.Background(), account.Id, "owner", update)
+	require.NoError(t, err)
+	assert.Equal(t, "api-server", updated.DNSLabel)
+
+	update = first.Copy()
+	update.Name = "WEB-SERVER"
+	updated, err = manager.UpdatePeer(context.Background(), account.Id, "owner", update)
+	require.NoError(t, err, "renaming to a different spelling of the own label must not collide with itself")
+	assert.Equal(t, "web-server", updated.DNSLabel)
+}
+
+func TestAddPeer_HostnameCollisionRejectedConcurrent(t *testing.T) {
+	manager, _, err := createManager(t)
+	require.NoError(t, err)
+
+	account := newAccountWithId(context.Background(), "test-account", "owner", "", "", "", false)
+	account.Settings.PeerHostnameCollisionRejected = true
+	require.NoError(t, manager.Store.SaveAccount(context.Background(), account))
+
+	setupKey, err := manager.CreateSetupKey(context.Background(), account.Id, "key", types.SetupKeyReusable, time.Hour, nil, 100, "owner", false, false)
+	require.NoError(t, err)
+
+	const attempts = 20
+	start := make(chan struct{})
+	errs := make(chan error, attempts)
+	var wg sync.WaitGroup
+	for i := 0; i < attempts; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			wgKey, err := wgtypes.GenerateKey()
+			if err != nil {
+				errs <- err
+				return
+			}
+			<-start
+			_, _, _, _, err = manager.AddPeer(context.Background(), "", setupKey.Key, "", &nbpeer.Peer{
+				Key:  wgKey.PublicKey().String(),
+				Meta: nbpeer.PeerSystemMeta{Hostname: "same-host", OS: "linux"},
+			}, false)
+			errs <- err
+		}()
+	}
+	close(start)
+	wg.Wait()
+	close(errs)
+
+	succeeded := 0
+	for err := range errs {
+		if err == nil {
+			succeeded++
+			continue
+		}
+		e, ok := status.FromError(err)
+		require.True(t, ok, "unexpected error: %v", err)
+		assert.Equal(t, status.PermissionDenied, e.Type(), "unexpected error: %v", err)
+	}
+	assert.Equal(t, 1, succeeded)
+
+	peers, err := manager.Store.GetAccountPeers(context.Background(), store.LockingStrengthNone, account.Id, "", "", "")
+	require.NoError(t, err)
+	require.Len(t, peers, 1)
+	assert.Equal(t, "same-host", peers[0].DNSLabel)
+}
+
+func TestAddPeer_IPCollisionKeepsLabel(t *testing.T) {
+	for _, rejectCollision := range []bool{false, true} {
+		t.Run(fmt.Sprintf("collision rejected %t", rejectCollision), func(t *testing.T) {
+			manager, _, err := createManager(t)
+			require.NoError(t, err)
+
+			account := newAccountWithId(context.Background(), "test-account", "owner", "", "", "", false)
+			account.Settings.PeerHostnameCollisionRejected = rejectCollision
+			_, smallNet, err := net.ParseCIDR("100.64.0.0/26")
+			require.NoError(t, err)
+			account.Network.Net = *smallNet
+			require.NoError(t, manager.Store.SaveAccount(context.Background(), account))
+
+			const totalPeers = 20
+			for i := 0; i < totalPeers; i++ {
+				wgKey, err := wgtypes.GenerateKey()
+				require.NoError(t, err)
+				hostname := fmt.Sprintf("host-%d", i)
+				added, _, _, _, err := manager.AddPeer(context.Background(), "", "", "owner", &nbpeer.Peer{
+					Key:  wgKey.PublicKey().String(),
+					Meta: nbpeer.PeerSystemMeta{Hostname: hostname, OS: "linux"},
+				}, false)
+				require.NoError(t, err)
+				assert.Equal(t, hostname, added.DNSLabel, "an IP collision must not change the DNS label")
+			}
+		})
+	}
+}
+
+func TestAddPeer_ExhaustedIPAllocationFails(t *testing.T) {
+	manager, _, err := createManager(t)
+	require.NoError(t, err)
+
+	account := newAccountWithId(context.Background(), "test-account", "owner", "", "", "", false)
+	_, tinyNet, err := net.ParseCIDR("100.64.0.0/30")
+	require.NoError(t, err)
+	account.Network.Net = *tinyNet
+	require.NoError(t, manager.Store.SaveAccount(context.Background(), account))
+
+	addPeer := func(hostname string) error {
+		wgKey, err := wgtypes.GenerateKey()
+		require.NoError(t, err)
+		_, _, _, _, err = manager.AddPeer(context.Background(), "", "", "owner", &nbpeer.Peer{
+			Key:  wgKey.PublicKey().String(),
+			Meta: nbpeer.PeerSystemMeta{Hostname: hostname, OS: "linux"},
+		}, false)
+		return err
+	}
+	require.NoError(t, addPeer("host-1"))
+	require.NoError(t, addPeer("host-2"))
+
+	err = addPeer("host-3")
+	require.Error(t, err, "no free IP left, registration must fail")
+
+	peers, err := manager.Store.GetAccountPeers(context.Background(), store.LockingStrengthNone, account.Id, "", "", "")
+	require.NoError(t, err)
+	assert.Len(t, peers, 2)
+}
diff --git a/management/server/store/sql_store_account.go b/management/server/store/sql_store_account.go
index 43fe09861..3780de77d 100644
--- a/management/server/store/sql_store_account.go
+++ b/management/server/store/sql_store_account.go
@@ -746,6 +746,7 @@ func (s *SqlStore) getAccount(ctx context.Context, accountID string) (*types.Acc
 			settings_routing_peer_dns_resolution_enabled, settings_dns_domain, settings_network_range,
 			settings_network_range_v6, settings_ipv6_enabled_groups, settings_lazy_connection_enabled,
 			settings_local_mfa_enabled, settings_metrics_push_enabled, settings_agent_network_only,
+			settings_peer_hostname_collision_rejected,
 			settings_dashboard_features, settings_auto_update_version, settings_auto_update_always,
 			settings_peer_expose_enabled, settings_peer_expose_groups,
 			-- Embedded ExtraSettings
@@ -771,6 +772,7 @@ func (s *SqlStore) getAccount(ctx context.Context, accountID string) (*types.Acc
 		sLazyConnectionEnabled           sql.NullBool
 		sLocalMFAEnabled                 sql.NullBool
 		sMetricsPushEnabled              sql.NullBool
+		sPeerHostnameCollisionRejected   sql.NullBool
 		sAgentNetworkOnly                sql.NullBool
 		sDashboardFeatures               sql.NullString
 		autoUpdateVersion                sql.NullString
@@ -800,6 +802,7 @@ func (s *SqlStore) getAccount(ctx context.Context, accountID string) (*types.Acc
 		&sRoutingPeerDNSResolutionEnabled, &sDNSDomain, &sNetworkRange,
 		&sNetworkRangeV6, &sIPv6EnabledGroups, &sLazyConnectionEnabled,
 		&sLocalMFAEnabled, &sMetricsPushEnabled, &sAgentNetworkOnly,
+		&sPeerHostnameCollisionRejected,
 		&sDashboardFeatures, &autoUpdateVersion, &autoUpdateAlways,
 		&peerExposeEnabled, &peerExposeGroups,
 		&sExtraPeerApprovalEnabled, &sExtraUserApprovalRequired,
@@ -870,6 +873,9 @@ func (s *SqlStore) getAccount(ctx context.Context, accountID string) (*types.Acc
 	if sMetricsPushEnabled.Valid {
 		account.Settings.MetricsPushEnabled = sMetricsPushEnabled.Bool
 	}
+	if sPeerHostnameCollisionRejected.Valid {
+		account.Settings.PeerHostnameCollisionRejected = sPeerHostnameCollisionRejected.Bool
+	}
 	if sAgentNetworkOnly.Valid {
 		account.Settings.AgentNetworkOnly = sAgentNetworkOnly.Bool
 	}
diff --git a/management/server/store/sql_store_account_test.go b/management/server/store/sql_store_account_test.go
index ec5976982..ba904bbe4 100644
--- a/management/server/store/sql_store_account_test.go
+++ b/management/server/store/sql_store_account_test.go
@@ -288,7 +288,7 @@ func Test_AccountSettings_SaveAndRetrieve(t *testing.T) {
 		settings := types.Settings{}
 		numOfExportedFields, err := populateFields.PopulateAll(reflect.ValueOf(&settings).Elem())
 		assert.NoError(t, err)
-		assert.Equal(t, 27, numOfExportedFields)
+		assert.Equal(t, 28, numOfExportedFields)
 		account.Settings = &settings
 
 		err = store.SaveAccount(context.Background(), account)
diff --git a/management/server/store/sql_store_peer.go b/management/server/store/sql_store_peer.go
index 9950069fd..ec5e1993c 100644
--- a/management/server/store/sql_store_peer.go
+++ b/management/server/store/sql_store_peer.go
@@ -715,12 +715,15 @@ func (s *SqlStore) GetPeerIdByLabel(ctx context.Context, lockStrength LockingStr
 		Where("account_id = ? AND dns_label = ?", accountID, hostname).
 		Limit(1).
 		Scan(&peerID)
+	if result.Error != nil {
+		return "", result.Error
+	}
 
 	if peerID == "" {
 		return "", gorm.ErrRecordNotFound
 	}
 
-	return peerID, result.Error
+	return peerID, nil
 }
 
 // GetEmbeddedProxyPeerIDsByCluster returns peer IDs of all embedded proxy peers
diff --git a/management/server/types/settings.go b/management/server/types/settings.go
index 815c93ce6..8aa1c7e4c 100644
--- a/management/server/types/settings.go
+++ b/management/server/types/settings.go
@@ -76,6 +76,10 @@ type Settings struct {
 	// MetricsPushEnabled globally enables or disables client metrics push for the account
 	MetricsPushEnabled bool `gorm:"default:false"`
 
+	// PeerHostnameCollisionRejected rejects registering or renaming a peer to a hostname
+	// already used by another peer of the account instead of suffixing it
+	PeerHostnameCollisionRejected bool `gorm:"default:false"`
+
 	// AgentNetworkOnly limits the dashboard to the Agent Network surface for this account.
 	// Set for accounts created via netbird.ai signups; users can disable it later.
 	AgentNetworkOnly bool `gorm:"default:false"`
@@ -123,6 +127,7 @@ func (s *Settings) Copy() *Settings {
 		AutoUpdateAlways:                s.AutoUpdateAlways,
 		IPv6EnabledGroups:               slices.Clone(s.IPv6EnabledGroups),
 		MetricsPushEnabled:              s.MetricsPushEnabled,
+		PeerHostnameCollisionRejected:   s.PeerHostnameCollisionRejected,
 		AgentNetworkOnly:                s.AgentNetworkOnly,
 		EmbeddedIdpEnabled:              s.EmbeddedIdpEnabled,
 		LocalAuthDisabled:               s.LocalAuthDisabled,
diff --git a/shared/management/http/api/openapi.yml b/shared/management/http/api/openapi.yml
index 68de0d1f5..8b97d5f47 100644
--- a/shared/management/http/api/openapi.yml
+++ b/shared/management/http/api/openapi.yml
@@ -380,6 +380,10 @@ components:
           description: Enables or disables client metrics push for all peers in the account
           type: boolean
           example: false
+        peer_hostname_collision_rejected:
+          description: When enabled, registering or renaming a peer to a hostname already used by another peer in the account fails instead of receiving an IP-based suffix. Applies to ephemeral peers as well.
+          type: boolean
+          example: false
         agent_network_only:
           description: Limits the dashboard to the Agent Network surface for this account. Set for accounts created via netbird.ai signups and can be disabled later. Enabling this requires dashboard_features.agent_network to be true in the same request.
           type: boolean
diff --git a/shared/management/http/api/types.gen.go b/shared/management/http/api/types.gen.go
index a1f4bc530..1595553ed 100644
--- a/shared/management/http/api/types.gen.go
+++ b/shared/management/http/api/types.gen.go
@@ -1693,6 +1693,9 @@ type AccountSettings struct {
 	// PeerExposeGroups Limits which peer groups are allowed to expose services. If empty, all peers are allowed when peer expose is enabled.
 	PeerExposeGroups []string `json:"peer_expose_groups"`
 
+	// PeerHostnameCollisionRejected When enabled, registering or renaming a peer to a hostname already used by another peer in the account fails instead of receiving an IP-based suffix. Applies to ephemeral peers as well.
+	PeerHostnameCollisionRejected *bool `json:"peer_hostname_collision_rejected,omitempty"`
+
 	// PeerInactivityExpiration Period of time of inactivity after which peer session expires (seconds).
 	PeerInactivityExpiration int `json:"peer_inactivity_expiration"`
 

From ef2292d822c4d61df9d1867fc3fa554daccbc77b Mon Sep 17 00:00:00 2001
From: Bruno Mercier Costa <94469565+emrcbrn@users.noreply.github.com>
Date: Mon, 12 Oct 2026 14:27:13 +0200
Subject: [PATCH 48/70] [client] Fix Windows UI exiting on first launch (#8138)

* [client] Fix Windows UI exiting on first launch

Bump the Wails fork to pick up netbirdio/wails#6, which stops
SetBackgroundColour from dereferencing a WebView2 controller that does
not exist yet. On first launch the theme service re-tints the Welcome
window while it is still being created, and losing that race made the
UI exit with no window.

* [client] Point the Wails fork at the merged netbirdio/wails#6

Replace the temporary pin on emrcbrn/wails with the merge commit of
netbirdio/wails#6 on the fork's integration branch.
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index fa7047bd8..dcbc7d9d7 100644
--- a/go.mod
+++ b/go.mod
@@ -381,7 +381,7 @@ replace github.com/dexidp/dex/api/v2 => github.com/netbirdio/dex/api/v2 v2.0.0-2
 
 replace github.com/mailru/easyjson => github.com/netbirdio/easyjson v0.9.0
 
-replace github.com/wailsapp/wails/v3 => github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260928122122-d1db5fa35318
+replace github.com/wailsapp/wails/v3 => github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20261009120932-4e087a8bfd6d
 
 tool (
 	github.com/goreleaser/chglog/cmd/chglog
diff --git a/go.sum b/go.sum
index 55b3edf85..64197c736 100644
--- a/go.sum
+++ b/go.sum
@@ -539,8 +539,8 @@ github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502 h1:3tHlFmhTdX9ax
 github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502/go.mod h1:CIMRFEJVL+0DS1a3Nx06NaMn4Dz63Ng6O7dl0qH0zVM=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45 h1:ujgviVYmx243Ksy7NdSwrdGPSRNE3pb8kEDSpH0QuAQ=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45/go.mod h1:5/sjFmLb8O96B5737VCqhHyGRzNFIaN/Bu7ZodXc3qQ=
-github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260928122122-d1db5fa35318 h1:Qv2jYeucRkuqkkM9aAVFcO9avmSfPEoB+gxKKKuI4vA=
-github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260928122122-d1db5fa35318/go.mod h1:62UsqQRqanuCbFi6xElIw3/2X+yGF+TKlyiWImA5taU=
+github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20261009120932-4e087a8bfd6d h1:DV0FHFhNAaU69JHXKclYQWr/ZJoc2BA/ZpqlnX8l22U=
+github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20261009120932-4e087a8bfd6d/go.mod h1:62UsqQRqanuCbFi6xElIw3/2X+yGF+TKlyiWImA5taU=
 github.com/netbirdio/wireguard-go v0.0.0-20261008122457-d2b1ce9bfee9 h1:Mjt3tIBGa1/mJh1Xn8uZP30cd2VYd0NHANqTn+HBsaU=
 github.com/netbirdio/wireguard-go v0.0.0-20261008122457-d2b1ce9bfee9/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=

From a6e154a9b367fc40532b04c3b33733cf283d0fe4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Janek=20H=C3=A4rtter?=
 <108095150+janekhaertter@users.noreply.github.com>
Date: Mon, 12 Oct 2026 15:02:52 +0200
Subject: [PATCH 49/70] [misc] Extend the copyright year to 2026 (#8169)

The Windows installer shows LICENSE on its license page, where the
2022 copyright line reads as outdated. Extend the range to 2022-2026
in LICENSE, its REUSE copy, and the installer's LegalCopyright, keeping
2022 as the year of first publication.
---
 LICENSE                   | 2 +-
 LICENSES/BSD-3-Clause.txt | 2 +-
 client/installer.nsis     | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/LICENSE b/LICENSE
index cea6f8f0b..4d0551de8 100644
--- a/LICENSE
+++ b/LICENSE
@@ -3,7 +3,7 @@ Those directories are licensed under the GNU Affero General Public License versi
 
 BSD 3-Clause License
 
-Copyright (c) 2022 NetBird GmbH & AUTHORS
+Copyright (c) 2022-2026 NetBird GmbH & AUTHORS
 
 Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
 
diff --git a/LICENSES/BSD-3-Clause.txt b/LICENSES/BSD-3-Clause.txt
index 7cba76dfd..5e9a2539c 100644
--- a/LICENSES/BSD-3-Clause.txt
+++ b/LICENSES/BSD-3-Clause.txt
@@ -1,6 +1,6 @@
 BSD 3-Clause License
 
-Copyright (c) 2022 NetBird GmbH & AUTHORS
+Copyright (c) 2022-2026 NetBird GmbH & AUTHORS
 
 Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
 
diff --git a/client/installer.nsis b/client/installer.nsis
index eb2d7d5bd..304d38864 100644
--- a/client/installer.nsis
+++ b/client/installer.nsis
@@ -2,7 +2,7 @@
 !define COMP_NAME "Netbird"
 !define WEB_SITE "Netbird.io"
 !define VERSION $%APPVER%
-!define COPYRIGHT "Netbird Authors, 2022"
+!define COPYRIGHT "Netbird Authors, 2022-2026"
 !define DESCRIPTION "Connect your devices into a secure WireGuard-based overlay network with SSO, MFA, and granular access controls."
 !define INSTALLER_NAME "netbird-installer.exe"
 !define MAIN_APP_EXE "Netbird"

From f0182dd645f5bdad07b7335b7302edbc33b58ce0 Mon Sep 17 00:00:00 2001
From: Nicolas Frati <nicofrati@gmail.com>
Date: Mon, 12 Oct 2026 15:09:45 +0200
Subject: [PATCH 50/70] [signal] Add a release-wired UBI image variant (#7458)

* [signal] Add an explicit non-root UBI image variant

Keep the existing signal image unchanged while making a separate UBI image available for local certification-readiness checks. Collect the linked Go dependency license terms as portable build inputs, and use SIGINT for the existing graceful stop handler.

* [signal] Wire the UBI variant into GoReleaser

Build the additive UBI signal variant through the existing release pipeline instead of relying on local Docker commands. Stage its licenses in the per-image build context and restrict the variant to validated AMD64 without changing existing image tags.

* [signal] Align the UBI image with the other UBI variants

Main now ships UBI images for the client, combined server and proxy with
a shared license collector and a common shape, so the signal variant
should look the same to reviewers and to Red Hat certification. Signal
also listens on port 80 by default, which an arbitrary non-root UID
cannot bind on OpenShift or Podman.

Use release_files/collect-licenses.sh instead of a signal-only copy,
build for amd64 and arm64 like the other UBI entries, and run as
1000:0 with a group-writable /var/lib/netbird that also holds Let's
Encrypt data. Default NB_PORT to the legacy gRPC port 10000 so the
image starts unprivileged and serves a single listener.

* [infrastructure] Certify the signal UBI image on release

The signal UBI image is published with every release, but only images
listed in the certification workflow reach the Red Hat catalog, so it
would otherwise need a manual run each time.

Add signal to the dispatch options and the component list, using the
same -ubi tag suffix as .goreleaser.yaml. The run reads its Partner
Connect ID from REDHAT_CERT_ID_SIGNAL.

* [signal] Answer Let's Encrypt challenges on the UBI image's port

The challenge listener defaults to :443, which a non-root UID cannot
bind on OpenShift or Podman, so Let's Encrypt could not work in the
UBI image. Now that the listener address is configurable, default it
to empty so the TLS listener on port 10000 answers the challenges
itself when public port 443 is forwarded to it.
---
 .github/workflows/redhat-certify.yml |  2 ++
 .goreleaser.yaml                     | 35 +++++++++++++++++++++++++
 signal/Dockerfile.ubi                | 38 ++++++++++++++++++++++++++++
 3 files changed, 75 insertions(+)
 create mode 100644 signal/Dockerfile.ubi

diff --git a/.github/workflows/redhat-certify.yml b/.github/workflows/redhat-certify.yml
index 7c26c79fb..c6cd62bca 100644
--- a/.github/workflows/redhat-certify.yml
+++ b/.github/workflows/redhat-certify.yml
@@ -33,6 +33,7 @@ on:
           - client-rootless
           - reverse-proxy
           - netbird-server
+          - signal
       version:
         description: "Released version, e.g. v0.80.0"
         type: string
@@ -68,6 +69,7 @@ jobs:
             "client-rootless ghcr.io/netbirdio/netbird -rootless-ubi"
             "reverse-proxy ghcr.io/netbirdio/reverse-proxy -ubi"
             "netbird-server ghcr.io/netbirdio/netbird-server -ubi"
+            "signal ghcr.io/netbirdio/signal -ubi"
           )
           matrix="[]"
           missing=()
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index ebb4a8525..1e7acbaa7 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -528,6 +528,41 @@ dockers_v2:
        "org.opencontainers.image.revision": "{{.FullCommit}}"
        "org.opencontainers.image.source": "{{.GitURL}}"
        "maintainer": "dev@netbird.io"
+   - id: signal-ubi
+     disable: "{{ .Env.SKIP_DOCKER_PUSH }}"
+     ids:
+       - netbird-signal
+     images:
+       - netbirdio/signal
+       - ghcr.io/netbirdio/signal
+     tags:
+       - "{{ .Version }}-ubi"
+       - "{{ if eq .Env.SKIP_PUBLISH \"false\" }}ubi-latest{{ end }}"
+     dockerfile: signal/Dockerfile.ubi
+     platforms:
+       - linux/amd64
+       - linux/arm64
+     build_args:
+       VERSION: "{{ .Version }}"
+       RELEASE: "{{ .Timestamp }}"
+     hooks:
+       pre:
+         - cmd: 'sh release_files/collect-licenses.sh -l signal/LICENSE "{{ .ContextDir }}/licenses" ./signal amd64 arm64'
+           env:
+             - GOOS=linux
+             - CGO_ENABLED=0
+     labels:
+       "org.opencontainers.image.created": "{{.Date}}"
+       "org.opencontainers.image.version": "{{.Version}}"
+       "org.opencontainers.image.revision": "{{.FullCommit}}"
+       "org.opencontainers.image.source": "{{.GitURL}}"
+     annotations:
+       "org.opencontainers.image.created": "{{.Date}}"
+       "org.opencontainers.image.title": "{{.ProjectName}}"
+       "org.opencontainers.image.version": "{{.Version}}"
+       "org.opencontainers.image.revision": "{{.FullCommit}}"
+       "org.opencontainers.image.source": "{{.GitURL}}"
+       "maintainer": "dev@netbird.io"
    - id: management
      disable: "{{ .Env.SKIP_DOCKER_PUSH }}"
      ids:
diff --git a/signal/Dockerfile.ubi b/signal/Dockerfile.ubi
new file mode 100644
index 000000000..f0a6552da
--- /dev/null
+++ b/signal/Dockerfile.ubi
@@ -0,0 +1,38 @@
+FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93
+
+ARG TARGETPLATFORM
+ARG VERSION=dev
+ARG RELEASE=1
+
+LABEL name="netbird-signal" \
+      maintainer="NetBird <dev@netbird.io>" \
+      vendor="NetBird GmbH" \
+      version="${VERSION}" \
+      release="${RELEASE}" \
+      summary="NetBird Signal" \
+      description="NetBird Signal brokers the connection handshakes between peers in NetBird networks."
+
+COPY --chmod=0555 ${TARGETPLATFORM}/netbird-signal /go/bin/netbird-signal
+COPY licenses/ /licenses/
+# Only the data directory shares the root group for arbitrary non-root UIDs.
+# Runtime-created Let's Encrypt keys retain the application's restrictive modes.
+RUN mkdir -p /var/lib/netbird && \
+    chown 1000:0 /var/lib/netbird && \
+    chmod 0770 /var/lib/netbird && \
+    chmod -R a+rX /licenses
+
+USER 1000:0
+ENV HOME=/var/lib/netbird
+ENV NB_LETSENCRYPT_DATA_DIR="/var/lib/netbird"
+# Unprivileged ports: runtimes such as OpenShift and Podman keep the kernel
+# default that reserves ports below 1024 for root, so serve on the legacy
+# gRPC port instead of 80/443. With Let's Encrypt, the empty listen address
+# answers challenges on that port when public 443 is forwarded to it.
+# 9090 is the metrics endpoint.
+ENV NB_PORT="10000"
+ENV NB_LETSENCRYPT_LISTEN_ADDRESS=""
+EXPOSE 10000 9090
+# The signal server only handles SIGINT for a graceful stop.
+STOPSIGNAL SIGINT
+ENTRYPOINT ["/go/bin/netbird-signal", "run"]
+CMD ["--log-file", "console"]

From 763da1b9853c0de7e97054e69862531b16e50979 Mon Sep 17 00:00:00 2001
From: Nicolas Frati <nicofrati@gmail.com>
Date: Mon, 12 Oct 2026 15:09:45 +0200
Subject: [PATCH 51/70] [relay] Add a release-wired UBI image variant (#7457)

* [relay] Add a release-wired UBI image variant

* [relay] Align the UBI image with the shared UBI pattern

Main now ships UBI variants of the client, combined server and proxy that
share one license collector and one image layout, and the Red Hat
certification workflow expects every certified image to carry both amd64
and arm64. The relay variant predated that, kept its own copy of the
license script, built amd64 only, and ran as UID 65532 on the privileged
default port :443, so it would not start under OpenShift or rootless Podman.

Use release_files/collect-licenses.sh and build amd64 and arm64 like the
other UBI images. Run as 1000:0 with a group-0 writable /var/lib/netbird
for Let's Encrypt data, and default the listener to :8443 so an arbitrary
non-root UID can bind it; the relay's Let's Encrypt flow uses TLS-ALPN on
that same listener, so no separate challenge port is needed.

* [infrastructure] Certify the relay UBI image on release

Releases certify the UBI images through redhat-certify.yml, which only
lists the client, proxy and combined server, so a released relay UBI
image would never reach the Red Hat catalog.

Add relay to the component list and the manual dispatch options. Its
Partner Connect ID comes from REDHAT_CERT_ID_RELAY, which must exist
before this merges: the resolve step fails the whole run when any
component's variable is missing.
---
 .github/workflows/redhat-certify.yml |  2 ++
 .goreleaser.yaml                     | 35 ++++++++++++++++++++++++++++
 relay/Dockerfile.ubi                 | 33 ++++++++++++++++++++++++++
 3 files changed, 70 insertions(+)
 create mode 100644 relay/Dockerfile.ubi

diff --git a/.github/workflows/redhat-certify.yml b/.github/workflows/redhat-certify.yml
index c6cd62bca..763da745d 100644
--- a/.github/workflows/redhat-certify.yml
+++ b/.github/workflows/redhat-certify.yml
@@ -34,6 +34,7 @@ on:
           - reverse-proxy
           - netbird-server
           - signal
+          - relay
       version:
         description: "Released version, e.g. v0.80.0"
         type: string
@@ -70,6 +71,7 @@ jobs:
             "reverse-proxy ghcr.io/netbirdio/reverse-proxy -ubi"
             "netbird-server ghcr.io/netbirdio/netbird-server -ubi"
             "signal ghcr.io/netbirdio/signal -ubi"
+            "relay ghcr.io/netbirdio/relay -ubi"
           )
           matrix="[]"
           missing=()
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 1e7acbaa7..785bc452a 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -506,6 +506,41 @@ dockers_v2:
        "org.opencontainers.image.revision": "{{.FullCommit}}"
        "org.opencontainers.image.source": "{{.GitURL}}"
        "maintainer": "dev@netbird.io"
+   - id: relay-ubi
+     disable: "{{ .Env.SKIP_DOCKER_PUSH }}"
+     ids:
+       - netbird-relay
+     images:
+       - netbirdio/relay
+       - ghcr.io/netbirdio/relay
+     tags:
+       - "{{ .Version }}-ubi"
+       - "{{ if eq .Env.SKIP_PUBLISH \"false\" }}ubi-latest{{ end }}"
+     dockerfile: relay/Dockerfile.ubi
+     platforms:
+       - linux/amd64
+       - linux/arm64
+     build_args:
+       VERSION: "{{ .Version }}"
+       RELEASE: "{{ .Timestamp }}"
+     hooks:
+       pre:
+         - cmd: 'sh release_files/collect-licenses.sh -l relay/LICENSE "{{ .ContextDir }}/licenses" ./relay amd64 arm64'
+           env:
+             - GOOS=linux
+             - CGO_ENABLED=0
+     labels:
+       "org.opencontainers.image.created": "{{.Date}}"
+       "org.opencontainers.image.version": "{{.Version}}"
+       "org.opencontainers.image.revision": "{{.FullCommit}}"
+       "org.opencontainers.image.source": "{{.GitURL}}"
+     annotations:
+       "org.opencontainers.image.created": "{{.Date}}"
+       "org.opencontainers.image.title": "{{.ProjectName}}"
+       "org.opencontainers.image.version": "{{.Version}}"
+       "org.opencontainers.image.revision": "{{.FullCommit}}"
+       "org.opencontainers.image.source": "{{.GitURL}}"
+       "maintainer": "dev@netbird.io"
    - id: signal
      disable: "{{ .Env.SKIP_DOCKER_PUSH }}"
      ids:
diff --git a/relay/Dockerfile.ubi b/relay/Dockerfile.ubi
new file mode 100644
index 000000000..86b0cbc01
--- /dev/null
+++ b/relay/Dockerfile.ubi
@@ -0,0 +1,33 @@
+FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93
+
+ARG TARGETPLATFORM
+ARG VERSION=dev
+ARG RELEASE=1
+
+LABEL name="netbird-relay" \
+      maintainer="NetBird <dev@netbird.io>" \
+      vendor="NetBird GmbH" \
+      version="${VERSION}" \
+      release="${RELEASE}" \
+      summary="NetBird Relay" \
+      description="NetBird Relay carries traffic between peers when a direct connection is unavailable."
+
+COPY --chmod=0555 ${TARGETPLATFORM}/netbird-relay /go/bin/netbird-relay
+COPY licenses/ /licenses/
+# Only the data directory shares the root group for arbitrary non-root UIDs.
+# Runtime-created Let's Encrypt keys retain the application's restrictive modes.
+RUN mkdir -p /var/lib/netbird && \
+    chown 1000:0 /var/lib/netbird && \
+    chmod 0770 /var/lib/netbird && \
+    chmod -R a+rX /licenses
+
+USER 1000:0
+ENV HOME=/var/lib/netbird
+ENV NB_LOG_FILE=console
+# Unprivileged port: runtimes such as OpenShift and Podman keep the kernel
+# default that reserves ports below 1024 for root. 8443/udp carries QUIC and
+# 9000 is the health probe.
+ENV NB_LISTEN_ADDRESS=":8443"
+EXPOSE 8443 8443/udp
+STOPSIGNAL SIGTERM
+ENTRYPOINT ["/go/bin/netbird-relay"]

From e4ddd9a3fc7055c4f4880f8e3275769c820cb6e1 Mon Sep 17 00:00:00 2001
From: Nicolas Frati <nicofrati@gmail.com>
Date: Mon, 12 Oct 2026 15:44:02 +0200
Subject: [PATCH 52/70] [management] Add a release-wired UBI image variant
 (#8167)

* [management] Add a release-wired UBI image variant

OpenShift and other Red Hat environments expect UBI-based images that run
as an arbitrary non-root UID. The proxy, combined server and rootless
client already ship -ubi variants; this adds the same for management,
published as <version>-ubi and ubi-latest for amd64 and arm64.

The default --port of 80 cannot bind without root, so the image defaults
to 8080. For Let's Encrypt, public 443 forwards to --port and
--letsencrypt-listen-address is empty (#7706), so the main listener
answers the TLS-ALPN challenges.

* [management] Certify the management UBI image

Adds management to the Red Hat certification components. Its Partner
Connect component ID goes in the REDHAT_CERT_ID_MANAGEMENT repository
variable.
---
 .github/workflows/redhat-certify.yml |  2 ++
 .goreleaser.yaml                     | 35 ++++++++++++++++++++++++++++
 management/Dockerfile.ubi            | 33 ++++++++++++++++++++++++++
 3 files changed, 70 insertions(+)
 create mode 100644 management/Dockerfile.ubi

diff --git a/.github/workflows/redhat-certify.yml b/.github/workflows/redhat-certify.yml
index 763da745d..96d50de9f 100644
--- a/.github/workflows/redhat-certify.yml
+++ b/.github/workflows/redhat-certify.yml
@@ -33,6 +33,7 @@ on:
           - client-rootless
           - reverse-proxy
           - netbird-server
+          - management
           - signal
           - relay
       version:
@@ -70,6 +71,7 @@ jobs:
             "client-rootless ghcr.io/netbirdio/netbird -rootless-ubi"
             "reverse-proxy ghcr.io/netbirdio/reverse-proxy -ubi"
             "netbird-server ghcr.io/netbirdio/netbird-server -ubi"
+            "management ghcr.io/netbirdio/management -ubi"
             "signal ghcr.io/netbirdio/signal -ubi"
             "relay ghcr.io/netbirdio/relay -ubi"
           )
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 785bc452a..de5f7419c 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -620,6 +620,41 @@ dockers_v2:
        "org.opencontainers.image.revision": "{{.FullCommit}}"
        "org.opencontainers.image.source": "{{.GitURL}}"
        "maintainer": "dev@netbird.io"
+   - id: management-ubi
+     disable: "{{ .Env.SKIP_DOCKER_PUSH }}"
+     ids:
+       - netbird-mgmt
+     images:
+       - netbirdio/management
+       - ghcr.io/netbirdio/management
+     tags:
+       - "{{ .Version }}-ubi"
+       - "{{ if eq .Env.SKIP_PUBLISH \"false\" }}ubi-latest{{ end }}"
+     dockerfile: management/Dockerfile.ubi
+     platforms:
+       - linux/amd64
+       - linux/arm64
+     build_args:
+       VERSION: "{{ .Version }}"
+       RELEASE: "{{ .Timestamp }}"
+     hooks:
+       pre:
+         - cmd: 'sh release_files/collect-licenses.sh -l management/LICENSE "{{ .ContextDir }}/licenses" ./management amd64 arm64'
+           env:
+             - GOOS=linux
+             - CGO_ENABLED=1
+     labels:
+       "org.opencontainers.image.created": "{{.Date}}"
+       "org.opencontainers.image.version": "{{.Version}}"
+       "org.opencontainers.image.revision": "{{.FullCommit}}"
+       "org.opencontainers.image.source": "{{.GitURL}}"
+     annotations:
+       "org.opencontainers.image.created": "{{.Date}}"
+       "org.opencontainers.image.title": "{{.ProjectName}}"
+       "org.opencontainers.image.version": "{{.Version}}"
+       "org.opencontainers.image.revision": "{{.FullCommit}}"
+       "org.opencontainers.image.source": "{{.GitURL}}"
+       "maintainer": "dev@netbird.io"
    - id: upload
      disable: "{{ .Env.SKIP_DOCKER_PUSH }}"
      ids:
diff --git a/management/Dockerfile.ubi b/management/Dockerfile.ubi
new file mode 100644
index 000000000..628d1a086
--- /dev/null
+++ b/management/Dockerfile.ubi
@@ -0,0 +1,33 @@
+FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93
+
+ARG TARGETPLATFORM
+ARG VERSION=dev
+ARG RELEASE=1
+
+LABEL name="netbird-management" \
+      maintainer="NetBird <dev@netbird.io>" \
+      vendor="NetBird GmbH" \
+      version="${VERSION}" \
+      release="${RELEASE}" \
+      summary="NetBird Management" \
+      description="NetBird Management is the control plane of a NetBird network and serves its REST and gRPC APIs."
+
+COPY --chmod=0555 ${TARGETPLATFORM}/netbird-mgmt /go/bin/netbird-mgmt
+COPY licenses/ /licenses/
+# Only the data directory shares the root group for arbitrary non-root UIDs.
+# Runtime-created keys and databases retain the application's restrictive modes.
+RUN mkdir -p /var/lib/netbird /etc/netbird && \
+    chown 1000:0 /var/lib/netbird && \
+    chmod 0770 /var/lib/netbird && \
+    chmod -R a+rX /licenses
+
+USER 1000:0
+ENV HOME=/var/lib/netbird
+# Runtimes such as OpenShift and Podman reserve ports below 1024 for root, so
+# --port defaults to 8080 here. With --letsencrypt-domain, forward public 443
+# to --port and set --letsencrypt-listen-address to empty, so the main listener
+# answers the TLS-ALPN challenges. 33073 is the legacy gRPC port.
+EXPOSE 8080 33073
+STOPSIGNAL SIGTERM
+ENTRYPOINT ["/go/bin/netbird-mgmt", "management"]
+CMD ["--port", "8080", "--log-file", "console"]

From 8c70f9ec71e2a3b4ed01e8776a6a78b1f5a8118c Mon Sep 17 00:00:00 2001
From: Pascal Fischer <32096965+pascal-fischer@users.noreply.github.com>
Date: Mon, 12 Oct 2026 16:13:03 +0200
Subject: [PATCH 53/70] [management] fix peer ip allocation test (#8173)

---
 management/server/peer_test.go | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/management/server/peer_test.go b/management/server/peer_test.go
index 93f38f25e..f6a7cc4c4 100644
--- a/management/server/peer_test.go
+++ b/management/server/peer_test.go
@@ -3252,12 +3252,12 @@ func TestAddPeer_ExhaustedIPAllocationFails(t *testing.T) {
 		return err
 	}
 	require.NoError(t, addPeer("host-1"))
-	require.NoError(t, addPeer("host-2"))
 
-	err = addPeer("host-3")
+	err = addPeer("host-2")
 	require.Error(t, err, "no free IP left, registration must fail")
 
 	peers, err := manager.Store.GetAccountPeers(context.Background(), store.LockingStrengthNone, account.Id, "", "", "")
 	require.NoError(t, err)
-	assert.Len(t, peers, 2)
+	require.Len(t, peers, 1)
+	assert.Equal(t, netip.MustParseAddr("100.64.0.1"), peers[0].IP)
 }

From a3949581600790a7ac1640be43f824150b11dc83 Mon Sep 17 00:00:00 2001
From: Pascal Fischer <32096965+pascal-fischer@users.noreply.github.com>
Date: Mon, 12 Oct 2026 20:36:04 +0200
Subject: [PATCH 54/70] [management] do in place expand of loaded snapshots
 (#8177)

---
 management/server/affectedpeers/resolver.go   |  6 +-
 .../server/affectedpeers/resolver_test.go     |  6 ++
 management/server/group.go                    | 27 +++--
 management/server/group_test.go               | 98 +++++++++++++++++++
 management/server/peer.go                     | 54 ++++------
 management/server/user.go                     | 12 ++-
 6 files changed, 148 insertions(+), 55 deletions(-)

diff --git a/management/server/affectedpeers/resolver.go b/management/server/affectedpeers/resolver.go
index 895e4fd36..f6946639d 100644
--- a/management/server/affectedpeers/resolver.go
+++ b/management/server/affectedpeers/resolver.go
@@ -267,10 +267,10 @@ func (c Change) isEmpty() bool {
 }
 
 // Expand returns the deduplicated affected peer IDs from the preloaded Snapshot,
-// no store access. Run after the producing tx commits. Logs the full walk at
-// trace level for diagnosing a miscalculation.
+// no store access. Run after the producing tx commits. A nil Snapshot expands to
+// nothing. Logs the full walk at trace level for diagnosing a miscalculation.
 func (snap *Snapshot) Expand(ctx context.Context, accountID string, c Change) []string {
-	if c.isEmpty() {
+	if snap == nil || c.isEmpty() {
 		return nil
 	}
 	r := newResolver(ctx, snap, accountID, c)
diff --git a/management/server/affectedpeers/resolver_test.go b/management/server/affectedpeers/resolver_test.go
index b0c430c3c..d7858b82c 100644
--- a/management/server/affectedpeers/resolver_test.go
+++ b/management/server/affectedpeers/resolver_test.go
@@ -1,6 +1,7 @@
 package affectedpeers
 
 import (
+	"context"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -77,6 +78,11 @@ func TestPolicyGroupsAndPeers_NonPeerResource(t *testing.T) {
 	assert.Empty(t, peers, "domain resource type should not produce direct peer IDs")
 }
 
+func TestExpand_NilSnapshot(t *testing.T) {
+	var snap *Snapshot
+	assert.Nil(t, snap.Expand(context.Background(), "acc", Change{ChangedGroupIDs: []string{"g"}}))
+}
+
 func TestChangeIsEmpty(t *testing.T) {
 	assert.True(t, Change{}.isEmpty())
 	assert.False(t, Change{ChangedGroupIDs: []string{"g"}}.isEmpty())
diff --git a/management/server/group.go b/management/server/group.go
index 8d91df3ab..d0d6d2628 100644
--- a/management/server/group.go
+++ b/management/server/group.go
@@ -6,12 +6,12 @@ import (
 	"fmt"
 	"slices"
 
-	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/rs/xid"
 	log "github.com/sirupsen/logrus"
 
 	nbdns "github.com/netbirdio/netbird/dns"
+	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/management/server/affectedpeers"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
@@ -249,8 +249,7 @@ func (am *DefaultAccountManager) CreateGroups(ctx context.Context, accountID, us
 	}
 
 	var eventsToStore []func()
-	var snaps []*affectedpeers.Snapshot
-	var changes []affectedpeers.Change
+	affected := make(affectedPeerSet)
 
 	var globalErr error
 	createdCount := 0
@@ -281,7 +280,7 @@ func (am *DefaultAccountManager) CreateGroups(ctx context.Context, accountID, us
 			return err
 		})
 		if err != nil {
-			log.WithContext(ctx).Errorf("failed to update group %s: %v", newGroup.ID, err)
+			log.WithContext(ctx).Errorf("failed to create group %s: %v", newGroup.ID, err)
 			if createdCount == 0 {
 				return err
 			}
@@ -290,15 +289,14 @@ func (am *DefaultAccountManager) CreateGroups(ctx context.Context, accountID, us
 			continue
 		}
 		createdCount++
-		snaps = append(snaps, snap)
-		changes = append(changes, change)
+		affected.add(snap.Expand(ctx, accountID, change))
 	}
 
 	for _, storeEvent := range eventsToStore {
 		storeEvent()
 	}
 
-	go am.dispatchAffected(ctx, accountID, snaps, changes)
+	go am.dispatchAffectedPeerIDs(ctx, accountID, affected.ids())
 
 	return globalErr
 }
@@ -317,8 +315,7 @@ func (am *DefaultAccountManager) UpdateGroups(ctx context.Context, accountID, us
 	}
 
 	var eventsToStore []func()
-	var snaps []*affectedpeers.Snapshot
-	var changes []affectedpeers.Change
+	affected := make(affectedPeerSet)
 
 	var globalErr error
 	for _, newGroup := range groups {
@@ -333,15 +330,14 @@ func (am *DefaultAccountManager) UpdateGroups(ctx context.Context, accountID, us
 			continue
 		}
 		eventsToStore = append(eventsToStore, events...)
-		snaps = append(snaps, snap)
-		changes = append(changes, change)
+		affected.add(snap.Expand(ctx, accountID, change))
 	}
 
 	for _, storeEvent := range eventsToStore {
 		storeEvent()
 	}
 
-	go am.dispatchAffected(ctx, accountID, snaps, changes)
+	go am.dispatchAffectedPeerIDs(ctx, accountID, affected.ids())
 
 	return globalErr
 }
@@ -538,7 +534,10 @@ func (am *DefaultAccountManager) DeleteGroups(ctx context.Context, accountID, us
 		am.StoreEvent(ctx, userID, group.ID, accountID, activity.GroupDeleted, group.EventMeta())
 	}
 
-	go am.dispatchAffected(ctx, accountID, []*affectedpeers.Snapshot{snap, ipv6Snap}, []affectedpeers.Change{change, ipv6Change})
+	affected := make(affectedPeerSet)
+	affected.add(snap.Expand(ctx, accountID, change))
+	affected.add(ipv6Snap.Expand(ctx, accountID, ipv6Change))
+	go am.dispatchAffectedPeerIDs(ctx, accountID, affected.ids())
 
 	return allErrors
 }
diff --git a/management/server/group_test.go b/management/server/group_test.go
index f0ccd385c..61ba56c44 100644
--- a/management/server/group_test.go
+++ b/management/server/group_test.go
@@ -1386,3 +1386,101 @@ func TestDefaultAccountManager_GroupPeersMustBelongToAccount(t *testing.T) {
 		assert.Equal(t, []string{peer1.ID}, stored.Peers, "rejected direct adds must not change membership")
 	})
 }
+
+func TestGroupsBatchAccountPeersUpdate(t *testing.T) {
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+
+		for _, group := range []*types.Group{
+			{ID: "groupA", Name: "GroupA", Peers: []string{peer1.ID, peer2.ID}},
+			{ID: "groupB", Name: "GroupB", Peers: []string{peer3.ID}},
+		} {
+			require.NoError(t, manager.CreateGroup(context.Background(), account.Id, userID, group))
+		}
+
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
+		})
+
+		step(t, "creating unlinked groups", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.CreateGroups(context.Background(), account.Id, userID, []*types.Group{
+				{ID: "groupC", Name: "GroupC", Peers: []string{peer1.ID}},
+				{ID: "groupD", Name: "GroupD"},
+			})
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		_, err := manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+			Enabled: true,
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"groupA"},
+					Destinations:  []string{"groupB"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
+			},
+		}, true)
+		require.NoError(t, err)
+
+		step(t, "updating a batch with a linked group", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.UpdateGroups(context.Background(), account.Id, userID, []*types.Group{
+				{ID: "groupD", Name: "GroupD renamed"},
+				{ID: "groupB", Name: "GroupB renamed"},
+			})
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		step(t, "updating a batch where one item fails", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.UpdateGroups(context.Background(), account.Id, userID, []*types.Group{
+				{ID: "missing", Name: "Missing"},
+				{ID: "groupB", Name: "GroupB"},
+			})
+			require.Error(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+	})
+}
diff --git a/management/server/peer.go b/management/server/peer.go
index c60737535..1e3f72a3c 100644
--- a/management/server/peer.go
+++ b/management/server/peer.go
@@ -1596,30 +1596,20 @@ func (am *DefaultAccountManager) UpdateAccountPeers(ctx context.Context, account
 // ExpandAndUpdateAffected expands a Snapshot (loaded INSIDE the now-committed
 // transaction) into the affected peers and dispatches the network-map refresh.
 // Pure in-memory work plus dispatch, so it runs AFTER commit — the fan-out walk
-// never holds the write lock, over the consistent in-tx snapshot. Exported so the
-// networks sub-package managers (which hold only account.Manager) share it.
+// never holds the write lock, over the consistent in-tx snapshot. The walk runs
+// before the dispatch goroutine starts, so the snapshot is released on return.
+// Exported so the networks sub-package managers (which hold only account.Manager)
+// share it.
 func (am *DefaultAccountManager) ExpandAndUpdateAffected(ctx context.Context, accountID string, snap *affectedpeers.Snapshot, change affectedpeers.Change) {
-	go am.dispatchAffected(ctx, accountID, []*affectedpeers.Snapshot{snap}, []affectedpeers.Change{change})
+	go am.dispatchAffectedPeerIDs(ctx, accountID, snap.Expand(ctx, accountID, change))
 }
 
-// dispatchAffected expands one or more (snapshot, change) pairs — collected across
-// one or several transactions — unions their affected peers, and dispatches a
-// single network-map refresh. Each snapshot must already be loaded inside its
-// transaction; this runs AFTER commit (pure in-memory + dispatch). It is spawned
-// in a goroutine that outlives the request, so it detaches from the request
-// context's cancellation up front.
-func (am *DefaultAccountManager) dispatchAffected(ctx context.Context, accountID string, snaps []*affectedpeers.Snapshot, changes []affectedpeers.Change) {
+// dispatchAffectedPeerIDs dispatches a single network-map refresh for already
+// expanded affected peer IDs. It may run in a goroutine that outlives the
+// request, so it detaches from the request context's cancellation up front.
+func (am *DefaultAccountManager) dispatchAffectedPeerIDs(ctx context.Context, accountID string, affectedPeerIDs []string) {
 	ctx = context.WithoutCancel(ctx)
 
-	var lists [][]string
-	for i, snap := range snaps {
-		if snap == nil {
-			continue
-		}
-		lists = append(lists, snap.Expand(ctx, accountID, changes[i]))
-	}
-
-	affectedPeerIDs := unionStrings(lists...)
 	if len(affectedPeerIDs) == 0 {
 		log.WithContext(ctx).Tracef("no affected peers for account %s", accountID)
 		return
@@ -1629,21 +1619,19 @@ func (am *DefaultAccountManager) dispatchAffected(ctx context.Context, accountID
 	_ = am.networkMapController.UpdateAffectedPeers(ctx, accountID, affectedPeerIDs)
 }
 
-// unionStrings concatenates the given string lists into one deduplicated slice,
-// preserving first-occurrence order.
-func unionStrings(lists ...[]string) []string {
-	seen := make(map[string]struct{})
-	var out []string
-	for _, list := range lists {
-		for _, id := range list {
-			if _, ok := seen[id]; ok {
-				continue
-			}
-			seen[id] = struct{}{}
-			out = append(out, id)
-		}
+// affectedPeerSet collects the affected peer IDs of several snapshot expansions,
+// deduplicating as they are added so it stays bounded by the account's peers
+// however many items a batch has.
+type affectedPeerSet map[string]struct{}
+
+func (s affectedPeerSet) add(peerIDs []string) {
+	for _, id := range peerIDs {
+		s[id] = struct{}{}
 	}
-	return out
+}
+
+func (s affectedPeerSet) ids() []string {
+	return maps.Keys(s)
 }
 
 // affectedPeerIDsFromNetworkMap returns the peer IDs referenced by a peer's
diff --git a/management/server/user.go b/management/server/user.go
index 5f29f4df7..e64320666 100644
--- a/management/server/user.go
+++ b/management/server/user.go
@@ -593,8 +593,7 @@ func (am *DefaultAccountManager) SaveOrAddUsers(ctx context.Context, accountID,
 		return nil, err
 	}
 
-	var snaps []*affectedpeers.Snapshot
-	var changes []affectedpeers.Change
+	affected := make(affectedPeerSet)
 	var peersToExpire []*nbpeer.Peer
 	var addUserEvents []func()
 	var usersToSave = make([]*types.User, 0, len(updates))
@@ -629,6 +628,8 @@ func (am *DefaultAccountManager) SaveOrAddUsers(ctx context.Context, accountID,
 			return nil, status.Errorf(status.InvalidArgument, "provided user update is nil")
 		}
 
+		var itemSnap *affectedpeers.Snapshot
+		var itemChange affectedpeers.Change
 		err = am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
 			change, updatedUser, userPeersToExpire, userEvents, err := am.processUserUpdate(
 				ctx, transaction, groupsMap, accountID, initiatorUserID, initiatorUser, update, addIfNotExists, settings,
@@ -647,8 +648,7 @@ func (am *DefaultAccountManager) SaveOrAddUsers(ctx context.Context, accountID,
 				return err
 			}
 
-			snaps = append(snaps, snap)
-			changes = append(changes, change)
+			itemSnap, itemChange = snap, change
 			usersToSave = append(usersToSave, updatedUser)
 			addUserEvents = append(addUserEvents, userEvents...)
 			peersToExpire = append(peersToExpire, userPeersToExpire...)
@@ -662,7 +662,9 @@ func (am *DefaultAccountManager) SaveOrAddUsers(ctx context.Context, accountID,
 			}
 			globalErr = errors.Join(globalErr, err)
 			// continue when updating multiple users
+			continue
 		}
+		affected.add(itemSnap.Expand(ctx, accountID, itemChange))
 	}
 
 	var updatedUsersInfo = make([]*types.UserInfo, 0, len(usersToSave))
@@ -693,7 +695,7 @@ func (am *DefaultAccountManager) SaveOrAddUsers(ctx context.Context, accountID,
 		if err = am.Store.IncrementNetworkSerial(ctx, accountID); err != nil {
 			return nil, fmt.Errorf("failed to increment network serial: %w", err)
 		}
-		go am.dispatchAffected(ctx, accountID, snaps, changes)
+		go am.dispatchAffectedPeerIDs(ctx, accountID, affected.ids())
 	}
 
 	return updatedUsersInfo, globalErr

From 70ddb2a39380605c8b0d928f15736489a14d86c0 Mon Sep 17 00:00:00 2001
From: Riccardo Manfrin <3090891+riccardomanfrin@users.noreply.github.com>
Date: Tue, 13 Oct 2026 10:54:30 +0200
Subject: [PATCH 55/70] [client] Bound the Signal stream registration wait and
 track its state based on stream health (#8175)

* [client] Move the Signal registration wait into its own helper

Pure move, no behavior change. The wait for the registration header and
the check on its value leave connect() for awaitRegistration(), so the
next commit can bound that wait in one place.

* [client] Split the Signal test server helper from its listener setup

Pure move, no behavior change. serveTestSignalExchange serves any
SignalExchangeServer on a local listener; startTestSignalServer keeps
serving the real server through it. Lets a test wrap the real server.

* [client] Bound the wait for the Signal registration header

After an outage the Signal client could wait forever for the registration
header of a new stream. Keepalive cannot end that wait when whatever
answers the transport (a proxy in front of Signal, or Signal itself)
accepts the stream and never answers it, and the receive watchdog only
starts once registration succeeds. Signal then stayed down until the
daemon was restarted, while Management and Relay recovered.

Cancel the stream when the header does not arrive within 10 seconds, so
connect() fails and the existing retry loop opens a new stream. A timer
is used instead of a context deadline because the stream context must
outlive registration.

* [client] Report Signal unhealthy while no stream is registered

IsHealthy judged Signal by the gRPC connection state alone and marked it
connected whenever the connection was Ready or Idle. With the connection
up but no stream registered, the client cannot receive offers or answers,
yet netbird status showed Signal: Connected, hiding a stuck registration
for as long as it lasted.

Require a registered stream before reporting healthy. When there is none,
return false without touching the recorder: the disconnect that dropped
the stream already reported its reason.

* [client] Name the server that reconnected in the SR watcher log

Signal and Relay shared one reconnect callback, which logged "reconnected
to Signal or Relay server" for either. A Relay reconnect while the Signal
stream was down read as Signal having recovered, which misled diagnosis
of a stuck Signal registration.

Register one callback per server so the log names the one that actually
reconnected. Which listeners get notified, and when, is unchanged.

* [client] Trim comments in the Signal registration and health code

Comment-only change, no behavior change. Drop comments that restate the
code and keep only the reason a timer is used instead of a context
deadline.

* [client] Check Signal stream registration before the connection state

IsHealthy returned true for a Connecting or Shutdown channel before the
registration check ran, so a client with no registered stream could
still be reported healthy while the channel was reconnecting. Check the
stream first; the connection-state cases now only apply to a client
that has a registered stream.

* [client] Log a plain connect in the SR watcher

The Signal and Relay callbacks also fire on the first connection, not
only after a disconnect, so "reconnected" was wrong at startup. Log
"connected to <server> server" for both cases.

* [client] Say what the SR watcher does when it logs

The line was read as a per-server connect log, which Signal and Relay
already emit themselves. What it marks is the peer guards being told to
reset their reconnection backoff, which happens only once both are
ready. Log that, naming the server whose event triggered it.
---
 client/internal/peer/guard/sr_watcher.go  |  16 ++-
 shared/signal/client/grpc.go              |  41 +++++--
 shared/signal/client/health_test.go       | 130 ++++++++++++++++++++++
 shared/signal/client/registration_test.go |  86 ++++++++++++++
 shared/signal/client/watchdog_test.go     |  13 ++-
 5 files changed, 270 insertions(+), 16 deletions(-)
 create mode 100644 shared/signal/client/health_test.go
 create mode 100644 shared/signal/client/registration_test.go

diff --git a/client/internal/peer/guard/sr_watcher.go b/client/internal/peer/guard/sr_watcher.go
index 0befd7438..8eac1a858 100644
--- a/client/internal/peer/guard/sr_watcher.go
+++ b/client/internal/peer/guard/sr_watcher.go
@@ -54,8 +54,8 @@ func (w *SRWatcher) Start(disableICEMonitor bool) {
 		iceMonitor := NewICEMonitor(w.iFaceDiscover, w.iceConfig, GetICEMonitorPeriod())
 		go iceMonitor.Start(ctx, w.onICEChanged)
 	}
-	w.signalClient.SetOnReconnectedListener(w.onReconnected)
-	w.relayManager.SetOnReconnectedListener(w.onReconnected)
+	w.signalClient.SetOnReconnectedListener(w.onSignalReconnected)
+	w.relayManager.SetOnReconnectedListener(w.onRelayReconnected)
 
 }
 
@@ -96,7 +96,15 @@ func (w *SRWatcher) onICEChanged() {
 	w.notify()
 }
 
-func (w *SRWatcher) onReconnected() {
+func (w *SRWatcher) onSignalReconnected() {
+	w.onReconnected("Signal")
+}
+
+func (w *SRWatcher) onRelayReconnected() {
+	w.onReconnected("Relay")
+}
+
+func (w *SRWatcher) onReconnected(server string) {
 	if !w.signalClient.Ready() {
 		return
 	}
@@ -104,7 +112,7 @@ func (w *SRWatcher) onReconnected() {
 		return
 	}
 
-	log.Infof("reconnected to Signal or Relay server")
+	log.Infof("Signal and Relay ready (triggered by %s), resetting peer reconnection backoff", server)
 	w.notify()
 }
 
diff --git a/shared/signal/client/grpc.go b/shared/signal/client/grpc.go
index 92be57b30..e489078a9 100644
--- a/shared/signal/client/grpc.go
+++ b/shared/signal/client/grpc.go
@@ -38,6 +38,8 @@ const (
 	receiveProbeTimeout = 10 * time.Second
 	// receiveWatchdogInterval is how often the watchdog evaluates the stream.
 	receiveWatchdogInterval = 10 * time.Second
+	// defaultRegistrationTimeout bounds the wait for a new stream's registration header.
+	defaultRegistrationTimeout = 10 * time.Second
 )
 
 // errReceiveStreamStalled is reported when the receive stream is transport-alive
@@ -92,6 +94,8 @@ type GrpcClient struct {
 	// new stream feeds the same worker, and only triggers a reconnect storm.
 	receiveHandoffBlocked atomic.Bool
 	watchdogWg            sync.WaitGroup
+
+	registrationTimeout time.Duration
 }
 
 // Option configures optional GrpcClient behavior.
@@ -112,6 +116,7 @@ func NewClient(ctx context.Context, addr string, key wgtypes.Key, tlsEnabled boo
 		mux:                   sync.Mutex{},
 		status:                StreamDisconnected,
 		connStateCallbackLock: sync.RWMutex{},
+		registrationTimeout:   defaultRegistrationTimeout,
 	}
 	for _, opt := range opts {
 		opt(c)
@@ -230,7 +235,7 @@ func (c *GrpcClient) Receive(ctx context.Context, msgHandler func(msg *proto.Mes
 		// todo once the key rotation logic has been implemented, consider changing to some other identifier (received from management)
 		streamCtx, cancelStream := context.WithCancel(ctx)
 		defer cancelStream()
-		stream, err := c.connect(streamCtx, c.key.PublicKey().String())
+		stream, err := c.connect(streamCtx, cancelStream, c.key.PublicKey().String())
 		if err != nil {
 			log.Warnf("disconnected from the Signal Exchange due to an error: %v", err)
 			return err
@@ -308,7 +313,7 @@ func (c *GrpcClient) notifyStreamConnected() {
 	}
 }
 
-func (c *GrpcClient) connect(ctx context.Context, key string) (proto.SignalExchange_ConnectStreamClient, error) {
+func (c *GrpcClient) connect(ctx context.Context, cancel context.CancelFunc, key string) (proto.SignalExchange_ConnectStreamClient, error) {
 	c.stream = nil
 
 	// add key fingerprint to the request header to be identified on the server side
@@ -319,19 +324,30 @@ func (c *GrpcClient) connect(ctx context.Context, key string) (proto.SignalExcha
 	if err != nil {
 		return nil, err
 	}
-	// blocks
-	header, err := c.stream.Header()
-	if err != nil {
+	if err := awaitRegistration(stream, c.registrationTimeout, cancel); err != nil {
 		return nil, err
 	}
-	registered := header.Get(proto.HeaderRegistered)
-	if len(registered) == 0 {
-		return nil, fmt.Errorf("didn't receive a registration header from the Signal server whille connecting to the streams")
-	}
 
 	return stream, nil
 }
 
+func awaitRegistration(stream proto.SignalExchange_ConnectStreamClient, timeout time.Duration, cancel context.CancelFunc) error {
+	// A timer rather than a context deadline: the stream context must outlive registration.
+	timer := time.AfterFunc(timeout, cancel)
+	header, err := stream.Header()
+	if !timer.Stop() {
+		return fmt.Errorf("no registration header from the Signal server within %s", timeout)
+	}
+	if err != nil {
+		return err
+	}
+	registered := header.Get(proto.HeaderRegistered)
+	if len(registered) == 0 {
+		return fmt.Errorf("didn't receive a registration header from the Signal server whille connecting to the streams")
+	}
+	return nil
+}
+
 // Ready indicates whether the client is okay and Ready to be used
 // for now it just checks whether gRPC connection to the service is in state Ready
 func (c *GrpcClient) Ready() bool {
@@ -343,6 +359,13 @@ func (c *GrpcClient) Ready() bool {
 // recorder accordingly. It does not actively probe: the watchdog
 // (watchReceiveStream) owns probing the receive path and reconnecting.
 func (c *GrpcClient) IsHealthy() bool {
+	c.mux.Lock()
+	registered := c.status == StreamConnected
+	c.mux.Unlock()
+	if !registered {
+		return false
+	}
+
 	switch c.signalConn.GetState() {
 	case connectivity.TransientFailure:
 		return false
diff --git a/shared/signal/client/health_test.go b/shared/signal/client/health_test.go
new file mode 100644
index 000000000..d62ee2cc2
--- /dev/null
+++ b/shared/signal/client/health_test.go
@@ -0,0 +1,130 @@
+package client
+
+import (
+	"context"
+	"net"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/connectivity"
+	"google.golang.org/grpc/credentials/insecure"
+
+	sigProto "github.com/netbirdio/netbird/shared/signal/proto"
+)
+
+type recordingNotifier struct {
+	mu        sync.Mutex
+	connected bool
+}
+
+func (n *recordingNotifier) MarkSignalDisconnected(error) {
+	n.mu.Lock()
+	defer n.mu.Unlock()
+	n.connected = false
+}
+
+func (n *recordingNotifier) MarkSignalConnected() {
+	n.mu.Lock()
+	defer n.mu.Unlock()
+	n.connected = true
+}
+
+func (n *recordingNotifier) isConnected() bool {
+	n.mu.Lock()
+	defer n.mu.Unlock()
+	return n.connected
+}
+
+// TestIsHealthyRequiresRegisteredStream covers the status reporting half of a
+// stuck registration: the gRPC connection to Signal is up but no stream is
+// registered, so no peer can reach this client. The health check used to look
+// at the connection only, reporting Signal as connected throughout.
+func TestIsHealthyRequiresRegisteredStream(t *testing.T) {
+	addr := startTestSignalServer(t)
+
+	key, err := wgtypes.GenerateKey()
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	client, err := NewClient(ctx, addr, key, false)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = client.Close() })
+
+	notifier := &recordingNotifier{}
+	client.SetConnStateListener(notifier)
+
+	assert.False(t, client.IsHealthy(), "no registered stream must not be reported healthy")
+	assert.False(t, notifier.isConnected(), "no registered stream must not mark Signal connected")
+
+	// Stop Receive before Close runs (cleanups are LIFO), so the two never overlap.
+	receiveDone := make(chan struct{})
+	go func() {
+		defer close(receiveDone)
+		_ = client.Receive(ctx, func(*sigProto.Message) error { return nil })
+	}()
+	t.Cleanup(func() {
+		cancel()
+		<-receiveDone
+	})
+
+	streamReady := make(chan struct{})
+	go func() {
+		client.WaitStreamConnected(ctx)
+		close(streamReady)
+	}()
+	select {
+	case <-streamReady:
+	case <-time.After(5 * time.Second):
+		t.Fatal("signal stream did not connect within timeout")
+	}
+
+	assert.True(t, client.IsHealthy(), "a registered stream on a usable connection must be healthy")
+	assert.True(t, notifier.isConnected(), "a registered stream must mark Signal connected")
+}
+
+// TestIsHealthyConnectingWithoutStream covers the window while the connection is
+// still being established: a TCP listener that accepts but never speaks HTTP/2
+// keeps the channel in Connecting, and with no registered stream the client
+// cannot receive anything yet, so it must not be reported healthy.
+func TestIsHealthyConnectingWithoutStream(t *testing.T) {
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	var mu sync.Mutex
+	var accepted []net.Conn
+	t.Cleanup(func() {
+		_ = lis.Close()
+		mu.Lock()
+		defer mu.Unlock()
+		for _, c := range accepted {
+			_ = c.Close()
+		}
+	})
+	go func() {
+		for {
+			c, err := lis.Accept()
+			if err != nil {
+				return
+			}
+			mu.Lock()
+			accepted = append(accepted, c)
+			mu.Unlock()
+		}
+	}()
+
+	conn, err := grpc.NewClient(lis.Addr().String(), grpc.WithTransportCredentials(insecure.NewCredentials()))
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = conn.Close() })
+	conn.Connect()
+	require.Eventually(t, func() bool { return conn.GetState() == connectivity.Connecting }, 5*time.Second, 10*time.Millisecond,
+		"channel should be stuck connecting to a listener that never answers")
+
+	client := &GrpcClient{signalConn: conn, status: StreamDisconnected}
+	assert.False(t, client.IsHealthy(), "a connecting channel with no registered stream must not be reported healthy")
+}
diff --git a/shared/signal/client/registration_test.go b/shared/signal/client/registration_test.go
new file mode 100644
index 000000000..7703f843d
--- /dev/null
+++ b/shared/signal/client/registration_test.go
@@ -0,0 +1,86 @@
+package client
+
+import (
+	"context"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"go.opentelemetry.io/otel"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	sigProto "github.com/netbirdio/netbird/shared/signal/proto"
+	"github.com/netbirdio/netbird/signal/server"
+)
+
+// stallingSignalServer holds the first ConnectStream open without ever sending
+// the registration header, while the transport keeps answering keepalive pings.
+// Later streams go to the real server. This is what a responder in front of or
+// inside Signal looks like when it accepts a stream and never answers it.
+type stallingSignalServer struct {
+	*server.Server
+	stalled atomic.Bool
+	held    chan struct{}
+}
+
+func (s *stallingSignalServer) ConnectStream(stream sigProto.SignalExchange_ConnectStreamServer) error {
+	if s.stalled.CompareAndSwap(false, true) {
+		close(s.held)
+		<-stream.Context().Done()
+		return stream.Context().Err()
+	}
+	return s.Server.ConnectStream(stream)
+}
+
+// TestReceiveRetriesWhenRegistrationHeaderNeverArrives reproduces a client stuck
+// forever waiting for the registration header of a stream the server side never
+// answers: the receive watchdog only starts after registration, so nothing ended
+// the wait and Signal never came back until the daemon was restarted. The client
+// must give up on the silent stream and register on a new one.
+func TestReceiveRetriesWhenRegistrationHeaderNeverArrives(t *testing.T) {
+	realServer, err := server.NewServer(context.Background(), otel.Meter(""))
+	require.NoError(t, err)
+	stalling := &stallingSignalServer{Server: realServer, held: make(chan struct{})}
+	addr := serveTestSignalExchange(t, stalling)
+
+	key, err := wgtypes.GenerateKey()
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	client, err := NewClient(ctx, addr, key, false)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = client.Close() })
+	client.registrationTimeout = 200 * time.Millisecond
+
+	// Stop Receive before Close runs (cleanups are LIFO), so the two never overlap.
+	receiveDone := make(chan struct{})
+	go func() {
+		defer close(receiveDone)
+		_ = client.Receive(ctx, func(*sigProto.Message) error { return nil })
+	}()
+	t.Cleanup(func() {
+		cancel()
+		<-receiveDone
+	})
+
+	select {
+	case <-stalling.held:
+	case <-time.After(5 * time.Second):
+		t.Fatal("first stream did not reach the stalling server")
+	}
+
+	streamReady := make(chan struct{})
+	go func() {
+		client.WaitStreamConnected(ctx)
+		close(streamReady)
+	}()
+	select {
+	case <-streamReady:
+	case <-time.After(5 * time.Second):
+		t.Fatal("client never registered after the first stream went unanswered")
+	}
+	require.True(t, client.StreamConnected(), "client should report a registered stream")
+}
diff --git a/shared/signal/client/watchdog_test.go b/shared/signal/client/watchdog_test.go
index a8bbafa29..ab0ab512e 100644
--- a/shared/signal/client/watchdog_test.go
+++ b/shared/signal/client/watchdog_test.go
@@ -19,13 +19,20 @@ import (
 func startTestSignalServer(t *testing.T) string {
 	t.Helper()
 
+	srv, err := server.NewServer(context.Background(), otel.Meter(""))
+	require.NoError(t, err)
+
+	return serveTestSignalExchange(t, srv)
+}
+
+func serveTestSignalExchange(t *testing.T, impl sigProto.SignalExchangeServer) string {
+	t.Helper()
+
 	lis, err := net.Listen("tcp", "127.0.0.1:0")
 	require.NoError(t, err)
 
 	s := grpc.NewServer()
-	srv, err := server.NewServer(context.Background(), otel.Meter(""))
-	require.NoError(t, err)
-	sigProto.RegisterSignalExchangeServer(s, srv)
+	sigProto.RegisterSignalExchangeServer(s, impl)
 
 	go func() {
 		_ = s.Serve(lis)

From 10e34090fa3f0a61f2366ce518955d3b9e168f03 Mon Sep 17 00:00:00 2001
From: Zoa Hickenlooper <legitnull0@gmail.com>
Date: Tue, 13 Oct 2026 05:21:37 -0400
Subject: [PATCH 56/70] [client] Ensure onDisconnected is called on connection
 teardown (#8178)

Conn.Close previously called onDisconnected only when evalStatus
reported StatusConnected. When a connection drops or closes from
a connecting or disconnecting state, the callback was skipped.
This left registered listeners such as Rosenpass unaware of the
teardown, keeping peer workers active and leaking sockets.

Invoke onDisconnected unconditionally on Conn.Close if registered.
---
 client/internal/peer/conn.go      |  2 +-
 client/internal/peer/conn_test.go | 43 +++++++++++++++++++++++++++++++
 2 files changed, 44 insertions(+), 1 deletion(-)

diff --git a/client/internal/peer/conn.go b/client/internal/peer/conn.go
index 17823e043..b8a32b0cb 100644
--- a/client/internal/peer/conn.go
+++ b/client/internal/peer/conn.go
@@ -341,7 +341,7 @@ func (conn *Conn) Close(signalToRemote bool) {
 		conn.Log.Errorf("failed to remove wg endpoint: %v", err)
 	}
 
-	if conn.evalStatus() == StatusConnected && conn.onDisconnected != nil {
+	if conn.onDisconnected != nil {
 		conn.onDisconnected(conn.config.WgConfig.RemoteKey)
 	}
 
diff --git a/client/internal/peer/conn_test.go b/client/internal/peer/conn_test.go
index 8f3d6216d..b481c95ed 100644
--- a/client/internal/peer/conn_test.go
+++ b/client/internal/peer/conn_test.go
@@ -3,19 +3,26 @@ package peer
 import (
 	"context"
 	"fmt"
+	"net"
+	"net/netip"
 	"os"
 	"testing"
 	"time"
 
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
 	"github.com/netbirdio/netbird/client/iface"
+	"github.com/netbirdio/netbird/client/iface/configurer"
+	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgproxy"
 	"github.com/netbirdio/netbird/client/internal/metrics"
 	"github.com/netbirdio/netbird/client/internal/peer/conntype"
 	"github.com/netbirdio/netbird/client/internal/peer/dispatcher"
 	"github.com/netbirdio/netbird/client/internal/peer/guard"
 	"github.com/netbirdio/netbird/client/internal/peer/ice"
+	"github.com/netbirdio/netbird/client/internal/peer/worker"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 	"github.com/netbirdio/netbird/util"
 )
@@ -418,3 +425,39 @@ func TestMetricsConnType_RelayedMatchesIsRelayed(t *testing.T) {
 			"priority %s: isRelayed and the %q metric tag must agree", priority, tag)
 	}
 }
+
+type stubWGIface struct{}
+
+func (s *stubWGIface) UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error {
+	return nil
+}
+func (s *stubWGIface) RemovePeer(peerKey string) error { return nil }
+func (s *stubWGIface) GetStats() (map[string]configurer.WGStats, error) {
+	return map[string]configurer.WGStats{}, nil
+}
+func (s *stubWGIface) GetProxy() wgproxy.Proxy                { return nil }
+func (s *stubWGIface) Address() wgaddr.Address                { return wgaddr.Address{} }
+func (s *stubWGIface) RemoveEndpointAddress(key string) error { return nil }
+
+func TestConn_Close_CallsOnDisconnected(t *testing.T) {
+	var disconnected []string
+	conn := newWGTimeoutTestConn(true, &disconnected)
+	conn.endpointUpdater = NewEndpointUpdater(conn.Log, conn.config.WgConfig, false)
+	conn.config.WgConfig.WgInterface = &stubWGIface{}
+	conn.endpointUpdater.wgConfig.WgInterface = &stubWGIface{}
+	conn.workerRelay = &WorkerRelay{}
+	ctx, cancel := context.WithCancel(context.Background())
+	conn.ctx = ctx
+	conn.ctxCancel = cancel
+	conn.opened = true
+	conn.statusICE = worker.NewAtomicStatus()
+	conn.statusRelay = worker.NewAtomicStatus()
+	conn.statusRecorder = NewRecorder("https://mgm")
+
+	// The connection is closed while in a disconnected or connecting state
+	// (e.g. peer dropped, ICE failed, or management disconnect).
+	conn.Close(false)
+
+	assert.Equal(t, []string{conn.config.WgConfig.RemoteKey}, disconnected,
+		"Close must notify onDisconnected so Rosenpass cleans up its peer worker")
+}

From 49ec0e26999abec532c2de28b63f80c2e04c95c5 Mon Sep 17 00:00:00 2001
From: Bethuel Mmbaga <bethuelmbaga12@gmail.com>
Date: Tue, 13 Oct 2026 13:04:10 +0300
Subject: [PATCH 57/70] [management] Emit activity events for batch group ops
 (#8180)

---
 management/server/group.go      | 10 ++++-----
 management/server/group_test.go | 39 +++++++++++++++++++++++++++++++--
 2 files changed, 42 insertions(+), 7 deletions(-)

diff --git a/management/server/group.go b/management/server/group.go
index d0d6d2628..3cd31f152 100644
--- a/management/server/group.go
+++ b/management/server/group.go
@@ -256,6 +256,7 @@ func (am *DefaultAccountManager) CreateGroups(ctx context.Context, accountID, us
 	for _, newGroup := range groups {
 		change := affectedpeers.Change{ChangedGroupIDs: []string{newGroup.ID}}
 		var snap *affectedpeers.Snapshot
+		var events []func()
 		err = am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
 			if err = validateNewGroup(ctx, transaction, accountID, newGroup); err != nil {
 				return err
@@ -263,6 +264,7 @@ func (am *DefaultAccountManager) CreateGroups(ctx context.Context, accountID, us
 
 			newGroup.AccountID = accountID
 			newGroup.PublicID = xid.New().String()
+			events = am.prepareGroupEvents(ctx, transaction, accountID, userID, newGroup)
 
 			if err = transaction.CreateGroup(ctx, newGroup); err != nil {
 				return err
@@ -273,9 +275,6 @@ func (am *DefaultAccountManager) CreateGroups(ctx context.Context, accountID, us
 				return err
 			}
 
-			events := am.prepareGroupEvents(ctx, transaction, accountID, userID, newGroup)
-			eventsToStore = append(eventsToStore, events...)
-
 			snap, err = affectedpeers.Load(ctx, transaction, accountID, change)
 			return err
 		})
@@ -290,6 +289,7 @@ func (am *DefaultAccountManager) CreateGroups(ctx context.Context, accountID, us
 		}
 		createdCount++
 		affected.add(snap.Expand(ctx, accountID, change))
+		eventsToStore = append(eventsToStore, events...)
 	}
 
 	for _, storeEvent := range eventsToStore {
@@ -358,6 +358,8 @@ func (am *DefaultAccountManager) updateSingleGroup(ctx context.Context, accountI
 		}
 		newGroup.PublicID = oldGroup.PublicID
 
+		events = am.prepareGroupEvents(ctx, transaction, accountID, userID, newGroup)
+
 		if err := transaction.UpdateGroup(ctx, newGroup); err != nil {
 			return err
 		}
@@ -372,8 +374,6 @@ func (am *DefaultAccountManager) updateSingleGroup(ctx context.Context, accountI
 			return err
 		}
 
-		events = am.prepareGroupEvents(ctx, transaction, accountID, userID, newGroup)
-
 		snap, err = affectedpeers.Load(ctx, transaction, accountID, change)
 		return err
 	})
diff --git a/management/server/group_test.go b/management/server/group_test.go
index 61ba56c44..9bcebfd34 100644
--- a/management/server/group_test.go
+++ b/management/server/group_test.go
@@ -20,6 +20,7 @@ import (
 	nbdns "github.com/netbirdio/netbird/dns"
 	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/management/server/groups"
 	"github.com/netbirdio/netbird/management/server/networks"
 	"github.com/netbirdio/netbird/management/server/networks/resources"
@@ -77,6 +78,42 @@ func TestDefaultAccountManager_CreateGroup(t *testing.T) {
 	}
 }
 
+func TestDefaultAccountManager_BatchGroupChangesStoreEvents(t *testing.T) {
+	t.Setenv("NB_EVENT_ACTIVITY_LOG_ENABLED", "true")
+
+	am, _, err := createManager(t)
+	require.NoError(t, err)
+
+	_, account, err := initTestGroupAccount(am)
+	require.NoError(t, err)
+
+	group := &types.Group{ID: "grp-batch", Name: "Batch group", Issued: types.GroupIssuedAPI}
+	err = am.CreateGroups(context.Background(), account.Id, groupAdminUserID, []*types.Group{group})
+	require.NoError(t, err)
+
+	renamed := &types.Group{ID: group.ID, Name: "Batch group renamed", Issued: types.GroupIssuedAPI}
+	err = am.UpdateGroups(context.Background(), account.Id, groupAdminUserID, []*types.Group{renamed})
+	require.NoError(t, err)
+
+	hasEvent := func(code activity.Activity) bool {
+		events, err := am.eventStore.Get(context.Background(), account.Id, 0, 100, true)
+		if err != nil {
+			return false
+		}
+		for _, event := range events {
+			if event.Activity == code && event.TargetID == group.ID {
+				return true
+			}
+		}
+		return false
+	}
+
+	assert.Eventually(t, func() bool { return hasEvent(activity.GroupCreated) }, time.Second, 10*time.Millisecond,
+		"CreateGroups should store a group created event")
+	assert.Eventually(t, func() bool { return hasEvent(activity.GroupUpdated) }, time.Second, 10*time.Millisecond,
+		"UpdateGroups should store a group updated event on rename")
+}
+
 func TestDefaultAccountManager_DeleteGroup(t *testing.T) {
 	am, _, err := createManager(t)
 	if err != nil {
@@ -1085,7 +1122,6 @@ func Test_AddPeerToGroup(t *testing.T) {
 				errs <- fmt.Errorf("AddPeer failed for peer %d: %w", i, err)
 				return
 			}
-
 		}(i)
 	}
 	startTime := time.Now()
@@ -1142,7 +1178,6 @@ func Test_AddPeerToAll(t *testing.T) {
 				errs <- fmt.Errorf("AddPeer failed for peer %d: %w", i, err)
 				return
 			}
-
 		}(i)
 	}
 	startTime := time.Now()

From f62949605e2b758bd5874e46432a932fdf5201cc Mon Sep 17 00:00:00 2001
From: Viktor Liu <17948409+lixmal@users.noreply.github.com>
Date: Tue, 13 Oct 2026 23:13:25 +0900
Subject: [PATCH 58/70] [client] Keep HA routing peer selection latency-aware
 and hold switches that reset connections (#7689)

---
 client/internal/peer/status.go                | 173 +++-
 client/internal/peer/status_test.go           | 178 +++++
 client/internal/peer/worker_ice.go            | 161 +++-
 client/internal/peer/worker_ice_test.go       | 168 ++++
 client/internal/routemanager/client/client.go | 755 ++++++++++++++----
 .../routemanager/client/client_bench_test.go  |   8 +-
 .../routemanager/client/client_test.go        | 652 +++++++++++++++
 client/internal/routemanager/client/env.go    |  77 ++
 .../client/relayed_switch_test.go             | 358 +++++++++
 9 files changed, 2334 insertions(+), 196 deletions(-)
 create mode 100644 client/internal/peer/worker_ice_test.go
 create mode 100644 client/internal/routemanager/client/env.go
 create mode 100644 client/internal/routemanager/client/relayed_switch_test.go

diff --git a/client/internal/peer/status.go b/client/internal/peer/status.go
index 6c44178e1..b695e3b22 100644
--- a/client/internal/peer/status.go
+++ b/client/internal/peer/status.go
@@ -28,6 +28,11 @@ import (
 
 const eventQueueSize = 10
 
+// routerLatencyNotifyThreshold is the latency or noise change that notifies the route
+// watchers subscribed to a peer. Latency is resampled continuously, so without
+// a threshold every sample would wake every watcher of every routing peer.
+const routerLatencyNotifyThreshold = 5 * time.Millisecond
+
 type ResolvedDomainInfo struct {
 	Prefixes     []netip.Prefix
 	ParentDomain domain.Domain
@@ -41,11 +46,21 @@ type EventListener interface {
 	OnEvent(event *proto.SystemEvent)
 }
 
+// LatencySample is a peer's smoothed round trip time together with the
+// uncertainty of that estimate, which is what the jitter of the path leaves
+// behind after smoothing. Comparing two peers is only meaningful when their
+// difference is larger than this.
+type LatencySample struct {
+	Latency time.Duration
+	Noise   time.Duration
+}
+
 // RouterState status for router peers. This contains relevant fields for route manager
 type RouterState struct {
-	Status  ConnStatus
-	Relayed bool
-	Latency time.Duration
+	Status       ConnStatus
+	Relayed      bool
+	Latency      time.Duration
+	LatencyNoise time.Duration
 }
 
 // State contains the latest state of a peer
@@ -67,9 +82,11 @@ type State struct {
 	BytesTx                    int64
 	BytesRx                    int64
 	Latency                    time.Duration
-	RosenpassEnabled           bool
-	SSHHostKey                 []byte
-	routes                     map[string]struct{}
+	// LatencyNoise is the uncertainty of Latency on a jittery path
+	LatencyNoise     time.Duration
+	RosenpassEnabled bool
+	SSHHostKey       []byte
+	routes           map[string]struct{}
 }
 
 // AddRoute add a single route to routes map
@@ -103,6 +120,13 @@ func (s *State) GetRoutes() map[string]struct{} {
 	return maps.Clone(s.routes)
 }
 
+// clearLatency drops the latency estimate, which is only measured over a direct
+// connection and says nothing about the path once that connection is gone.
+func (s *State) clearLatency() {
+	s.Latency = 0
+	s.LatencyNoise = 0
+}
+
 // LocalPeerState contains the latest state of the local peer
 type LocalPeerState struct {
 	IP              string
@@ -163,11 +187,25 @@ type FullStatus struct {
 	Events                []*proto.SystemEvent
 }
 
+// routerSnapshot is a router-state map stamped with a sequence number taken
+// under the status lock. Snapshots are built under the lock but delivered
+// outside it, so two dispatchers can race on the way to a subscriber; the
+// stamp lets delivery drop the older snapshot instead of letting it overwrite
+// a newer one.
+type routerSnapshot struct {
+	seq    uint64
+	states map[string]RouterState
+}
+
 type StatusChangeSubscription struct {
 	peerID     string
 	id         string
 	eventsChan chan map[string]RouterState
 	ctx        context.Context
+
+	// sendMu serializes deliveries and guards lastSeq
+	sendMu  sync.Mutex
+	lastSeq uint64
 }
 
 func newStatusChangeSubscription(ctx context.Context, peerID string) *StatusChangeSubscription {
@@ -184,17 +222,54 @@ func (s *StatusChangeSubscription) Events() chan map[string]RouterState {
 	return s.eventsChan
 }
 
+// deliver forwards a snapshot to the subscriber, dropping it when a newer one
+// has already been delivered. A blocking deliver waits for buffer space, since
+// peer state transitions must not be lost. A non-blocking one gives up when the
+// subscriber is backlogged or another delivery is in flight; it is meant for
+// latency refreshes, which are superseded by the next sample anyway and are
+// also re-read from the recorder on the route watchers' periodic re-evaluation.
+// Only a snapshot that reached the subscriber supersedes older ones.
+func (s *StatusChangeSubscription) deliver(snapshot *routerSnapshot, block bool) {
+	if block {
+		s.sendMu.Lock()
+	} else if !s.sendMu.TryLock() {
+		return
+	}
+	defer s.sendMu.Unlock()
+
+	if snapshot.seq <= s.lastSeq {
+		return
+	}
+
+	if block {
+		select {
+		case s.eventsChan <- snapshot.states:
+			s.lastSeq = snapshot.seq
+		case <-s.ctx.Done():
+		}
+		return
+	}
+
+	select {
+	case s.eventsChan <- snapshot.states:
+		s.lastSeq = snapshot.seq
+	default:
+	}
+}
+
 // Status holds a state of peers, signal, management connections and relays.
 // mux is an RWMutex so hot read paths (notably PeerStateByIP, called for
 // every private-service request) don't contend against each other.
 // Pure read methods take RLock; anything that mutates state takes Lock.
 type Status struct {
-	mux                 sync.RWMutex
-	muxRelays           sync.RWMutex
-	peers               map[string]State
-	ipToKey             map[string]string
-	activeRoutePeers    map[route.HAUniqueID]string
-	changeNotify        map[string]map[string]*StatusChangeSubscription // map[peerID]map[subscriptionID]*StatusChangeSubscription
+	mux              sync.RWMutex
+	muxRelays        sync.RWMutex
+	peers            map[string]State
+	ipToKey          map[string]string
+	activeRoutePeers map[route.HAUniqueID]string
+	changeNotify     map[string]map[string]*StatusChangeSubscription // map[peerID]map[subscriptionID]*StatusChangeSubscription
+	// routerSeq stamps router-state snapshots, see routerSnapshot
+	routerSeq           uint64
 	signalState         bool
 	signalError         error
 	managementState     bool
@@ -386,6 +461,7 @@ func (d *Status) UpdatePeerState(receivedState State) error {
 		peerState.RemoteIceCandidateEndpoint = receivedState.RemoteIceCandidateEndpoint
 		peerState.RelayServerAddress = receivedState.RelayServerAddress
 		peerState.RosenpassEnabled = receivedState.RosenpassEnabled
+		peerState.clearLatency()
 	}
 
 	d.peers[receivedState.PubKey] = peerState
@@ -402,7 +478,7 @@ func (d *Status) UpdatePeerState(receivedState State) error {
 		d.notifier.peerListChanged(numPeers)
 	}
 	if notifyRouter {
-		d.dispatchRouterPeers(receivedState.PubKey, routerSnapshot)
+		d.dispatchRouterPeers(receivedState.PubKey, routerSnapshot, true)
 	}
 	d.notifyStateChange()
 	return nil
@@ -522,7 +598,7 @@ func (d *Status) UpdatePeerICEState(receivedState State) error {
 		d.notifier.peerListChanged(numPeers)
 	}
 	if notifyRouter {
-		d.dispatchRouterPeers(receivedState.PubKey, routerSnapshot)
+		d.dispatchRouterPeers(receivedState.PubKey, routerSnapshot, true)
 	}
 	d.notifyStateChange()
 	return nil
@@ -559,7 +635,7 @@ func (d *Status) UpdatePeerRelayedState(receivedState State) error {
 		d.notifier.peerListChanged(numPeers)
 	}
 	if notifyRouter {
-		d.dispatchRouterPeers(receivedState.PubKey, routerSnapshot)
+		d.dispatchRouterPeers(receivedState.PubKey, routerSnapshot, true)
 	}
 	d.notifyStateChange()
 	return nil
@@ -595,7 +671,7 @@ func (d *Status) UpdatePeerRelayedStateToDisconnected(receivedState State) error
 		d.notifier.peerListChanged(numPeers)
 	}
 	if notifyRouter {
-		d.dispatchRouterPeers(receivedState.PubKey, routerSnapshot)
+		d.dispatchRouterPeers(receivedState.PubKey, routerSnapshot, true)
 	}
 	d.notifyStateChange()
 	return nil
@@ -620,6 +696,7 @@ func (d *Status) UpdatePeerICEStateToDisconnected(receivedState State) error {
 	peerState.RemoteIceCandidateType = receivedState.RemoteIceCandidateType
 	peerState.LocalIceCandidateEndpoint = receivedState.LocalIceCandidateEndpoint
 	peerState.RemoteIceCandidateEndpoint = receivedState.RemoteIceCandidateEndpoint
+	peerState.clearLatency()
 
 	d.peers[receivedState.PubKey] = peerState
 
@@ -634,7 +711,7 @@ func (d *Status) UpdatePeerICEStateToDisconnected(receivedState State) error {
 		d.notifier.peerListChanged(numPeers)
 	}
 	if notifyRouter {
-		d.dispatchRouterPeers(receivedState.PubKey, routerSnapshot)
+		d.dispatchRouterPeers(receivedState.PubKey, routerSnapshot, true)
 	}
 	d.notifyStateChange()
 	return nil
@@ -714,7 +791,7 @@ func (d *Status) FinishPeerListModifications() {
 	// snapshot per-peer router state to deliver after the lock is released
 	type routerDispatch struct {
 		peerID   string
-		snapshot map[string]RouterState
+		snapshot *routerSnapshot
 	}
 	dispatches := make([]routerDispatch, 0, len(d.peers))
 	for key := range d.peers {
@@ -728,7 +805,7 @@ func (d *Status) FinishPeerListModifications() {
 
 	d.notifier.peerListChanged(numPeers)
 	for _, rd := range dispatches {
-		d.dispatchRouterPeers(rd.peerID, rd.snapshot)
+		d.dispatchRouterPeers(rd.peerID, rd.snapshot, true)
 	}
 	d.notifyStateChange()
 }
@@ -1057,22 +1134,42 @@ func (d *Status) GetManagementState() ManagementState {
 	}
 }
 
-func (d *Status) UpdateLatency(pubKey string, latency time.Duration) error {
-	if latency <= 0 {
+func (d *Status) UpdateLatency(pubKey string, sample LatencySample) error {
+	if sample.Latency <= 0 {
 		return nil
 	}
 
 	d.mux.Lock()
-	defer d.mux.Unlock()
 	peerState, ok := d.peers[pubKey]
 	if !ok {
+		d.mux.Unlock()
 		return errors.New("peer doesn't exist")
 	}
-	peerState.Latency = latency
+
+	previous, previousNoise := peerState.Latency, peerState.LatencyNoise
+	peerState.Latency = sample.Latency
+	peerState.LatencyNoise = sample.Noise
 	d.peers[pubKey] = peerState
+
+	// the noise sets the switch margin, so it counts on its own
+	notifyRouter := absDuration(sample.Latency-previous) >= routerLatencyNotifyThreshold ||
+		absDuration(sample.Noise-previousNoise) >= routerLatencyNotifyThreshold
+	routerSnapshot := d.snapshotRouterPeersLocked(pubKey, notifyRouter)
+
+	d.mux.Unlock()
+
+	d.dispatchRouterPeers(pubKey, routerSnapshot, false)
+
 	return nil
 }
 
+func absDuration(d time.Duration) time.Duration {
+	if d < 0 {
+		return -d
+	}
+	return d
+}
+
 // IsLoginRequired determines if a peer's login has expired.
 func (d *Status) IsLoginRequired() bool {
 	d.mux.RLock()
@@ -1229,7 +1326,7 @@ func (d *Status) RemoveConnectionListener() {
 // Caller MUST hold d.mux. Returns nil when there are no subscribers for peerID
 // or when notify is false. The snapshot is consumed later by dispatchRouterPeers
 // outside the lock so the channel send cannot stall any d.mux holder.
-func (d *Status) snapshotRouterPeersLocked(peerID string, notify bool) map[string]RouterState {
+func (d *Status) snapshotRouterPeersLocked(peerID string, notify bool) *routerSnapshot {
 	if !notify {
 		return nil
 	}
@@ -1244,22 +1341,29 @@ func (d *Status) snapshotRouterPeersLocked(peerID string, notify bool) map[strin
 			continue
 		}
 		routerPeers[pid] = RouterState{
-			Status:  s.ConnStatus,
-			Relayed: s.Relayed,
-			Latency: s.Latency,
+			Status:       s.ConnStatus,
+			Relayed:      s.Relayed,
+			Latency:      s.Latency,
+			LatencyNoise: s.LatencyNoise,
 		}
 	}
-	return routerPeers
+
+	d.routerSeq++
+
+	return &routerSnapshot{seq: d.routerSeq, states: routerPeers}
 }
 
 // dispatchRouterPeers delivers a previously snapshotted router-state map to
 // the peer's subscribers. Caller MUST NOT hold d.mux. The method takes a
 // fresh, short read of d.changeNotify under the lock to grab subscriber
 // channels, then sends outside the lock so a slow consumer cannot block other
-// d.mux holders. The send itself stays blocking (only short-circuited by the
-// subscriber's context) so peer state transitions are not silently dropped.
-func (d *Status) dispatchRouterPeers(peerID string, routerPeers map[string]RouterState) {
-	if routerPeers == nil {
+// d.mux holders. With block set, the send waits for buffer space (only
+// short-circuited by the subscriber's context) so peer state transitions are
+// not silently dropped; without it, a backlogged subscriber loses the snapshot
+// instead of stalling the caller. Out-of-order deliveries are dropped either
+// way, see StatusChangeSubscription.deliver.
+func (d *Status) dispatchRouterPeers(peerID string, snapshot *routerSnapshot, block bool) {
+	if snapshot == nil {
 		return
 	}
 
@@ -1274,10 +1378,7 @@ func (d *Status) dispatchRouterPeers(peerID string, routerPeers map[string]Route
 	d.mux.Unlock()
 
 	for _, sub := range subs {
-		select {
-		case sub.eventsChan <- routerPeers:
-		case <-sub.ctx.Done():
-		}
+		sub.deliver(snapshot, block)
 	}
 }
 
diff --git a/client/internal/peer/status_test.go b/client/internal/peer/status_test.go
index b3f01b217..2d910ccf5 100644
--- a/client/internal/peer/status_test.go
+++ b/client/internal/peer/status_test.go
@@ -44,6 +44,184 @@ func TestGetPeer(t *testing.T) {
 	assert.Error(t, err, "should return error when peer doesn't exist")
 }
 
+func TestUpdateLatencyNotifiesRouteWatchers(t *testing.T) {
+	key := "abc"
+	status := NewRecorder("https://mgm")
+	require.NoError(t, status.AddPeer(key, "abc.netbird", "100.108.254.1", ""))
+
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+	sub := status.SubscribeToPeerStateChanges(ctx, key)
+
+	require.NoError(t, status.UpdateLatency(key, LatencySample{Latency: 40 * time.Millisecond}))
+	select {
+	case states := <-sub.Events():
+		assert.Equal(t, 40*time.Millisecond, states[key].Latency, "the notified state should carry the new latency")
+	default:
+		t.Fatal("expected a router state notification for the first latency sample")
+	}
+
+	// below routerLatencyNotifyThreshold: recorded, but not worth waking the watchers
+	require.NoError(t, status.UpdateLatency(key, LatencySample{Latency: 42 * time.Millisecond}))
+	select {
+	case <-sub.Events():
+		t.Fatal("a latency change below the threshold should not notify")
+	default:
+	}
+
+	peerState, err := status.GetPeer(key)
+	require.NoError(t, err)
+	assert.Equal(t, 42*time.Millisecond, peerState.Latency, "the latency should be recorded even without a notification")
+
+	require.NoError(t, status.UpdateLatency(key, LatencySample{Latency: 100 * time.Millisecond}))
+	select {
+	case states := <-sub.Events():
+		assert.Equal(t, 100*time.Millisecond, states[key].Latency, "a significant latency change should notify")
+	default:
+		t.Fatal("expected a router state notification for a significant latency change")
+	}
+
+	// the noise feeds the switch margin, so a large change in it matters on its
+	// own even when the latency stays put
+	require.NoError(t, status.UpdateLatency(key, LatencySample{Latency: 100 * time.Millisecond, Noise: 20 * time.Millisecond}))
+	select {
+	case states := <-sub.Events():
+		assert.Equal(t, 20*time.Millisecond, states[key].LatencyNoise, "a significant noise change should notify")
+	default:
+		t.Fatal("expected a router state notification for a significant noise change")
+	}
+
+	require.NoError(t, status.UpdateLatency(key, LatencySample{Latency: 100 * time.Millisecond, Noise: 21 * time.Millisecond}))
+	select {
+	case <-sub.Events():
+		t.Fatal("a noise change below the threshold should not notify")
+	default:
+	}
+}
+
+// TestSubscriptionDeliverOrdering covers the sequence stamping: snapshots are
+// built under the status lock but delivered outside it, so a dispatcher that
+// is descheduled between the two can deliver an outdated snapshot after a
+// newer one. The older snapshot must be dropped, not delivered.
+func TestSubscriptionDeliverOrdering(t *testing.T) {
+	sub := newStatusChangeSubscription(context.Background(), "peer")
+
+	newer := &routerSnapshot{seq: 2, states: map[string]RouterState{"peer": {Status: StatusConnecting}}}
+	older := &routerSnapshot{seq: 1, states: map[string]RouterState{"peer": {Status: StatusConnected}}}
+
+	sub.deliver(newer, true)
+	sub.deliver(older, true)
+
+	select {
+	case states := <-sub.Events():
+		assert.Equal(t, StatusConnecting, states["peer"].Status, "the newer snapshot should be delivered")
+	default:
+		t.Fatal("expected the newer snapshot to be delivered")
+	}
+
+	select {
+	case <-sub.Events():
+		t.Fatal("the outdated snapshot must be dropped, not delivered after the newer one")
+	default:
+	}
+}
+
+// TestSubscriptionDeliverNonBlocking covers the latency dispatch path: a
+// backlogged subscriber must not block the sender, and the dropped snapshot is
+// recovered from the recorder by the route watchers' periodic re-evaluation.
+func TestSubscriptionDeliverNonBlocking(t *testing.T) {
+	sub := newStatusChangeSubscription(context.Background(), "peer")
+
+	// fill the subscription buffer with no consumer draining it
+	seq := uint64(1)
+	for {
+		before := len(sub.eventsChan)
+		sub.deliver(&routerSnapshot{seq: seq, states: map[string]RouterState{}}, false)
+		seq++
+		if len(sub.eventsChan) == before {
+			break
+		}
+	}
+
+	done := make(chan struct{})
+	go func() {
+		sub.deliver(&routerSnapshot{seq: seq, states: map[string]RouterState{}}, false)
+		close(done)
+	}()
+
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("a non-blocking deliver must return with the buffer full")
+	}
+}
+
+// A snapshot the subscriber never received must not count as delivered: a
+// state transition dispatched just before it, but delivered just after, would
+// otherwise be dropped as outdated and never reach the subscriber.
+func TestSubscriptionDroppedDeliveryDoesNotSupersede(t *testing.T) {
+	sub := newStatusChangeSubscription(context.Background(), "peer")
+
+	for seq := uint64(1); seq <= uint64(cap(sub.eventsChan)); seq++ {
+		sub.deliver(&routerSnapshot{seq: seq, states: map[string]RouterState{}}, false)
+	}
+	require.Len(t, sub.eventsChan, cap(sub.eventsChan), "the buffer must be full")
+
+	// a latency refresh stamped after the transition wins the race to the
+	// subscriber and is dropped on the full buffer
+	transition := &routerSnapshot{seq: 100, states: map[string]RouterState{"peer": {Status: StatusConnecting}}}
+	latency := &routerSnapshot{seq: 101, states: map[string]RouterState{"peer": {Status: StatusConnected}}}
+	sub.deliver(latency, false)
+
+	for range cap(sub.eventsChan) {
+		<-sub.eventsChan
+	}
+	sub.deliver(transition, true)
+
+	select {
+	case states := <-sub.Events():
+		assert.Equal(t, StatusConnecting, states["peer"].Status, "the transition must be delivered")
+	default:
+		t.Fatal("a transition must not be dropped because a later snapshot was dropped")
+	}
+}
+
+// Latency is only measured over a direct connection. Once it is gone the last
+// sample describes a path the traffic no longer takes, and must not be compared
+// against other routing peers as if it were current.
+func TestLatencyClearedWithDirectConnection(t *testing.T) {
+	const key = "abc"
+
+	newStatus := func(t *testing.T) *Status {
+		t.Helper()
+		status := NewRecorder("https://mgm")
+		require.NoError(t, status.AddPeer(key, "peer-a.netbird.local", "10.10.10.10", ""))
+		require.NoError(t, status.UpdatePeerICEState(State{PubKey: key, ConnStatus: StatusConnected}))
+		require.NoError(t, status.UpdateLatency(key, LatencySample{Latency: 20 * time.Millisecond, Noise: time.Millisecond}))
+		return status
+	}
+
+	assertCleared := func(t *testing.T, status *Status) {
+		t.Helper()
+		state, err := status.GetPeer(key)
+		require.NoError(t, err)
+		assert.Zero(t, state.Latency, "the latency of the lost direct path must be cleared")
+		assert.Zero(t, state.LatencyNoise, "the noise of the lost direct path must be cleared")
+	}
+
+	t.Run("ice disconnected, relayed", func(t *testing.T) {
+		status := newStatus(t)
+		require.NoError(t, status.UpdatePeerICEStateToDisconnected(State{PubKey: key, ConnStatus: StatusConnected, Relayed: true}))
+		assertCleared(t, status)
+	})
+
+	t.Run("connection closed", func(t *testing.T) {
+		status := newStatus(t)
+		require.NoError(t, status.UpdatePeerState(State{PubKey: key, ConnStatus: StatusIdle}))
+		assertCleared(t, status)
+	})
+}
+
 func TestUpdatePeerState(t *testing.T) {
 	key := "abc"
 	ip := "10.10.10.10"
diff --git a/client/internal/peer/worker_ice.go b/client/internal/peer/worker_ice.go
index 5979e9bdc..257164bbd 100644
--- a/client/internal/peer/worker_ice.go
+++ b/client/internal/peer/worker_ice.go
@@ -3,6 +3,7 @@ package peer
 import (
 	"context"
 	"fmt"
+	"math"
 	"net"
 	"strconv"
 	"sync"
@@ -20,6 +21,26 @@ import (
 	"github.com/netbirdio/netbird/route"
 )
 
+const (
+	// latencySampleInterval is how often the round trip time of the selected
+	// candidate pair is read. The ICE agent refreshes it on every consent
+	// binding request, so sampling is cheap and needs no extra traffic.
+	latencySampleInterval = 4 * time.Second
+
+	// latencyEWMAAlpha is the weight of a new sample in the exponentially
+	// weighted moving average. At latencySampleInterval this yields a time
+	// constant of roughly 27 seconds: a sustained change is reflected within
+	// tens of seconds, while the residual movement on a jittery path stays
+	// below the switch margin that route selection applies, so noise alone
+	// cannot move a route. Raising it widens that residual movement.
+	latencyEWMAAlpha = 0.15
+)
+
+// latencySmoothedNoiseFactor converts the spread of the raw samples into the
+// spread of the smoothed value: for an exponentially weighted moving average
+// with weight a, the variance of the output is a/(2-a) of the input variance.
+var latencySmoothedNoiseFactor = math.Sqrt(latencyEWMAAlpha / (2 - latencyEWMAAlpha))
+
 type ICEConnInfo struct {
 	RemoteConn                 net.Conn
 	RosenpassPubKey            []byte
@@ -137,7 +158,7 @@ func (w *WorkerICE) OnNewOffer(remoteOfferAnswer *OfferAnswer) {
 		w.log.Debugf("recreate ICE agent: %s / %s", w.sessionID, *remoteOfferAnswer.SessionID)
 	}
 	dialerCtx, dialerCancel := context.WithCancel(w.ctx)
-	agent, err := w.reCreateAgent(dialerCancel, preferredCandidateTypes)
+	agent, sampleNow, err := w.reCreateAgent(dialerCancel, preferredCandidateTypes)
 	if err != nil {
 		w.log.Errorf("failed to recreate ICE Agent: %s", err)
 		return
@@ -153,7 +174,7 @@ func (w *WorkerICE) OnNewOffer(remoteOfferAnswer *OfferAnswer) {
 
 	// Capture the cancel func at spawn time: connect reads it from the argument
 	// instead of the field, which a newer OnNewOffer may already have replaced.
-	go w.connect(dialerCtx, dialerCancel, agent, remoteOfferAnswer)
+	go w.connect(dialerCtx, dialerCancel, agent, sampleNow, remoteOfferAnswer)
 }
 
 // OnRemoteCandidate Handles ICE connection Candidate provided by the remote peer.
@@ -217,29 +238,33 @@ func (w *WorkerICE) Close() {
 	w.abandonNegotiation()
 }
 
-func (w *WorkerICE) reCreateAgent(dialerCancel context.CancelFunc, candidates []ice.CandidateType) (*icemaker.ThreadSafeAgent, error) {
+// reCreateAgent creates a new ICE agent with its callbacks registered. The
+// returned channel wakes that agent's latency sampler when its selected
+// candidate pair changes.
+func (w *WorkerICE) reCreateAgent(dialerCancel context.CancelFunc, candidates []ice.CandidateType) (*icemaker.ThreadSafeAgent, chan struct{}, error) {
 	w.portForwardAttempted = false
 
 	agent, err := icemaker.NewAgent(w.ctx, w.iFaceDiscover, w.config.ICEConfig, candidates, w.localUfrag, w.localPwd)
 	if err != nil {
-		return nil, fmt.Errorf("create agent: %w", err)
+		return nil, nil, fmt.Errorf("create agent: %w", err)
 	}
 
 	if err := agent.OnCandidate(w.onICECandidate); err != nil {
-		return nil, err
+		return nil, nil, err
 	}
 
 	if err := agent.OnConnectionStateChange(w.onConnectionStateChange(agent, dialerCancel)); err != nil {
-		return nil, err
+		return nil, nil, err
 	}
 
-	if err := agent.OnSelectedCandidatePairChange(func(c1, c2 ice.Candidate) {
-		w.onICESelectedCandidatePair(agent, c1, c2)
-	}); err != nil {
-		return nil, err
+	// one channel per agent, so the sampler of a replaced agent cannot take a
+	// wakeup meant for the new one
+	sampleNow := make(chan struct{}, 1)
+	if err := agent.OnSelectedCandidatePairChange(w.onICESelectedCandidatePair(sampleNow)); err != nil {
+		return nil, nil, err
 	}
 
-	return agent, nil
+	return agent, sampleNow, nil
 }
 
 func (w *WorkerICE) SessionID() ICESessionID {
@@ -252,7 +277,7 @@ func (w *WorkerICE) SessionID() ICESessionID {
 // will block until connection succeeded
 // but it won't release if ICE Agent went into Disconnected or Failed state,
 // so we have to cancel it with the provided context once agent detected a broken connection
-func (w *WorkerICE) connect(ctx context.Context, dialerCancel context.CancelFunc, agent *icemaker.ThreadSafeAgent, remoteOfferAnswer *OfferAnswer) {
+func (w *WorkerICE) connect(ctx context.Context, dialerCancel context.CancelFunc, agent *icemaker.ThreadSafeAgent, sampleNow <-chan struct{}, remoteOfferAnswer *OfferAnswer) {
 	w.log.Debugf("gather candidates")
 	if err := agent.GatherCandidates(); err != nil {
 		w.log.Warnf("failed to gather candidates: %s", err)
@@ -343,6 +368,9 @@ func (w *WorkerICE) connect(ctx context.Context, dialerCancel context.CancelFunc
 	w.lastSuccess = time.Now()
 	w.muxAgent.Unlock()
 
+	// ctx is the agent's dialer context, so sampling stops when the agent is closed
+	go w.sampleLatency(ctx, agent, sampleNow)
+
 	// todo: the potential problem is a race between the onConnectionStateChange
 	// and the delivery below: after this unlock, a newer offer can replace
 	// w.agent before onICEConnectionIsReady runs, delivering this (now stale)
@@ -532,21 +560,63 @@ func (w *WorkerICE) createForwardedCandidate(srflxCandidate ice.Candidate, mappi
 	return candidate, nil
 }
 
-func (w *WorkerICE) onICESelectedCandidatePair(agent *icemaker.ThreadSafeAgent, c1, c2 ice.Candidate) {
-	w.log.Debugf("selected candidate pair [local <-> remote] -> [%s <-> %s], peer %s", c1.String(), c2.String(),
-		w.config.Key)
+func (w *WorkerICE) onICESelectedCandidatePair(sampleNow chan<- struct{}) func(c1, c2 ice.Candidate) {
+	return func(c1, c2 ice.Candidate) {
+		w.log.Debugf("selected candidate pair [local <-> remote] -> [%s <-> %s], peer %s", c1.String(), c2.String(),
+			w.config.Key)
 
+		// refresh the recorded latency right away: it still describes the previous
+		// path, and route selection may run before the next sampling tick
+		select {
+		case sampleNow <- struct{}{}:
+		default:
+		}
+	}
+}
+
+// sampleLatency records the smoothed round trip time of the agent's selected
+// candidate pair until the agent is closed. Route selection compares the
+// recorded latencies of high availability peers, so it has to keep following
+// the path instead of freezing at the value observed when the pair was chosen.
+func (w *WorkerICE) sampleLatency(ctx context.Context, agent *icemaker.ThreadSafeAgent, sampleNow <-chan struct{}) {
+	var sampler latencySampler
+
+	ticker := time.NewTicker(latencySampleInterval)
+	defer ticker.Stop()
+
+	for {
+		w.updateLatency(ctx, agent, &sampler)
+
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+		case <-sampleNow:
+		}
+	}
+}
+
+func (w *WorkerICE) updateLatency(ctx context.Context, agent *icemaker.ThreadSafeAgent, sampler *latencySampler) {
 	pairStat, ok := agent.GetSelectedCandidatePairStats()
 	if !ok {
-		w.log.Warnf("failed to get selected candidate pair stats")
+		w.log.Debugf("failed to get selected candidate pair stats")
 		return
 	}
 
-	duration := time.Duration(pairStat.CurrentRoundTripTime * float64(time.Second))
-	if err := w.statusRecorder.UpdateLatency(w.config.Key, duration); err != nil {
-		w.log.Debugf("failed to update latency for peer: %s", err)
+	sample := sampler.observe(pairStat)
+	if sample.Latency <= 0 {
 		return
 	}
+
+	// the agent may have been closed while sampling, and its connection's
+	// latency cleared: a late sample must not bring the stale value back
+	if ctx.Err() != nil {
+		return
+	}
+
+	if err := w.statusRecorder.UpdateLatency(w.config.Key, sample); err != nil {
+		w.log.Debugf("failed to update latency for peer: %s", err)
+	}
 }
 
 func (w *WorkerICE) logSuccessfulPaths(agent *icemaker.ThreadSafeAgent) {
@@ -612,6 +682,59 @@ func (w *WorkerICE) agentDial(ctx context.Context, agent *icemaker.ThreadSafeAge
 	}
 }
 
+// latencySampler smooths the round trip time samples of a single ICE agent and
+// tracks how much they scatter, so consumers can tell a real difference between
+// two paths from the noise of a jittery one.
+type latencySampler struct {
+	smoothed  time.Duration
+	deviation time.Duration
+	localID   string
+	remoteID  string
+}
+
+// observe folds a candidate pair stat into the moving average and returns the
+// smoothed latency with the uncertainty of that estimate. A different candidate
+// pair starts over: the path changed, so the previous samples describe a route
+// that no longer carries the traffic.
+func (s *latencySampler) observe(stat ice.CandidatePairStats) LatencySample {
+	rtt := time.Duration(stat.CurrentRoundTripTime * float64(time.Second))
+	if rtt <= 0 {
+		return LatencySample{}
+	}
+
+	if s.smoothed <= 0 || s.localID != stat.LocalCandidateID || s.remoteID != stat.RemoteCandidateID {
+		s.localID = stat.LocalCandidateID
+		s.remoteID = stat.RemoteCandidateID
+		s.smoothed = rtt
+		// A fresh path is described by a single raw sample, which is exactly
+		// when the estimate deserves the least trust: a lucky outlier reported
+		// with no uncertainty could move a route on its own. Seed the deviation
+		// at half the observed value so the reported noise stays conservative
+		// until real samples accumulate, and keep a larger deviation carried
+		// over from the previous path, since the link's jitter usually outlives
+		// a candidate pair change.
+		if seed := rtt / 2; s.deviation < seed {
+			s.deviation = seed
+		}
+		return s.sample()
+	}
+
+	// mean absolute deviation of the samples around the average, the same
+	// estimator TCP keeps next to its smoothed round trip time
+	delta := absDuration(rtt - s.smoothed)
+	s.deviation = time.Duration(latencyEWMAAlpha*float64(delta) + (1-latencyEWMAAlpha)*float64(s.deviation))
+	s.smoothed = time.Duration(latencyEWMAAlpha*float64(rtt) + (1-latencyEWMAAlpha)*float64(s.smoothed))
+
+	return s.sample()
+}
+
+func (s *latencySampler) sample() LatencySample {
+	return LatencySample{
+		Latency: s.smoothed,
+		Noise:   time.Duration(latencySmoothedNoiseFactor * float64(s.deviation)),
+	}
+}
+
 func shouldAddExtraCandidate(candidate ice.Candidate) bool {
 	if candidate.Type() != ice.CandidateTypeServerReflexive {
 		return false
diff --git a/client/internal/peer/worker_ice_test.go b/client/internal/peer/worker_ice_test.go
new file mode 100644
index 000000000..3089841c2
--- /dev/null
+++ b/client/internal/peer/worker_ice_test.go
@@ -0,0 +1,168 @@
+package peer
+
+import (
+	"testing"
+	"time"
+
+	"github.com/pion/ice/v4"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func pairStat(local, remote string, rtt time.Duration) ice.CandidatePairStats {
+	return ice.CandidatePairStats{
+		LocalCandidateID:     local,
+		RemoteCandidateID:    remote,
+		CurrentRoundTripTime: rtt.Seconds(),
+	}
+}
+
+func TestLatencySamplerObserve(t *testing.T) {
+	t.Run("first sample is taken as is", func(t *testing.T) {
+		var s latencySampler
+
+		got := s.observe(pairStat("local", "remote", 40*time.Millisecond))
+		assert.Equal(t, 40*time.Millisecond, got.Latency, "the first sample has nothing to average with")
+	})
+
+	t.Run("zero round trip time is not recorded", func(t *testing.T) {
+		var s latencySampler
+
+		require.Zero(t, s.observe(pairStat("local", "remote", 0)).Latency, "a pair without an RTT sample yields no latency")
+
+		// the first real sample still seeds the average
+		assert.Equal(t, 20*time.Millisecond, s.observe(pairStat("local", "remote", 20*time.Millisecond)).Latency)
+	})
+
+	t.Run("single spike is damped", func(t *testing.T) {
+		var s latencySampler
+
+		s.observe(pairStat("local", "remote", 20*time.Millisecond))
+		spiked := s.observe(pairStat("local", "remote", 220*time.Millisecond)).Latency
+
+		// a single sample only contributes its weight of the 200ms delta
+		assert.Equal(t, 50*time.Millisecond, spiked, "a single spike must not be reported in full")
+
+		// and it decays again once the path is back to normal
+		for range 10 {
+			s.observe(pairStat("local", "remote", 20*time.Millisecond))
+		}
+		assert.Less(t, s.observe(pairStat("local", "remote", 20*time.Millisecond)).Latency, 30*time.Millisecond,
+			"the average should return towards the steady state")
+	})
+
+	t.Run("sustained change is followed", func(t *testing.T) {
+		var s latencySampler
+
+		s.observe(pairStat("local", "remote", 20*time.Millisecond))
+
+		// the route selection switch margin, see routemanager/client
+		const switchMargin = 20 * time.Millisecond
+
+		// at a 4s sample interval, 3 samples are about 12 seconds
+		var latency time.Duration
+		for range 3 {
+			latency = s.observe(pairStat("local", "remote", 80*time.Millisecond)).Latency
+		}
+		assert.Greater(t, latency-20*time.Millisecond, switchMargin,
+			"a sustained 60ms degradation must clear the switch margin within seconds")
+
+		// and 10 more samples, about 40 seconds in total, get most of the way there
+		for range 10 {
+			latency = s.observe(pairStat("local", "remote", 80*time.Millisecond)).Latency
+		}
+		assert.Greater(t, latency, 70*time.Millisecond, "a sustained degradation must be tracked within tens of seconds")
+	})
+
+	// Smoothing narrows the scatter of a jittery path but leaves a residue, and
+	// that residue is what route selection has to compare its margins against.
+	// The reported noise has to describe it, so it has to grow with the jitter
+	// and cover the movement of the smoothed value.
+	t.Run("reported noise reflects the jitter of the path", func(t *testing.T) {
+		// 100ms +/- 40ms, the same shape the netem jitter test uses
+		jittery := []int{
+			104, 138, 61, 96, 141, 72, 118, 65, 133, 88,
+			59, 127, 92, 136, 68, 111, 143, 74, 99, 121,
+		}
+		steady := []int{
+			100, 101, 99, 100, 102, 99, 100, 101, 100, 99, 101, 100, 99, 100, 101, 100, 99, 101, 100, 100,
+			101, 99, 100, 102, 99, 100, 101, 100, 99, 101, 100, 99, 100, 101, 100, 99, 101, 100, 100, 101,
+		}
+
+		spreadAndNoise := func(raw []int) (spread, noise time.Duration) {
+			var s latencySampler
+			var minSmoothed, maxSmoothed time.Duration
+
+			for i, ms := range raw {
+				got := s.observe(pairStat("local", "remote", time.Duration(ms)*time.Millisecond))
+				noise = got.Noise
+
+				// skip the warmup, the first sample is taken as is
+				if i < 5 {
+					continue
+				}
+				if minSmoothed == 0 || got.Latency < minSmoothed {
+					minSmoothed = got.Latency
+				}
+				if got.Latency > maxSmoothed {
+					maxSmoothed = got.Latency
+				}
+			}
+
+			return maxSmoothed - minSmoothed, noise
+		}
+
+		jitterySpread, jitteryNoise := spreadAndNoise(jittery)
+		steadySpread, steadyNoise := spreadAndNoise(steady)
+
+		assert.Greater(t, jitteryNoise, steadyNoise, "a jittery path must report more noise than a steady one")
+		assert.Less(t, steadyNoise, time.Millisecond, "a steady path must report almost no noise, so the fixed margins decide")
+
+		// the noise is a deviation, so a few of them have to cover the movement
+		// of the smoothed value, which is what the switch margin relies on
+		assert.Greater(t, 4*jitteryNoise, jitterySpread,
+			"reported noise %v must account for the smoothed spread %v", jitteryNoise, jitterySpread)
+		assert.Greater(t, 4*steadyNoise+time.Millisecond, steadySpread,
+			"reported noise %v must account for the smoothed spread %v", steadyNoise, steadySpread)
+	})
+
+	t.Run("new candidate pair discards the previous average", func(t *testing.T) {
+		var s latencySampler
+
+		s.observe(pairStat("local", "remote", 200*time.Millisecond))
+		got := s.observe(pairStat("local2", "remote2", 20*time.Millisecond)).Latency
+
+		assert.Equal(t, 20*time.Millisecond, got, "samples of the previous path must not be carried over")
+	})
+
+	// A single raw sample is when the estimate deserves the least trust: with
+	// zero reported noise, a lucky outlier could clear the switch margins and
+	// move a route on its own.
+	t.Run("a fresh path reports conservative noise", func(t *testing.T) {
+		var s latencySampler
+
+		first := s.observe(pairStat("local", "remote", 100*time.Millisecond))
+		assert.Greater(t, first.Noise, 10*time.Millisecond, "a single-sample estimate must not be reported as noise-free")
+
+		// steady samples shrink the uncertainty again
+		var got LatencySample
+		for range 40 {
+			got = s.observe(pairStat("local", "remote", 100*time.Millisecond))
+		}
+		assert.Less(t, got.Noise, 2*time.Millisecond, "steady samples should earn the estimate its trust back")
+	})
+
+	t.Run("a pair change keeps the larger deviation of a jittery link", func(t *testing.T) {
+		var s latencySampler
+
+		// build up a deviation well above the reseed floor of the new path
+		for _, ms := range []int{100, 180, 60, 170, 50, 190, 70, 160} {
+			s.observe(pairStat("local", "remote", time.Duration(ms)*time.Millisecond))
+		}
+		before := s.deviation
+		require.Greater(t, before, 25*time.Millisecond, "the jittery path should have accumulated deviation")
+
+		s.observe(pairStat("local2", "remote2", 50*time.Millisecond))
+		assert.GreaterOrEqual(t, s.deviation, before, "a pair change must not shrink the known jitter of the link")
+	})
+}
diff --git a/client/internal/routemanager/client/client.go b/client/internal/routemanager/client/client.go
index 973cf1ab8..b882c4d4a 100644
--- a/client/internal/routemanager/client/client.go
+++ b/client/internal/routemanager/client/client.go
@@ -3,8 +3,10 @@ package client
 import (
 	"context"
 	"fmt"
+	"math"
 	"net/netip"
 	"reflect"
+	"sync"
 	"time"
 
 	log "github.com/sirupsen/logrus"
@@ -26,6 +28,48 @@ const (
 	handlerTypeStatic
 )
 
+const (
+	// latencySwitchMinGain is the absolute latency improvement an alternative
+	// routing peer must show before an otherwise equivalent current peer is
+	// replaced. An absolute margin alone would be meaningless on slow paths,
+	// hence latencySwitchGainPercent on top.
+	latencySwitchMinGain = 20 * time.Millisecond
+
+	// latencySwitchGainPercent is the relative latency improvement required in
+	// addition to latencySwitchMinGain. A relative margin alone would churn on
+	// fast paths, where a few milliseconds are a large fraction of the latency.
+	latencySwitchGainPercent = 20
+
+	// latencyNoiseSigmas is how many standard deviations of the measurement
+	// noise a latency gain has to exceed. Smoothing narrows the scatter of a
+	// jittery path but does not remove it, so on such a path two equivalent
+	// peers keep producing differences of tens of milliseconds. Requiring the
+	// gain to stand out from that scatter is what separates a peer that is
+	// really closer from one that only looks closer right now.
+	latencyNoiseSigmas = 4
+
+	// latencySwitchMinDwell is how long a routing peer is kept before latency
+	// can move the choice again. Changes in connection status, metric or relay
+	// state ignore it so failover is never delayed.
+	latencySwitchMinDwell = 30 * time.Second
+
+	// routeReevalInterval is how often routes are re-evaluated without an
+	// incoming peer state change. A switch deferred by latencySwitchMinDwell,
+	// or a latency that drifts in steps too small to notify, would otherwise
+	// wait for an unrelated event to be reconsidered.
+	routeReevalInterval = latencySwitchMinDwell
+
+	// unknownLatency ranks peers without a latency sample below any peer with a
+	// real measurement, without excluding them from selection. It doubles as the
+	// upper bound for samples, so a pathological value cannot dominate, and sits
+	// well above any usable path so that slow paths keep their order.
+	unknownLatency = 10 * time.Second
+
+	// holdReportInterval is how long a routing peer held back by a switch rule
+	// is reported at debug level only, after being reported at info level once.
+	holdReportInterval = 10 * time.Minute
+)
+
 type reason int
 
 const (
@@ -36,10 +80,133 @@ const (
 	reasonHA
 )
 
+// switchReason describes why a routing peer replaced the current one.
+type switchReason string
+
+const (
+	switchReasonNone         switchReason = ""
+	switchReasonUnavailable  switchReason = "current routing peer unavailable"
+	switchReasonConnected    switchReason = "connected peer preferred over idle"
+	switchReasonMetric       switchReason = "lower route metric"
+	switchReasonDirect       switchReason = "direct connection preferred over relayed"
+	switchReasonLatency      switchReason = "lower latency"
+	switchReasonRouteChanged switchReason = "route assigned to a different routing peer"
+)
+
+// holdKind is the rule that keeps the current routing peer over a better one.
+type holdKind int
+
+const (
+	holdLatencyMargin holdKind = iota
+	holdLatencyDwell
+	holdRelayedDelay
+)
+
 type routerPeerStatus struct {
 	status  peer.ConnStatus
 	relayed bool
 	latency time.Duration
+	// noise is the uncertainty of latency, see peer.LatencySample
+	noise time.Duration
+}
+
+func (s routerPeerStatus) isDirect() bool {
+	return s.status == peer.StatusConnected && !s.relayed
+}
+
+// routeCandidate is a route considered for selection, together with the
+// selection criteria derived from the state of its routing peer.
+type routeCandidate struct {
+	id        route.ID
+	peer      string
+	metric    int
+	connected bool
+	relayed   bool
+	latency   time.Duration
+	noise     time.Duration
+}
+
+func newRouteCandidate(r *route.Route, status routerPeerStatus) routeCandidate {
+	latency := status.latency
+	if latency <= 0 || latency > unknownLatency {
+		latency = unknownLatency
+	}
+
+	return routeCandidate{
+		id:        r.ID,
+		peer:      r.Peer,
+		metric:    r.Metric,
+		connected: status.status == peer.StatusConnected,
+		relayed:   status.relayed,
+		latency:   latency,
+		noise:     status.noise,
+	}
+}
+
+// tierCompare orders c against o on the categorical criteria: connection status,
+// then route metric, then direct versus relayed. It returns a positive number
+// when c outranks o, a negative one when o outranks c, and zero when the two are
+// equivalent. Latency is excluded on purpose: it is the tie-break applied by
+// betterThan and the only criterion the switch margins in shouldSwitchRoute
+// apply to.
+func (c routeCandidate) tierCompare(o routeCandidate) int {
+	if c.connected != o.connected {
+		if c.connected {
+			return 1
+		}
+		return -1
+	}
+	if c.metric != o.metric {
+		return o.metric - c.metric
+	}
+	if c.relayed != o.relayed {
+		if c.relayed {
+			return -1
+		}
+		return 1
+	}
+
+	return 0
+}
+
+func (c routeCandidate) isDirect() bool {
+	return c.connected && !c.relayed
+}
+
+func (c routeCandidate) tierBetterThan(o routeCandidate) bool {
+	return c.tierCompare(o) > 0
+}
+
+// winsOnlyOnRelay reports whether c outranks o solely by being direct while o
+// is relayed, with connection status and metric equal.
+func (c routeCandidate) winsOnlyOnRelay(o routeCandidate) bool {
+	return c.connected == o.connected && c.metric == o.metric && o.relayed && !c.relayed
+}
+
+// switchReasonOver names the criterion on which c replaces the current o.
+func (c routeCandidate) switchReasonOver(o routeCandidate) switchReason {
+	switch {
+	case c.connected != o.connected:
+		return switchReasonConnected
+	case c.metric != o.metric:
+		return switchReasonMetric
+	case c.relayed != o.relayed:
+		return switchReasonDirect
+	default:
+		return switchReasonLatency
+	}
+}
+
+func (c routeCandidate) betterThan(o routeCandidate) bool {
+	if tier := c.tierCompare(o); tier != 0 {
+		return tier > 0
+	}
+
+	return c.latency < o.latency
+}
+
+func (c routeCandidate) String() string {
+	return fmt.Sprintf("connected: %t, metric: %d, relayed: %t, latency: %v +/- %v", c.connected, c.metric, c.relayed, c.latency, c.noise)
 }
 
 type RoutesUpdate struct {
@@ -69,18 +236,72 @@ type WatcherConfig struct {
 // Once stopped, it cannot be reused.
 // The methods are not thread-safe and should be synchronized externally.
 type Watcher struct {
-	ctx                 context.Context
-	cancel              context.CancelFunc
-	statusRecorder      *peer.Status
-	wgInterface         iface.WGIface
-	routes              map[route.ID]*route.Route
-	routeUpdate         chan RoutesUpdate
-	peerStateUpdate     chan map[string]peer.RouterState
+	ctx            context.Context
+	cancel         context.CancelFunc
+	statusRecorder *peer.Status
+	wgInterface    iface.WGIface
+	routes         map[route.ID]*route.Route
+	routeUpdate    chan RoutesUpdate
+	// peerStateUpdate holds at most one pending routing peer state notification,
+	// see watchPeerStatusChanges
+	peerStateUpdate     chan struct{}
 	routePeersNotifiers map[string]chan struct{} // map of peer key to channel for peer state changes
 	currentChosen       *route.Route
 	currentChosenStatus *routerPeerStatus
-	handler             RouteHandler
-	updateSerial        uint64
+	// lastSwitch is when currentChosen was last replaced by a latency-driven
+	// switch, used to enforce latencySwitchMinDwell. Categorical switches
+	// (failover, metric, relay state) leave it untouched: the dwell exists to
+	// stop latency ping-pong, and arming it on a failover would delay the
+	// return to a recovered better peer.
+	lastSwitch time.Time
+	// latencySwitch marks the evaluation's switch decision as latency-driven;
+	// set by shouldSwitchRoute, consumed when the switch is applied
+	latencySwitch bool
+	// switchReason describes why the evaluation replaced the current routing
+	// peer; set by getBestRouteFromStatuses, consumed when the switch is applied
+	switchReason switchReason
+	// relayedSwitch is how long a current routing peer that dropped from direct
+	// to relayed is kept over an otherwise equivalent direct one. The zero value
+	// switches at once.
+	relayedSwitch relayedSwitchPolicy
+	// trackedCurrent, trackedPeer and trackedDirect are the current route, its
+	// routing peer and whether that peer was connected directly as of the
+	// previous evaluation, used to tell a peer that dropped to relay while
+	// carrying the route from one that was never direct
+	trackedCurrent route.ID
+	trackedPeer    string
+	trackedDirect  bool
+	// degradedSince is when the current routing peer dropped from direct to
+	// relayed, zero if it is direct or was already relayed when chosen
+	degradedSince time.Time
+	// relayedHold fires when a relayed switch being held back becomes due, so it
+	// is applied on time rather than on the next periodic re-evaluation
+	relayedHold *time.Timer
+	// heldCandidate and heldKind identify the alternative last held back by the
+	// switch rules and the rule holding it, and heldReported is when that was
+	// reported at info level. Routes are re-evaluated on every latency change,
+	// so a hold is reported once per episode instead of on every evaluation.
+	heldCandidate route.ID
+	heldKind      holdKind
+	heldReported  time.Time
+	// reportedUnassigned tracks that the current no-routing-peer episode has
+	// been reported, so the periodic re-evaluation does not repeat it
+	reportedUnassigned bool
+	// done is closed when the Start loop exits, so Stop can wait for it before
+	// removing the routes the loop might still be updating
+	done chan struct{}
+	// lifecycleMu orders Start against Stop: Start runs in its own goroutine
+	// and may begin after Stop, or never, so Stop only waits for done when the
+	// loop has actually started
+	lifecycleMu  sync.Mutex
+	started      bool
+	stopped      bool
+	handler      RouteHandler
+	updateSerial uint64
+}
+
+func newPeerStateUpdate() chan struct{} {
+	return make(chan struct{}, 1)
 }
 
 func NewWatcher(config WatcherConfig) *Watcher {
@@ -94,9 +315,11 @@ func NewWatcher(config WatcherConfig) *Watcher {
 		routes:              make(map[route.ID]*route.Route),
 		routePeersNotifiers: make(map[string]chan struct{}),
 		routeUpdate:         make(chan RoutesUpdate),
-		peerStateUpdate:     make(chan map[string]peer.RouterState),
+		peerStateUpdate:     newPeerStateUpdate(),
+		done:                make(chan struct{}),
 		handler:             config.Handler,
 		currentChosenStatus: nil,
+		relayedSwitch:       relayedSwitch(),
 	}
 	return client
 }
@@ -113,23 +336,7 @@ func (w *Watcher) getRouterPeerStatuses() map[route.ID]routerPeerStatus {
 			status:  peerStatus.ConnStatus,
 			relayed: peerStatus.Relayed,
 			latency: peerStatus.Latency,
-		}
-	}
-	return routePeerStatuses
-}
-
-func (w *Watcher) convertRouterPeerStatuses(states map[string]peer.RouterState) map[route.ID]routerPeerStatus {
-	routePeerStatuses := make(map[route.ID]routerPeerStatus)
-	for _, r := range w.routes {
-		peerStatus, ok := states[r.Peer]
-		if !ok {
-			log.Warnf("couldn't fetch peer state: %v", r.Peer)
-			continue
-		}
-		routePeerStatuses[r.ID] = routerPeerStatus{
-			status:  peerStatus.Status,
-			relayed: peerStatus.Relayed,
-			latency: peerStatus.Latency,
+			noise:   peerStatus.LatencyNoise,
 		}
 	}
 	return routePeerStatuses
@@ -139,122 +346,277 @@ func (w *Watcher) convertRouterPeerStatuses(states map[string]peer.RouterState)
 // within a Watcher, taking into account peer connection status, route metrics, and
 // preference for non-relayed and direct connections.
 //
-// It follows these prioritization rules:
+// Candidates are ranked by the categorical criteria first, in this order:
 // * Connection status: Both connected and idle peers are considered, but connected peers always take precedence.
-// * Idle peer penalty: Idle peers receive a significant score penalty to ensure any connected peer is preferred.
 // * Metric: Routes with lower metrics (better) are prioritized.
 // * Non-relayed: Routes without relays are preferred.
-// * Latency: Routes with lower latency are prioritized.
-// * Allowed IPs: Idle peers can still receive allowed IPs to enable lazy connection triggering.
-// * we compare the current score + 10ms to the chosen score to avoid flapping between routes
-// * Stability: In case of equal scores, the currently active route (if any) is maintained.
+// Peers that are equal on all of them are then ranked by latency, lowest first.
+//
+// Idle peers can still receive allowed IPs to enable lazy connection triggering.
+// Connecting peers are skipped: they have no endpoint to assign allowed IPs to.
+//
+// Replacing the current route is subject to shouldSwitchRoute, so latency alone
+// only moves the route when the gain is worth the interruption. In case of a
+// tie, the currently active route (if any) is maintained.
 //
 // It returns the ID of the selected optimal route.
 func (w *Watcher) getBestRouteFromStatuses(routePeerStatuses map[route.ID]routerPeerStatus) (route.ID, routerPeerStatus) {
-	var chosen route.ID
-	chosenScore := float64(0)
-	currScore := float64(0)
-
 	var currID route.ID
 	if w.currentChosen != nil {
 		currID = w.currentChosen.ID
 	}
 
-	var chosenStatus routerPeerStatus
+	var best, current routeCandidate
+	var haveBest, haveCurrent bool
 
 	for _, r := range w.routes {
-		tempScore := float64(0)
 		peerStatus, found := routePeerStatuses[r.ID]
-		// connecting status equals disconnected: no wireguard endpoint to assign allowed IPs to
+		// connecting status equals disconnected: no endpoint to assign allowed IPs to
 		if !found || peerStatus.status == peer.StatusConnecting {
 			continue
 		}
 
-		if r.Metric < route.MaxMetric {
-			metricDiff := route.MaxMetric - r.Metric
-			tempScore = float64(metricDiff) * 10
-		}
-
-		// in some temporal cases, latency can be 0, so we set it to 999ms to not block but try to avoid this route
-		latency := 999 * time.Millisecond
-		if peerStatus.latency != 0 {
-			latency = peerStatus.latency
-		} else if !peerStatus.relayed && peerStatus.status != peer.StatusIdle {
-			log.Tracef("peer %s has 0 latency: [%v]", r.Peer, w.handler)
-		}
-
-		// avoid negative tempScore on the higher latency calculation
-		if latency > 1*time.Second {
-			latency = 999 * time.Millisecond
-		}
-
-		// higher latency is worse score
-		tempScore += 1 - latency.Seconds()
-
-		// apply significant penalty for idle peers to ensure connected peers always take precedence
-		if peerStatus.status == peer.StatusConnected {
-			tempScore += 100_000
-		}
-
-		if !peerStatus.relayed {
-			tempScore++
-		}
-
-		if tempScore > chosenScore || (tempScore == chosenScore && chosen == "") {
-			chosen = r.ID
-			chosenStatus = peerStatus
-			chosenScore = tempScore
-		}
-
-		if chosen == "" && currID == "" {
-			chosen = r.ID
-			chosenStatus = peerStatus
-			chosenScore = tempScore
-		}
-
+		candidate := newRouteCandidate(r, peerStatus)
 		if r.ID == currID {
-			currScore = tempScore
+			current, haveCurrent = candidate, true
+		}
+		if !haveBest || candidate.betterThan(best) {
+			best, haveBest = candidate, true
 		}
 	}
 
-	chosenID := chosen
-	if chosen == "" {
-		chosenID = "<none>"
-	}
-	currentID := currID
-	if currID == "" {
-		currentID = "<none>"
+	// Candidates that tie must not displace the current peer: the routes are
+	// held in a map, so the winner of a tie would otherwise depend on iteration
+	// order and change from one evaluation to the next.
+	if haveCurrent && !best.betterThan(current) {
+		best = current
 	}
 
-	log.Debugf("chosen route: %s, chosen score: %f, current route: %s, current score: %f", chosenID, chosenScore, currentID, currScore)
+	w.trackRelayed(current, haveCurrent)
+
+	if !haveBest {
+		w.reportUnassigned()
+		w.heldCandidate = ""
+
+		return "", routerPeerStatus{}
+	}
+	w.reportedUnassigned = false
+
+	if haveCurrent && current.id != best.id {
+		if log.IsLevelEnabled(log.DebugLevel) {
+			log.Debugf("best routing peer for [%v] is %s (%s), current is %s (%s)",
+				w.handler, best.peer, best, current.peer, current)
+		}
+
+		if !w.shouldSwitchRoute(current, best) {
+			return current.id, routePeerStatuses[current.id]
+		}
+	}
 
 	switch {
-	case chosen == "":
-		var peers []string
-		for _, r := range w.routes {
-			peers = append(peers, r.Peer)
-		}
-
-		log.Infof("network [%v] has not been assigned a routing peer as no peers from the list %s are currently available", w.handler, peers)
-	case chosen != currID:
-		// we compare the current score + 10ms to the chosen score to avoid flapping between routes
-		if currScore != 0 && currScore+0.01 > chosenScore {
-			log.Debugf("keeping current routing peer %s for [%v]: the score difference with latency is less than 0.01(10ms): current: %f, new: %f",
-				w.currentChosen.Peer, w.handler, currScore, chosenScore)
-			return currID, chosenStatus
-		}
-		var p string
-		if rt := w.routes[chosen]; rt != nil {
-			p = rt.Peer
-		}
-		log.Infof("New chosen route is %s with peer %s with score %f for network [%v]", chosen, p, chosenScore, w.handler)
+	case haveCurrent && current.id == best.id:
+	case haveCurrent:
+		w.switchReason = best.switchReasonOver(current)
+		log.Warnf("switching routing peer for network [%v] from %s to %s: %s (%s)",
+			w.handler, current.peer, best.peer, w.switchReason, best)
+	case w.currentChosen != nil:
+		w.switchReason = switchReasonUnavailable
+		log.Warnf("switching routing peer for network [%v] from %s to %s: %s (%s)",
+			w.handler, w.currentChosen.Peer, best.peer, w.switchReason, best)
+	default:
+		log.Infof("new chosen route is %s with peer %s for network [%v]: %s",
+			best.id, best.peer, w.handler, best)
 	}
 
-	return chosen, chosenStatus
+	return best.id, routePeerStatuses[best.id]
 }
 
-func (w *Watcher) watchPeerStatusChanges(ctx context.Context, peerKey string, peerStateUpdate chan map[string]peer.RouterState, closer chan struct{}) {
-	subscription := w.statusRecorder.SubscribeToPeerStateChanges(ctx, peerKey)
+// reportUnassigned reports that no routing peer is available for the network,
+// once per episode: the periodic re-evaluation would otherwise repeat it for as
+// long as the routing peers stay unavailable.
+func (w *Watcher) reportUnassigned() {
+	if w.reportedUnassigned {
+		return
+	}
+	w.reportedUnassigned = true
+
+	var peers []string
+	for _, r := range w.routes {
+		peers = append(peers, r.Peer)
+	}
+	log.Infof("network [%v] has not been assigned a routing peer as no peers from the list %s are currently available", w.handler, peers)
+}
+
+// trackRelayed records when the current routing peer dropped from a direct to a
+// relayed connection while carrying the route, which starts the relayedSwitch
+// delay. A peer that was never direct, because it was relayed when chosen or
+// came up over relay from idle, is not degraded: holding on to it would only
+// keep the route on the slower path.
+func (w *Watcher) trackRelayed(current routeCandidate, haveCurrent bool) {
+	if !haveCurrent {
+		w.trackedCurrent, w.trackedPeer, w.trackedDirect, w.degradedSince = "", "", false, time.Time{}
+		return
+	}
+
+	switch {
+	case current.id != w.trackedCurrent, current.peer != w.trackedPeer, !current.relayed:
+		w.degradedSince = time.Time{}
+	case w.trackedDirect:
+		w.degradedSince = time.Now()
+		// a new degradation, reported as such even if an earlier one held
+		// back the same candidate
+		w.heldCandidate = ""
+	}
+	w.trackedCurrent, w.trackedPeer, w.trackedDirect = current.id, current.peer, current.isDirect()
+}
+
+// shouldSwitchRoute reports whether the current routing peer should be replaced
+// by the candidate, which outranks it.
+//
+// A candidate that wins on a categorical criterion (it is connected while the
+// current peer is not, has a better metric, or is direct while the current peer
+// is relayed) takes over immediately. The exception is a current peer that only
+// just dropped from direct to relayed, see relayedSwitchDue.
+//
+// A candidate that only has lower latency has to beat the current peer by the
+// switch margin, and the current peer has to have been in place for
+// latencySwitchMinDwell. Every switch interrupts the traffic using the route, so
+// a gain that is marginal, or that the measurement noise of the two paths can
+// account for on its own, is not worth acting on.
+//
+// An approved latency-driven switch sets w.latencySwitch, which arms the dwell
+// time once the switch is applied.
+func (w *Watcher) shouldSwitchRoute(current, candidate routeCandidate) bool {
+	if candidate.winsOnlyOnRelay(current) {
+		return w.relayedSwitchDue(current, candidate)
+	}
+	if candidate.tierBetterThan(current) {
+		return true
+	}
+
+	gain := current.latency - candidate.latency
+	if margin := switchMargin(current, candidate); gain < margin {
+		if level := w.holdLevel(candidate, holdLatencyMargin); log.IsLevelEnabled(level) {
+			log.StandardLogger().Logf(level,
+				"keeping routing peer %s for [%v] over %s: latency gain %v on %v is below the %v switch margin (%s)",
+				current.peer, w.handler, candidate.peer, gain, current.latency, margin, candidate)
+		}
+		return false
+	}
+
+	if dwelled := time.Since(w.lastSwitch); dwelled < latencySwitchMinDwell {
+		if level := w.holdLevel(candidate, holdLatencyDwell); log.IsLevelEnabled(level) {
+			log.StandardLogger().Logf(level,
+				"keeping routing peer %s for [%v] over %s: chosen %v ago, below the %v minimum dwell time",
+				current.peer, w.handler, candidate.peer, dwelled.Round(time.Second), latencySwitchMinDwell)
+		}
+		return false
+	}
+
+	w.latencySwitch = true
+
+	return true
+}
+
+// relayedSwitchDue reports whether a relayed current routing peer should give
+// way to a candidate that is better only by being direct.
+//
+// A peer that dropped from direct to relayed while carrying the route is kept
+// for the relayedSwitch delay: the relay still carries the traffic, staying
+// keeps every flow through this routing peer alive, and a direct connection that
+// dropped often recovers within seconds. A peer that was already relayed when
+// chosen gives way at once, so the route is not stuck on the slower path when a
+// direct one becomes available. A switch that is not due yet arms relayedHold so
+// it is applied as soon as it becomes due.
+func (w *Watcher) relayedSwitchDue(current, candidate routeCandidate) bool {
+	if w.degradedSince.IsZero() {
+		return true
+	}
+
+	policy := w.relayedSwitch
+	if !policy.never {
+		remaining := policy.delay - time.Since(w.degradedSince)
+		if remaining <= 0 {
+			return true
+		}
+		w.armRelayedHold(remaining)
+	}
+
+	if level := w.holdLevel(candidate, holdRelayedDelay); log.IsLevelEnabled(level) {
+		log.StandardLogger().Logf(level,
+			"keeping relayed routing peer %s for [%v] over direct %s: dropped to relay %v ago, switch delay %s",
+			current.peer, w.handler, candidate.peer, time.Since(w.degradedSince).Round(time.Second), policy)
+	}
+
+	return false
+}
+
+func (w *Watcher) armRelayedHold(d time.Duration) {
+	if w.relayedHold == nil {
+		w.relayedHold = time.NewTimer(d)
+		return
+	}
+	w.relayedHold.Reset(d)
+}
+
+// relayedHoldC is the channel of relayedHold, nil while it was never armed so
+// that selecting on it blocks.
+func (w *Watcher) relayedHoldC() <-chan time.Time {
+	if w.relayedHold == nil {
+		return nil
+	}
+	return w.relayedHold.C
+}
+
+// holdLevel is the level to report a decision to keep the current routing peer
+// at. The first evaluation that holds a given candidate back under a given rule
+// is reported at info level, because that is what someone wondering why a route
+// did not move needs to see. The repeats stay at debug level for
+// holdReportInterval, including when two near-equal peers keep trading places.
+func (w *Watcher) holdLevel(candidate routeCandidate, kind holdKind) log.Level {
+	if w.heldCandidate == candidate.id && w.heldKind == kind && time.Since(w.heldReported) < holdReportInterval {
+		return log.DebugLevel
+	}
+
+	w.heldCandidate, w.heldKind, w.heldReported = candidate.id, kind, time.Now()
+
+	return log.InfoLevel
+}
+
+// switchMargin is how much lower the candidate's latency has to be before the
+// route moves: at least latencySwitchMinGain, at least latencySwitchGainPercent
+// of the current latency so the margin scales with slow paths, and more than the
+// combined measurement noise of the two paths. The noise term is what keeps a
+// jittery path from moving the route on its own; it vanishes on a stable path,
+// where the fixed margins decide.
+func switchMargin(current, candidate routeCandidate) time.Duration {
+	margin := latencySwitchMinGain
+
+	if relative := current.latency * latencySwitchGainPercent / 100; relative > margin {
+		margin = relative
+	}
+
+	// the two paths vary independently, so their noise adds in quadrature
+	noise := time.Duration(latencyNoiseSigmas * math.Hypot(float64(current.noise), float64(candidate.noise)))
+	if noise > margin {
+		margin = noise
+	}
+
+	return margin
+}
+
+// watchPeerStatusChanges forwards the state changes of a routing peer to the
+// watcher as a notification to re-evaluate. The watcher reads the current peer
+// states when it gets to it, so a notification still pending covers any number
+// of later changes, and the forwarder never waits for a busy watcher: that
+// would stop it draining the subscription and in turn block the peer's updates.
+func (w *Watcher) watchPeerStatusChanges(ctx context.Context, peerKey string, peerStateUpdate chan<- struct{}, closer chan struct{}) {
+	// the subscription gets its own context so a delivery blocked on it is
+	// released as soon as this forwarder exits, not only when the watcher stops
+	subCtx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	subscription := w.statusRecorder.SubscribeToPeerStateChanges(subCtx, peerKey)
 	defer w.statusRecorder.UnsubscribePeerStateChanges(subscription)
 
 	for {
@@ -263,14 +625,11 @@ func (w *Watcher) watchPeerStatusChanges(ctx context.Context, peerKey string, pe
 			return
 		case <-closer:
 			return
-		case routerStates := <-subscription.Events():
+		case <-subscription.Events():
 			select {
-			case peerStateUpdate <- routerStates:
+			case peerStateUpdate <- struct{}{}:
 				log.Debugf("triggered route state update for Peer: %s", peerKey)
-			case <-ctx.Done():
-				return
-			case <-closer:
-				return
+			default:
 			}
 		}
 	}
@@ -337,6 +696,8 @@ func (w *Watcher) shouldSkipRecalculation(newChosenID route.ID, newStatus router
 }
 
 func (w *Watcher) recalculateRoutes(rsn reason, routerPeerStatuses map[route.ID]routerPeerStatus) error {
+	w.latencySwitch = false
+	w.switchReason = switchReasonNone
 	newChosenID, newStatus := w.getBestRouteFromStatuses(routerPeerStatuses)
 
 	// If no route is chosen, remove the route from the peer
@@ -348,6 +709,9 @@ func (w *Watcher) recalculateRoutes(rsn reason, routerPeerStatuses map[route.ID]
 		if err := w.removeAllowedIPs(w.currentChosen, rsn); err != nil {
 			return fmt.Errorf("remove obsolete: %w", err)
 		}
+		if rsn == reasonPeerUpdate {
+			w.routingPeerLostEvent(w.currentChosen)
+		}
 
 		w.currentChosen = nil
 		w.currentChosenStatus = nil
@@ -360,6 +724,17 @@ func (w *Watcher) recalculateRoutes(rsn reason, routerPeerStatuses map[route.ID]
 		return nil
 	}
 
+	previous := w.currentChosen
+	newChosenRoute := w.routes[newChosenID]
+	// a route update can hand the same route to a different routing peer
+	peerReplaced := previous != nil && previous.ID == newChosenID && previous.Peer != newChosenRoute.Peer
+	switched := previous == nil || previous.ID != newChosenID || peerReplaced
+	if peerReplaced {
+		w.switchReason = switchReasonRouteChanged
+		log.Warnf("switching routing peer for network [%v] from %s to %s: %s",
+			w.handler, previous.Peer, newChosenRoute.Peer, w.switchReason)
+	}
+
 	// If the chosen route was assigned to a different peer, remove the allowed IPs first
 	if isNew := w.currentChosen == nil; !isNew {
 		if err := w.removeAllowedIPs(w.currentChosen, reasonHA); err != nil {
@@ -367,7 +742,6 @@ func (w *Watcher) recalculateRoutes(rsn reason, routerPeerStatuses map[route.ID]
 		}
 	}
 
-	newChosenRoute := w.routes[newChosenID]
 	if err := w.addAllowedIPs(newChosenRoute); err != nil {
 		return fmt.Errorf("add new: %w", err)
 	}
@@ -377,20 +751,86 @@ func (w *Watcher) recalculateRoutes(rsn reason, routerPeerStatuses map[route.ID]
 
 	w.currentChosen = newChosenRoute
 	w.currentChosenStatus = &newStatus
+	if !switched {
+		return nil
+	}
+
+	// start tracking the new routing peer from the state it was chosen in, so a
+	// drop to relay seen by the next evaluation counts as a degradation
+	w.trackedCurrent, w.trackedPeer = newChosenID, newChosenRoute.Peer
+	w.trackedDirect, w.degradedSince = newStatus.isDirect(), time.Time{}
+	if w.latencySwitch {
+		w.lastSwitch = time.Now()
+	}
+	if previous != nil {
+		w.routingPeerSwitchEvent(previous, newChosenRoute)
+	}
 
 	return nil
 }
 
-func (w *Watcher) connectEvent(route *route.Route) {
-	var defaultRoute bool
-	for _, r := range w.routes {
-		if r.Network.Bits() == 0 {
-			defaultRoute = true
-			break
-		}
+// routingPeerSwitchEvent publishes a replaced routing peer as a system event,
+// so it shows in the status output and debug bundles whatever the log level.
+// Moving a masqueraded route resets the connections that used it. For default
+// routes this adds the reason to the events of disconnectEvent and
+// connectEvent, and carries no user message so it is not shown as a
+// notification a second time.
+func (w *Watcher) routingPeerSwitchEvent(previous, next *route.Route) {
+	if w.statusRecorder == nil {
+		return
 	}
 
-	if !defaultRoute {
+	reason := w.switchReason
+	if reason == switchReasonNone {
+		reason = switchReasonUnavailable
+	}
+
+	w.statusRecorder.PublishEvent(
+		proto.SystemEvent_WARNING,
+		proto.SystemEvent_NETWORK,
+		"Routing peer changed",
+		"",
+		map[string]string{
+			"network":       w.handler.String(),
+			"id":            string(next.NetID),
+			"previous_peer": previous.Peer,
+			"peer":          next.Peer,
+			"reason":        string(reason),
+		},
+	)
+}
+
+// routingPeerLostEvent publishes the loss of the last available routing peer of
+// a network as a system event. Default routes are left to disconnectEvent.
+func (w *Watcher) routingPeerLostEvent(previous *route.Route) {
+	if w.statusRecorder == nil || w.hasDefaultRoute() {
+		return
+	}
+
+	w.statusRecorder.PublishEvent(
+		proto.SystemEvent_WARNING,
+		proto.SystemEvent_NETWORK,
+		"No routing peer available",
+		"",
+		map[string]string{
+			"network":       w.handler.String(),
+			"id":            string(previous.NetID),
+			"previous_peer": previous.Peer,
+		},
+	)
+}
+
+func (w *Watcher) hasDefaultRoute() bool {
+	for _, r := range w.routes {
+		if r.Network.Bits() == 0 {
+			return true
+		}
+	}
+	return false
+}
+
+func (w *Watcher) connectEvent(route *route.Route) {
+	if !w.hasDefaultRoute() {
 		return
 	}
 
@@ -411,15 +851,7 @@ func (w *Watcher) connectEvent(route *route.Route) {
 }
 
 func (w *Watcher) disconnectEvent(route *route.Route, rsn reason) {
-	var defaultRoute bool
-	for _, r := range w.routes {
-		if r.Network.Bits() == 0 {
-			defaultRoute = true
-			break
-		}
-	}
-
-	if !defaultRoute {
+	if !w.hasDefaultRoute() {
 		return
 	}
 
@@ -505,13 +937,41 @@ func (w *Watcher) classifyUpdate(update RoutesUpdate) bool {
 // Start is the main point of reacting on client network routing events.
 // All the processing related to the client network should be done here. Thread-safe.
 func (w *Watcher) Start() {
+	w.lifecycleMu.Lock()
+	if w.stopped || w.started {
+		w.lifecycleMu.Unlock()
+		return
+	}
+	w.started = true
+	w.lifecycleMu.Unlock()
+
+	defer close(w.done)
+
+	reeval := time.NewTicker(routeReevalInterval)
+	defer reeval.Stop()
+	defer func() {
+		if w.relayedHold != nil {
+			w.relayedHold.Stop()
+		}
+	}()
+
 	for {
 		select {
 		case <-w.ctx.Done():
 			return
-		case routersStates := <-w.peerStateUpdate:
-			routerPeerStatuses := w.convertRouterPeerStatuses(routersStates)
-			if err := w.recalculateRoutes(reasonPeerUpdate, routerPeerStatuses); err != nil {
+		case <-reeval.C:
+			if err := w.recalculateRoutes(reasonPeerUpdate, w.getRouterPeerStatuses()); err != nil {
+				log.Errorf("Failed to re-evaluate routes for network [%v]: %v", w.handler, err)
+			}
+		case <-w.relayedHoldC():
+			if err := w.recalculateRoutes(reasonPeerUpdate, w.getRouterPeerStatuses()); err != nil {
+				log.Errorf("Failed to re-evaluate routes for network [%v]: %v", w.handler, err)
+			}
+		case <-w.peerStateUpdate:
+			// The notification only says that a routing peer changed. The states it
+			// carries can be older than ones already applied, since every routing
+			// peer has its own subscription, so the current states are read instead.
+			if err := w.recalculateRoutes(reasonPeerUpdate, w.getRouterPeerStatuses()); err != nil {
 				log.Errorf("Failed to recalculate routes for network [%v]: %v", w.handler, err)
 			}
 		case update := <-w.routeUpdate:
@@ -550,7 +1010,22 @@ func (w *Watcher) handleRouteUpdate(update RoutesUpdate) {
 func (w *Watcher) Stop() {
 	log.Debugf("Stopping watcher for network [%v]", w.handler)
 
+	w.lifecycleMu.Lock()
+	if w.stopped {
+		w.lifecycleMu.Unlock()
+		return
+	}
+	w.stopped = true
+	started := w.started
+	w.lifecycleMu.Unlock()
+
 	w.cancel()
+	// wait for the Start loop to exit: it may be inside a recalculation, and
+	// cleaning up concurrently would race on currentChosen and could leave the
+	// allowed IPs of a route chosen after this point behind
+	if started {
+		<-w.done
+	}
 
 	if w.currentChosen == nil {
 		return
diff --git a/client/internal/routemanager/client/client_bench_test.go b/client/internal/routemanager/client/client_bench_test.go
index 668aec427..b788015db 100644
--- a/client/internal/routemanager/client/client_bench_test.go
+++ b/client/internal/routemanager/client/client_bench_test.go
@@ -23,6 +23,12 @@ var benchmarkTiers = []benchmarkTier{
 	{"Small", 100, 50, 4},
 	{"Medium", 1000, 200, 16},
 	{"Large", 5000, 500, 32},
+	// the tiers below are deliberately past anything realistic: a watcher holds
+	// the routes of a single network, while these give one watcher every route
+	// in the account at once
+	{"ManyPeers", 20000, 500, 32},
+	{"ManyRoutes", 1000, 5000, 16},
+	{"ManyBoth", 20000, 5000, 32},
 }
 
 type mockRouteHandler struct {
@@ -136,7 +142,7 @@ func BenchmarkRecalculateRoutes(b *testing.B) {
 				routes:              routes,
 				routePeersNotifiers: make(map[string]chan struct{}),
 				routeUpdate:         make(chan RoutesUpdate),
-				peerStateUpdate:     make(chan map[string]peer.RouterState),
+				peerStateUpdate:     newPeerStateUpdate(),
 				handler:             &mockRouteHandler{network: "benchmark"},
 				currentChosenStatus: nil,
 			}
diff --git a/client/internal/routemanager/client/client_test.go b/client/internal/routemanager/client/client_test.go
index 850f6691f..764a2f74d 100644
--- a/client/internal/routemanager/client/client_test.go
+++ b/client/internal/routemanager/client/client_test.go
@@ -1,11 +1,17 @@
 package client
 
 import (
+	"context"
 	"fmt"
 	"net/netip"
+	"sync"
 	"testing"
 	"time"
 
+	log "github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/routemanager/common"
 	"github.com/netbirdio/netbird/client/internal/routemanager/static"
@@ -316,6 +322,145 @@ func TestGetBestrouteFromStatuses(t *testing.T) {
 			currentRoute:    "route1",
 			expectedRouteID: "route2",
 		},
+		{
+			// 40ms gain clears latencySwitchMinGain but not the 20% of 300ms
+			name: "latency gain below the relative margin should not change the route",
+			statuses: map[route.ID]routerPeerStatus{
+				"route1": {
+					status:  peer.StatusConnected,
+					latency: 300 * time.Millisecond,
+				},
+				"route2": {
+					status:  peer.StatusConnected,
+					latency: 260 * time.Millisecond,
+				},
+			},
+			existingRoutes: map[route.ID]*route.Route{
+				"route1": {
+					ID:     "route1",
+					Metric: route.MaxMetric,
+					Peer:   "peer1",
+				},
+				"route2": {
+					ID:     "route2",
+					Metric: route.MaxMetric,
+					Peer:   "peer2",
+				},
+			},
+			currentRoute:    "route1",
+			expectedRouteID: "route1",
+		},
+		{
+			name: "latency gain above both margins should change the route",
+			statuses: map[route.ID]routerPeerStatus{
+				"route1": {
+					status:  peer.StatusConnected,
+					latency: 300 * time.Millisecond,
+				},
+				"route2": {
+					status:  peer.StatusConnected,
+					latency: 200 * time.Millisecond,
+				},
+			},
+			existingRoutes: map[route.ID]*route.Route{
+				"route1": {
+					ID:     "route1",
+					Metric: route.MaxMetric,
+					Peer:   "peer1",
+				},
+				"route2": {
+					ID:     "route2",
+					Metric: route.MaxMetric,
+					Peer:   "peer2",
+				},
+			},
+			currentRoute:    "route1",
+			expectedRouteID: "route2",
+		},
+		{
+			// 7ms gain is 58% of the current latency but below latencySwitchMinGain
+			name: "latency gain below the absolute margin should not change the route",
+			statuses: map[route.ID]routerPeerStatus{
+				"route1": {
+					status:  peer.StatusConnected,
+					latency: 12 * time.Millisecond,
+				},
+				"route2": {
+					status:  peer.StatusConnected,
+					latency: 5 * time.Millisecond,
+				},
+			},
+			existingRoutes: map[route.ID]*route.Route{
+				"route1": {
+					ID:     "route1",
+					Metric: route.MaxMetric,
+					Peer:   "peer1",
+				},
+				"route2": {
+					ID:     "route2",
+					Metric: route.MaxMetric,
+					Peer:   "peer2",
+				},
+			},
+			currentRoute:    "route1",
+			expectedRouteID: "route1",
+		},
+		{
+			name: "current relayed peer should be replaced by a direct peer with worse latency",
+			statuses: map[route.ID]routerPeerStatus{
+				"route1": {
+					status:  peer.StatusConnected,
+					relayed: true,
+					latency: 10 * time.Millisecond,
+				},
+				"route2": {
+					status:  peer.StatusConnected,
+					relayed: false,
+					latency: 200 * time.Millisecond,
+				},
+			},
+			existingRoutes: map[route.ID]*route.Route{
+				"route1": {
+					ID:     "route1",
+					Metric: route.MaxMetric,
+					Peer:   "peer1",
+				},
+				"route2": {
+					ID:     "route2",
+					Metric: route.MaxMetric,
+					Peer:   "peer2",
+				},
+			},
+			currentRoute:    "route1",
+			expectedRouteID: "route2",
+		},
+		{
+			name: "better metric should replace the current peer with better latency",
+			statuses: map[route.ID]routerPeerStatus{
+				"route1": {
+					status:  peer.StatusConnected,
+					latency: 10 * time.Millisecond,
+				},
+				"route2": {
+					status:  peer.StatusConnected,
+					latency: 300 * time.Millisecond,
+				},
+			},
+			existingRoutes: map[route.ID]*route.Route{
+				"route1": {
+					ID:     "route1",
+					Metric: route.MaxMetric,
+					Peer:   "peer1",
+				},
+				"route2": {
+					ID:     "route2",
+					Metric: 5000,
+					Peer:   "peer2",
+				},
+			},
+			currentRoute:    "route1",
+			expectedRouteID: "route2",
+		},
 		{
 			name: "current chosen route doesn't exist anymore",
 			statuses: map[route.ID]routerPeerStatus{
@@ -828,3 +973,510 @@ func TestGetBestrouteFromStatuses(t *testing.T) {
 		})
 	}
 }
+
+// newTestWatcher builds a watcher over two routes of equal metric, with route1
+// as the currently chosen one.
+func newTestWatcher(t *testing.T, lastSwitch time.Time) *Watcher {
+	t.Helper()
+
+	routes := map[route.ID]*route.Route{
+		"route1": {ID: "route1", Metric: route.MaxMetric, Peer: "peer1"},
+		"route2": {ID: "route2", Metric: route.MaxMetric, Peer: "peer2"},
+	}
+
+	params := common.HandlerParams{
+		Route: &route.Route{Network: netip.MustParsePrefix("192.168.0.0/24")},
+	}
+
+	return &Watcher{
+		handler:       static.NewRoute(params),
+		routes:        routes,
+		currentChosen: routes["route1"],
+		lastSwitch:    lastSwitch,
+	}
+}
+
+func TestLatencySwitchDwellTime(t *testing.T) {
+	// a gain large enough to clear both switch margins
+	statuses := map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, latency: 300 * time.Millisecond},
+		"route2": {status: peer.StatusConnected, latency: 100 * time.Millisecond},
+	}
+
+	t.Run("latency switch is held during the dwell time", func(t *testing.T) {
+		w := newTestWatcher(t, time.Now())
+
+		chosen, _ := w.getBestRouteFromStatuses(statuses)
+		assert.Equal(t, route.ID("route1"), chosen, "route should be kept while the dwell time has not elapsed")
+	})
+
+	t.Run("latency switch is allowed after the dwell time", func(t *testing.T) {
+		w := newTestWatcher(t, time.Now().Add(-latencySwitchMinDwell-time.Second))
+
+		chosen, _ := w.getBestRouteFromStatuses(statuses)
+		assert.Equal(t, route.ID("route2"), chosen, "route should switch once the dwell time has elapsed")
+	})
+
+	t.Run("categorical improvement ignores the dwell time", func(t *testing.T) {
+		w := newTestWatcher(t, time.Now())
+
+		// route1 is no longer connected, so the dwell time must not delay failover
+		chosen, _ := w.getBestRouteFromStatuses(map[route.ID]routerPeerStatus{
+			"route1": {status: peer.StatusIdle, latency: 10 * time.Millisecond},
+			"route2": {status: peer.StatusConnected, latency: 300 * time.Millisecond},
+		})
+		assert.Equal(t, route.ID("route2"), chosen, "failover must not be delayed by the dwell time")
+	})
+}
+
+// TestLatencySwitchNoiseMargin covers the noise aware margin: on a jittery path
+// the smoothed latencies of two equivalent peers keep drifting apart by tens of
+// milliseconds, and that difference must not move the route even though it
+// clears the fixed margins.
+// Measurements on slow paths must keep their order: a peer measured at 1.2s is
+// better than one at 2.5s, and a peer without a sample still ranks below both.
+func TestSlowPathLatenciesKeepTheirOrder(t *testing.T) {
+	w := newTestWatcher(t, time.Time{})
+
+	chosen, _ := w.getBestRouteFromStatuses(map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, latency: 2500 * time.Millisecond},
+		"route2": {status: peer.StatusConnected, latency: 1200 * time.Millisecond},
+	})
+	assert.Equal(t, route.ID("route2"), chosen, "a 1.3s gain on a 2.5s path must move the route")
+
+	unsampled := newRouteCandidate(w.routes["route1"], routerPeerStatus{status: peer.StatusConnected})
+	slow := newRouteCandidate(w.routes["route2"], routerPeerStatus{status: peer.StatusConnected, latency: 5 * time.Second})
+	assert.True(t, slow.betterThan(unsampled), "a measured peer must rank above one without a sample")
+}
+
+func TestLatencySwitchNoiseMargin(t *testing.T) {
+	t.Run("a gain within the measurement noise does not switch", func(t *testing.T) {
+		w := newTestWatcher(t, time.Time{})
+
+		chosen, _ := w.getBestRouteFromStatuses(map[route.ID]routerPeerStatus{
+			"route1": {status: peer.StatusConnected, latency: 120 * time.Millisecond, noise: 12 * time.Millisecond},
+			"route2": {status: peer.StatusConnected, latency: 80 * time.Millisecond, noise: 12 * time.Millisecond},
+		})
+		assert.Equal(t, route.ID("route1"), chosen, "a 40ms gain between two paths jittering by 12ms is not a real difference")
+	})
+
+	t.Run("a gain beyond the measurement noise switches", func(t *testing.T) {
+		w := newTestWatcher(t, time.Time{})
+
+		chosen, _ := w.getBestRouteFromStatuses(map[route.ID]routerPeerStatus{
+			"route1": {status: peer.StatusConnected, latency: 300 * time.Millisecond, noise: 12 * time.Millisecond},
+			"route2": {status: peer.StatusConnected, latency: 80 * time.Millisecond, noise: 12 * time.Millisecond},
+		})
+		assert.Equal(t, route.ID("route2"), chosen, "a 220ms gain stands out from 12ms of jitter")
+	})
+
+	// the held candidate is tracked so the decision is reported once per episode
+	// rather than on every re-evaluation
+	t.Run("holding a candidate back is tracked as one episode", func(t *testing.T) {
+		w := newTestWatcher(t, time.Time{})
+
+		within := map[route.ID]routerPeerStatus{
+			"route1": {status: peer.StatusConnected, latency: 120 * time.Millisecond, noise: 12 * time.Millisecond},
+			"route2": {status: peer.StatusConnected, latency: 80 * time.Millisecond, noise: 12 * time.Millisecond},
+		}
+
+		w.getBestRouteFromStatuses(within)
+		assert.Equal(t, route.ID("route2"), w.heldCandidate, "the held candidate should be recorded on the first hold")
+
+		w.getBestRouteFromStatuses(within)
+		assert.Equal(t, route.ID("route2"), w.heldCandidate, "a repeated hold of the same candidate stays the same episode")
+
+		// the smoothed latencies of two near-equal peers keep crossing: route2
+		// falling behind for a moment must not start a new episode
+		w.getBestRouteFromStatuses(map[route.ID]routerPeerStatus{
+			"route1": {status: peer.StatusConnected, latency: 80 * time.Millisecond, noise: 12 * time.Millisecond},
+			"route2": {status: peer.StatusConnected, latency: 120 * time.Millisecond, noise: 12 * time.Millisecond},
+		})
+		held := routeCandidate{id: "route2"}
+		assert.Equal(t, log.DebugLevel, w.holdLevel(held, holdLatencyMargin), "holding route2 back again after a crossing is a repeat")
+
+		// a hold reported long ago is worth reporting again
+		w.heldReported = w.heldReported.Add(-holdReportInterval - time.Second)
+		assert.Equal(t, log.InfoLevel, w.holdLevel(held, holdLatencyMargin), "a hold is reported again once the report interval passed")
+	})
+
+	t.Run("a stable path is decided by the fixed margins", func(t *testing.T) {
+		w := newTestWatcher(t, time.Time{})
+
+		// the same 40ms gain as the first case, on paths that barely vary
+		chosen, _ := w.getBestRouteFromStatuses(map[route.ID]routerPeerStatus{
+			"route1": {status: peer.StatusConnected, latency: 120 * time.Millisecond, noise: 300 * time.Microsecond},
+			"route2": {status: peer.StatusConnected, latency: 80 * time.Millisecond, noise: 300 * time.Microsecond},
+		})
+		assert.Equal(t, route.ID("route2"), chosen, "without jitter a 40ms gain on a 120ms path is a real improvement")
+	})
+}
+
+// recordingHandler records the allowed IPs calls a watcher makes.
+type recordingHandler struct {
+	added   []string
+	removed int
+}
+
+func (h *recordingHandler) String() string                 { return "recording" }
+func (h *recordingHandler) AddRoute(context.Context) error { return nil }
+func (h *recordingHandler) RemoveRoute() error             { return nil }
+func (h *recordingHandler) AddAllowedIPs(peerKey string) error {
+	h.added = append(h.added, peerKey)
+	return nil
+}
+
+func (h *recordingHandler) RemoveAllowedIPs() error {
+	h.removed++
+	return nil
+}
+
+func newRecalcWatcher(t *testing.T) (*Watcher, *recordingHandler) {
+	t.Helper()
+
+	handler := &recordingHandler{}
+	routes := map[route.ID]*route.Route{
+		"route1": {ID: "route1", Metric: route.MaxMetric, Peer: "peer1"},
+		"route2": {ID: "route2", Metric: route.MaxMetric, Peer: "peer2"},
+	}
+
+	return &Watcher{
+		statusRecorder: peer.NewRecorder("https://mgm"),
+		routes:         routes,
+		handler:        handler,
+	}, handler
+}
+
+// TestRecalculateRoutesAssignsIdlePeer covers the lazy connection path: an idle
+// routing peer has no established connection yet, but must still receive the
+// allowed IPs so that traffic for the route can trigger the connection.
+func TestRecalculateRoutesAssignsIdlePeer(t *testing.T) {
+	w, handler := newRecalcWatcher(t)
+
+	err := w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusIdle},
+	})
+	require.NoError(t, err)
+
+	assert.Equal(t, []string{"peer1"}, handler.added, "an idle routing peer should still get the allowed IPs")
+	require.NotNil(t, w.currentChosen, "an idle peer should be chosen when it is the only candidate")
+	assert.Equal(t, route.ID("route1"), w.currentChosen.ID)
+}
+
+func TestRecalculateRoutesDwellTime(t *testing.T) {
+	w, handler := newRecalcWatcher(t)
+
+	// route2 has no status yet, so route1 is the only candidate
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, latency: 300 * time.Millisecond},
+	}))
+	require.Equal(t, []string{"peer1"}, handler.added)
+	require.True(t, w.lastSwitch.IsZero(), "the initial assignment is not latency-driven and must not arm the dwell time")
+
+	betterRoute2 := map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, latency: 300 * time.Millisecond},
+		"route2": {status: peer.StatusConnected, latency: 100 * time.Millisecond},
+	}
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, betterRoute2))
+	assert.Equal(t, []string{"peer1", "peer2"}, handler.added, "a latency switch with no recent switch should be allowed")
+	assert.Equal(t, 1, handler.removed)
+	require.False(t, w.lastSwitch.IsZero(), "a latency-driven switch must arm the dwell time")
+
+	// the peers trade places: switching back is again latency-only, but now
+	// inside the dwell window
+	betterRoute1 := map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, latency: 100 * time.Millisecond},
+		"route2": {status: peer.StatusConnected, latency: 300 * time.Millisecond},
+	}
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, betterRoute1))
+	assert.Equal(t, []string{"peer1", "peer2"}, handler.added, "the route should be held during the dwell time")
+
+	w.lastSwitch = w.lastSwitch.Add(-latencySwitchMinDwell - time.Second)
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, betterRoute1))
+	assert.Equal(t, []string{"peer1", "peer2", "peer1"}, handler.added, "the route should switch once the dwell time elapsed")
+	assert.Equal(t, 2, handler.removed)
+
+	// the switch re-armed the dwell time, which must not delay failover
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnecting, latency: 100 * time.Millisecond},
+		"route2": {status: peer.StatusConnected, latency: 300 * time.Millisecond},
+	}))
+	assert.Equal(t, []string{"peer1", "peer2", "peer1", "peer2"}, handler.added, "losing the routing peer must fail over regardless of the dwell time")
+	assert.Equal(t, 3, handler.removed)
+}
+
+// TestFailoverDoesNotArmDwellTime covers the recovery path: a failover to a
+// worse peer must not start the dwell time, or traffic would be stuck on the
+// worse path for the full dwell after the better peer comes back.
+func TestFailoverDoesNotArmDwellTime(t *testing.T) {
+	w, handler := newRecalcWatcher(t)
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, latency: 20 * time.Millisecond},
+		"route2": {status: peer.StatusConnected, latency: 200 * time.Millisecond},
+	}))
+	require.Equal(t, []string{"peer1"}, handler.added)
+
+	// peer1 blips into connecting: unguarded failover to the worse peer2
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnecting, latency: 20 * time.Millisecond},
+		"route2": {status: peer.StatusConnected, latency: 200 * time.Millisecond},
+	}))
+	require.Equal(t, []string{"peer1", "peer2"}, handler.added, "failover to the remaining peer should happen")
+	require.True(t, w.lastSwitch.IsZero(), "a failover must not arm the dwell time")
+
+	// peer1 recovers seconds later: the return is latency-only but must not be
+	// held back by a dwell the failover would have armed
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, latency: 20 * time.Millisecond},
+		"route2": {status: peer.StatusConnected, latency: 200 * time.Millisecond},
+	}))
+	assert.Equal(t, []string{"peer1", "peer2", "peer1"}, handler.added, "the recovered better peer should take the route back immediately")
+}
+
+// blockingHandler records the allowed IPs calls in order and blocks the first
+// AddAllowedIPs until released, to hold a recalculation in flight.
+type blockingHandler struct {
+	mu      sync.Mutex
+	calls   []string
+	entered chan struct{}
+	release chan struct{}
+	once    sync.Once
+}
+
+func (h *blockingHandler) String() string                 { return "blocking" }
+func (h *blockingHandler) AddRoute(context.Context) error { return nil }
+func (h *blockingHandler) RemoveRoute() error             { return nil }
+
+func (h *blockingHandler) AddAllowedIPs(peerKey string) error {
+	h.once.Do(func() {
+		close(h.entered)
+		<-h.release
+	})
+	h.record("add " + peerKey)
+	return nil
+}
+
+func (h *blockingHandler) RemoveAllowedIPs() error {
+	h.record("remove")
+	return nil
+}
+
+func (h *blockingHandler) record(call string) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	h.calls = append(h.calls, call)
+}
+
+// TestStopWaitsForStart covers the shutdown ordering: Stop must not clean up
+// while the Start loop is still inside a recalculation, or it would remove the
+// allowed IPs before the recalculation adds them and leave them behind.
+func TestStopWaitsForStart(t *testing.T) {
+	w, _ := newRecalcWatcher(t)
+	handler := &blockingHandler{entered: make(chan struct{}), release: make(chan struct{})}
+	w.handler = handler
+
+	require.NoError(t, w.statusRecorder.AddPeer("peer1", "peer1.netbird.cloud", "100.64.0.1", ""))
+	require.NoError(t, w.statusRecorder.UpdatePeerState(peer.State{PubKey: "peer1", ConnStatus: peer.StatusConnected}))
+
+	w.ctx, w.cancel = context.WithCancel(context.Background())
+	w.done = make(chan struct{})
+	w.peerStateUpdate = make(chan struct{})
+	go w.Start()
+
+	// the unbuffered send returns once the loop took the notification, so the
+	// loop is running and about to recalculate
+	w.peerStateUpdate <- struct{}{}
+	select {
+	case <-handler.entered:
+	case <-time.After(2 * time.Second):
+		t.Fatal("the notification should start a recalculation")
+	}
+
+	finished := make(chan struct{})
+	go func() {
+		w.Stop()
+		close(finished)
+	}()
+
+	select {
+	case <-finished:
+		t.Fatal("Stop must wait for the recalculation in flight")
+	case <-time.After(100 * time.Millisecond):
+	}
+
+	close(handler.release)
+	select {
+	case <-finished:
+	case <-time.After(2 * time.Second):
+		t.Fatal("Stop should return once the Start loop has exited")
+	}
+
+	handler.mu.Lock()
+	defer handler.mu.Unlock()
+	assert.Equal(t, []string{"add peer1", "remove"}, handler.calls, "Stop must clean up after the recalculation, not before it")
+}
+
+// A notification carries no peer states: every routing peer has its own
+// subscription and forwarder feeding the same channel, so a snapshot could
+// arrive after a newer one. The watcher acts on the states in the recorder as
+// of when it handles the notification.
+func TestPeerStateNotificationUsesRecordedStates(t *testing.T) {
+	w, handler := newRecalcWatcher(t)
+
+	recorder := w.statusRecorder
+	for _, key := range []string{"peer1", "peer2"} {
+		require.NoError(t, recorder.AddPeer(key, key+".netbird.cloud", "100.64.0.1", ""))
+	}
+	require.NoError(t, recorder.UpdatePeerICEState(peer.State{PubKey: "peer1", ConnStatus: peer.StatusConnected}))
+	require.NoError(t, recorder.UpdatePeerICEState(peer.State{PubKey: "peer2", ConnStatus: peer.StatusConnecting}))
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, w.getRouterPeerStatuses()))
+	require.Equal(t, []string{"peer1"}, handler.added)
+
+	w.ctx, w.cancel = context.WithCancel(context.Background())
+	w.done = make(chan struct{})
+	w.peerStateUpdate = make(chan struct{})
+	go w.Start()
+
+	require.NoError(t, recorder.UpdatePeerICEState(peer.State{PubKey: "peer1", ConnStatus: peer.StatusConnecting}))
+	require.NoError(t, recorder.UpdatePeerICEState(peer.State{PubKey: "peer2", ConnStatus: peer.StatusConnected}))
+	w.peerStateUpdate <- struct{}{}
+	w.Stop()
+
+	assert.Equal(t, []string{"peer1", "peer2"}, handler.added, "the notification must move the route according to the recorded states")
+}
+
+// While the watcher is busy, for instance inside a recalculation, the peer state
+// forwarder must keep draining its subscription. Otherwise the subscription
+// buffer fills up and the peer's next state update blocks its caller, the
+// peer's connection handling, until the watcher is free again.
+func TestPeerStateForwarderDoesNotBlockWhileWatcherIsBusy(t *testing.T) {
+	w, _ := newRecalcWatcher(t)
+	w.peerStateUpdate = newPeerStateUpdate()
+
+	recorder := w.statusRecorder
+	require.NoError(t, recorder.AddPeer("peer1", "peer1.netbird.cloud", "100.64.0.1", ""))
+
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+	closer := make(chan struct{})
+	go w.watchPeerStatusChanges(ctx, "peer1", w.peerStateUpdate, closer)
+
+	// wait for the forwarder's subscription to exist, so the updates below reach it
+	require.Eventually(t, func() bool {
+		require.NoError(t, recorder.UpdatePeerICEState(peer.State{PubKey: "peer1", ConnStatus: peer.StatusConnected}))
+		require.NoError(t, recorder.UpdatePeerICEState(peer.State{PubKey: "peer1", ConnStatus: peer.StatusConnecting}))
+		select {
+		case <-w.peerStateUpdate:
+			return true
+		case <-time.After(50 * time.Millisecond):
+			return false
+		}
+	}, 2*time.Second, 10*time.Millisecond, "the forwarder must pass on a notification")
+
+	// nobody reads peerStateUpdate: the watcher is busy
+	updated := make(chan struct{})
+	go func() {
+		defer close(updated)
+		for i := 0; i < 50; i++ {
+			status := peer.StatusConnected
+			if i%2 == 1 {
+				status = peer.StatusConnecting
+			}
+			if err := recorder.UpdatePeerICEState(peer.State{PubKey: "peer1", ConnStatus: status}); err != nil {
+				t.Errorf("update peer state: %v", err)
+				return
+			}
+		}
+	}()
+
+	select {
+	case <-updated:
+	case <-time.After(2 * time.Second):
+		t.Fatal("peer state updates must not block while the watcher is busy")
+	}
+}
+
+// TestStopWithoutStart covers a watcher whose Start goroutine never ran, or ran
+// only after Stop: Stop must return instead of waiting for a loop that does not
+// exist, and a late Start must not begin working on a stopped watcher.
+func TestStopWithoutStart(t *testing.T) {
+	w := NewWatcher(WatcherConfig{
+		Context:        context.Background(),
+		StatusRecorder: peer.NewRecorder("https://mgm"),
+		Handler:        &recordingHandler{},
+	})
+
+	finished := make(chan struct{})
+	go func() {
+		w.Stop()
+		close(finished)
+	}()
+
+	select {
+	case <-finished:
+	case <-time.After(2 * time.Second):
+		t.Fatal("Stop must return when Start was never called")
+	}
+
+	started := make(chan struct{})
+	go func() {
+		w.Start()
+		close(started)
+	}()
+
+	select {
+	case <-started:
+	case <-time.After(2 * time.Second):
+		t.Fatal("Start after Stop must return immediately")
+	}
+}
+
+// TestUnassignedNetworkReportedOncePerEpisode covers the no-routing-peer log:
+// the periodic re-evaluation hits the same branch every tick, so the episode
+// must be reported once, and again only after a route was assigned in between.
+func TestUnassignedNetworkReportedOncePerEpisode(t *testing.T) {
+	w, _ := newRecalcWatcher(t)
+
+	unassigned := map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnecting},
+	}
+	assigned := map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, latency: 10 * time.Millisecond},
+	}
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, unassigned))
+	assert.True(t, w.reportedUnassigned, "the first unassigned evaluation should be reported")
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, unassigned))
+	assert.True(t, w.reportedUnassigned, "repeats stay within the same episode")
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, assigned))
+	assert.False(t, w.reportedUnassigned, "an assigned route ends the episode")
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, unassigned))
+	assert.True(t, w.reportedUnassigned, "losing the route again starts a new episode")
+}
+
+// TestLatencyJitterDoesNotSwitchRoute walks two equivalent peers through jitter
+// around the same mean. Neither peer is genuinely better, so the route must not
+// move at any point.
+func TestLatencyJitterDoesNotSwitchRoute(t *testing.T) {
+	w := newTestWatcher(t, time.Time{})
+
+	jitter := []int{-6, 3, -4, 8, -2, 5, -7, 1, 6, -3}
+	for i, offsetMs := range jitter {
+		offset := time.Duration(offsetMs) * time.Millisecond
+		statuses := map[route.ID]routerPeerStatus{
+			"route1": {status: peer.StatusConnected, latency: 20*time.Millisecond + offset},
+			"route2": {status: peer.StatusConnected, latency: 20*time.Millisecond - offset},
+		}
+
+		chosen, _ := w.getBestRouteFromStatuses(statuses)
+		require.Equal(t, route.ID("route1"), chosen, "route changed on jitter at sample %d", i)
+	}
+}
diff --git a/client/internal/routemanager/client/env.go b/client/internal/routemanager/client/env.go
new file mode 100644
index 000000000..398667cdf
--- /dev/null
+++ b/client/internal/routemanager/client/env.go
@@ -0,0 +1,77 @@
+package client
+
+import (
+	"os"
+	"strings"
+	"sync"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	// envRelayedSwitchDelay sets how long a routing peer that dropped from a
+	// direct to a relayed connection while carrying the route is kept before the
+	// route moves to an equivalent peer with a direct connection. Takes a
+	// duration ("30s", "0" to switch at once) or "never" to only leave such a
+	// peer when it disconnects. A routing peer that was already relayed when
+	// chosen always gives way to a direct one at once.
+	envRelayedSwitchDelay = "NB_HA_RELAYED_SWITCH_DELAY"
+
+	relayedSwitchDelayNever = "never"
+
+	// defaultRelayedSwitchDelay covers the common case of a direct connection
+	// that drops to relay and recovers within seconds. Moving the route
+	// resets every masqueraded flow using it, staying on the relay does not.
+	defaultRelayedSwitchDelay = 30 * time.Second
+)
+
+// relayedSwitchPolicy is the resolved envRelayedSwitchDelay setting.
+type relayedSwitchPolicy struct {
+	delay time.Duration
+	// never keeps a connected relayed routing peer regardless of delay
+	never bool
+}
+
+func (p relayedSwitchPolicy) String() string {
+	if p.never {
+		return relayedSwitchDelayNever
+	}
+	return p.delay.String()
+}
+
+var (
+	relayedSwitchOnce     sync.Once
+	resolvedRelayedSwitch relayedSwitchPolicy
+)
+
+// relayedSwitch returns the process-wide relayed switch policy, read from the
+// environment on first use.
+func relayedSwitch() relayedSwitchPolicy {
+	relayedSwitchOnce.Do(func() {
+		resolvedRelayedSwitch = parseRelayedSwitchPolicy(os.Getenv(envRelayedSwitchDelay))
+		log.Infof("routing peer relayed switch delay: %s", resolvedRelayedSwitch)
+	})
+	return resolvedRelayedSwitch
+}
+
+func parseRelayedSwitchPolicy(raw string) relayedSwitchPolicy {
+	def := relayedSwitchPolicy{delay: defaultRelayedSwitchDelay}
+
+	val := strings.TrimSpace(raw)
+	if val == "" {
+		return def
+	}
+	if strings.EqualFold(val, relayedSwitchDelayNever) {
+		return relayedSwitchPolicy{never: true}
+	}
+
+	delay, err := time.ParseDuration(val)
+	if err != nil || delay < 0 {
+		log.Warnf("invalid %s value %q, using the default of %s: want a duration or %q",
+			envRelayedSwitchDelay, raw, def, relayedSwitchDelayNever)
+		return def
+	}
+
+	return relayedSwitchPolicy{delay: delay}
+}
diff --git a/client/internal/routemanager/client/relayed_switch_test.go b/client/internal/routemanager/client/relayed_switch_test.go
new file mode 100644
index 000000000..8f4a67bba
--- /dev/null
+++ b/client/internal/routemanager/client/relayed_switch_test.go
@@ -0,0 +1,358 @@
+package client
+
+import (
+	"context"
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/peer"
+	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/route"
+)
+
+func TestParseRelayedSwitchPolicy(t *testing.T) {
+	testCases := []struct {
+		raw  string
+		want relayedSwitchPolicy
+	}{
+		{raw: "", want: relayedSwitchPolicy{delay: defaultRelayedSwitchDelay}},
+		{raw: "  ", want: relayedSwitchPolicy{delay: defaultRelayedSwitchDelay}},
+		{raw: "0", want: relayedSwitchPolicy{}},
+		{raw: "10s", want: relayedSwitchPolicy{delay: 10 * time.Second}},
+		{raw: " 2m ", want: relayedSwitchPolicy{delay: 2 * time.Minute}},
+		{raw: "never", want: relayedSwitchPolicy{never: true}},
+		{raw: "NEVER", want: relayedSwitchPolicy{never: true}},
+		// unrecognised values keep the default rather than guessing
+		{raw: "-5s", want: relayedSwitchPolicy{delay: defaultRelayedSwitchDelay}},
+		{raw: "soon", want: relayedSwitchPolicy{delay: defaultRelayedSwitchDelay}},
+		{raw: "30", want: relayedSwitchPolicy{delay: defaultRelayedSwitchDelay}},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.raw, func(t *testing.T) {
+			assert.Equal(t, tc.want, parseRelayedSwitchPolicy(tc.raw), "policy parsed from %q", tc.raw)
+		})
+	}
+}
+
+// newRelayedTestWatcher is a watcher over two equal-metric routes, currently on
+// route1, for the given policy.
+func newRelayedTestWatcher(t *testing.T, policy relayedSwitchPolicy) *Watcher {
+	t.Helper()
+
+	w := newTestWatcher(t, time.Time{})
+	w.relayedSwitch = policy
+	t.Cleanup(func() {
+		if w.relayedHold != nil {
+			w.relayedHold.Stop()
+		}
+	})
+	return w
+}
+
+// degrade walks the current routing peer route1 from direct to relayed, the way
+// it is seen when a direct connection carrying the route drops to relay.
+func degrade(t *testing.T, w *Watcher) {
+	t.Helper()
+
+	chosen, _ := w.getBestRouteFromStatuses(currentDirect)
+	require.Equal(t, route.ID("route1"), chosen, "route1 must carry the route while direct")
+
+	chosen, _ = w.getBestRouteFromStatuses(currentRelayed)
+	require.Equal(t, route.ID("route1"), chosen, "a routing peer that just dropped to relay must be kept")
+	require.False(t, w.degradedSince.IsZero(), "the drop to relay must be recorded")
+}
+
+var (
+	// route1 is relayed, route2 is an equivalent peer with a direct connection
+	currentRelayed = map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, relayed: true, latency: 50 * time.Millisecond},
+		"route2": {status: peer.StatusConnected, latency: 60 * time.Millisecond},
+	}
+	currentDirect = map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, latency: 50 * time.Millisecond},
+		"route2": {status: peer.StatusConnected, latency: 60 * time.Millisecond},
+	}
+)
+
+func TestDegradedRoutingPeerIsKeptDuringDelay(t *testing.T) {
+	w := newRelayedTestWatcher(t, relayedSwitchPolicy{delay: 30 * time.Second})
+
+	degrade(t, w)
+	require.NotNil(t, w.relayedHold, "the pending switch must arm a timer so it is applied when due")
+
+	// the direct connection comes back within the delay: nothing moved, and the
+	// degraded period ends
+	chosen, _ := w.getBestRouteFromStatuses(currentDirect)
+	assert.Equal(t, route.ID("route1"), chosen, "the recovered routing peer must stay chosen")
+	assert.True(t, w.degradedSince.IsZero(), "the degraded period must end once the peer is direct again")
+}
+
+func TestDegradedRoutingPeerIsReplacedAfterDelay(t *testing.T) {
+	w := newRelayedTestWatcher(t, relayedSwitchPolicy{delay: 30 * time.Second})
+
+	degrade(t, w)
+	w.degradedSince = w.degradedSince.Add(-31 * time.Second)
+
+	chosen, _ := w.getBestRouteFromStatuses(currentRelayed)
+	assert.Equal(t, route.ID("route2"), chosen, "a routing peer relayed for longer than the delay must give way to a direct one")
+	assert.Equal(t, switchReasonDirect, w.switchReason, "the switch reason must name the relayed connection")
+}
+
+// A routing peer that was relayed when it was chosen is not degraded: when an
+// equivalent direct peer shows up the route must upgrade at once instead of
+// staying on the slower path for the delay.
+func TestRelayedRoutingPeerUpgradesAtOnce(t *testing.T) {
+	w := newRelayedTestWatcher(t, relayedSwitchPolicy{never: true})
+
+	// route1 was chosen while relayed and route2 was still connecting
+	chosen, _ := w.getBestRouteFromStatuses(map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, relayed: true},
+		"route2": {status: peer.StatusConnecting},
+	})
+	require.Equal(t, route.ID("route1"), chosen)
+	require.True(t, w.degradedSince.IsZero(), "a peer relayed from the start is not degraded")
+
+	chosen, _ = w.getBestRouteFromStatuses(currentRelayed)
+	assert.Equal(t, route.ID("route2"), chosen, "a direct peer must take over from one that was relayed all along")
+	assert.Equal(t, switchReasonDirect, w.switchReason)
+	assert.Nil(t, w.relayedHold, "an upgrade must not schedule anything")
+}
+
+// An idle routing peer woken by traffic whose relay connection comes up before
+// the direct one was never direct: it is not degraded, and must give way to an
+// equivalent direct peer at once.
+func TestIdleRoutingPeerWokenOverRelayUpgradesAtOnce(t *testing.T) {
+	w := newRelayedTestWatcher(t, relayedSwitchPolicy{never: true})
+
+	chosen, _ := w.getBestRouteFromStatuses(map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusIdle},
+		"route2": {status: peer.StatusIdle},
+	})
+	require.Equal(t, route.ID("route1"), chosen)
+
+	chosen, _ = w.getBestRouteFromStatuses(map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, relayed: true},
+		"route2": {status: peer.StatusConnecting},
+	})
+	require.Equal(t, route.ID("route1"), chosen)
+	require.True(t, w.degradedSince.IsZero(), "waking up over relay is not a drop from direct")
+
+	chosen, _ = w.getBestRouteFromStatuses(currentRelayed)
+	assert.Equal(t, route.ID("route2"), chosen, "a direct peer must take over from one that was never direct")
+	assert.Nil(t, w.relayedHold, "an upgrade must not schedule anything")
+}
+
+// A routing peer that drops to relay again, after recovering from an earlier
+// drop, is a new degradation and must be reported at info level again.
+func TestRepeatedDegradationIsReportedAgain(t *testing.T) {
+	w := newRelayedTestWatcher(t, relayedSwitchPolicy{delay: 30 * time.Second})
+
+	degrade(t, w)
+	require.Equal(t, route.ID("route2"), w.heldCandidate, "the first drop must be reported")
+
+	// the first report is well within the report interval
+	w.heldReported = w.heldReported.Add(-time.Minute)
+	firstReport := w.heldReported
+
+	degrade(t, w)
+	assert.True(t, w.heldReported.After(firstReport), "a new drop to relay must be reported, not treated as a repeat")
+}
+
+func TestDegradedRoutingPeerNeverPolicy(t *testing.T) {
+	w := newRelayedTestWatcher(t, relayedSwitchPolicy{never: true})
+
+	degrade(t, w)
+	w.degradedSince = w.degradedSince.Add(-time.Hour)
+
+	chosen, _ := w.getBestRouteFromStatuses(currentRelayed)
+	assert.Equal(t, route.ID("route1"), chosen, "with never, a degraded routing peer is kept while connected")
+	assert.Nil(t, w.relayedHold, "with never there is nothing to schedule")
+}
+
+func TestDegradedRoutingPeerZeroDelaySwitchesAtOnce(t *testing.T) {
+	w := newRelayedTestWatcher(t, relayedSwitchPolicy{})
+
+	chosen, _ := w.getBestRouteFromStatuses(currentDirect)
+	require.Equal(t, route.ID("route1"), chosen)
+
+	chosen, _ = w.getBestRouteFromStatuses(currentRelayed)
+	assert.Equal(t, route.ID("route2"), chosen, "a zero delay must keep the immediate switch to a direct peer")
+}
+
+// The delay only covers a candidate that is better solely by being direct. A
+// better metric or a lost routing peer must move the route at once.
+func TestRelayedDelayDoesNotHoldOtherSwitches(t *testing.T) {
+	t.Run("better metric", func(t *testing.T) {
+		w := newRelayedTestWatcher(t, relayedSwitchPolicy{never: true})
+		degrade(t, w)
+		w.routes["route2"].Metric = route.MaxMetric - 1
+
+		chosen, _ := w.getBestRouteFromStatuses(currentRelayed)
+		assert.Equal(t, route.ID("route2"), chosen, "a better metric must win over a degraded peer immediately")
+		assert.Equal(t, switchReasonMetric, w.switchReason)
+	})
+
+	t.Run("current peer disconnected", func(t *testing.T) {
+		w := newRelayedTestWatcher(t, relayedSwitchPolicy{never: true})
+		degrade(t, w)
+
+		chosen, _ := w.getBestRouteFromStatuses(map[route.ID]routerPeerStatus{
+			"route1": {status: peer.StatusConnecting, relayed: true},
+			"route2": {status: peer.StatusConnected, latency: 60 * time.Millisecond},
+		})
+		assert.Equal(t, route.ID("route2"), chosen, "a routing peer that is gone must be replaced regardless of the delay")
+		assert.Equal(t, switchReasonUnavailable, w.switchReason)
+	})
+
+	t.Run("both relayed", func(t *testing.T) {
+		w := newRelayedTestWatcher(t, relayedSwitchPolicy{delay: 30 * time.Second})
+
+		chosen, _ := w.getBestRouteFromStatuses(map[route.ID]routerPeerStatus{
+			"route1": {status: peer.StatusConnected, relayed: true},
+			"route2": {status: peer.StatusConnected, relayed: true},
+		})
+		assert.Equal(t, route.ID("route1"), chosen, "equally relayed peers are a tie and the current one stays")
+		assert.Nil(t, w.relayedHold, "a tie must not schedule a switch")
+	})
+}
+
+// TestRelayedHoldTimerAppliesSwitch drives the Start loop: once the delay has
+// passed, the held switch must be applied without waiting for a peer update or
+// the periodic re-evaluation.
+func TestRelayedHoldTimerAppliesSwitch(t *testing.T) {
+	w, handler := newRecalcWatcher(t)
+	w.relayedSwitch = relayedSwitchPolicy{delay: 50 * time.Millisecond}
+
+	recorder := w.statusRecorder
+	for _, key := range []string{"peer1", "peer2"} {
+		require.NoError(t, recorder.AddPeer(key, key+".netbird.cloud", "100.64.0.1", ""))
+	}
+	require.NoError(t, recorder.UpdatePeerState(peer.State{PubKey: "peer1", ConnStatus: peer.StatusConnected, Relayed: true}))
+	require.NoError(t, recorder.UpdatePeerState(peer.State{PubKey: "peer2", ConnStatus: peer.StatusConnected}))
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected},
+	}))
+	require.Equal(t, []string{"peer1"}, handler.added)
+
+	// route1 drops to relay while route2 is direct: held for the delay
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, relayed: true},
+		"route2": {status: peer.StatusConnected},
+	}))
+	require.Equal(t, []string{"peer1"}, handler.added, "the switch must be held while the delay runs")
+
+	w.ctx, w.cancel = context.WithCancel(context.Background())
+	w.done = make(chan struct{})
+	go w.Start()
+	t.Cleanup(w.Stop)
+
+	// the loop owns the watcher state now, so observe the switch through the
+	// event it publishes rather than reading its fields
+	require.Eventually(t, func() bool {
+		for _, e := range recorder.GetEventHistory() {
+			if e.Message == "Routing peer changed" && e.Metadata["peer"] == "peer2" {
+				return true
+			}
+		}
+		return false
+	}, 2*time.Second, 10*time.Millisecond, "the held switch must be applied once the delay passed")
+}
+
+// A route update can keep a route's ID and hand it to a different routing peer.
+// That is a switch like any other: it is reported, and the new peer is tracked
+// from its own state rather than inheriting the previous peer's.
+func TestRouteReassignedToDifferentPeerIsASwitch(t *testing.T) {
+	w, handler := newRecalcWatcher(t)
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected},
+	}))
+	require.Equal(t, []string{"peer1"}, handler.added)
+
+	reassigned := *w.routes["route1"]
+	reassigned.Peer = "peer3"
+	w.routes["route1"] = &reassigned
+
+	require.NoError(t, w.recalculateRoutes(reasonRouteUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, relayed: true},
+	}))
+	assert.Equal(t, []string{"peer1", "peer3"}, handler.added, "the allowed IPs must move to the new routing peer")
+	assert.Equal(t, "peer3", w.trackedPeer, "the new routing peer must be tracked")
+	assert.False(t, w.trackedDirect, "the new routing peer is tracked from its own state")
+
+	events := w.statusRecorder.GetEventHistory()
+	require.Len(t, events, 1, "the reassignment must publish a switch event")
+	assert.Equal(t, "Routing peer changed", events[0].Message)
+	assert.Equal(t, "peer1", events[0].Metadata["previous_peer"])
+	assert.Equal(t, "peer3", events[0].Metadata["peer"])
+	assert.Equal(t, string(switchReasonRouteChanged), events[0].Metadata["reason"])
+}
+
+// Exit nodes report their own connect and disconnect events, but those carry
+// no reason: the switch event is published for default routes too.
+func TestDefaultRouteSwitchPublishesEvent(t *testing.T) {
+	w, _ := newRecalcWatcher(t)
+	for _, r := range w.routes {
+		r.Network = netip.MustParsePrefix("0.0.0.0/0")
+	}
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected},
+	}))
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnecting},
+		"route2": {status: peer.StatusConnected},
+	}))
+
+	var switchEvents []*proto.SystemEvent
+	for _, e := range w.statusRecorder.GetEventHistory() {
+		if e.Message == "Routing peer changed" {
+			switchEvents = append(switchEvents, e)
+		}
+	}
+	require.Len(t, switchEvents, 1, "an exit node switch must publish a switch event")
+	assert.Equal(t, string(switchReasonUnavailable), switchEvents[0].Metadata["reason"])
+	assert.Empty(t, switchEvents[0].UserMessage, "the switch event must not notify the user a second time")
+}
+
+func TestRoutingPeerSwitchPublishesEvent(t *testing.T) {
+	w, _ := newRecalcWatcher(t)
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, latency: 20 * time.Millisecond},
+	}))
+	assert.Empty(t, w.statusRecorder.GetEventHistory(), "the initial assignment is not a switch")
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnecting},
+		"route2": {status: peer.StatusConnected, latency: 20 * time.Millisecond},
+	}))
+
+	events := w.statusRecorder.GetEventHistory()
+	require.Len(t, events, 1, "a switch must publish exactly one event")
+	assert.Equal(t, proto.SystemEvent_WARNING, events[0].Severity)
+	assert.Equal(t, "Routing peer changed", events[0].Message)
+	assert.Equal(t, map[string]string{
+		"network":       "recording",
+		"id":            "",
+		"previous_peer": "peer1",
+		"peer":          "peer2",
+		"reason":        string(switchReasonUnavailable),
+	}, events[0].Metadata, "the event must name both peers and the reason")
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnecting},
+		"route2": {status: peer.StatusConnecting},
+	}))
+
+	events = w.statusRecorder.GetEventHistory()
+	require.Len(t, events, 2, "losing the last routing peer must publish an event")
+	assert.Equal(t, "No routing peer available", events[1].Message)
+	assert.Equal(t, "peer2", events[1].Metadata["previous_peer"])
+}

From dfa7bd78923c64ad5ca28a59a91546aadf911ed5 Mon Sep 17 00:00:00 2001
From: Daniele Casciani <d.casciani@genogra.com>
Date: Tue, 13 Oct 2026 18:03:47 +0200
Subject: [PATCH 59/70] [client] Migrate macOS cask template to Homebrew
 install steps (#7477)

Homebrew deprecated the postflight and uninstall_preflight cask stanzas
in favour of the declarative *_steps DSL, so every brew command that
evaluates netbirdio/tap now prints deprecation warnings. Once the
deprecation becomes a disable the generated cask stops loading and
netbird-ui can no longer be installed or upgraded through Homebrew.

The *_steps blocks take JSON-serialisable steps run in a sandbox rather
than arbitrary Ruby, so system_command is re-expressed as run/remove.
The two postflight blocks merge into one because a cask carries only a
single instance, preserving the original order. set_permissions moves
from a hardcoded /Applications to base: :appdir, matching what the
installer invocation already did. The launchctl fallbacks keep their
tolerant semantics through must_succeed: false, and remove is a no-op
when the plist is absent.

From 9efe59b9b2b2d4678e55ec1161be37479eb39314 Mon Sep 17 00:00:00 2001
From: Brandon Hopkins <76761586+TechHutTV@users.noreply.github.com>
Date: Tue, 13 Oct 2026 09:46:27 -0700
Subject: [PATCH 60/70] [infrastructure] Fix Traefik Versioning and Update
 Crowdsec (#8152)

---
 .../workflows/test-infrastructure-files.yml   | 12 +++
 .../getting-started-enterprise.sh             | 82 ++++++++++++++--
 infrastructure_files/getting-started.sh       | 34 ++++++-
 infrastructure_files/migrate.sh               | 10 +-
 .../tests/test-getting-started-enterprise.sh  | 96 +++++++++++++++++++
 .../tests/test-getting-started-networks.sh    | 54 +++++++++++
 .../tests/test-getting-started.sh             | 82 ++++++++++++++++
 7 files changed, 357 insertions(+), 13 deletions(-)
 create mode 100644 infrastructure_files/tests/test-getting-started-enterprise.sh
 create mode 100644 infrastructure_files/tests/test-getting-started-networks.sh
 create mode 100644 infrastructure_files/tests/test-getting-started.sh

diff --git a/.github/workflows/test-infrastructure-files.yml b/.github/workflows/test-infrastructure-files.yml
index 1313379ee..4875adc31 100644
--- a/.github/workflows/test-infrastructure-files.yml
+++ b/.github/workflows/test-infrastructure-files.yml
@@ -258,6 +258,18 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Verify enterprise Traefik tag validation
+        run: bash infrastructure_files/tests/test-getting-started-enterprise.sh
+
+      - name: Verify community Traefik image validation
+        run: bash infrastructure_files/tests/test-getting-started.sh
+
+      - name: Verify community Compose network scoping
+        run: bash infrastructure_files/tests/test-getting-started-networks.sh
+
+      - name: Verify migration Compose network scoping
+        run: bash infrastructure_files/tests/test-getting-started-networks.sh --migration
+
       - name: Verify fresh-install session cookie key hardening
         run: |
           grep -Fxq '  SESSION_COOKIE_ENCRYPTION_KEY=$(openssl rand -base64 32)' infrastructure_files/getting-started.sh
diff --git a/infrastructure_files/getting-started-enterprise.sh b/infrastructure_files/getting-started-enterprise.sh
index 344bd2fed..b6565bff1 100755
--- a/infrastructure_files/getting-started-enterprise.sh
+++ b/infrastructure_files/getting-started-enterprise.sh
@@ -1,8 +1,5 @@
 #!/bin/bash
 
-set -e
-set -o pipefail
-
 # NetBird Enterprise — Getting Started
 # Single-node bootstrap for a self-hosted NetBird Enterprise stack with the
 # embedded identity provider. Owner is created via first-login flow.
@@ -23,6 +20,9 @@ PROXY_TOKEN_ID=""
 # server trusts X-Forwarded-* headers from this address only.
 TRAEFIK_IP="172.30.0.10"
 
+TRAEFIK_HEADER_CONFIG='      - "--entrypoints.web.http.aliasHeadersStrategy=delete"
+      - "--entrypoints.websecure.http.aliasHeadersStrategy=delete"'
+
 LICENSE_VERDICT="unknown"
 LICENSE_LOG_LINES=""
 
@@ -50,6 +50,25 @@ check_openssl() {
     echo "openssl is not installed or not in PATH." > /dev/stderr
     exit 1
   fi
+  return
+}
+
+# Only parseable versions can guarantee that aliasHeadersStrategy and its
+# CVE-2026-88004 fix (v3.7.13) are available in the fresh-install compose.
+check_traefik_tag() {
+  local tag="${NETBIRD_TRAEFIK_TAG:-}" ver major minor patch
+  [[ -n "$tag" ]] || return 0
+  ver="${tag#v}"
+  if [[ ! "$ver" =~ ^([0-9]+)\.([0-9]+)(\.([0-9]+))?$ ]]; then
+    die "Cannot verify NETBIRD_TRAEFIK_TAG=$tag. Use a numeric version tag such as v3.7.13 or newer, or unset NETBIRD_TRAEFIK_TAG for the default (v3.7.14)."
+  fi
+  major=$((10#${BASH_REMATCH[1]}))
+  minor=$((10#${BASH_REMATCH[2]}))
+  patch=$((10#${BASH_REMATCH[4]:-0}))
+  if (( major < 3 || (major == 3 && minor < 7) || (major == 3 && minor == 7 && patch < 13) )); then
+    die "NETBIRD_TRAEFIK_TAG=$tag predates aliasHeadersStrategy and its CVE-2026-88004 fix (added in v3.7.12, fixed in v3.7.13), which this installer always enables. Use v3.7.13 or newer, or unset NETBIRD_TRAEFIK_TAG for the default (v3.7.14)."
+  fi
+  return
 }
 
 die() {
@@ -62,6 +81,7 @@ env_get() {
   local value
   value=$(sed -n "s/^$1=//p" .env | tail -n 1)
   echo "${value:-$2}"
+  return
 }
 
 # merge_env upserts the KEY=VALUE lines from stdin into .env, in place.
@@ -72,14 +92,17 @@ merge_env() {
     { print }
     END { for (i = 1; i <= n; i++) if (o[i] in v) print v[o[i]] }' - .env)
   printf '%s\n' "$merged" > .env
+  return
 }
 
 rand_secret() {
   openssl rand -base64 32 | sed "$SED_STRIP_PADDING"
+  return
 }
 
 rand_b64_key() {
   openssl rand -base64 32
+  return
 }
 
 check_nb_domain() {
@@ -133,6 +156,7 @@ read_nb_domain() {
     fi
   fi
   echo "$value"
+  return
 }
 
 read_letsencrypt_email() {
@@ -150,6 +174,7 @@ read_letsencrypt_email() {
     return
   fi
   echo "$value"
+  return
 }
 
 read_required() {
@@ -163,6 +188,7 @@ read_required() {
     fi
   done
   echo "$value"
+  return
 }
 
 read_secret() {
@@ -177,6 +203,7 @@ read_secret() {
     fi
   done
   echo "$value"
+  return
 }
 
 # read_yes_no "<prompt>" [<default y|n>]
@@ -199,6 +226,7 @@ read_yes_no() {
     [Yy] | [Yy][Ee][Ss]) echo "yes" ;;
     *) echo "no" ;;
   esac
+  return
 }
 
 read_crowdsec_option() {
@@ -208,6 +236,7 @@ read_crowdsec_option() {
   echo "  blocks known malicious sources before they reach services exposed through"
   echo "  the proxy. Adds a CrowdSec container to the stack."
   NETBIRD_CROWDSEC=$(read_yes_no "Enable CrowdSec" "n")
+  return
 }
 
 # Gate the install on explicit acceptance of the NetBird On-Premise EULA.
@@ -245,6 +274,7 @@ EOF
     exit 1
   fi
   echo "" > /dev/stderr
+  return
 }
 
 wait_postgres() {
@@ -267,6 +297,7 @@ wait_postgres() {
   done
   echo " done"
   set -e
+  return
 }
 
 wait_for_license_verdict() {
@@ -359,6 +390,7 @@ up_all_but_proxy() {
   services=$($DOCKER_COMPOSE_COMMAND config --services | grep -vx proxy)
   # shellcheck disable=SC2086
   $DOCKER_COMPOSE_COMMAND up -d $services
+  return
 }
 
 wait_crowdsec() {
@@ -372,6 +404,7 @@ wait_crowdsec() {
 
 admin_token() {
   $DOCKER_COMPOSE_COMMAND run --rm --no-deps -T netbird-server admin token "$@" --config /etc/netbird/config.yaml
+  return
 }
 
 # revoke_proxy_token revokes the token this run minted if the proxy never started.
@@ -384,6 +417,7 @@ revoke_proxy_token() {
   fi
   echo "Could not revoke the unused proxy token ${PROXY_TOKEN_ID}. Revoke it with:" > /dev/stderr
   echo "  $DOCKER_COMPOSE_COMMAND run --rm netbird-server admin token revoke ${PROXY_TOKEN_ID} --config /etc/netbird/config.yaml" > /dev/stderr
+  return
 }
 
 # start_proxy mints the proxy token and CrowdSec bouncer key, then starts the proxy.
@@ -419,6 +453,7 @@ start_proxy() {
     die "Could not start the proxy. Check the proxy logs, then re-run with --enable-proxy."
   fi
   PROXY_TOKEN_ID=""
+  return
 }
 
 print_proxy_notes() {
@@ -433,10 +468,12 @@ print_proxy_notes() {
   if [[ "$NETBIRD_CROWDSEC" == "yes" ]]; then
     echo "  CrowdSec is running. Enable it per service in the dashboard under Access Control."
   fi
+  return
 }
 
 init_environment() {
   check_openssl
+  check_traefik_tag
   DOCKER_COMPOSE_COMMAND=$(check_docker_compose)
 
   if [[ -f .env ]] || [[ -f docker-compose.yml ]] || [[ -f config.yaml ]]; then
@@ -555,12 +592,14 @@ init_environment() {
   if [[ "$LICENSE_VERDICT" == "rejected" ]]; then
     exit 1
   fi
+  return
 }
 
 # service_block NAME prints a service's definition from the compose file on stdin.
 service_block() {
   local name="$1"
   awk -v s="  ${name}:" '$0 == s { p = 1; print; next } p && (/^[^ ]/ || /^  [^ ]/) { exit } p'
+  return
 }
 
 # enable_features adds the proxy and/or traffic events to the install in the
@@ -585,6 +624,9 @@ enable_features() {
   # so the re-render never removes a working Let's Encrypt setup.
   local traefik_block
   traefik_block=$(service_block traefik < docker-compose.yml)
+  # Enabling features does not upgrade Traefik. Preserve the existing header policy,
+  # including its absence on older releases that do not support these options.
+  TRAEFIK_HEADER_CONFIG=$(printf '%s\n' "$traefik_block" | grep -Ei -- '--entrypoints\.[^.]+\.http\.(alias|underscore)headersstrategy=' || true)
   if ! grep -q certificatesresolvers <<< "$traefik_block"; then
     CUSTOM_TLS_CERTS=$(awk '/:\/certs:ro$/ { sub(/^ *- /, ""); sub(/:\/certs:ro$/, ""); print; exit }' <<< "$traefik_block")
   fi
@@ -684,6 +726,7 @@ enable_features() {
   if [[ "$want_proxy" == "yes" ]]; then
     print_proxy_notes
   fi
+  return
 }
 
 rollback() {
@@ -697,6 +740,7 @@ rollback() {
   done
   $DOCKER_COMPOSE_COMMAND up -d --remove-orphans
   $DOCKER_COMPOSE_COMMAND restart netbird-server
+  return
 }
 
 # ------------------------------------------------------------------
@@ -723,7 +767,7 @@ NETBIRD_DOMAIN=${NETBIRD_DOMAIN}
 
 # Reverse proxy (Traefik)
 NETBIRD_LETSENCRYPT_EMAIL=${NETBIRD_LETSENCRYPT_EMAIL}
-NETBIRD_TRAEFIK_TAG=${NETBIRD_TRAEFIK_TAG:-v3.6}
+NETBIRD_TRAEFIK_TAG=${NETBIRD_TRAEFIK_TAG:-v3.7.14}
 NETBIRD_TRAEFIK_IP=${TRAEFIK_IP}
 
 # Image tags. Default to "latest"
@@ -770,20 +814,23 @@ NETBIRD_ENCRYPTION_KEY=${NETBIRD_ENCRYPTION_KEY}
 # Dashboard OIDC scopes
 NETBIRD_AUTH_SUPPORTED_SCOPES=${NETBIRD_AUTH_SUPPORTED_SCOPES:-openid profile email groups}
 EOF
+  return
 }
 
 render_env_flow() {
   echo "NETBIRD_ENRICHER_TAG=${NETBIRD_ENRICHER_TAG:-latest}"
   echo "NETBIRD_RECEIVER_TAG=${NETBIRD_RECEIVER_TAG:-latest}"
+  return
 }
 
 render_env_proxy() {
   echo "NETBIRD_PROXY_TAG=${NETBIRD_PROXY_TAG:-latest}"
   echo "NETBIRD_PROXY_TOKEN="
   if [[ "$NETBIRD_CROWDSEC" == "yes" ]]; then
-    echo "NETBIRD_CROWDSEC_TAG=${NETBIRD_CROWDSEC_TAG:-v1.7.7}"
+    echo "NETBIRD_CROWDSEC_TAG=${NETBIRD_CROWDSEC_TAG:-v1.8.1}"
     echo "NETBIRD_CROWDSEC_BOUNCER_KEY="
   fi
+  return
 }
 
 render_docker_compose() {
@@ -801,6 +848,7 @@ render_docker_compose() {
     render_compose_footer
   } | if [[ -n "${NETBIRD_LICENSE_SERVER_BASE_URL:-}" ]]; then cat; else sed '/NETBIRD_LICENSE_SERVER_BASE_URL/d'; fi \
     | if [[ -n "$CUSTOM_TLS_CERTS" ]]; then sed -e '/certificatesresolvers/d' -e '/certresolver/d'; else cat; fi
+  return
 }
 
 render_compose_header() {
@@ -815,6 +863,7 @@ x-default: &default
 
 services:
 EOF
+  return
 }
 
 render_compose_common() {
@@ -840,6 +889,12 @@ render_compose_common() {
       - "--entrypoints.web.address=:80"
       - "--entrypoints.websecure.address=:443"
       - "--entrypoints.websecure.allowACMEByPass=true"
+EOF
+  # Installs that predate these options have no header config; don't leave a blank line.
+  if [[ -n "$TRAEFIK_HEADER_CONFIG" ]]; then
+    printf '%s\n' "$TRAEFIK_HEADER_CONFIG"
+  fi
+  cat <<'EOF'
       # readTimeout bounds the whole request, and gRPC streams / relay WebSockets
       # never end one; idleTimeout would close the keep-alive connection they
       # are reused over. Entrypoint-wide is the only scope Traefik offers here.
@@ -916,6 +971,7 @@ EOF
       - LETSENCRYPT_EMAIL=
 
 EOF
+  return
 }
 
 render_compose_server() {
@@ -963,6 +1019,7 @@ render_compose_server() {
       - NETBIRD_LICENSE_SERVER_BASE_URL=${NETBIRD_LICENSE_SERVER_BASE_URL}
 
 EOF
+  return
 }
 
 render_compose_flow() {
@@ -1034,6 +1091,7 @@ render_compose_flow() {
       - traefik.http.services.netbird-flow-h2c.loadbalancer.server.scheme=h2c
 
 EOF
+  return
 }
 
 render_compose_proxy() {
@@ -1097,6 +1155,7 @@ EOF
 EOF
   fi
   echo ""
+  return
 }
 
 render_compose_postgres() {
@@ -1119,6 +1178,7 @@ render_compose_postgres() {
       - netbird_postgres:/var/lib/postgresql/data
 
 EOF
+  return
 }
 
 render_compose_footer() {
@@ -1151,6 +1211,7 @@ networks:
         - subnet: 172.30.0.0/24
           gateway: 172.30.0.1
 EOF
+  return
 }
 
 render_config_yaml() {
@@ -1215,6 +1276,7 @@ EOF
   if [[ "$NETBIRD_TRAFFIC_FLOW" == "yes" ]]; then
     render_config_flow
   fi
+  return
 }
 
 render_config_flow() {
@@ -1225,6 +1287,7 @@ render_config_flow() {
     address: "https://${NETBIRD_DOMAIN}:443"
     interval: "60s"
 EOF
+  return
 }
 
 render_traefik_proxy() {
@@ -1235,6 +1298,7 @@ tcp:
       proxyProtocol:
         version: 2
 EOF
+  return
 }
 
 usage() {
@@ -1249,6 +1313,7 @@ the current directory.
   --enable-traffic-events  add traffic events logging (NATS, receiver, enricher)
   -h, --help               show this help
 EOF
+  return
 }
 
 main() {
@@ -1268,6 +1333,11 @@ main() {
   else
     enable_features "$enable_proxy" "$enable_flow"
   fi
+  return
 }
 
-main "$@"
+if [[ "${BASH_SOURCE[0]:-$0}" == "$0" ]]; then
+  set -e
+  set -o pipefail
+  main "$@"
+fi
diff --git a/infrastructure_files/getting-started.sh b/infrastructure_files/getting-started.sh
index d5c6d9dc9..902956199 100755
--- a/infrastructure_files/getting-started.sh
+++ b/infrastructure_files/getting-started.sh
@@ -87,6 +87,27 @@ check_jq() {
   return 0
 }
 
+check_traefik_image() {
+  local image="${TRAEFIK_IMAGE##*/}" major minor patch
+
+  # A version tag cannot establish which release a digest points to.
+  if [[ "$TRAEFIK_IMAGE" == *@* ||
+    ! "$image" =~ ^[^:@]+:v?([0-9]+)(\.([0-9]+)(\.([0-9]+))?)?$ ]]; then
+    echo "Cannot verify TRAEFIK_IMAGE=$TRAEFIK_IMAGE." >&2
+    echo "Use a numeric Traefik version tag (v3.7.13 or newer) without a digest." >&2
+    return 1
+  fi
+  major=$((10#${BASH_REMATCH[1]}))
+  minor=$((10#${BASH_REMATCH[3]:-0}))
+  patch=$((10#${BASH_REMATCH[5]:-0}))
+  if (( major < 3 || (major == 3 && minor < 7) || (major == 3 && minor == 7 && patch < 13) )); then
+    echo "TRAEFIK_IMAGE=$TRAEFIK_IMAGE is incompatible with this configuration." >&2
+    echo "Use Traefik v3.7.13 or newer for aliasHeadersStrategy and its header-sanitization fix." >&2
+    return 1
+  fi
+  return 0
+}
+
 get_main_ip_address() {
   if [[ "$OSTYPE" == "darwin"* ]]; then
     interface=$(route -n get default | grep 'interface:' | awk '{print $2}')
@@ -448,8 +469,8 @@ initialize_default_values() {
   # Combined server replaces separate signal, relay, and management containers
   NETBIRD_SERVER_IMAGE=${NETBIRD_SERVER_IMAGE:-"netbirdio/netbird-server:latest"}
   NETBIRD_PROXY_IMAGE=${NETBIRD_PROXY_IMAGE:-"netbirdio/reverse-proxy:latest"}
-  TRAEFIK_IMAGE=${TRAEFIK_IMAGE:-"traefik:v3.6"}
-  CROWDSEC_IMAGE=${CROWDSEC_IMAGE:-"crowdsecurity/crowdsec:v1.7.7"}
+  TRAEFIK_IMAGE=${TRAEFIK_IMAGE:-"traefik:v3.7.14"}
+  CROWDSEC_IMAGE=${CROWDSEC_IMAGE:-"crowdsecurity/crowdsec:v1.8.1"}
   # Reverse proxy configuration
   REVERSE_PROXY_TYPE="0"
   TRAEFIK_EXTERNAL_NETWORK=""
@@ -613,6 +634,7 @@ generate_configuration_files() {
   # Render docker-compose and proxy config based on selection
   case "$REVERSE_PROXY_TYPE" in
     0)
+      check_traefik_image || return 1
       render_docker_compose_traefik_builtin > docker-compose.yml
       if [[ "$ENABLE_PROXY" == "true" ]]; then
         # Create placeholder proxy.env so docker-compose can validate
@@ -912,11 +934,13 @@ services:
       # Docker provider
       - "--providers.docker=true"
       - "--providers.docker.exposedbydefault=false"
-      - "--providers.docker.network=netbird"
+      - "--providers.docker.network=\${COMPOSE_PROJECT_NAME:-}_netbird"
       # Entrypoints
       - "--entrypoints.web.address=:80"
       - "--entrypoints.websecure.address=:443"
       - "--entrypoints.websecure.allowACMEByPass=true"
+      - "--entrypoints.web.http.aliasHeadersStrategy=delete"
+      - "--entrypoints.websecure.http.aliasHeadersStrategy=delete"
       # Disable timeouts for long-lived gRPC streams
       - "--entrypoints.websecure.transport.respondingTimeouts.readTimeout=0"
       - "--entrypoints.websecure.transport.respondingTimeouts.writeTimeout=0"
@@ -1779,4 +1803,6 @@ print_post_setup_instructions() {
   return 0
 }
 
-init_environment
+if [[ "${BASH_SOURCE[0]:-$0}" == "$0" ]]; then
+  init_environment
+fi
diff --git a/infrastructure_files/migrate.sh b/infrastructure_files/migrate.sh
index 67895fab6..46971a57a 100755
--- a/infrastructure_files/migrate.sh
+++ b/infrastructure_files/migrate.sh
@@ -838,7 +838,7 @@ generate_docker_compose_traefik() {
 services:
   # Traefik reverse proxy (automatic TLS via Let's Encrypt)
   traefik:
-    image: traefik:v3.6
+    image: traefik:v3.7.14
     container_name: netbird-traefik
     restart: unless-stopped
     networks:
@@ -851,11 +851,13 @@ services:
       # Docker provider
       - "--providers.docker=true"
       - "--providers.docker.exposedbydefault=false"
-      - "--providers.docker.network=netbird"
+      - "--providers.docker.network=\${COMPOSE_PROJECT_NAME:-}_netbird"
       # Entrypoints
       - "--entrypoints.web.address=:80"
       - "--entrypoints.websecure.address=:443"
       - "--entrypoints.websecure.allowACMEByPass=true"
+      - "--entrypoints.web.http.aliasHeadersStrategy=delete"
+      - "--entrypoints.websecure.http.aliasHeadersStrategy=delete"
       # Disable timeouts for long-lived gRPC streams
       - "--entrypoints.websecure.transport.respondingTimeouts.readTimeout=0"
       - "--entrypoints.websecure.transport.respondingTimeouts.writeTimeout=0"
@@ -1283,4 +1285,6 @@ main() {
   return 0
 }
 
-main "$@"
+if [[ "${BASH_SOURCE[0]:-$0}" == "$0" ]]; then
+  main "$@"
+fi
diff --git a/infrastructure_files/tests/test-getting-started-enterprise.sh b/infrastructure_files/tests/test-getting-started-enterprise.sh
new file mode 100644
index 000000000..9335caf2a
--- /dev/null
+++ b/infrastructure_files/tests/test-getting-started-enterprise.sh
@@ -0,0 +1,96 @@
+#!/bin/bash
+
+set -euo pipefail
+
+script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+source "$script_dir/../getting-started-enterprise.sh"
+
+test_dir=$(mktemp -d)
+trap 'rm -rf "$test_dir"' EXIT
+cases=0
+
+for errexit in +o -o; do
+  for pipefail in +o -o; do
+    bash -c '
+      set "$1" errexit
+      set "$2" pipefail
+      before_options=$SHELLOPTS
+      source "$3"
+      if [[ "$SHELLOPTS" != "$before_options" ]]; then
+        echo "Sourcing changed shell options: $before_options -> $SHELLOPTS" >&2
+        exit 1
+      fi
+    ' bash "$errexit" "$pipefail" "$script_dir/../getting-started-enterprise.sh"
+  done
+done
+
+assert_tag() {
+  local expected_status="$1" expected_message="$2" actual_status=0
+  shift 2
+  local label="${1-<unset>}"
+
+  # Each call needs its own process because die exits rather than returning.
+  (
+    unset NETBIRD_TRAEFIK_TAG
+    if [[ $# -gt 0 ]]; then
+      NETBIRD_TRAEFIK_TAG="$1"
+    fi
+    check_traefik_tag
+  ) >"$test_dir/stdout" 2>"$test_dir/stderr" || actual_status=$?
+
+  if [[ "$actual_status" != "$expected_status" ]]; then
+    echo "Tag '$label': expected exit $expected_status, got $actual_status" >&2
+    cat "$test_dir/stderr" >&2
+    exit 1
+  fi
+  if [[ -s "$test_dir/stdout" ]]; then
+    echo "Tag '$label': unexpected output on stdout" >&2
+    cat "$test_dir/stdout" >&2
+    exit 1
+  fi
+  if [[ -n "$expected_message" ]]; then
+    if ! grep -Fq "$expected_message" "$test_dir/stderr"; then
+      echo "Tag '$label': expected diagnostic '$expected_message'" >&2
+      cat "$test_dir/stderr" >&2
+      exit 1
+    fi
+  elif [[ -s "$test_dir/stderr" ]]; then
+    echo "Tag '$label': unexpected output on stderr" >&2
+    cat "$test_dir/stderr" >&2
+    exit 1
+  fi
+  cases=$((cases + 1))
+}
+
+# Unset and empty overrides both select the installer's default image.
+assert_tag 0 ""
+assert_tag 0 "" ""
+
+for tag in v3.7.13 3.7.13 v3.7.14 v3.8 3.8 v4.0 v4.0.0 \
+  v03.07.013 v3.08.0 v3.7.019; do
+  assert_tag 0 "" "$tag"
+done
+
+for tag in v2.11.0 v3.6.20 v3.7 3.7 v3.7.11 v3.7.12 3.7.12 \
+  v03.07.012 v3.7.08; do
+  assert_tag 1 "predates aliasHeadersStrategy" "$tag"
+done
+
+for tag in latest custom-build v2 v3 sha256:abcdef v3.7.11-alpine \
+  v3.7.13-alpine v3.7.13-rc1 v3.7.14+custom v3.7.14@sha256:abcdef \
+  3..14 v3.7.14.0 " 3.7.14" $'v3.7.14\n'; do
+  assert_tag 1 "Cannot verify NETBIRD_TRAEFIK_TAG=" "$tag"
+done
+
+# Re-rendering an install that has no header config must not add a blank line
+# to the Traefik command list.
+for header_config in "" "$TRAEFIK_HEADER_CONFIG"; do
+  rendered=$(TRAEFIK_HEADER_CONFIG="$header_config" render_compose_common)
+  if [[ "$(printf '%s\n' "$rendered" | service_block traefik)" == *$'\n\n'* ]]; then
+    echo "Traefik command list has a blank line (header config: '${header_config:-<empty>}')" >&2
+    exit 1
+  fi
+  cases=$((cases + 1))
+done
+
+echo "Passed $cases Traefik tag validation cases."
diff --git a/infrastructure_files/tests/test-getting-started-networks.sh b/infrastructure_files/tests/test-getting-started-networks.sh
new file mode 100644
index 000000000..9283a80bc
--- /dev/null
+++ b/infrastructure_files/tests/test-getting-started-networks.sh
@@ -0,0 +1,54 @@
+#!/bin/bash
+
+set -eo pipefail
+
+script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+source "$script_dir/../getting-started.sh"
+compose_command=$(check_docker_compose)
+read -r -a compose <<< "$compose_command"
+
+test_dir=$(mktemp -d)
+trap 'rm -rf "$test_dir"' EXIT
+mkdir "$test_dir/deployment"
+cd "$test_dir/deployment"
+
+unset COMPOSE_PROJECT_NAME COMPOSE_FILE COMPOSE_ENV_FILES
+# The generator's environment must not bake a project name into the output.
+if [[ "${1:-}" == "--migration" ]]; then
+  COMPOSE_PROJECT_NAME=render-only bash -s -- "$script_dir/../migrate.sh" >/dev/null <<'EOF'
+source "$1"
+INSTALL_DIR=$PWD
+DOMAIN=netbird.test
+generate_dashboard_env
+generate_docker_compose_traefik
+EOF
+else
+  TRAEFIK_IMAGE=traefik:v3.7.14
+  NETBIRD_DOMAIN=netbird.test
+  NETBIRD_AGENT_NETWORK=false
+  initialize_default_values
+  COMPOSE_PROJECT_NAME=render-only generate_configuration_files >/dev/null
+fi
+
+assert_network() {
+  local expected="$1" actual provider
+  shift
+  "${compose[@]}" "$@" config --format json >config.json
+  actual=$(jq -r '.networks.netbird.name' config.json)
+  provider=$(jq -r '.services.traefik.command[] | select(startswith("--providers.docker.network="))' config.json)
+  if [[ "$actual" != "$expected" || "$provider" != "--providers.docker.network=$expected" ]]; then
+    echo "Expected network '$expected'; Compose chose '$actual', Traefik received '$provider'" >&2
+    exit 1
+  fi
+}
+
+assert_network deployment_netbird
+COMPOSE_PROJECT_NAME=env-project assert_network env-project_netbird
+echo 'COMPOSE_PROJECT_NAME=file-project' >.env
+assert_network file-project_netbird
+COMPOSE_PROJECT_NAME=env-project assert_network cli-project_netbird -p cli-project
+: >.env
+echo 'name: config-project' >>docker-compose.yml
+assert_network config-project_netbird
+
+echo "Passed 5 Compose network scoping cases."
diff --git a/infrastructure_files/tests/test-getting-started.sh b/infrastructure_files/tests/test-getting-started.sh
new file mode 100644
index 000000000..0826340e5
--- /dev/null
+++ b/infrastructure_files/tests/test-getting-started.sh
@@ -0,0 +1,82 @@
+#!/bin/bash
+
+set -eo pipefail
+
+script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+source "$script_dir/../getting-started.sh"
+
+test_dir=$(mktemp -d)
+trap 'rm -rf "$test_dir"' EXIT
+cases=0
+
+assert_image() {
+  local expected_status="$1" expected_message="$2" image="$3" actual_status=0
+  local case_dir="$test_dir/$cases"
+  mkdir "$case_dir"
+
+  (
+    cd "$case_dir"
+    TRAEFIK_IMAGE="$image"
+    NETBIRD_DOMAIN=netbird.test
+    NETBIRD_AGENT_NETWORK=false
+    initialize_default_values
+    generate_configuration_files
+  ) >"$case_dir/stdout" 2>"$case_dir/stderr" || actual_status=$?
+
+  if [[ "$actual_status" != "$expected_status" ]]; then
+    echo "Image '$image': expected exit $expected_status, got $actual_status" >&2
+    cat "$case_dir/stderr" >&2
+    exit 1
+  fi
+  if [[ "$expected_status" == 0 ]]; then
+    if [[ -s "$case_dir/stderr" ]]; then
+      cat "$case_dir/stderr" >&2
+      exit 1
+    fi
+    for entrypoint in web websecure; do
+      if ! grep -Fq -- "--entrypoints.$entrypoint.http.aliasHeadersStrategy=delete" "$case_dir/docker-compose.yml"; then
+        echo "Image '$image': missing header protection for $entrypoint" >&2
+        exit 1
+      fi
+    done
+    if ! grep -Fxq "    image: ${image:-traefik:v3.7.14}" "$case_dir/docker-compose.yml"; then
+      echo "Image '$image': unexpected rendered image" >&2
+      exit 1
+    fi
+  else
+    if ! grep -Fq "$expected_message" "$case_dir/stderr"; then
+      echo "Image '$image': expected diagnostic '$expected_message'" >&2
+      cat "$case_dir/stderr" >&2
+      exit 1
+    fi
+    if [[ -e "$case_dir/docker-compose.yml" || -e "$case_dir/config.yaml" || -e "$case_dir/dashboard.env" ]]; then
+      echo "Image '$image': generated configuration despite failed validation" >&2
+      exit 1
+    fi
+  fi
+  cases=$((cases + 1))
+}
+
+# An empty override selects the default image.
+assert_image 0 "" ""
+for image in traefik:v3.7.13 traefik:3.7.13 traefik:v3.7.14 traefik:v3.8 \
+  traefik:v4 traefik:v4.0.0 traefik:v03.07.013 traefik:v3.08.0 \
+  registry.example:5000/team/traefik:3.7.13; do
+  assert_image 0 "" "$image"
+done
+
+for tag in v2 v2.11.0 v3 v3.6.20 v3.7 v3.7.11 v3.7.12 v03.07.012 v3.7.08; do
+  assert_image 1 "incompatible with this configuration" "traefik:$tag"
+done
+
+digest="sha256:$(printf '%064d' 0)"
+for image in traefik:latest traefik:custom-build traefik registry.example:5000/traefik \
+  "traefik@$digest" "registry.example:5000/team/traefik@$digest" \
+  "traefik:v3.7.13@$digest" "traefik:latest@$digest" \
+  traefik:v3.7.13-rc1 traefik:v3.7.13-alpine traefik:v3.7.14+custom \
+  traefik:3..14 traefik:v3.7.14.0 traefik:custom:v3.7.14 :v3.7.14 \
+  "traefik: v3.7.14" $'traefik:v3.7.14\n'; do
+  assert_image 1 "Cannot verify TRAEFIK_IMAGE=" "$image"
+done
+
+echo "Passed $cases Traefik image configuration cases."

From 2299e3d5a742ac5c8d28cf3fa36a8fcaacbb771d Mon Sep 17 00:00:00 2001
From: Pascal Fischer <32096965+pascal-fischer@users.noreply.github.com>
Date: Wed, 14 Oct 2026 13:46:35 +0200
Subject: [PATCH 61/70] [management] move is child account (#8195)

---
 management/internals/server/boot.go           |  2 +-
 management/internals/server/modules.go        |  4 ----
 management/server/account.go                  | 18 ++----------------
 management/server/auth/manager.go             |  4 ++--
 .../server/http/middleware/auth_middleware.go | 19 -------------------
 .../http/middleware/auth_middleware_test.go   | 12 +-----------
 .../http/middleware/middleware_factory.go     |  3 +--
 .../testing/testing_tools/channel/channel.go  |  4 ++--
 8 files changed, 9 insertions(+), 57 deletions(-)

diff --git a/management/internals/server/boot.go b/management/internals/server/boot.go
index 4ced64a16..13bbaa6fa 100644
--- a/management/internals/server/boot.go
+++ b/management/internals/server/boot.go
@@ -204,7 +204,7 @@ func (s *BaseServer) IDPHandler() http.Handler {
 func (s *BaseServer) Router() *mux.Router {
 	return Create(s, func() *mux.Router {
 		router := mux.NewRouter()
-		router.Use(middleware.BuildMiddleware(s.RateLimiter(), s.AuthManager(), s.AccountManager(), s.Metrics(), s.IsValidChildAccount)...)
+		router.Use(middleware.BuildMiddleware(s.RateLimiter(), s.AuthManager(), s.AccountManager(), s.Metrics())...)
 		return router
 	})
 }
diff --git a/management/internals/server/modules.go b/management/internals/server/modules.go
index f548e9238..3379becf6 100644
--- a/management/internals/server/modules.go
+++ b/management/internals/server/modules.go
@@ -248,7 +248,3 @@ func (s *BaseServer) ReverseProxyDomainManager() *manager.Manager {
 		return &m
 	})
 }
-
-func (s *BaseServer) IsValidChildAccount(_ context.Context, _, _, _ string) bool {
-	return false
-}
diff --git a/management/server/account.go b/management/server/account.go
index 0a8ec9a59..90e384ac0 100644
--- a/management/server/account.go
+++ b/management/server/account.go
@@ -1637,10 +1637,6 @@ func (am *DefaultAccountManager) GetAccountIDFromUserAuth(ctx context.Context, u
 		return "", "", status.Errorf(status.NotFound, "user %s not found", userAuth.UserId)
 	}
 
-	if userAuth.IsChild {
-		return accountID, user.Id, nil
-	}
-
 	ctx, err = am.permissionsManager.ValidateAccountAccess(ctx, accountID, user, false)
 	if err != nil {
 		return "", "", err
@@ -1692,10 +1688,10 @@ func (am *DefaultAccountManager) updateUserAuthWithSingleMode(ctx context.Contex
 // and propagates changes to peers if group propagation is enabled.
 // requires userAuth to have been ValidateAndParseToken and EnsureUserAccessByJWTGroups by the AuthManager
 func (am *DefaultAccountManager) SyncUserJWTGroups(ctx context.Context, userAuth auth.UserAuth) error {
-	// Child accounts and PAT-authenticated requests do not sync JWT groups.
+	// PAT-authenticated requests do not sync JWT groups.
 	// Embedded-Dex local users also skip sync because local password authentication
 	// does not provide external IdP group claims.
-	if userAuth.IsChild || userAuth.IsPAT || dex.IsLocalUserID(userAuth.UserId) {
+	if userAuth.IsPAT || dex.IsLocalUserID(userAuth.UserId) {
 		return nil
 	}
 
@@ -1874,8 +1870,6 @@ func (am *DefaultAccountManager) SyncUserJWTGroups(ctx context.Context, userAuth
 // Existing user + Existing account + Existing Indexed Domain -> Nothing changes
 //
 // Existing user + Existing account + Existing domain reclassified Domain as private -> Nothing changes (index domain)
-//
-// UserAuth IsChild -> checks that account exists
 func (am *DefaultAccountManager) getAccountIDWithAuthorizationClaims(ctx context.Context, userAuth auth.UserAuth) (string, error) {
 	log.WithContext(ctx).Tracef("getting account with authorization claims. User ID: \"%s\", Account ID: \"%s\", Domain: \"%s\", Domain Category: \"%s\"",
 		userAuth.UserId, userAuth.AccountId, userAuth.Domain, userAuth.DomainCategory)
@@ -1884,14 +1878,6 @@ func (am *DefaultAccountManager) getAccountIDWithAuthorizationClaims(ctx context
 		return "", errors.New(emptyUserID)
 	}
 
-	if userAuth.IsChild {
-		exists, err := am.Store.AccountExists(ctx, store.LockingStrengthNone, userAuth.AccountId)
-		if err != nil || !exists {
-			return "", err
-		}
-		return userAuth.AccountId, nil
-	}
-
 	if userAuth.DomainCategory != types.PrivateCategory || !isDomainValid(userAuth.Domain) {
 		return am.GetAccountIDByUserID(ctx, userAuth)
 	}
diff --git a/management/server/auth/manager.go b/management/server/auth/manager.go
index 9498789f2..7064c094f 100644
--- a/management/server/auth/manager.go
+++ b/management/server/auth/manager.go
@@ -75,10 +75,10 @@ func (m *manager) ValidateAndParseToken(ctx context.Context, value string) (auth
 }
 
 func (m *manager) EnsureUserAccessByJWTGroups(ctx context.Context, userAuth auth.UserAuth, token *jwt.Token) (auth.UserAuth, error) {
-	// Child accounts and PAT-authenticated requests do not use JWT group access checks.
+	// PAT-authenticated requests do not use JWT group access checks.
 	// Embedded-Dex local users also skip them because local password authentication
 	// does not provide external IdP group claims.
-	if userAuth.IsChild || userAuth.IsPAT || dex.IsLocalUserID(userAuth.UserId) {
+	if userAuth.IsPAT || dex.IsLocalUserID(userAuth.UserId) {
 		return userAuth, nil
 	}
 
diff --git a/management/server/http/middleware/auth_middleware.go b/management/server/http/middleware/auth_middleware.go
index 1e831e6c3..7c21b6a55 100644
--- a/management/server/http/middleware/auth_middleware.go
+++ b/management/server/http/middleware/auth_middleware.go
@@ -26,8 +26,6 @@ type SyncUserJWTGroupsFunc func(ctx context.Context, userAuth auth.UserAuth) err
 
 type GetUserFromUserAuthFunc func(ctx context.Context, userAuth auth.UserAuth) (*types.User, error)
 
-type IsValidChildAccountFunc func(ctx context.Context, userID, accountID, childAccountID string) bool
-
 // AuthMiddleware middleware to verify personal access tokens (PAT) and JWT tokens
 type AuthMiddleware struct {
 	authManager         serverauth.Manager
@@ -36,7 +34,6 @@ type AuthMiddleware struct {
 	syncUserJWTGroups   SyncUserJWTGroupsFunc
 	rateLimiter         *ratelimit.APIRateLimiter
 	patUsageTracker     *PATUsageTracker
-	isValidChildAccount IsValidChildAccountFunc
 }
 
 // NewAuthMiddleware instance constructor
@@ -47,7 +44,6 @@ func NewAuthMiddleware(
 	getUserFromUserAuth GetUserFromUserAuthFunc,
 	rateLimiter *ratelimit.APIRateLimiter,
 	meter metric.Meter,
-	isValidChildAccount IsValidChildAccountFunc,
 ) *AuthMiddleware {
 	var patUsageTracker *PATUsageTracker
 	if meter != nil {
@@ -65,7 +61,6 @@ func NewAuthMiddleware(
 		getUserFromUserAuth: getUserFromUserAuth,
 		rateLimiter:         rateLimiter,
 		patUsageTracker:     patUsageTracker,
-		isValidChildAccount: isValidChildAccount,
 	}
 }
 
@@ -127,13 +122,6 @@ func (m *AuthMiddleware) checkJWTFromRequest(r *http.Request, authHeaderParts []
 		return err
 	}
 
-	if impersonate, ok := r.URL.Query()["account"]; ok && len(impersonate) == 1 {
-		if m.isValidChildAccount(ctx, userAuth.UserId, userAuth.AccountId, impersonate[0]) {
-			userAuth.AccountId = impersonate[0]
-			userAuth.IsChild = true
-		}
-	}
-
 	// Email is now extracted in ToUserAuth (from claims or userinfo endpoint)
 	// Available as userAuth.Email
 
@@ -210,13 +198,6 @@ func (m *AuthMiddleware) checkPATFromRequest(r *http.Request, authHeaderParts []
 		IsPAT:          true,
 	}
 
-	if impersonate, ok := r.URL.Query()["account"]; ok && len(impersonate) == 1 {
-		if m.isValidChildAccount(r.Context(), userAuth.UserId, userAuth.AccountId, impersonate[0]) {
-			userAuth.AccountId = impersonate[0]
-			userAuth.IsChild = true
-		}
-	}
-
 	// propagates ctx change to upstream middleware
 	*r = *nbcontext.SetUserAuthInRequest(r, userAuth)
 	return nil
diff --git a/management/server/http/middleware/auth_middleware_test.go b/management/server/http/middleware/auth_middleware_test.go
index ceefc7c45..9e60af1fa 100644
--- a/management/server/http/middleware/auth_middleware_test.go
+++ b/management/server/http/middleware/auth_middleware_test.go
@@ -104,7 +104,7 @@ func mockMarkPATUsed(_ context.Context, token string) error {
 }
 
 func mockEnsureUserAccessByJWTGroups(_ context.Context, userAuth nbauth.UserAuth, token *jwt.Token) (nbauth.UserAuth, error) {
-	if userAuth.IsChild || userAuth.IsPAT {
+	if userAuth.IsPAT {
 		return userAuth, nil
 	}
 
@@ -212,7 +212,6 @@ func TestAuthMiddleware_Handler(t *testing.T) {
 		},
 		disabledLimiter,
 		nil,
-		func(_ context.Context, _, _, _ string) bool { return false },
 	)
 
 	handlerToTest := authMiddleware.Handler(nextHandler)
@@ -279,7 +278,6 @@ func TestAuthMiddleware_SyncUserJWTGroupsDetachedFromRequestCancellation(t *test
 		},
 		disabledLimiter,
 		nil,
-		func(_ context.Context, _, _, _ string) bool { return false },
 	)
 
 	handlerToTest := authMiddleware.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}))
@@ -332,7 +330,6 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 			},
 			ratelimit.NewAPIRateLimiter(rateLimitConfig),
 			nil,
-			func(_ context.Context, _, _, _ string) bool { return false },
 		)
 
 		handler := authMiddleware.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -385,7 +382,6 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 			},
 			ratelimit.NewAPIRateLimiter(rateLimitConfig),
 			nil,
-			func(_ context.Context, _, _, _ string) bool { return false },
 		)
 
 		handler := authMiddleware.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -429,7 +425,6 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 			},
 			ratelimit.NewAPIRateLimiter(rateLimitConfig),
 			nil,
-			func(_ context.Context, _, _, _ string) bool { return false },
 		)
 
 		handler := authMiddleware.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -474,7 +469,6 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 			},
 			ratelimit.NewAPIRateLimiter(rateLimitConfig),
 			nil,
-			func(_ context.Context, _, _, _ string) bool { return false },
 		)
 
 		handler := authMiddleware.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -539,7 +533,6 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 			},
 			ratelimit.NewAPIRateLimiter(rateLimitConfig),
 			nil,
-			func(_ context.Context, _, _, _ string) bool { return false },
 		)
 
 		handler := authMiddleware.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -599,7 +592,6 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 			},
 			ratelimit.NewAPIRateLimiter(rateLimitConfig),
 			nil,
-			func(_ context.Context, _, _, _ string) bool { return false },
 		)
 
 		handler := authMiddleware.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -655,7 +647,6 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 			},
 			ratelimit.NewAPIRateLimiter(rateLimitConfig),
 			nil,
-			func(_ context.Context, _, _, _ string) bool { return false },
 		)
 
 		handler := authMiddleware.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -756,7 +747,6 @@ func TestAuthMiddleware_Handler_Child(t *testing.T) {
 		},
 		disabledLimiter,
 		nil,
-		func(_ context.Context, _, _, _ string) bool { return false },
 	)
 
 	for _, tc := range tt {
diff --git a/management/server/http/middleware/middleware_factory.go b/management/server/http/middleware/middleware_factory.go
index 3ae617774..5346301ea 100644
--- a/management/server/http/middleware/middleware_factory.go
+++ b/management/server/http/middleware/middleware_factory.go
@@ -10,7 +10,7 @@ import (
 	log "github.com/sirupsen/logrus"
 )
 
-func BuildMiddleware(rateLimiter *ratelimit.APIRateLimiter, authManager auth.Manager, accountManager account.Manager, metrics telemetry.AppMetrics, isValidChildAcctFunc IsValidChildAccountFunc) []mux.MiddlewareFunc {
+func BuildMiddleware(rateLimiter *ratelimit.APIRateLimiter, authManager auth.Manager, accountManager account.Manager, metrics telemetry.AppMetrics) []mux.MiddlewareFunc {
 	toret := make([]mux.MiddlewareFunc, 0)
 
 	toret = append(toret, metrics.HTTPMiddleware().Handler)
@@ -28,7 +28,6 @@ func BuildMiddleware(rateLimiter *ratelimit.APIRateLimiter, authManager auth.Man
 		accountManager.GetUserFromUserAuth,
 		rateLimiter,
 		metrics.GetMeter(),
-		isValidChildAcctFunc,
 	).Handler)
 
 	return toret
diff --git a/management/server/http/testing/testing_tools/channel/channel.go b/management/server/http/testing/testing_tools/channel/channel.go
index 1b15ba780..88ab70b9c 100644
--- a/management/server/http/testing/testing_tools/channel/channel.go
+++ b/management/server/http/testing/testing_tools/channel/channel.go
@@ -146,7 +146,7 @@ func BuildApiBlackBoxWithDBState(t testing_tools.TB, sqlFile string, expectedPee
 	zoneRecordsManager := recordsManager.NewManager(store, am, permissionsManager)
 
 	apiRouter := mux.NewRouter().PathPrefix("/api").Subrouter()
-	apiRouter.Use(middleware.BuildMiddleware(nil, authManagerMock, am, metrics, nil)...)
+	apiRouter.Use(middleware.BuildMiddleware(nil, authManagerMock, am, metrics)...)
 	apiHandler, err := http2.NewAPIHandler(ctx, apiRouter, am, networksManager, resourcesManager, routersManager,
 		groupsManager, geoMock, permissionsManager, settingsManager, customZonesManager, zoneRecordsManager,
 		networkMapController, nil, serviceManager, nil, nil, nil, nil, nil, nil)
@@ -288,7 +288,7 @@ func BuildApiBlackBoxWithDBStateAndPeerChannel(t testing_tools.TB, sqlFile strin
 	zoneRecordsManager := recordsManager.NewManager(store, am, permissionsManager)
 
 	apiRouter := mux.NewRouter().PathPrefix("/api").Subrouter()
-	apiRouter.Use(middleware.BuildMiddleware(nil, authManagerMock, am, metrics, nil)...)
+	apiRouter.Use(middleware.BuildMiddleware(nil, authManagerMock, am, metrics)...)
 	apiHandler, err := http2.NewAPIHandler(ctx, apiRouter, am, networksManager, resourcesManager, routersManager, groupsManager,
 		geoMock, permissionsManager, settingsManager, customZonesManager, zoneRecordsManager,
 		networkMapController, nil, serviceManager, nil, nil, nil, nil, nil, nil)

From 405bbb8997f3d58d34cf6138bb05f066c1686fd2 Mon Sep 17 00:00:00 2001
From: Maycon Santos <mlsmaycon@gmail.com>
Date: Wed, 14 Oct 2026 15:50:16 +0200
Subject: [PATCH 62/70] [infrastructure] Restrict the FreeBSD port job to
 stable releases (#8204)

* [infrastructure] Restrict the FreeBSD port job to stable releases

The port scripts picked the target version by scraping the GitHub tags
page and only dropped tags containing "rc". A canary tag such as
v0.81.0-canary.pr-8098.1 sorts above the latest stable release, so the
job tried to package a prerelease, and the page only lists ten tags, so
a run of prereleases could leave no candidate at all. Both scripts now
share one helper that reads the tags API, keeps MAJOR.MINOR.PATCH
versions only, and rejects an explicitly requested prerelease. Go proxy
downloads fail instead of hashing an error page.

The job moves out of the release workflow into its own, so it runs on
pushes to main, on release tags, and on pull requests that touch the
scripts or the workflow itself. Prerelease tags skip the job, and a
stable tag is packaged directly rather than whatever happens to be the
latest release at the time.

* [infrastructure] Keep the FreeBSD port job in the release workflow

A separate workflow would rename the check and detach the job from the
release run, so the job stays in release.yml behind a small trigger job
that decides when it runs: pushes to main, stable release tags, and pull
requests that touch the port scripts or the workflow. Prerelease tags
and other branches skip it.

Tags are now listed with git ls-remote, which returns every tag in one
call and needs neither a token nor pagination, and the Go module proxy
downloads are limited to HTTPS like the other fetches.

* [infrastructure] Address Sonar findings in the FreeBSD port helper

Read the version into a local and return explicitly from is_stable_version.

* [infrastructure] Address review findings in the FreeBSD port job

Only a full vMAJOR.MINOR.PATCH tag starts the port job, so a tag like
v1.2 skips it instead of failing in the resolver. The diff detection
steps use a glob array rather than parsing ls, and quote GITHUB_OUTPUT.

A failed tag listing now stops the issue body script instead of writing
an incomplete changelog, and a bare "v" argument is rejected rather than
treated as a request for the latest release.
---
 .github/workflows/release.yml            | 71 ++++++++++++++---
 release_files/freebsd-port-diff.sh       | 86 ++++-----------------
 release_files/freebsd-port-issue-body.sh | 88 +++++----------------
 release_files/freebsd-port-lib.sh        | 98 ++++++++++++++++++++++++
 4 files changed, 197 insertions(+), 146 deletions(-)
 create mode 100644 release_files/freebsd-port-lib.sh

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d133d87f1..b3ed4763c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,8 +23,50 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  freebsd_port_trigger:
+    name: "FreeBSD Port / Trigger"
+    runs-on: ubuntu-22.04
+    outputs:
+      run: ${{ steps.decide.outputs.run }}
+      version: ${{ steps.decide.outputs.version }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Decide whether the port job runs
+        id: decide
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: |
+          set -euo pipefail
+          run=false
+          case "$GITHUB_EVENT_NAME" in
+            push)
+              if [[ "$GITHUB_REF" == "refs/heads/main" ]]; then
+                run=true
+              elif [[ "$GITHUB_REF" == refs/tags/* && "$GITHUB_REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+                # The port tracks stable releases only, so a canary or rc tag has nothing to submit.
+                run=true
+                echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+              fi
+              ;;
+            pull_request)
+              git fetch --depth=1 origin "$BASE_SHA"
+              if git diff --name-only "$BASE_SHA" HEAD | \
+                  grep -qE '^(release_files/freebsd-port-.*\.sh|\.github/workflows/release\.yml)$'; then
+                run=true
+              fi
+              ;;
+          esac
+          echo "run=$run" >> "$GITHUB_OUTPUT"
+          echo "FreeBSD port job runs: $run"
+
   release_freebsd_port:
     name: "FreeBSD Port / Build & Test"
+    needs: freebsd_port_trigger
+    if: needs.freebsd_port_trigger.outputs.run == 'true'
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
@@ -33,18 +75,19 @@ jobs:
           persist-credentials: false
 
       - name: Generate FreeBSD port diff
-        run: bash -x release_files/freebsd-port-diff.sh
-
-      - name: Generate FreeBSD port issue body
-        run: bash -x release_files/freebsd-port-issue-body.sh
+        env:
+          TARGET_VERSION: ${{ needs.freebsd_port_trigger.outputs.version }}
+        run: bash -x release_files/freebsd-port-diff.sh "$TARGET_VERSION"
 
       - name: Check if diff was generated
         id: check_diff
         run: |
-          if ls netbird-*.diff 1> /dev/null 2>&1; then
-            echo "diff_exists=true" >> $GITHUB_OUTPUT
+          shopt -s nullglob
+          diffs=(netbird-*.diff)
+          if [[ ${#diffs[@]} -gt 0 ]]; then
+            echo "diff_exists=true" >> "$GITHUB_OUTPUT"
           else
-            echo "diff_exists=false" >> $GITHUB_OUTPUT
+            echo "diff_exists=false" >> "$GITHUB_OUTPUT"
             echo "No diff file generated (port may already be up to date)"
           fi
 
@@ -52,10 +95,18 @@ jobs:
         if: steps.check_diff.outputs.diff_exists == 'true'
         id: version
         run: |
-          VERSION=$(ls netbird-*.diff | sed 's/netbird-\(.*\)\.diff/\1/')
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          diffs=(netbird-*.diff)
+          VERSION="${diffs[0]#netbird-}"
+          VERSION="${VERSION%.diff}"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
           echo "Generated files for version: $VERSION"
-          cat netbird-*.diff
+          cat "${diffs[0]}"
+
+      - name: Generate FreeBSD port issue body
+        if: steps.check_diff.outputs.diff_exists == 'true'
+        env:
+          TARGET_VERSION: ${{ steps.version.outputs.version }}
+        run: bash -x release_files/freebsd-port-issue-body.sh "" "$TARGET_VERSION"
 
       - name: Read Go version from go.mod
         id: goversion
diff --git a/release_files/freebsd-port-diff.sh b/release_files/freebsd-port-diff.sh
index 77ea55520..cd3c341b9 100755
--- a/release_files/freebsd-port-diff.sh
+++ b/release_files/freebsd-port-diff.sh
@@ -9,62 +9,19 @@
 # Usage: ./freebsd-port-diff.sh [new_version]
 # Example: ./freebsd-port-diff.sh 0.60.7
 #
-# If no version is provided, it fetches the latest from GitHub.
+# If no version is provided, it uses the latest stable release from GitHub.
+# Prerelease versions (canary, rc, ...) are rejected: the port only tracks
+# stable releases.
 
 set -e
 
-GITHUB_REPO="netbirdio/netbird"
-PORTS_MIRROR_BASE="https://raw.githubusercontent.com/freebsd/freebsd-ports/main/security/netbird"
+# shellcheck source=release_files/freebsd-port-lib.sh
+source "$(dirname "${BASH_SOURCE[0]}")/freebsd-port-lib.sh"
+
 GO_PROXY="https://proxy.golang.org/github.com/netbirdio/netbird/@v"
 OUTPUT_DIR="${OUTPUT_DIR:-.}"
 AWK_FIRST_FIELD='{print $1}'
 
-fetch_all_tags() {
-    curl -sL "https://github.com/${GITHUB_REPO}/tags" 2>/dev/null | \
-        grep -oE '/releases/tag/v[0-9]+\.[0-9]+\.[0-9]+([^"]+)?' | \
-        grep -iv 'rc' | \
-        sed 's/.*\/v//' | \
-        sort -u -V
-    return 0
-}
-
-fetch_current_ports_version() {
-    echo "Fetching current version from FreeBSD ports..." >&2
-    local makefile version
-    makefile=$(fetch_ports_file "Makefile") || return 1
-    version=$(echo "$makefile" | \
-        grep -E "^DISTVERSION=" | \
-        sed 's/DISTVERSION=[[:space:]]*//' | \
-        tr -d '\t ')
-    if [[ -z "$version" ]]; then
-        echo "Error: Could not extract DISTVERSION from ports Makefile" >&2
-        return 1
-    fi
-    echo "$version"
-    return 0
-}
-
-fetch_latest_github_release() {
-    echo "Fetching latest release from GitHub..." >&2
-    fetch_all_tags | tail -1
-    return 0
-}
-
-fetch_ports_file() {
-    local filename="$1"
-    local content
-    if ! content=$(curl -fsL --proto '=https' --proto-redir '=https' --retry 3 "${PORTS_MIRROR_BASE}/${filename}" 2>/dev/null); then
-        echo "Error: Could not fetch ${filename} from ${PORTS_MIRROR_BASE}" >&2
-        return 1
-    fi
-    if [[ "$content" == \<* ]]; then
-        echo "Error: Received HTML instead of ${filename} from ${PORTS_MIRROR_BASE}" >&2
-        return 1
-    fi
-    printf '%s' "$content"
-    return 0
-}
-
 compute_checksums() {
     local version="$1"
     local tmpdir
@@ -77,11 +34,15 @@ compute_checksums() {
     local mod_file="${tmpdir}/v${version}.mod"
     local zip_file="${tmpdir}/v${version}.zip"
 
-    curl -sL "${GO_PROXY}/v${version}.mod" -o "$mod_file" 2>/dev/null
-    curl -sL "${GO_PROXY}/v${version}.zip" -o "$zip_file" 2>/dev/null
+    local -a curl_opts=(-fsL --proto '=https' --proto-redir '=https' --retry 3)
+    if ! curl "${curl_opts[@]}" "${GO_PROXY}/v${version}.mod" -o "$mod_file" 2>/dev/null || \
+       ! curl "${curl_opts[@]}" "${GO_PROXY}/v${version}.zip" -o "$zip_file" 2>/dev/null; then
+        echo "Error: Could not download v${version} from the Go module proxy" >&2
+        return 1
+    fi
 
     if [[ ! -s "$mod_file" ]] || [[ ! -s "$zip_file" ]]; then
-        echo "Error: Could not download files from Go module proxy" >&2
+        echo "Error: Go module proxy returned empty files for v${version}" >&2
         return 1
     fi
 
@@ -133,25 +94,12 @@ generate_new_makefile() {
 }
 
 # Parse arguments
-NEW_VERSION="${1:-}"
-
-# Auto-detect versions if not provided
-OLD_VERSION=$(fetch_current_ports_version)
-if [[ -z "$OLD_VERSION" ]]; then
-    echo "Error: Could not fetch current version from FreeBSD ports" >&2
-    exit 1
-fi
-echo "Current FreeBSD ports version: ${OLD_VERSION}" >&2
-
-if [[ -z "$NEW_VERSION" ]]; then
-    NEW_VERSION=$(fetch_latest_github_release)
-    if [[ -z "$NEW_VERSION" ]]; then
-        echo "Error: Could not fetch latest release from GitHub" >&2
-        exit 1
-    fi
-fi
+NEW_VERSION=$(resolve_target_version "${1:-}")
 echo "Target version: ${NEW_VERSION}" >&2
 
+OLD_VERSION=$(fetch_current_ports_version)
+echo "Current FreeBSD ports version: ${OLD_VERSION}" >&2
+
 if [[ "$OLD_VERSION" = "$NEW_VERSION" ]]; then
     echo "Port is already at version ${NEW_VERSION}. Nothing to do." >&2
     exit 0
diff --git a/release_files/freebsd-port-issue-body.sh b/release_files/freebsd-port-issue-body.sh
index 1f0c8a567..16fe0e2b6 100755
--- a/release_files/freebsd-port-issue-body.sh
+++ b/release_files/freebsd-port-issue-body.sh
@@ -10,81 +10,29 @@
 #
 # If no versions are provided, the script will:
 #   - Fetch OLD version from the FreeBSD ports GitHub mirror (current version in ports tree)
-#   - Fetch NEW version from latest NetBird GitHub release tag
+#   - Fetch NEW version from the latest stable NetBird release tag on GitHub
+#
+# Prerelease versions (canary, rc, ...) are rejected: the port only tracks
+# stable releases.
 
 set -e
 
-GITHUB_REPO="netbirdio/netbird"
-PORTS_MAKEFILE_URL="https://raw.githubusercontent.com/freebsd/freebsd-ports/main/security/netbird/Makefile"
-
-fetch_current_ports_version() {
-    echo "Fetching current version from FreeBSD ports..." >&2
-    local makefile_content
-    makefile_content=$(curl -fsL --proto '=https' --proto-redir '=https' --retry 3 "$PORTS_MAKEFILE_URL" 2>/dev/null) || makefile_content=""
-    if [[ "$makefile_content" == \<* ]]; then
-        echo "Error: Received HTML instead of Makefile from ${PORTS_MAKEFILE_URL}" >&2
-        return 1
-    fi
-    if [[ -z "$makefile_content" ]]; then
-        echo "Error: Could not fetch Makefile from FreeBSD ports" >&2
-        return 1
-    fi
-    echo "$makefile_content" | grep -E "^DISTVERSION=" | sed 's/DISTVERSION=[[:space:]]*//' | tr -d '\t '
-    return 0
-}
-
-fetch_all_tags() {
-    # Fetch tags from GitHub tags page (no rate limiting, no auth needed)
-    curl -sL "https://github.com/${GITHUB_REPO}/tags" 2>/dev/null | \
-        grep -oE '/releases/tag/v[0-9]+\.[0-9]+\.[0-9]+([^"]+)?' | \
-        grep -iv 'rc' | \
-        sed 's/.*\/v//' | \
-        sort -u -V
-    return 0
-}
-
-fetch_latest_github_release() {
-    echo "Fetching latest release from GitHub..." >&2
-    local latest
-
-    # Fetch from GitHub tags page
-    latest=$(fetch_all_tags | tail -1)
-
-    if [[ -z "$latest" ]]; then
-        # Fallback to GitHub API
-        latest=$(curl -sL "https://api.github.com/repos/${GITHUB_REPO}/releases/latest" 2>/dev/null | \
-            grep '"tag_name"' | sed 's/.*"tag_name": *"v\([^"]*\)".*/\1/')
-    fi
-
-    if [[ -z "$latest" ]]; then
-        echo "Error: Could not fetch latest release from GitHub" >&2
-        return 1
-    fi
-    echo "$latest"
-    return 0
-}
+# shellcheck source=release_files/freebsd-port-lib.sh
+source "$(dirname "${BASH_SOURCE[0]}")/freebsd-port-lib.sh"
 
 OLD_VERSION="${1:-}"
 NEW_VERSION="${2:-}"
 
 if [[ -z "$OLD_VERSION" ]]; then
     OLD_VERSION=$(fetch_current_ports_version)
-    if [[ -z "$OLD_VERSION" ]]; then
-        echo "Error: Could not determine old version. Please provide it manually." >&2
-        echo "Usage: $0 <old_version> <new_version>" >&2
-        exit 1
-    fi
     echo "Detected OLD version from FreeBSD ports: $OLD_VERSION" >&2
 fi
 
 if [[ -z "$NEW_VERSION" ]]; then
-    NEW_VERSION=$(fetch_latest_github_release)
-    if [[ -z "$NEW_VERSION" ]]; then
-        echo "Error: Could not determine new version. Please provide it manually." >&2
-        echo "Usage: $0 <old_version> <new_version>" >&2
-        exit 1
-    fi
+    NEW_VERSION=$(resolve_target_version "")
     echo "Detected NEW version from GitHub: $NEW_VERSION" >&2
+else
+    NEW_VERSION=$(resolve_target_version "$NEW_VERSION")
 fi
 
 if [[ "$OLD_VERSION" = "$NEW_VERSION" ]]; then
@@ -98,8 +46,11 @@ OUTPUT_DIR="${OUTPUT_DIR:-.}"
 fetch_releases_between_versions() {
     echo "Fetching release history from GitHub..." >&2
 
-    # Fetch all tags and filter to those between OLD and NEW versions
-    fetch_all_tags | \
+    local tags
+    tags=$(fetch_stable_tags) || return 1
+
+    # List the stable releases after OLD up to and including NEW
+    echo "$tags" | \
         while read -r ver; do
             if [[ "$(printf '%s\n' "$OLD_VERSION" "$ver" | sort -V | head -n1)" = "$OLD_VERSION" ]] && \
                [[ "$(printf '%s\n' "$ver" "$NEW_VERSION" | sort -V | head -n1)" = "$ver" ]] && \
@@ -112,7 +63,7 @@ fetch_releases_between_versions() {
 
 generate_changelog_section() {
     local releases
-    releases=$(fetch_releases_between_versions)
+    releases=$(fetch_releases_between_versions) || return 1
 
     echo "Changelogs:"
     if [[ -n "$releases" ]]; then
@@ -127,7 +78,10 @@ generate_changelog_section() {
 
 OUTPUT_FILE="${OUTPUT_DIR}/netbird-${NEW_VERSION}-issue.txt"
 
-cat << EOF > "$OUTPUT_FILE"
+# Built before the heredoc: a failing substitution inside it would not stop the script.
+CHANGELOG=$(generate_changelog_section)
+
+cat << EOT > "$OUTPUT_FILE"
 BUGZILLA ISSUE DETAILS
 ======================
 
@@ -139,11 +93,11 @@ Description:
 ------------
 security/netbird: Update ${OLD_VERSION} => ${NEW_VERSION}
 
-$(generate_changelog_section)
+${CHANGELOG}
 
 Commit log:
 https://github.com/${GITHUB_REPO}/compare/v${OLD_VERSION}...v${NEW_VERSION}
-EOF
+EOT
 
 echo "========================================="
 echo "Issue body saved to: ${OUTPUT_FILE}"
diff --git a/release_files/freebsd-port-lib.sh b/release_files/freebsd-port-lib.sh
new file mode 100644
index 000000000..20102be54
--- /dev/null
+++ b/release_files/freebsd-port-lib.sh
@@ -0,0 +1,98 @@
+#!/bin/bash
+#
+# Shared helpers for the FreeBSD port scripts. Source this file, do not run it.
+#
+# The FreeBSD port tracks stable NetBird releases only, so every helper here
+# works on plain MAJOR.MINOR.PATCH versions and ignores canary, release
+# candidate and any other prerelease tag.
+
+GITHUB_REPO="netbirdio/netbird"
+GITHUB_REPO_URL="https://github.com/${GITHUB_REPO}.git"
+PORTS_MIRROR_BASE="https://raw.githubusercontent.com/freebsd/freebsd-ports/main/security/netbird"
+STABLE_VERSION_RE='^[0-9]+\.[0-9]+\.[0-9]+$'
+
+# is_stable_version reports whether the version is a plain MAJOR.MINOR.PATCH release.
+is_stable_version() {
+    local version="$1"
+    if [[ "$version" =~ $STABLE_VERSION_RE ]]; then
+        return 0
+    fi
+    return 1
+}
+
+# fetch_stable_tags prints the stable release versions known to GitHub, oldest
+# first. git ls-remote returns every tag in one round trip, with no API
+# pagination or rate limit to work around.
+fetch_stable_tags() {
+    local refs
+    if ! refs=$(git ls-remote --tags --refs "$GITHUB_REPO_URL" 2>/dev/null); then
+        echo "Error: Could not list tags of ${GITHUB_REPO_URL}" >&2
+        return 1
+    fi
+
+    echo "$refs" | \
+        sed -nE 's#.*refs/tags/v([0-9]+\.[0-9]+\.[0-9]+)$#\1#p' | \
+        sort -u -V
+    return 0
+}
+
+# resolve_target_version validates an explicitly requested version, or picks the
+# latest stable release from GitHub when none was given. A leading "v" is
+# accepted so a git tag name can be passed as is.
+resolve_target_version() {
+    local raw="$1"
+    local requested="${raw#v}"
+
+    if [[ -n "$raw" ]]; then
+        if ! is_stable_version "$requested"; then
+            echo "Error: '${raw}' is not a stable release. The FreeBSD port only tracks MAJOR.MINOR.PATCH versions." >&2
+            return 1
+        fi
+        echo "$requested"
+        return 0
+    fi
+
+    echo "Fetching latest stable release from GitHub..." >&2
+    local latest
+    latest=$(fetch_stable_tags | tail -1)
+    if [[ -z "$latest" ]]; then
+        echo "Error: Could not determine the latest stable release from GitHub" >&2
+        return 1
+    fi
+    echo "$latest"
+    return 0
+}
+
+# fetch_ports_file prints a file from the security/netbird port on the FreeBSD
+# ports GitHub mirror.
+fetch_ports_file() {
+    local filename="$1"
+    local content
+    if ! content=$(curl -fsL --proto '=https' --proto-redir '=https' --retry 3 "${PORTS_MIRROR_BASE}/${filename}" 2>/dev/null); then
+        echo "Error: Could not fetch ${filename} from ${PORTS_MIRROR_BASE}" >&2
+        return 1
+    fi
+    if [[ "$content" == \<* ]]; then
+        echo "Error: Received HTML instead of ${filename} from ${PORTS_MIRROR_BASE}" >&2
+        return 1
+    fi
+    printf '%s' "$content"
+    return 0
+}
+
+# fetch_current_ports_version prints the DISTVERSION currently in the ports tree.
+fetch_current_ports_version() {
+    echo "Fetching current version from FreeBSD ports..." >&2
+    local makefile version
+    makefile=$(fetch_ports_file "Makefile") || return 1
+    version=$(echo "$makefile" | \
+        grep -E "^DISTVERSION=" | \
+        sed 's/DISTVERSION=[[:space:]]*//' | \
+        tr -d '\t ')
+    if [[ -z "$version" ]]; then
+        echo "Error: Could not extract DISTVERSION from ports Makefile" >&2
+        return 1
+    fi
+    echo "$version"
+    return 0
+}

From 85db35194ef437bc37e6f3cfe561378582c6c994 Mon Sep 17 00:00:00 2001
From: Riccardo Manfrin <3090891+riccardomanfrin@users.noreply.github.com>
Date: Thu, 15 Oct 2026 10:53:55 +0200
Subject: [PATCH 63/70] [client] Prolong HA routes on the current routing peer
 across relay and direct transitions (#8192)

* [client] Do not move an HA route on latency before both peers have a sample

A direct connection reports no latency until the first sample of its new ICE
agent, and a drop to relay clears the previous one. Route selection ranked
such a peer at unknownLatency, so a routing peer whose direct connection came
back within the relayed switch delay lost the route to an equivalent peer on
a "lower latency" switch right after recovering, resetting every masqueraded
flow the delay was meant to keep alive. The sample usually lands before the
evaluation, but nothing orders the two, and a pair with no round trip time
yet postpones it to the next sampling tick.

Latency-only switches now require a sample on both peers. Categorical
criteria (connected, metric, direct versus relayed) are unaffected.

* [client] Hold a never-direct HA routing peer before a direct peer takes over

The peers of an HA group come up over relay first and turn direct one after
the other, as when lazy connections wake the group or the client reconnects.
A routing peer that was relayed when it carried the route gave way at once
to the first equivalent peer that turned direct, so in a group of N peers
the route moved right after the session started in roughly (N-1)/N of the
cases, resetting every masqueraded flow, typically an SSH session opened on
the wake-up traffic.

Such a peer is now kept for the relayedSwitch delay, counted from the first
evaluation that finds a direct contender. If it turns direct within the
delay the route stays; otherwise it moves when the delay runs out, so the
route does not stay on a relay for longer than the delay. A peer that
dropped from direct keeps counting from the drop.

* [client] Keep allowed IPs when only the chosen routing peer's status changes

recalculateRoutes did not tell a status change of the chosen routing peer
(idle to connected when traffic wakes it, connected to relayed and back) from
a switch to another peer: it removed the allowed IPs and added them back on
the same peer. In between the prefix had no owner and packets for it were
dropped, and default routes published a spurious "disconnected due to high
availability change" event followed by two "connected" ones.

When the same route stays on the same peer with the same definition, only
the recorded status is updated now.

* [client] Limit the "never" relayed switch policy to peers that dropped from direct

NB_HA_RELAYED_SWITCH_DELAY=never keeps a routing peer whose direct
connection dropped to relay for as long as it stays connected. Once the
relayed delay also covered peers that were never direct, "never" pinned
those to the relay for good, although a direct equivalent was available
and the peer showed no sign of turning direct.

A peer that was never direct now uses the default delay under "never",
which keeps the policy's original scope.

* [client] Merge the unchanged-route checks of the HA route watcher

shouldSkipRecalculation and the status-only fast path in recalculateRoutes
both handled the same route staying on the same routing peer, one for an
unchanged status and one for a changed one. They are now a single
keepChosenRoute check.

Pure refactor, no behavior change.

* [client] Re-apply routed allowed IPs when a kept routing peer connects

A peer update can recreate a routing peer: modifyPeers removes it from the
interface, which drops its routed prefixes, and adds it back idle with its
overlay addresses only. The remove and re-add that recalculateRoutes used
to run on every status change of the chosen peer put the prefixes back as
a side effect once the peer connected. Without it, a watcher that sees the
same peer go idle and then connected leaves the routed subnet without an
owner until a route update or an HA switch.

When the chosen peer connects while keeping the route, the watcher now
re-applies its routed allowed IPs through the route manager's reconcile,
which is add-only and idempotent. Lazy connections already do the same when
they arm an idle peer.

* [client] Bound the HA route hold on a routing peer without a latency sample

A latency-only switch waited for a sample on both peers. If the current
peer never got one, because its candidate pair stats kept failing or
reporting no round trip time, it kept the route indefinitely against a
measured peer, however much faster that one was.

The hold on an unsampled current peer now lasts unmeasuredLatencyHold
(30s), long enough for a recovered direct connection to report its first
sample. After that the peer is ranked at unknownLatency again and the usual
switch margins apply. relayedHold is armed so the switch is reconsidered
when the hold runs out.

* [client] Restart the relayed delay of a never-direct peer when its contender goes

For a routing peer that was never direct, the relayed delay runs from the
first evaluation that finds a direct contender. It was only reset when the
current peer changed or turned direct, so if that contender went away and
another one showed up later, the delay counted from the first one and the
new contender took over at once.

The delay of such a peer now restarts once no direct contender is left.
The delay of a peer that dropped from direct keeps running from the drop.

* [client] Retrigger pull request synchronization

* [client] Retry a failed routed allowed IPs reconcile on the next evaluation

keepChosenRoute recorded the connected status before re-applying the routed
allowed IPs and only logged a failed reconcile. Later evaluations then saw
an unchanged status and never retried, so a transient AddAllowedIP failure
left the recreated routing peer without its routed prefixes until another
status transition or a route switch.

The status is now recorded only once the reconcile succeeds. A failure
leaves the previous status in place, so the next evaluation, at the latest
the periodic re-evaluation, sees the change again and retries.
---
 client/internal/routemanager/client/client.go | 171 ++++++++++++---
 .../routemanager/client/client_test.go        |  82 +++++++
 client/internal/routemanager/client/env.go    |   9 +-
 .../client/relayed_switch_test.go             | 204 +++++++++++++++---
 client/internal/routemanager/manager.go       |  26 +--
 5 files changed, 421 insertions(+), 71 deletions(-)

diff --git a/client/internal/routemanager/client/client.go b/client/internal/routemanager/client/client.go
index b882c4d4a..66c2ed491 100644
--- a/client/internal/routemanager/client/client.go
+++ b/client/internal/routemanager/client/client.go
@@ -65,6 +65,12 @@ const (
 	// well above any usable path so that slow paths keep their order.
 	unknownLatency = 10 * time.Second
 
+	// unmeasuredLatencyHold is how long a current routing peer without a
+	// latency sample is kept against a measured one. A direct connection is
+	// sampled within seconds, so a peer still unsampled after this is ranked
+	// at unknownLatency rather than held indefinitely.
+	unmeasuredLatencyHold = 30 * time.Second
+
 	// holdReportInterval is how long a routing peer held back by a switch rule
 	// is reported at debug level only, after being reported at info level once.
 	holdReportInterval = 10 * time.Minute
@@ -99,6 +105,7 @@ type holdKind int
 const (
 	holdLatencyMargin holdKind = iota
 	holdLatencyDwell
+	holdLatencyUnmeasured
 	holdRelayedDelay
 )
 
@@ -124,6 +131,9 @@ type routeCandidate struct {
 	relayed   bool
 	latency   time.Duration
 	noise     time.Duration
+	// measured is false while the peer has no latency sample, as right after a
+	// direct connection comes up: latency then holds unknownLatency
+	measured bool
 }
 
 func newRouteCandidate(r *route.Route, status routerPeerStatus) routeCandidate {
@@ -140,6 +150,7 @@ func newRouteCandidate(r *route.Route, status routerPeerStatus) routeCandidate {
 		relayed:   status.relayed,
 		latency:   latency,
 		noise:     status.noise,
+		measured:  status.latency > 0,
 	}
 }
 
@@ -230,6 +241,9 @@ type WatcherConfig struct {
 	StatusRecorder   *peer.Status
 	Route            *route.Route
 	Handler          RouteHandler
+	// ReconcileAllowedIPs re-applies the routed allowed IPs tracked for a
+	// routing peer onto the interface. Optional.
+	ReconcileAllowedIPs func(peerKey string) error
 }
 
 // Watcher watches route and peer changes and updates allowed IPs accordingly.
@@ -271,11 +285,20 @@ type Watcher struct {
 	trackedCurrent route.ID
 	trackedPeer    string
 	trackedDirect  bool
-	// degradedSince is when the current routing peer dropped from direct to
-	// relayed, zero if it is direct or was already relayed when chosen
+	// degradedSince is when the relayedSwitch delay of the current relayed
+	// routing peer started: its drop from direct, or the first direct contender
+	// if it was never direct. Zero while it is direct or uncontended.
 	degradedSince time.Time
-	// relayedHold fires when a relayed switch being held back becomes due, so it
-	// is applied on time rather than on the next periodic re-evaluation
+	// unmeasuredRoute and unmeasuredSince track since when the current route's
+	// peer has had no latency sample, bounding the hold in shouldSwitchRoute
+	unmeasuredRoute route.ID
+	unmeasuredSince time.Time
+	// neverDirect marks a degradedSince started by a direct contender rather
+	// than by a drop from direct, which the "never" policy does not cover
+	neverDirect bool
+	// relayedHold fires when a switch held back by the relayed delay or the
+	// unmeasured latency hold becomes due, so it is applied on time rather than
+	// on the next periodic re-evaluation
 	relayedHold *time.Timer
 	// heldCandidate and heldKind identify the alternative last held back by the
 	// switch rules and the rule holding it, and heldReported is when that was
@@ -298,6 +321,9 @@ type Watcher struct {
 	stopped      bool
 	handler      RouteHandler
 	updateSerial uint64
+	// reconcileAllowedIPs re-applies a routing peer's routed allowed IPs when
+	// it connects while keeping the route, see keepChosenRoute. May be nil.
+	reconcileAllowedIPs func(peerKey string) error
 }
 
 func newPeerStateUpdate() chan struct{} {
@@ -320,6 +346,7 @@ func NewWatcher(config WatcherConfig) *Watcher {
 		handler:             config.Handler,
 		currentChosenStatus: nil,
 		relayedSwitch:       relayedSwitch(),
+		reconcileAllowedIPs: config.ReconcileAllowedIPs,
 	}
 	return client
 }
@@ -393,6 +420,8 @@ func (w *Watcher) getBestRouteFromStatuses(routePeerStatuses map[route.ID]router
 	}
 
 	w.trackRelayed(current, haveCurrent)
+	w.trackUnmeasured(current, haveCurrent)
+	w.trackContender(current, best, haveCurrent && haveBest)
 
 	if !haveBest {
 		w.reportUnassigned()
@@ -449,9 +478,8 @@ func (w *Watcher) reportUnassigned() {
 
 // trackRelayed records when the current routing peer dropped from a direct to a
 // relayed connection while carrying the route, which starts the relayedSwitch
-// delay. A peer that was never direct, because it was relayed when chosen or
-// came up over relay from idle, is not degraded: holding on to it would only
-// keep the route on the slower path.
+// delay at once. A peer that was never direct starts it later, when a direct
+// peer first contends for the route, see relayedSwitchDue.
 func (w *Watcher) trackRelayed(current routeCandidate, haveCurrent bool) {
 	if !haveCurrent {
 		w.trackedCurrent, w.trackedPeer, w.trackedDirect, w.degradedSince = "", "", false, time.Time{}
@@ -462,7 +490,7 @@ func (w *Watcher) trackRelayed(current routeCandidate, haveCurrent bool) {
 	case current.id != w.trackedCurrent, current.peer != w.trackedPeer, !current.relayed:
 		w.degradedSince = time.Time{}
 	case w.trackedDirect:
-		w.degradedSince = time.Now()
+		w.degradedSince, w.neverDirect = time.Now(), false
 		// a new degradation, reported as such even if an earlier one held
 		// back the same candidate
 		w.heldCandidate = ""
@@ -494,6 +522,20 @@ func (w *Watcher) shouldSwitchRoute(current, candidate routeCandidate) bool {
 		return true
 	}
 
+	// Without a sample on both sides there is no gain to weigh. A direct
+	// connection reports no latency until its first sample, so comparing it as
+	// unknownLatency would move the route away from a peer that just recovered.
+	// The hold is bounded so a peer that never gets a sample does not keep the
+	// route for good.
+	if w.unmeasuredHoldActive(current, candidate) {
+		if level := w.holdLevel(candidate, holdLatencyUnmeasured); log.IsLevelEnabled(level) {
+			log.StandardLogger().Logf(level,
+				"keeping routing peer %s for [%v] over %s: latency not measured on both peers yet (%s)",
+				current.peer, w.handler, candidate.peer, candidate)
+		}
+		return false
+	}
+
 	gain := current.latency - candidate.latency
 	if margin := switchMargin(current, candidate); gain < margin {
 		if level := w.holdLevel(candidate, holdLatencyMargin); log.IsLevelEnabled(level) {
@@ -518,22 +560,75 @@ func (w *Watcher) shouldSwitchRoute(current, candidate routeCandidate) bool {
 	return true
 }
 
+// trackContender restarts the relayed delay of a peer that was never direct
+// once no direct contender is left. That delay runs from the first contender,
+// so keeping it would let a later contender take over without waiting. The
+// delay of a peer that dropped from direct keeps running from the drop.
+func (w *Watcher) trackContender(current, best routeCandidate, have bool) {
+	if !w.neverDirect || w.degradedSince.IsZero() {
+		return
+	}
+	if have && best.winsOnlyOnRelay(current) {
+		return
+	}
+	w.degradedSince = time.Time{}
+}
+
+// trackUnmeasured records since when the current route's peer has had no
+// latency sample, and forgets it once the peer is measured or the route moves.
+func (w *Watcher) trackUnmeasured(current routeCandidate, haveCurrent bool) {
+	if !haveCurrent || current.measured || current.id != w.unmeasuredRoute {
+		w.unmeasuredRoute, w.unmeasuredSince = "", time.Time{}
+	}
+	if haveCurrent && !current.measured && w.unmeasuredSince.IsZero() {
+		w.unmeasuredRoute, w.unmeasuredSince = current.id, time.Now()
+	}
+}
+
+// unmeasuredHoldActive reports whether a latency comparison must wait because
+// a side has no sample: always for an unsampled candidate, and for an unsampled
+// current peer until unmeasuredLatencyHold runs out. A pending hold arms
+// relayedHold so the switch is reconsidered when it runs out.
+func (w *Watcher) unmeasuredHoldActive(current, candidate routeCandidate) bool {
+	if !candidate.measured {
+		return true
+	}
+	if current.measured {
+		return false
+	}
+
+	remaining := unmeasuredLatencyHold - time.Since(w.unmeasuredSince)
+	if remaining <= 0 {
+		return false
+	}
+	w.armRelayedHold(remaining)
+
+	return true
+}
+
 // relayedSwitchDue reports whether a relayed current routing peer should give
 // way to a candidate that is better only by being direct.
 //
-// A peer that dropped from direct to relayed while carrying the route is kept
-// for the relayedSwitch delay: the relay still carries the traffic, staying
-// keeps every flow through this routing peer alive, and a direct connection that
-// dropped often recovers within seconds. A peer that was already relayed when
-// chosen gives way at once, so the route is not stuck on the slower path when a
-// direct one becomes available. A switch that is not due yet arms relayedHold so
-// it is applied as soon as it becomes due.
+// A relayed peer is kept for the relayedSwitch delay: the relay still carries
+// the traffic, and staying keeps every flow through this routing peer alive.
+// For a peer that dropped from direct to relayed the delay runs from the drop,
+// since a direct connection that dropped often recovers within seconds. For a
+// peer that was never direct, as when the peers of a group come up over relay
+// before their direct connections, it runs from the first evaluation that
+// finds a direct contender: the current peer usually turns direct within
+// seconds too. A switch that is not due yet arms relayedHold so it is applied
+// as soon as it becomes due.
 func (w *Watcher) relayedSwitchDue(current, candidate routeCandidate) bool {
 	if w.degradedSince.IsZero() {
-		return true
+		w.degradedSince, w.neverDirect = time.Now(), true
 	}
 
 	policy := w.relayedSwitch
+	// "never" keeps a peer whose direct connection dropped; one that was never
+	// direct still moves after the default delay instead of staying relayed
+	if policy.never && w.neverDirect {
+		policy = relayedSwitchPolicy{delay: defaultRelayedSwitchDelay}
+	}
 	if !policy.never {
 		remaining := policy.delay - time.Since(w.degradedSince)
 		if remaining <= 0 {
@@ -544,7 +639,7 @@ func (w *Watcher) relayedSwitchDue(current, candidate routeCandidate) bool {
 
 	if level := w.holdLevel(candidate, holdRelayedDelay); log.IsLevelEnabled(level) {
 		log.StandardLogger().Logf(level,
-			"keeping relayed routing peer %s for [%v] over direct %s: dropped to relay %v ago, switch delay %s",
+			"keeping relayed routing peer %s for [%v] over direct %s: held for %v, switch delay %s",
 			current.peer, w.handler, candidate.peer, time.Since(w.degradedSince).Round(time.Second), policy)
 	}
 
@@ -677,21 +772,46 @@ func (w *Watcher) removeAllowedIPs(route *route.Route, rsn reason) error {
 	return nil
 }
 
-// shouldSkipRecalculation checks if we can skip route recalculation for the same route without status changes
-func (w *Watcher) shouldSkipRecalculation(newChosenID route.ID, newStatus routerPeerStatus) bool {
-	if w.currentChosen == nil {
+// keepChosenRoute reports whether the evaluation keeps the current route, with
+// the same definition, on the same routing peer. A status change of that peer
+// is recorded without removing and re-adding its allowed IPs, which would leave
+// the prefix without an owner in between. When the peer connects, its routed
+// allowed IPs are re-applied instead: a peer recreated by a peer update comes
+// back with its overlay addresses only.
+func (w *Watcher) keepChosenRoute(newChosenID route.ID, newStatus routerPeerStatus) bool {
+	if w.currentChosen == nil || w.currentChosen.ID != newChosenID {
 		return false
 	}
 
-	isSameRoute := w.currentChosen.ID == newChosenID && w.currentChosen.Equal(w.routes[newChosenID])
-	if !isSameRoute {
+	newChosenRoute := w.routes[newChosenID]
+	if !w.currentChosen.Equal(newChosenRoute) {
 		return false
 	}
 
-	if w.currentChosenStatus != nil {
-		return w.currentChosenStatus.status == newStatus.status
+	if w.currentChosenStatus == nil || w.currentChosenStatus.status == newStatus.status {
+		return true
 	}
 
+	// a failed reconcile leaves the previous status recorded, so the next
+	// evaluation sees the change again and retries
+	if newStatus.status == peer.StatusConnected && !w.reconcileRoutedAllowedIPs(newChosenRoute.Peer) {
+		return true
+	}
+
+	w.currentChosen = newChosenRoute
+	w.currentChosenStatus = &newStatus
+
+	return true
+}
+
+func (w *Watcher) reconcileRoutedAllowedIPs(peerKey string) bool {
+	if w.reconcileAllowedIPs == nil {
+		return true
+	}
+	if err := w.reconcileAllowedIPs(peerKey); err != nil {
+		log.Warnf("failed to reconcile routed allowed IPs of routing peer %s for [%v], will retry: %v", peerKey, w.handler, err)
+		return false
+	}
 	return true
 }
 
@@ -719,8 +839,7 @@ func (w *Watcher) recalculateRoutes(rsn reason, routerPeerStatuses map[route.ID]
 		return nil
 	}
 
-	// If we can skip recalculation for the same route without changes, do nothing
-	if w.shouldSkipRecalculation(newChosenID, newStatus) {
+	if w.keepChosenRoute(newChosenID, newStatus) {
 		return nil
 	}
 
diff --git a/client/internal/routemanager/client/client_test.go b/client/internal/routemanager/client/client_test.go
index 764a2f74d..641383e90 100644
--- a/client/internal/routemanager/client/client_test.go
+++ b/client/internal/routemanager/client/client_test.go
@@ -2,6 +2,7 @@ package client
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net/netip"
 	"sync"
@@ -1480,3 +1481,84 @@ func TestLatencyJitterDoesNotSwitchRoute(t *testing.T) {
 		require.Equal(t, route.ID("route1"), chosen, "route changed on jitter at sample %d", i)
 	}
 }
+
+// A routing peer that keeps the route while only its connection status changes,
+// as when an idle peer is woken by traffic, must keep its allowed IPs in place:
+// removing and re-adding them leaves the prefix without an owner in between.
+func TestRecalculateRoutesStatusChangeKeepsAllowedIPs(t *testing.T) {
+	w, handler := newRecalcWatcher(t)
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusIdle},
+	}))
+	require.Equal(t, []string{"peer1"}, handler.added)
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, relayed: true},
+	}))
+	assert.Equal(t, []string{"peer1"}, handler.added, "a status change must not re-add the allowed IPs")
+	assert.Equal(t, 0, handler.removed, "a status change must not remove the allowed IPs")
+	require.NotNil(t, w.currentChosenStatus)
+	assert.Equal(t, peer.StatusConnected, w.currentChosenStatus.status, "the new status must be recorded")
+}
+
+// A routing peer recreated by a peer update comes back idle with its overlay
+// addresses only. When it connects while keeping the route, its routed allowed
+// IPs must be re-applied, since nothing else puts them back on the new peer.
+func TestRecalculateRoutesReconcilesAllowedIPsOnConnect(t *testing.T) {
+	w, handler := newRecalcWatcher(t)
+	var reconciled []string
+	w.reconcileAllowedIPs = func(peerKey string) error {
+		reconciled = append(reconciled, peerKey)
+		return nil
+	}
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected},
+	}))
+	require.Equal(t, []string{"peer1"}, handler.added)
+	require.Empty(t, reconciled, "a fresh assignment adds the allowed IPs itself")
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusIdle},
+	}))
+	assert.Empty(t, reconciled, "going idle must not reconcile")
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected},
+	}))
+	assert.Equal(t, []string{"peer1"}, reconciled, "connecting while keeping the route must reconcile its allowed IPs")
+	assert.Equal(t, []string{"peer1"}, handler.added, "the reconcile must not go through the refcounted add")
+	assert.Equal(t, 0, handler.removed, "the allowed IPs must not be removed")
+}
+
+// A failed reconcile must be retried: the new status is only recorded once the
+// routed allowed IPs are back, so the next evaluation tries again.
+func TestRecalculateRoutesRetriesFailedReconcile(t *testing.T) {
+	w, _ := newRecalcWatcher(t)
+	calls := 0
+	w.reconcileAllowedIPs = func(string) error {
+		calls++
+		if calls == 1 {
+			return errors.New("add allowed IP: transient failure")
+		}
+		return nil
+	}
+
+	connected := map[route.ID]routerPeerStatus{"route1": {status: peer.StatusConnected}}
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, connected))
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusIdle},
+	}))
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, connected))
+	require.Equal(t, 1, calls, "connecting must reconcile")
+	assert.Equal(t, peer.StatusIdle, w.currentChosenStatus.status, "a failed reconcile must not record the new status")
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, connected))
+	assert.Equal(t, 2, calls, "the next evaluation must retry the reconcile")
+	assert.Equal(t, peer.StatusConnected, w.currentChosenStatus.status, "a successful reconcile records the status")
+
+	require.NoError(t, w.recalculateRoutes(reasonPeerUpdate, connected))
+	assert.Equal(t, 2, calls, "nothing to retry once the reconcile succeeded")
+}
diff --git a/client/internal/routemanager/client/env.go b/client/internal/routemanager/client/env.go
index 398667cdf..6a7c08a1f 100644
--- a/client/internal/routemanager/client/env.go
+++ b/client/internal/routemanager/client/env.go
@@ -12,10 +12,11 @@ import (
 const (
 	// envRelayedSwitchDelay sets how long a routing peer that dropped from a
 	// direct to a relayed connection while carrying the route is kept before the
-	// route moves to an equivalent peer with a direct connection. Takes a
-	// duration ("30s", "0" to switch at once) or "never" to only leave such a
-	// peer when it disconnects. A routing peer that was already relayed when
-	// chosen always gives way to a direct one at once.
+	// route moves to an equivalent peer with a direct connection. A routing peer
+	// that was never direct is kept for the same delay from when a direct peer
+	// first contends for the route. Takes a duration ("30s", "0" to switch at
+	// once) or "never" to only leave a peer that dropped from direct when it
+	// disconnects; a peer that was never direct then uses the default delay.
 	envRelayedSwitchDelay = "NB_HA_RELAYED_SWITCH_DELAY"
 
 	relayedSwitchDelayNever = "never"
diff --git a/client/internal/routemanager/client/relayed_switch_test.go b/client/internal/routemanager/client/relayed_switch_test.go
index 8f4a67bba..f70dfff50 100644
--- a/client/internal/routemanager/client/relayed_switch_test.go
+++ b/client/internal/routemanager/client/relayed_switch_test.go
@@ -103,11 +103,11 @@ func TestDegradedRoutingPeerIsReplacedAfterDelay(t *testing.T) {
 	assert.Equal(t, switchReasonDirect, w.switchReason, "the switch reason must name the relayed connection")
 }
 
-// A routing peer that was relayed when it was chosen is not degraded: when an
-// equivalent direct peer shows up the route must upgrade at once instead of
-// staying on the slower path for the delay.
-func TestRelayedRoutingPeerUpgradesAtOnce(t *testing.T) {
-	w := newRelayedTestWatcher(t, relayedSwitchPolicy{never: true})
+// A routing peer that was relayed when it was chosen is held for the delay when
+// an equivalent direct peer shows up, from that moment on: it usually turns
+// direct within seconds, and moving the route resets its masqueraded flows.
+func TestRelayedRoutingPeerIsKeptDuringDelay(t *testing.T) {
+	w := newRelayedTestWatcher(t, relayedSwitchPolicy{delay: 30 * time.Second})
 
 	// route1 was chosen while relayed and route2 was still connecting
 	chosen, _ := w.getBestRouteFromStatuses(map[route.ID]routerPeerStatus{
@@ -115,36 +115,57 @@ func TestRelayedRoutingPeerUpgradesAtOnce(t *testing.T) {
 		"route2": {status: peer.StatusConnecting},
 	})
 	require.Equal(t, route.ID("route1"), chosen)
-	require.True(t, w.degradedSince.IsZero(), "a peer relayed from the start is not degraded")
+	require.True(t, w.degradedSince.IsZero(), "the delay must not run before a direct peer contends")
 
 	chosen, _ = w.getBestRouteFromStatuses(currentRelayed)
-	assert.Equal(t, route.ID("route2"), chosen, "a direct peer must take over from one that was relayed all along")
-	assert.Equal(t, switchReasonDirect, w.switchReason)
-	assert.Nil(t, w.relayedHold, "an upgrade must not schedule anything")
+	assert.Equal(t, route.ID("route1"), chosen, "a relayed peer must be kept when a direct one shows up")
+	assert.False(t, w.degradedSince.IsZero(), "the direct contender must start the delay")
+	assert.NotNil(t, w.relayedHold, "the pending switch must arm a timer so it is applied when due")
+
+	w.degradedSince = w.degradedSince.Add(-31 * time.Second)
+	chosen, _ = w.getBestRouteFromStatuses(currentRelayed)
+	assert.Equal(t, route.ID("route2"), chosen, "a peer still relayed after the delay must give way to a direct one")
+	assert.Equal(t, switchReasonDirect, w.switchReason, "the switch reason must name the relayed connection")
 }
 
-// An idle routing peer woken by traffic whose relay connection comes up before
-// the direct one was never direct: it is not degraded, and must give way to an
-// equivalent direct peer at once.
-func TestIdleRoutingPeerWokenOverRelayUpgradesAtOnce(t *testing.T) {
-	w := newRelayedTestWatcher(t, relayedSwitchPolicy{never: true})
+// The peers of an HA group woken from idle come up over relay first and turn
+// direct one after the other. The route must stay on the peer it was on when
+// the other one turns direct first and the current one follows within the
+// delay, including before the current peer's first latency sample.
+func TestIdleRoutingPeersWokenOverRelayKeepRoute(t *testing.T) {
+	w := newRelayedTestWatcher(t, relayedSwitchPolicy{delay: 30 * time.Second})
 
-	chosen, _ := w.getBestRouteFromStatuses(map[route.ID]routerPeerStatus{
-		"route1": {status: peer.StatusIdle},
-		"route2": {status: peer.StatusIdle},
-	})
-	require.Equal(t, route.ID("route1"), chosen)
+	steps := []struct {
+		name     string
+		statuses map[route.ID]routerPeerStatus
+	}{
+		{"both idle", map[route.ID]routerPeerStatus{
+			"route1": {status: peer.StatusIdle},
+			"route2": {status: peer.StatusIdle},
+		}},
+		{"both relayed", map[route.ID]routerPeerStatus{
+			"route1": {status: peer.StatusConnected, relayed: true},
+			"route2": {status: peer.StatusConnected, relayed: true},
+		}},
+		{"other direct first", map[route.ID]routerPeerStatus{
+			"route1": {status: peer.StatusConnected, relayed: true},
+			"route2": {status: peer.StatusConnected, latency: 20 * time.Millisecond},
+		}},
+		{"current direct, not sampled", map[route.ID]routerPeerStatus{
+			"route1": {status: peer.StatusConnected},
+			"route2": {status: peer.StatusConnected, latency: 20 * time.Millisecond},
+		}},
+		{"current direct, sampled", map[route.ID]routerPeerStatus{
+			"route1": {status: peer.StatusConnected, latency: 38 * time.Millisecond},
+			"route2": {status: peer.StatusConnected, latency: 20 * time.Millisecond},
+		}},
+	}
 
-	chosen, _ = w.getBestRouteFromStatuses(map[route.ID]routerPeerStatus{
-		"route1": {status: peer.StatusConnected, relayed: true},
-		"route2": {status: peer.StatusConnecting},
-	})
-	require.Equal(t, route.ID("route1"), chosen)
-	require.True(t, w.degradedSince.IsZero(), "waking up over relay is not a drop from direct")
-
-	chosen, _ = w.getBestRouteFromStatuses(currentRelayed)
-	assert.Equal(t, route.ID("route2"), chosen, "a direct peer must take over from one that was never direct")
-	assert.Nil(t, w.relayedHold, "an upgrade must not schedule anything")
+	for _, step := range steps {
+		chosen, _ := w.getBestRouteFromStatuses(step.statuses)
+		require.Equal(t, route.ID("route1"), chosen, "step %q must keep the route on route1", step.name)
+	}
+	assert.True(t, w.degradedSince.IsZero(), "the delay must end once the current peer is direct")
 }
 
 // A routing peer that drops to relay again, after recovering from an earlier
@@ -356,3 +377,128 @@ func TestRoutingPeerSwitchPublishesEvent(t *testing.T) {
 	assert.Equal(t, "No routing peer available", events[1].Message)
 	assert.Equal(t, "peer2", events[1].Metadata["previous_peer"])
 }
+
+// The statuses below follow the status recorder: a drop to relay clears the
+// latency, and a recovered direct connection reports no latency until the new
+// ICE agent's first sample lands.
+var (
+	flapDirect = map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, latency: 50 * time.Millisecond},
+		"route2": {status: peer.StatusConnected, latency: 60 * time.Millisecond},
+	}
+	flapRelayed = map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, relayed: true},
+		"route2": {status: peer.StatusConnected, latency: 60 * time.Millisecond},
+	}
+	flapRecoveredUnsampled = map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected},
+		"route2": {status: peer.StatusConnected, latency: 60 * time.Millisecond},
+	}
+)
+
+// A routing peer whose direct connection drops to relay and comes back within
+// the delay must keep the route, including the window between the recovery and
+// the first latency sample of the new connection.
+func TestRecoveredRoutingPeerWithoutLatencySampleIsKept(t *testing.T) {
+	w := newRelayedTestWatcher(t, relayedSwitchPolicy{delay: 30 * time.Second})
+
+	chosen, _ := w.getBestRouteFromStatuses(flapDirect)
+	require.Equal(t, route.ID("route1"), chosen)
+
+	chosen, _ = w.getBestRouteFromStatuses(flapRelayed)
+	require.Equal(t, route.ID("route1"), chosen, "a routing peer that just dropped to relay must be kept")
+
+	chosen, _ = w.getBestRouteFromStatuses(flapRecoveredUnsampled)
+	assert.Equal(t, route.ID("route1"), chosen, "a recovered routing peer must not lose the route before its latency is sampled")
+}
+
+// A routing peer that keeps dropping to relay for less than the delay, and
+// staying direct for less than the delay in between, must keep the route on
+// every cycle: each drop is a new degradation with its own delay.
+func TestFlappingRoutingPeerIsKept(t *testing.T) {
+	w := newRelayedTestWatcher(t, relayedSwitchPolicy{delay: 30 * time.Second})
+
+	chosen, _ := w.getBestRouteFromStatuses(flapDirect)
+	require.Equal(t, route.ID("route1"), chosen)
+
+	for cycle := 0; cycle < 3; cycle++ {
+		chosen, _ = w.getBestRouteFromStatuses(flapRelayed)
+		require.Equal(t, route.ID("route1"), chosen, "cycle %d: drop to relay", cycle)
+
+		// relayed for 25s, still within the delay
+		w.degradedSince = w.degradedSince.Add(-25 * time.Second)
+		chosen, _ = w.getBestRouteFromStatuses(flapRelayed)
+		require.Equal(t, route.ID("route1"), chosen, "cycle %d: relayed within the delay", cycle)
+
+		chosen, _ = w.getBestRouteFromStatuses(flapRecoveredUnsampled)
+		require.Equal(t, route.ID("route1"), chosen, "cycle %d: recovered, latency not sampled yet", cycle)
+
+		chosen, _ = w.getBestRouteFromStatuses(flapDirect)
+		require.Equal(t, route.ID("route1"), chosen, "cycle %d: recovered and sampled", cycle)
+	}
+}
+
+// "never" only keeps a routing peer that dropped from direct. A peer that was
+// never direct must still move to a direct one after the default delay, so the
+// route is not left on a relay for good.
+func TestNeverPolicyDoesNotPinNeverDirectPeer(t *testing.T) {
+	w := newRelayedTestWatcher(t, relayedSwitchPolicy{never: true})
+
+	chosen, _ := w.getBestRouteFromStatuses(map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, relayed: true},
+		"route2": {status: peer.StatusConnecting},
+	})
+	require.Equal(t, route.ID("route1"), chosen)
+
+	chosen, _ = w.getBestRouteFromStatuses(currentRelayed)
+	require.Equal(t, route.ID("route1"), chosen, "a never-direct peer must be held for the default delay")
+	require.NotNil(t, w.relayedHold, "the default delay must arm the timer")
+
+	w.degradedSince = w.degradedSince.Add(-defaultRelayedSwitchDelay - time.Second)
+	chosen, _ = w.getBestRouteFromStatuses(currentRelayed)
+	assert.Equal(t, route.ID("route2"), chosen, "with never, a never-direct peer must still give way after the default delay")
+}
+
+// A current peer that never gets a latency sample must not keep the route
+// forever against a measured peer: once the hold runs out it is ranked as
+// unknown latency again.
+func TestUnmeasuredRoutingPeerHoldIsBounded(t *testing.T) {
+	w := newRelayedTestWatcher(t, relayedSwitchPolicy{delay: 30 * time.Second})
+
+	chosen, _ := w.getBestRouteFromStatuses(flapRecoveredUnsampled)
+	require.Equal(t, route.ID("route1"), chosen, "an unsampled current peer must be held at first")
+	require.False(t, w.unmeasuredSince.IsZero(), "the hold must record when it started")
+
+	w.unmeasuredSince = w.unmeasuredSince.Add(-unmeasuredLatencyHold - time.Second)
+	chosen, _ = w.getBestRouteFromStatuses(flapRecoveredUnsampled)
+	assert.Equal(t, route.ID("route2"), chosen, "a peer still unsampled after the hold must give way to a measured one")
+	assert.Equal(t, switchReasonLatency, w.switchReason)
+}
+
+// The delay of a peer that was never direct runs from the first direct
+// contender. When that contender goes away the delay must start over, so a
+// later contender is held for the full delay instead of taking over at once.
+func TestNeverDirectDelayRestartsWhenContenderGoes(t *testing.T) {
+	w := newRelayedTestWatcher(t, relayedSwitchPolicy{delay: 30 * time.Second})
+
+	relayedAlone := map[route.ID]routerPeerStatus{
+		"route1": {status: peer.StatusConnected, relayed: true},
+		"route2": {status: peer.StatusConnecting},
+	}
+	chosen, _ := w.getBestRouteFromStatuses(relayedAlone)
+	require.Equal(t, route.ID("route1"), chosen)
+
+	chosen, _ = w.getBestRouteFromStatuses(currentRelayed)
+	require.Equal(t, route.ID("route1"), chosen, "the first direct contender must be held")
+	require.False(t, w.degradedSince.IsZero())
+
+	// the first contender was seen longer ago than the delay
+	w.degradedSince = w.degradedSince.Add(-31 * time.Second)
+
+	chosen, _ = w.getBestRouteFromStatuses(relayedAlone)
+	require.Equal(t, route.ID("route1"), chosen)
+	assert.True(t, w.degradedSince.IsZero(), "the delay must start over once no direct contender is left")
+
+	chosen, _ = w.getBestRouteFromStatuses(currentRelayed)
+	assert.Equal(t, route.ID("route1"), chosen, "a new direct contender must be held for the full delay")
+}
diff --git a/client/internal/routemanager/manager.go b/client/internal/routemanager/manager.go
index 981b0c987..7d699fbb4 100644
--- a/client/internal/routemanager/manager.go
+++ b/client/internal/routemanager/manager.go
@@ -578,12 +578,13 @@ func (m *DefaultManager) TriggerSelection(networks route.HAMap) {
 		}
 
 		config := client.WatcherConfig{
-			Context:          m.ctx,
-			DNSRouteInterval: m.dnsRouteInterval,
-			WGInterface:      m.wgInterface,
-			StatusRecorder:   m.statusRecorder,
-			Route:            routes[0],
-			Handler:          handler,
+			Context:             m.ctx,
+			DNSRouteInterval:    m.dnsRouteInterval,
+			WGInterface:         m.wgInterface,
+			StatusRecorder:      m.statusRecorder,
+			Route:               routes[0],
+			Handler:             handler,
+			ReconcileAllowedIPs: m.ReconcilePeerAllowedIPs,
 		}
 		clientNetworkWatcher := client.NewWatcher(config)
 		m.clientNetworks[id] = clientNetworkWatcher
@@ -628,12 +629,13 @@ func (m *DefaultManager) updateClientNetworks(updateSerial uint64, networks rout
 			}
 
 			config := client.WatcherConfig{
-				Context:          m.ctx,
-				DNSRouteInterval: m.dnsRouteInterval,
-				WGInterface:      m.wgInterface,
-				StatusRecorder:   m.statusRecorder,
-				Route:            routes[0],
-				Handler:          handler,
+				Context:             m.ctx,
+				DNSRouteInterval:    m.dnsRouteInterval,
+				WGInterface:         m.wgInterface,
+				StatusRecorder:      m.statusRecorder,
+				Route:               routes[0],
+				Handler:             handler,
+				ReconcileAllowedIPs: m.ReconcilePeerAllowedIPs,
 			}
 			clientNetworkWatcher = client.NewWatcher(config)
 			m.clientNetworks[id] = clientNetworkWatcher

From 9d837c6ae672c93fd23d40dafb615541d4bd6b2e Mon Sep 17 00:00:00 2001
From: Viktor Liu <17948409+lixmal@users.noreply.github.com>
Date: Thu, 15 Oct 2026 19:14:26 +0900
Subject: [PATCH 64/70] [client, management] Fix the edge cases left open in
 the certificate posture check (#8174)

---
 .github/workflows/release.yml                 |   2 +
 .goreleaser.yaml                              |  32 ++++-
 client/internal/certproof/collect.go          |  14 ++-
 client/internal/certproof/collect_darwin.go   |   8 +-
 client/internal/certproof/collect_test.go     |  18 +--
 client/internal/certproof/collect_windows.go  |   6 +-
 .../internal/certproof/consoleuser_darwin.go  |   4 +-
 .../certproof/consoleuser_darwin_test.go      |   4 +-
 .../internal/certproof/desktopuser_windows.go |  12 +-
 .../certproof/desktopuser_windows_test.go     |   8 +-
 client/internal/certproof/helper_spawn.go     |  45 -------
 .../internal/certproof/helper_spawn_test.go   |  27 ----
 client/internal/certproof/helper_test.go      |  11 +-
 client/internal/certproof/keychain_darwin.go  |  27 ++--
 client/internal/certproof/keystore_test.go    |   6 +-
 client/internal/certproof/merge.go            |  50 ++++++++
 client/internal/certproof/merge_test.go       |  54 ++++++++
 client/internal/certproof/pkcs11store.go      |  51 ++++----
 client/internal/certproof/pkcs11store_test.go |  33 +++--
 client/internal/certproof/signattempts.go     |  24 ++++
 .../internal/certproof/signattempts_test.go   |  41 +++++++
 client/internal/certproof/store.go            |  12 +-
 client/internal/certproof/store_other.go      |   6 +-
 client/internal/certproof/store_other_test.go |  10 +-
 client/internal/certproof/store_tpm_test.go   |   4 +-
 .../internal/certproof/storefile_unix_test.go |   2 +-
 .../internal/certproof/systemstore_windows.go |  22 ++--
 client/internal/pkcs11/driver_linux.go        |  69 ++++++++---
 client/internal/pkcs11/driver_linux_test.go   | 116 ++++++++++++++++++
 client/internal/pkcs11/pkcs11.go              |   1 +
 client/internal/pkcs11/publickey.go           |   8 +-
 client/internal/pkcs11/publickey_test.go      |  16 +++
 client/internal/pkcs11/uri.go                 |  57 ++++++++-
 client/internal/pkcs11/uri_test.go            |  56 +++++++++
 .../network_map_db/shared_types_test.go       |  22 ++++
 .../certposture/certposture_test.go           |  21 ++++
 shared/management/client/grpc_test.go         |  24 ++++
 shared/management/http/api/openapi.yml        |   1 +
 38 files changed, 718 insertions(+), 206 deletions(-)
 create mode 100644 client/internal/certproof/merge.go
 create mode 100644 client/internal/certproof/merge_test.go
 create mode 100644 client/internal/certproof/signattempts.go
 create mode 100644 client/internal/certproof/signattempts_test.go

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b3ed4763c..22ab7f566 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -417,6 +417,8 @@ jobs:
           path: |
             dist/netbird_linux**
             dist/netbird-pkcs11_linux**
+            dist/netbird-deb-32bit_linux**
+            dist/netbird-rpm-*_linux**
           retention-days: 7
       - name: upload windows packages
         id: upload_windows_packages
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index de5f7419c..41c330a64 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -40,8 +40,9 @@ builds:
     tags:
       - load_wgnt_from_rsrc
 
-  # deb and rpm packages target glibc distributions, so they carry the PKCS#11 store, which
-  # links libc. Tarballs and the Alpine-based images keep the static build above.
+  # deb and rpm packages target glibc distributions, so on amd64 and arm64, the only
+  # architectures with a PKCS#11 driver, they carry the PKCS#11 store, which links libc.
+  # Tarballs, the Alpine-based images and the other architectures keep the static build.
   - id: netbird-pkcs11
     dir: client
     binary: netbird
@@ -49,10 +50,8 @@ builds:
     goos:
       - linux
     goarch:
-      - arm
       - amd64
       - arm64
-      - 386
     ldflags:
       - -s -w -X github.com/netbirdio/netbird/version.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}} -X main.builtBy=goreleaser
     mod_timestamp: "{{ .CommitTimestamp }}"
@@ -60,8 +59,24 @@ builds:
       - load_wgnt_from_rsrc
       - pkcs11
 
-  # Single-arch builds: nfpm provides is not templated, so the RPM splits per arch. They
-  # carry the PKCS#11 store like the deb build above.
+  # The 32-bit deb architectures, which have no PKCS#11 driver.
+  - id: netbird-deb-32bit
+    dir: client
+    binary: netbird
+    env: [CGO_ENABLED=0]
+    goos:
+      - linux
+    goarch:
+      - arm
+      - 386
+    ldflags:
+      - -s -w -X github.com/netbirdio/netbird/version.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}} -X main.builtBy=goreleaser
+    mod_timestamp: "{{ .CommitTimestamp }}"
+    tags:
+      - load_wgnt_from_rsrc
+
+  # Single-arch builds: nfpm provides is not templated, so the RPM splits per arch. The
+  # ones with a PKCS#11 driver carry the store like the deb build above.
   - &netbird_rpm_build
     id: netbird-rpm-amd64
     dir: client
@@ -83,10 +98,14 @@ builds:
   - <<: *netbird_rpm_build
     id: netbird-rpm-arm
     goarch: [arm]
+    tags:
+      - load_wgnt_from_rsrc
 
   - <<: *netbird_rpm_build
     id: netbird-rpm-386
     goarch: [386]
+    tags:
+      - load_wgnt_from_rsrc
 
   - id: netbird-static
     dir: client
@@ -323,6 +342,7 @@ nfpms:
     bindir: /usr/bin
     builds:
       - netbird-pkcs11
+      - netbird-deb-32bit
     formats:
       - deb
     scripts:
diff --git a/client/internal/certproof/collect.go b/client/internal/certproof/collect.go
index 65affca71..310fd2b19 100644
--- a/client/internal/certproof/collect.go
+++ b/client/internal/certproof/collect.go
@@ -149,9 +149,19 @@ func prove(signer crypto.Signer, chain []*x509.Certificate, nonce, peerKey []byt
 }
 
 func chainFingerprint(chain []*x509.Certificate) [sha256.Size]byte {
-	buf := make([]byte, 0, len(chain)*sha256.Size)
+	ders := make([][]byte, 0, len(chain))
 	for _, cert := range chain {
-		certHash := sha256.Sum256(cert.Raw)
+		ders = append(ders, cert.Raw)
+	}
+	return chainDERFingerprint(ders)
+}
+
+// chainDERFingerprint identifies a chain of DER certificates by the hashes of all of them,
+// in order.
+func chainDERFingerprint(chain [][]byte) [sha256.Size]byte {
+	buf := make([]byte, 0, len(chain)*sha256.Size)
+	for _, der := range chain {
+		certHash := sha256.Sum256(der)
 		buf = append(buf, certHash[:]...)
 	}
 	return sha256.Sum256(buf)
diff --git a/client/internal/certproof/collect_darwin.go b/client/internal/certproof/collect_darwin.go
index 92f0471e7..cc21563c1 100644
--- a/client/internal/certproof/collect_darwin.go
+++ b/client/internal/certproof/collect_darwin.go
@@ -60,7 +60,7 @@ func UserContext(cfg Config) string {
 	if os.Geteuid() != 0 || cfg.OwnerUnknown {
 		return ""
 	}
-	user, ok := CurrentConsoleUser()
+	user, ok := currentConsoleUser()
 	if !ok || !user.isOwner(cfg.ProfileOwner) {
 		return ""
 	}
@@ -72,7 +72,7 @@ func UserContext(cfg Config) string {
 // per-session securityd, so the helper has to enter their Mach bootstrap namespace,
 // which is what launchctl asuser does.
 func collectAsConsoleUser(ctx context.Context, owner string, challenges []*proto.CertificateChallenge, peerKey []byte) ([]certposture.Proof, error) {
-	user, ok := CurrentConsoleUser()
+	user, ok := currentConsoleUser()
 	if !ok {
 		return nil, nil
 	}
@@ -126,12 +126,12 @@ func helperStore() Store {
 	home, err := os.UserHomeDir()
 	if err != nil {
 		log.Debugf("certificate posture: no home directory, searching the default keychain list: %v", err)
-		return NewKeychainStore()
+		return newKeychainStore()
 	}
 	login := filepath.Join(home, "Library", "Keychains", "login.keychain-db")
 	if _, err := os.Stat(login); err != nil {
 		// Keychains created before macOS 10.12 keep the old file name.
 		login = filepath.Join(home, "Library", "Keychains", "login.keychain")
 	}
-	return NewKeychainStore(login)
+	return newKeychainStore(login)
 }
diff --git a/client/internal/certproof/collect_test.go b/client/internal/certproof/collect_test.go
index e16ee3668..aa033dea5 100644
--- a/client/internal/certproof/collect_test.go
+++ b/client/internal/certproof/collect_test.go
@@ -51,7 +51,7 @@ func TestCollect_ProvesOneMatchingCertificatePerChallenge(t *testing.T) {
 		challenge("not a pem"),
 	}
 
-	proofs := Collect(context.Background(), NewFileStore(dir), checks, peerKey)
+	proofs := Collect(context.Background(), newFileStore(dir), checks, peerKey)
 
 	require.Len(t, proofs, 2)
 	var subjects []string
@@ -74,10 +74,10 @@ func TestCollect_NothingToProve(t *testing.T) {
 		store  Store
 		checks []*proto.Checks
 	}{
-		{"no checks", NewFileStore(dir), nil},
-		{"files only", NewFileStore(dir), []*proto.Checks{{Files: []string{"/bin/x"}}}},
-		{"challenge without nonce", NewFileStore(dir), []*proto.Checks{{CertificateChallenge: &proto.CertificateChallenge{CaCertificates: []string{ca.PEM}}}}},
-		{"missing store dir", NewFileStore(filepath.Join(dir, "missing")), []*proto.Checks{{CertificateChallenge: &proto.CertificateChallenge{Nonce: make([]byte, certposture.NonceSize), CaCertificates: []string{ca.PEM}}}}},
+		{"no checks", newFileStore(dir), nil},
+		{"files only", newFileStore(dir), []*proto.Checks{{Files: []string{"/bin/x"}}}},
+		{"challenge without nonce", newFileStore(dir), []*proto.Checks{{CertificateChallenge: &proto.CertificateChallenge{CaCertificates: []string{ca.PEM}}}}},
+		{"missing store dir", newFileStore(filepath.Join(dir, "missing")), []*proto.Checks{{CertificateChallenge: &proto.CertificateChallenge{Nonce: make([]byte, certposture.NonceSize), CaCertificates: []string{ca.PEM}}}}},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -95,7 +95,7 @@ func TestFileStore_ChainWithIntermediate(t *testing.T) {
 	dir := storeDir(t)
 	writeFile(t, dir, "device.pem", certtest.CertPEM(leaf)+certtest.CertPEM(intermediate.Cert)+certtest.KeyPEM(t, key))
 
-	candidates, err := NewFileStore(dir).Candidates(context.Background())
+	candidates, err := newFileStore(dir).Candidates(context.Background())
 	require.NoError(t, err)
 	require.Len(t, candidates, 1)
 	require.Len(t, candidates[0].Chain, 2)
@@ -124,7 +124,7 @@ func TestCollectChallenges_RefusesMalformedInput(t *testing.T) {
 	dir := storeDir(t)
 	key := certtest.ECDSAKey(t)
 	writeFile(t, dir, "device.pem", certtest.CertPEM(ca.Issue(t, key, "device"))+certtest.KeyPEM(t, key))
-	store := NewFileStore(dir)
+	store := newFileStore(dir)
 	nonce := certposture.NewChallenger([]byte("secret")).Nonce(peerKey, time.Now())
 
 	tests := []struct {
@@ -159,7 +159,7 @@ func TestFileStore_SkipsKeyOfAnotherCertificate(t *testing.T) {
 	good := ca.Issue(t, goodKey, "good")
 	writeFile(t, dir, "b-good.pem", certtest.CertPEM(good)+certtest.KeyPEM(t, goodKey))
 
-	candidates, err := NewFileStore(dir).Candidates(context.Background())
+	candidates, err := newFileStore(dir).Candidates(context.Background())
 	require.NoError(t, err)
 	require.Len(t, candidates, 1, "only the certificate whose key matches is a candidate")
 	assert.True(t, good.Equal(candidates[0].Chain[0]), "the matching pair is kept")
@@ -167,7 +167,7 @@ func TestFileStore_SkipsKeyOfAnotherCertificate(t *testing.T) {
 	challenger := certposture.NewChallenger([]byte("secret"))
 	now := time.Now()
 	nonce := challenger.Nonce(peerKey, now)
-	proofs := CollectChallenges(context.Background(), NewFileStore(dir), []*proto.CertificateChallenge{{Nonce: nonce, CaCertificates: []string{ca.PEM}}}, peerKey)
+	proofs := CollectChallenges(context.Background(), newFileStore(dir), []*proto.CertificateChallenge{{Nonce: nonce, CaCertificates: []string{ca.PEM}}}, peerKey)
 	require.Len(t, proofs, 1)
 	_, err = challenger.Verify(proofs[0], peerKey, now)
 	assert.NoError(t, err, "the proof sent is one management accepts")
diff --git a/client/internal/certproof/collect_windows.go b/client/internal/certproof/collect_windows.go
index 8e5695539..3b21ec147 100644
--- a/client/internal/certproof/collect_windows.go
+++ b/client/internal/certproof/collect_windows.go
@@ -51,7 +51,7 @@ func UserContext(cfg Config) string {
 	if !runningAsLocalSystem() || cfg.OwnerUnknown {
 		return ""
 	}
-	user, ok := CurrentDesktopUser(cfg.ProfileOwner)
+	user, ok := currentDesktopUser(cfg.ProfileOwner)
 	if !ok {
 		return ""
 	}
@@ -62,14 +62,14 @@ func UserContext(cfg Config) string {
 // helperStore is the store the helper reads. It runs as the signed-in user, so it wants
 // that user's store rather than the machine store the service already read.
 func helperStore() Store {
-	return NewUserStore()
+	return newUserStore()
 }
 
 // collectAsDesktopUser runs the helper inside the interactive session of the signed-in
 // user. Unlike a keychain on macOS, a Windows service can assume a user identity
 // directly, so the session token goes straight into the child process.
 func collectAsDesktopUser(ctx context.Context, owner string, challenges []*proto.CertificateChallenge, peerKey []byte) ([]certposture.Proof, error) {
-	user, ok := CurrentDesktopUser(owner)
+	user, ok := currentDesktopUser(owner)
 	if !ok {
 		return nil, nil
 	}
diff --git a/client/internal/certproof/consoleuser_darwin.go b/client/internal/certproof/consoleuser_darwin.go
index a5182c7fd..1045bc014 100644
--- a/client/internal/certproof/consoleuser_darwin.go
+++ b/client/internal/certproof/consoleuser_darwin.go
@@ -35,10 +35,10 @@ type ConsoleUser struct {
 	GID  uint32
 }
 
-// CurrentConsoleUser reports the user sitting at the desktop. The second return value is
+// currentConsoleUser reports the user sitting at the desktop. The second return value is
 // false when nobody is: at the login window macOS either reports no console user at all
 // or attributes the session to root, and neither has a login keychain to offer.
-func CurrentConsoleUser() (ConsoleUser, bool) {
+func currentConsoleUser() (ConsoleUser, bool) {
 	if err := loadConsoleUser(); err != nil {
 		log.Debugf("console user lookup unavailable: %v", err)
 		return ConsoleUser{}, false
diff --git a/client/internal/certproof/consoleuser_darwin_test.go b/client/internal/certproof/consoleuser_darwin_test.go
index 9c1aaa22c..051cc4ab0 100644
--- a/client/internal/certproof/consoleuser_darwin_test.go
+++ b/client/internal/certproof/consoleuser_darwin_test.go
@@ -27,10 +27,10 @@ func TestConsoleUser_OnlyADesktopSessionCanBeValidated(t *testing.T) {
 	}
 }
 
-// CurrentConsoleUser runs against the real SystemConfiguration framework. A machine with
+// currentConsoleUser runs against the real SystemConfiguration framework. A machine with
 // a desktop open must report a non-root user; a headless runner must report none.
 func TestCurrentConsoleUser_AgreesWithItself(t *testing.T) {
-	user, ok := CurrentConsoleUser()
+	user, ok := currentConsoleUser()
 	if !ok {
 		t.Log("no console user, running headless")
 		return
diff --git a/client/internal/certproof/desktopuser_windows.go b/client/internal/certproof/desktopuser_windows.go
index 6f50aae4f..0a9d63b36 100644
--- a/client/internal/certproof/desktopuser_windows.go
+++ b/client/internal/certproof/desktopuser_windows.go
@@ -13,12 +13,8 @@ const (
 	noActiveSession = 0xFFFFFFFF
 	servicesSession = 0
 
-	// wtsCurrentServer is WTS_CURRENT_SERVER_HANDLE; wtsActive and wtsDisconnected are
-	// WTSActive and WTSDisconnected of WTS_CONNECTSTATE_CLASS. None is exported by
-	// x/sys/windows.
+	// wtsCurrentServer is WTS_CURRENT_SERVER_HANDLE, which x/sys/windows does not export.
 	wtsCurrentServer = windows.Handle(0)
-	wtsActive        = 0
-	wtsDisconnected  = 4
 )
 
 // DesktopUser is an interactive session and the account signed into it. The user's
@@ -37,7 +33,7 @@ func (u DesktopUser) Close() {
 	}
 }
 
-// CurrentDesktopUser returns a token for the session whose certificate store should be
+// currentDesktopUser returns a token for the session whose certificate store should be
 // asked: a session of owner, the account the active profile belongs to, with the
 // physical console preferred over remote sessions. With no owner only the console user
 // counts. Picking any signed-in user instead would let whoever else is logged in to a
@@ -46,7 +42,7 @@ func (u DesktopUser) Close() {
 //
 // Obtaining the token needs SE_TCB_NAME, which the LocalSystem service has and an
 // ordinary process does not.
-func CurrentDesktopUser(owner string) (DesktopUser, bool) {
+func currentDesktopUser(owner string) (DesktopUser, bool) {
 	console := windows.WTSGetActiveConsoleSessionId()
 	if owner == "" {
 		return consoleUser(console)
@@ -163,7 +159,7 @@ func userSessions(console uint32) ([]uint32, error) {
 	if console != noActiveSession && console != servicesSession {
 		sessions = append(sessions, console)
 	}
-	for _, state := range []uint32{wtsActive, wtsDisconnected} {
+	for _, state := range []uint32{windows.WTSActive, windows.WTSDisconnected} {
 		for _, session := range unsafe.Slice(info, count) {
 			if session.SessionID == servicesSession || session.SessionID == console || session.State != state {
 				continue
diff --git a/client/internal/certproof/desktopuser_windows_test.go b/client/internal/certproof/desktopuser_windows_test.go
index 95d29eb5f..c3c4022e5 100644
--- a/client/internal/certproof/desktopuser_windows_test.go
+++ b/client/internal/certproof/desktopuser_windows_test.go
@@ -26,10 +26,10 @@ func TestSameAccountName(t *testing.T) {
 	}
 }
 
-// CurrentDesktopUser against the real session manager: an owner no session belongs to
+// currentDesktopUser against the real session manager: an owner no session belongs to
 // must never yield a session, whoever else is signed in.
 func TestCurrentDesktopUser_UnknownOwnerHasNoSession(t *testing.T) {
-	user, ok := CurrentDesktopUser(`NO-SUCH-DOMAIN\no-such-user-netbird`)
+	user, ok := currentDesktopUser(`NO-SUCH-DOMAIN\no-such-user-netbird`)
 	if ok {
 		user.Close()
 	}
@@ -44,14 +44,14 @@ func TestCurrentDesktopUser_FindsTheOwnersSession(t *testing.T) {
 	if owner == "" {
 		t.Skip("set NB_TEST_DESKTOP_OWNER to a signed-in account and run as LocalSystem")
 	}
-	user, ok := CurrentDesktopUser(owner)
+	user, ok := currentDesktopUser(owner)
 	require.True(t, ok, "the signed-in owner %s must have a session", owner)
 	defer user.Close()
 	t.Logf("owner %s resolved to session %d as %s", owner, user.Session, user.Name)
 	assert.True(t, sameAccountName(user.Name, owner), "the session found belongs to %s, not %s", owner, user.Name)
 	assert.NotZero(t, user.Session, "session 0 hosts services and never belongs to the owner")
 
-	console, consoleOK := CurrentDesktopUser("")
+	console, consoleOK := currentDesktopUser("")
 	if consoleOK {
 		defer console.Close()
 		t.Logf("without an owner the console user counts: session %d as %s", console.Session, console.Name)
diff --git a/client/internal/certproof/helper_spawn.go b/client/internal/certproof/helper_spawn.go
index 968cc3679..54ed265ec 100644
--- a/client/internal/certproof/helper_spawn.go
+++ b/client/internal/certproof/helper_spawn.go
@@ -3,12 +3,6 @@
 package certproof
 
 import (
-	"crypto/sha256"
-	"crypto/x509"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/shared/management/certposture"
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
@@ -22,42 +16,3 @@ func helperRequest(challenges []*proto.CertificateChallenge, peerKey []byte) Hel
 	}
 	return req
 }
-
-// mergeProofs appends the user session proofs to the device proofs, dropping a leaf that
-// both stores hold so the same certificate is proven once.
-func mergeProofs(device, user []certposture.Proof) []certposture.Proof {
-	if len(user) == 0 {
-		return device
-	}
-
-	seen := make(map[[sha256.Size]byte]struct{}, len(device))
-	for _, proof := range device {
-		if len(proof.Chain) > 0 {
-			seen[sha256.Sum256(proof.Chain[0])] = struct{}{}
-		}
-	}
-
-	merged := device
-	for _, proof := range user {
-		if len(proof.Chain) == 0 {
-			continue
-		}
-		fingerprint := sha256.Sum256(proof.Chain[0])
-		if _, done := seen[fingerprint]; done {
-			continue
-		}
-		seen[fingerprint] = struct{}{}
-		merged = append(merged, proof)
-		logUserProof(proof)
-	}
-	return merged
-}
-
-func logUserProof(proof certposture.Proof) {
-	leaf, err := x509.ParseCertificate(proof.Chain[0])
-	if err != nil {
-		log.Debugf("certificate posture: user proof carries an unparsable leaf: %v", err)
-		return
-	}
-	log.Debugf("certificate posture: signed-in user proved %q issued by %q", leaf.Subject, leaf.Issuer)
-}
diff --git a/client/internal/certproof/helper_spawn_test.go b/client/internal/certproof/helper_spawn_test.go
index 338a5f66a..74a792a49 100644
--- a/client/internal/certproof/helper_spawn_test.go
+++ b/client/internal/certproof/helper_spawn_test.go
@@ -3,42 +3,15 @@
 package certproof
 
 import (
-	"crypto/sha256"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/netbirdio/netbird/shared/management/certposture"
 	"github.com/netbirdio/netbird/shared/management/certposture/certtest"
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
-func TestMergeProofs_ProvesACertificateHeldByBothStoresOnce(t *testing.T) {
-	ca := certtest.NewCA(t, "corp-root")
-	shared := ca.Issue(t, certtest.ECDSAKey(t), "shared")
-	userOnly := ca.Issue(t, certtest.ECDSAKey(t), "user-only")
-
-	device := []certposture.Proof{{Chain: [][]byte{shared.Raw}}}
-	user := []certposture.Proof{{Chain: [][]byte{shared.Raw}}, {Chain: [][]byte{userOnly.Raw}}, {}}
-
-	merged := mergeProofs(device, user)
-
-	require.Len(t, merged, 2, "the shared leaf is proven once and the empty chain is dropped")
-	assert.Equal(t, shared.Raw, merged[0].Chain[0], "the device proof keeps its place")
-	assert.Equal(t, userOnly.Raw, merged[1].Chain[0], "the user-only certificate is appended")
-}
-
-func TestMergeProofs_KeepsDeviceProofsWhenNoUserSession(t *testing.T) {
-	ca := certtest.NewCA(t, "corp-root")
-	device := []certposture.Proof{{Chain: [][]byte{ca.Issue(t, certtest.ECDSAKey(t), "device").Raw}}}
-
-	merged := mergeProofs(device, nil)
-
-	require.Len(t, merged, 1, "a machine with nobody signed in still sends its device proof")
-	assert.Equal(t, sha256.Sum256(device[0].Chain[0]), sha256.Sum256(merged[0].Chain[0]), "the device proof is unchanged")
-}
-
 func TestHelperRequest_CarriesEveryChallenge(t *testing.T) {
 	ca := certtest.NewCA(t, "corp-root")
 	challenges := []*proto.CertificateChallenge{
diff --git a/client/internal/certproof/helper_test.go b/client/internal/certproof/helper_test.go
index 37dadead2..61fcc8532 100644
--- a/client/internal/certproof/helper_test.go
+++ b/client/internal/certproof/helper_test.go
@@ -14,7 +14,10 @@ import (
 	"github.com/netbirdio/netbird/shared/management/certposture/certtest"
 )
 
-func TestRunHelper_ProofSurvivesTheProcessBoundary(t *testing.T) {
+// TestRunHelper_AnswersAChallengeFromItsStore runs the helper's request and response
+// handling in-process: the proof it writes verifies as the daemon will verify it. The
+// process boundary itself is covered by the runHelperCmd tests.
+func TestRunHelper_AnswersAChallengeFromItsStore(t *testing.T) {
 	ca := certtest.NewCA(t, "corp-root")
 	dir := storeDir(t)
 	key := certtest.ECDSAKey(t)
@@ -29,7 +32,7 @@ func TestRunHelper_ProofSurvivesTheProcessBoundary(t *testing.T) {
 	require.NoError(t, err, "request must encode")
 
 	var stdout bytes.Buffer
-	require.NoError(t, runHelper(context.Background(), NewFileStore(dir), bytes.NewReader(request), &stdout))
+	require.NoError(t, runHelper(context.Background(), newFileStore(dir), bytes.NewReader(request), &stdout))
 
 	var resp HelperResponse
 	require.NoError(t, json.Unmarshal(stdout.Bytes(), &resp), "helper must emit decodable JSON")
@@ -47,7 +50,7 @@ func TestRunHelper_NoChallengesYieldsEmptyResponse(t *testing.T) {
 	require.NoError(t, err)
 
 	var stdout bytes.Buffer
-	require.NoError(t, runHelper(context.Background(), NewFileStore(storeDir(t)), bytes.NewReader(request), &stdout))
+	require.NoError(t, runHelper(context.Background(), newFileStore(storeDir(t)), bytes.NewReader(request), &stdout))
 
 	var resp HelperResponse
 	require.NoError(t, json.Unmarshal(stdout.Bytes(), &resp), "an empty request must still emit valid JSON")
@@ -56,7 +59,7 @@ func TestRunHelper_NoChallengesYieldsEmptyResponse(t *testing.T) {
 
 func TestRunHelper_RejectsMalformedRequest(t *testing.T) {
 	var stdout bytes.Buffer
-	err := runHelper(context.Background(), NewFileStore(storeDir(t)), bytes.NewReader([]byte("not json")), &stdout)
+	err := runHelper(context.Background(), newFileStore(storeDir(t)), bytes.NewReader([]byte("not json")), &stdout)
 
 	require.Error(t, err, "a malformed request must fail rather than emit an empty proof set")
 	assert.Empty(t, stdout.String(), "nothing should be written to stdout on a decode failure")
diff --git a/client/internal/certproof/keychain_darwin.go b/client/internal/certproof/keychain_darwin.go
index 2bffdc81e..5b1426997 100644
--- a/client/internal/certproof/keychain_darwin.go
+++ b/client/internal/certproof/keychain_darwin.go
@@ -71,25 +71,25 @@ const systemKeychain = "/Library/Keychains/System.keychain"
 // by an ordinary user, it is that user's keychain search list.
 func DefaultStore() Store {
 	if os.Geteuid() == 0 {
-		return NewKeychainStore(systemKeychain)
+		return newKeychainStore(systemKeychain)
 	}
-	return NewKeychainStore()
+	return newKeychainStore()
 }
 
-// KeychainStore yields the identities of a set of keychains, or of the process's keychain
+// keychainStore yields the identities of a set of keychains, or of the process's keychain
 // search list when none is named, reached through purego so the client keeps building
 // with CGO_ENABLED=0.
-type KeychainStore struct {
+type keychainStore struct {
 	keychains []string
 }
 
-// NewKeychainStore returns a store that searches the keychain files at paths, or the
+// newKeychainStore returns a store that searches the keychain files at paths, or the
 // process's keychain search list when no path is given.
-func NewKeychainStore(paths ...string) *KeychainStore {
-	return &KeychainStore{keychains: paths}
+func newKeychainStore(paths ...string) *keychainStore {
+	return &keychainStore{keychains: paths}
 }
 
-func (s *KeychainStore) Candidates(_ context.Context) ([]Candidate, error) {
+func (s *keychainStore) Candidates(_ context.Context) ([]Candidate, error) {
 	if err := loadKeychain(); err != nil {
 		return nil, err
 	}
@@ -163,17 +163,24 @@ func (s *keychainSigner) Sign(_ io.Reader, digest []byte, opts crypto.SignerOpts
 
 	algorithm := keychainAlgorithm(scheme)
 	var signature []byte
+	var attempts signAttempts
 	err = eachIdentity(searchList, func(identity uintptr, der []byte) (bool, error) {
 		if !bytes.Equal(der, s.leaf.Raw) {
 			return false, nil
 		}
-		signature, err = signWithIdentity(identity, algorithm, digest)
-		return true, err
+		// The same certificate can sit in the keychain with more than one key, of which
+		// only one may be usable, so a failure moves on to the next match.
+		var ok bool
+		signature, ok = attempts.try(func() ([]byte, error) { return signWithIdentity(identity, algorithm, digest) })
+		return ok, nil
 	})
 	if err != nil {
 		return nil, err
 	}
 	if signature == nil {
+		if err := attempts.err(); err != nil {
+			return nil, err
+		}
 		return nil, errors.New("certificate is no longer in the keychain")
 	}
 	log.Debugf("keychain signed certificate posture challenge for %q, %d bytes", s.leaf.Subject, len(signature))
diff --git a/client/internal/certproof/keystore_test.go b/client/internal/certproof/keystore_test.go
index 592d7414f..7d028c4fb 100644
--- a/client/internal/certproof/keystore_test.go
+++ b/client/internal/certproof/keystore_test.go
@@ -56,6 +56,8 @@ func TestSchemeFor(t *testing.T) {
 		{"ecdsa sha384", ecKey.Public(), crypto.SHA384, schemeECDSASHA384},
 		{"rsa pss sha256", rsaKey.Public(), pss, schemeRSAPSSSHA256},
 		{"rsa pkcs1v15", rsaKey.Public(), crypto.SHA256, 0},
+		{"ecdsa sha512", ecKey.Public(), crypto.SHA512, 0},
+		{"rsa pss sha384", rsaKey.Public(), &rsa.PSSOptions{SaltLength: rsa.PSSSaltLengthEqualsHash, Hash: crypto.SHA384}, 0},
 		{"ed25519", certtest.Ed25519Key(t).Public(), crypto.Hash(0), 0},
 	}
 	for _, tc := range tests {
@@ -83,5 +85,7 @@ func TestECDSASignatureASN1(t *testing.T) {
 	assert.True(t, ecdsa.VerifyASN1(&key.PublicKey, digest[:], der))
 
 	_, err = ecdsaSignatureASN1(raw[:63])
-	assert.Error(t, err)
+	assert.Error(t, err, "an odd length cannot split into r and s")
+	_, err = ecdsaSignatureASN1(nil)
+	assert.Error(t, err, "an empty signature is malformed")
 }
diff --git a/client/internal/certproof/merge.go b/client/internal/certproof/merge.go
new file mode 100644
index 000000000..d539ce927
--- /dev/null
+++ b/client/internal/certproof/merge.go
@@ -0,0 +1,50 @@
+package certproof
+
+import (
+	"crypto/sha256"
+	"crypto/x509"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+)
+
+// mergeProofs appends the user session proofs to the device proofs, dropping one whose
+// chain the device already proved. Management checks each chain against each check's CAs,
+// so the same leaf proven through another chain is kept.
+func mergeProofs(device, user []certposture.Proof) []certposture.Proof {
+	if len(user) == 0 {
+		return device
+	}
+
+	seen := make(map[[sha256.Size]byte]struct{}, len(device)+len(user))
+	for _, proof := range device {
+		if len(proof.Chain) > 0 {
+			seen[chainDERFingerprint(proof.Chain)] = struct{}{}
+		}
+	}
+
+	merged := device
+	for _, proof := range user {
+		if len(proof.Chain) == 0 {
+			continue
+		}
+		fingerprint := chainDERFingerprint(proof.Chain)
+		if _, done := seen[fingerprint]; done {
+			continue
+		}
+		seen[fingerprint] = struct{}{}
+		merged = append(merged, proof)
+		logUserProof(proof)
+	}
+	return merged
+}
+
+func logUserProof(proof certposture.Proof) {
+	leaf, err := x509.ParseCertificate(proof.Chain[0])
+	if err != nil {
+		log.Debugf("certificate posture: user proof carries an unparsable leaf: %v", err)
+		return
+	}
+	log.Debugf("certificate posture: signed-in user proved %q issued by %q", leaf.Subject, leaf.Issuer)
+}
diff --git a/client/internal/certproof/merge_test.go b/client/internal/certproof/merge_test.go
new file mode 100644
index 000000000..7db2dd421
--- /dev/null
+++ b/client/internal/certproof/merge_test.go
@@ -0,0 +1,54 @@
+package certproof
+
+import (
+	"crypto/sha256"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/management/certposture"
+	"github.com/netbirdio/netbird/shared/management/certposture/certtest"
+)
+
+func TestMergeProofs_ProvesACertificateHeldByBothStoresOnce(t *testing.T) {
+	ca := certtest.NewCA(t, "corp-root")
+	shared := ca.Issue(t, certtest.ECDSAKey(t), "shared")
+	userOnly := ca.Issue(t, certtest.ECDSAKey(t), "user-only")
+
+	device := []certposture.Proof{{Chain: [][]byte{shared.Raw}}}
+	user := []certposture.Proof{{Chain: [][]byte{shared.Raw}}, {Chain: [][]byte{userOnly.Raw}}, {}}
+
+	merged := mergeProofs(device, user)
+
+	require.Len(t, merged, 2, "the shared leaf is proven once and the empty chain is dropped")
+	assert.Equal(t, shared.Raw, merged[0].Chain[0], "the device proof keeps its place")
+	assert.Equal(t, userOnly.Raw, merged[1].Chain[0], "the user-only certificate is appended")
+}
+
+func TestMergeProofs_KeepsDeviceProofsWhenNoUserSession(t *testing.T) {
+	ca := certtest.NewCA(t, "corp-root")
+	device := []certposture.Proof{{Chain: [][]byte{ca.Issue(t, certtest.ECDSAKey(t), "device").Raw}}}
+
+	merged := mergeProofs(device, nil)
+
+	require.Len(t, merged, 1, "a machine with nobody signed in still sends its device proof")
+	assert.Equal(t, sha256.Sum256(device[0].Chain[0]), sha256.Sum256(merged[0].Chain[0]), "the device proof is unchanged")
+}
+
+func TestMergeProofs_KeepsAnotherChainOfTheSameLeaf(t *testing.T) {
+	root := certtest.NewCA(t, "corp-root")
+	interA := root.Issue(t, certtest.ECDSAKey(t), "inter-a")
+	interB := root.Issue(t, certtest.ECDSAKey(t), "inter-b")
+	leaf := root.Issue(t, certtest.ECDSAKey(t), "leaf")
+
+	// Management checks each chain against each check's CAs, so the same leaf proven
+	// through another chain is a different proof, not a duplicate.
+	device := []certposture.Proof{{Chain: [][]byte{leaf.Raw, interA.Raw}}}
+	user := []certposture.Proof{{Chain: [][]byte{leaf.Raw, interB.Raw}}, {Chain: [][]byte{leaf.Raw, interA.Raw}}}
+
+	merged := mergeProofs(device, user)
+
+	require.Len(t, merged, 2, "the chain only the user store holds is kept, the one both hold is not repeated")
+	assert.Equal(t, interB.Raw, merged[1].Chain[1], "the user's chain through the other intermediate is appended")
+}
diff --git a/client/internal/certproof/pkcs11store.go b/client/internal/certproof/pkcs11store.go
index 1f88e7600..381f55799 100644
--- a/client/internal/certproof/pkcs11store.go
+++ b/client/internal/certproof/pkcs11store.go
@@ -38,24 +38,24 @@ func PKCS11FromEnv() PKCS11Config {
 	return PKCS11Config{URI: os.Getenv(PKCS11URIEnv), PIN: os.Getenv(PINEnv)}
 }
 
-// PKCS11Store yields the identities of a PKCS#11 token, which is how tpm2-pkcs11 exposes
+// pkcs11Store yields the identities of a PKCS#11 token, which is how tpm2-pkcs11 exposes
 // TPM-held keys on Linux. Certificates on the token are paired with keys by CKA_ID, the
 // convention tpm2_ptool addcert and pkcs11-tool follow; certificate files in the PEM
 // directory by public key. Every signature happens on the token.
-type PKCS11Store struct {
+type pkcs11Store struct {
 	uri     *pkcs11.URI
 	pin     string
 	certDir string
 }
 
-// NewPKCS11Store parses cfg.URI, standing in the bare defaults when it is empty. Files in
+// newPKCS11Store parses cfg.URI, standing in the bare defaults when it is empty. Files in
 // certDir without a key of their own are paired with the token's keys by public key.
 //
 // A PIN is only accepted together with a token label: without one the PIN would go to
 // whichever token the module lists first, which on a machine with a smartcard plugged
 // in may be the card, and every wrong PIN counts towards that card's lockout.
-func NewPKCS11Store(cfg PKCS11Config, certDir string) (*PKCS11Store, error) {
-	store := &PKCS11Store{uri: &pkcs11.URI{}, pin: cfg.PIN, certDir: certDir}
+func newPKCS11Store(cfg PKCS11Config, certDir string) (*pkcs11Store, error) {
+	store := &pkcs11Store{uri: &pkcs11.URI{}, pin: cfg.PIN, certDir: certDir}
 	if cfg.URI != "" {
 		parsed, err := pkcs11.ParseURI(cfg.URI)
 		if err != nil {
@@ -69,7 +69,7 @@ func NewPKCS11Store(cfg PKCS11Config, certDir string) (*PKCS11Store, error) {
 	return store, nil
 }
 
-func (s *PKCS11Store) Candidates(_ context.Context) ([]Candidate, error) {
+func (s *pkcs11Store) Candidates(_ context.Context) ([]Candidate, error) {
 	session, err := s.open()
 	if err != nil {
 		return nil, err
@@ -80,7 +80,7 @@ func (s *PKCS11Store) Candidates(_ context.Context) ([]Candidate, error) {
 	if err != nil {
 		return nil, err
 	}
-	fileChains, err := s.fileChains()
+	fileChains, fileIntermediates, err := s.fileChains()
 	if err != nil {
 		return nil, err
 	}
@@ -93,6 +93,7 @@ func (s *PKCS11Store) Candidates(_ context.Context) ([]Candidate, error) {
 	for _, chain := range fileChains {
 		pool = append(pool, chain...)
 	}
+	pool = append(pool, fileIntermediates...)
 
 	var candidates []Candidate
 	for _, cert := range certs {
@@ -106,9 +107,12 @@ func (s *PKCS11Store) Candidates(_ context.Context) ([]Candidate, error) {
 		return candidates, nil
 	}
 
+	// A token that cannot list its public keys still answers for the certificates it
+	// holds, so the identities found above are kept.
 	keys, err := tokenPublicKeys(session)
 	if err != nil {
-		return nil, err
+		log.Warnf("%s: cannot read its public keys, certificate files are not paired with them: %v", s, err)
+		return candidates, nil
 	}
 	for _, chain := range fileChains {
 		leaf := chain[0]
@@ -122,41 +126,45 @@ func (s *PKCS11Store) Candidates(_ context.Context) ([]Candidate, error) {
 	return candidates, nil
 }
 
-func (s *PKCS11Store) candidate(leaf *x509.Certificate, id []byte, pool []*x509.Certificate) Candidate {
+func (s *pkcs11Store) candidate(leaf *x509.Certificate, id []byte, pool []*x509.Certificate) Candidate {
 	chain := buildChain(leaf, pool)
 	log.Debugf("%s candidate %q issued by %q built a chain of %d certificates", s, leaf.Subject, leaf.Issuer, len(chain))
 	return Candidate{Chain: chain, Signer: &pkcs11Signer{store: s, leaf: leaf, id: id}, Intermediates: pool}
 }
 
 // fileChains reads the certificate files in the PEM directory that carry no key of their
-// own; the file store answers for the ones that do.
-func (s *PKCS11Store) fileChains() ([][]*x509.Certificate, error) {
+// own; the file store answers for the ones that do. The certificates of a file that does
+// carry a key are returned too, since they can complete the chain of a token certificate.
+func (s *pkcs11Store) fileChains() (chains [][]*x509.Certificate, intermediates []*x509.Certificate, err error) {
 	if s.certDir == "" {
-		return nil, nil
+		return nil, nil, nil
 	}
 	paths, err := certFiles(s.certDir)
 	if err != nil {
-		return nil, err
+		return nil, nil, err
 	}
-	var chains [][]*x509.Certificate
 	for _, path := range paths {
 		chain, signer, err := loadPEM(path)
-		if err != nil || signer != nil {
+		if err != nil {
+			continue
+		}
+		if signer != nil {
+			intermediates = append(intermediates, chain...)
 			continue
 		}
 		chains = append(chains, chain)
 	}
-	return chains, nil
+	return chains, intermediates, nil
 }
 
-func (s *PKCS11Store) String() string {
+func (s *pkcs11Store) String() string {
 	if s.uri.Token == "" {
 		return "PKCS#11 token"
 	}
 	return fmt.Sprintf("PKCS#11 token %q", s.uri.Token)
 }
 
-func (s *PKCS11Store) open() (*pkcs11.Session, error) {
+func (s *pkcs11Store) open() (*pkcs11.Session, error) {
 	module, err := pkcs11.Load(s.uri.Module())
 	if err != nil {
 		return nil, err
@@ -185,7 +193,7 @@ func (s *PKCS11Store) open() (*pkcs11.Session, error) {
 	return session, err
 }
 
-func (s *PKCS11Store) userPIN() ([]byte, error) {
+func (s *pkcs11Store) userPIN() ([]byte, error) {
 	if s.pin != "" {
 		return []byte(s.pin), nil
 	}
@@ -208,7 +216,8 @@ func tokenPublicKeys(session *pkcs11.Session) (tokenKeys, error) {
 	for _, object := range objects {
 		id, err := session.Attribute(object, pkcs11.AttrID)
 		if err != nil {
-			return nil, err
+			log.Debugf("skipping public key on PKCS#11 token: %v", err)
+			continue
 		}
 		public, err := session.PublicKey(object)
 		if err != nil {
@@ -287,7 +296,7 @@ func privateKey(session *pkcs11.Session, id []byte) (pkcs11.Object, error) {
 // pkcs11Signer holds only the certificate and its CKA_ID; the key is looked up in a fresh
 // session at signing time so no token handle outlives a call.
 type pkcs11Signer struct {
-	store *PKCS11Store
+	store *pkcs11Store
 	leaf  *x509.Certificate
 	id    []byte
 }
diff --git a/client/internal/certproof/pkcs11store_test.go b/client/internal/certproof/pkcs11store_test.go
index 485c84aae..746b54918 100644
--- a/client/internal/certproof/pkcs11store_test.go
+++ b/client/internal/certproof/pkcs11store_test.go
@@ -44,7 +44,7 @@ func TestStores_KeepsFileCertificatesWhenTokenFails(t *testing.T) {
 	dir := storeDir(t)
 	writeFile(t, dir, "device.pem", certtest.CertPEM(ca.Issue(t, key, "device"))+certtest.KeyPEM(t, key))
 
-	candidates, err := Stores{failingStore{}, NewFileStore(dir)}.Candidates(context.Background())
+	candidates, err := Stores{failingStore{}, newFileStore(dir)}.Candidates(context.Background())
 	require.NoError(t, err)
 	assert.Len(t, candidates, 1, "the directory's certificate must survive a failing token")
 }
@@ -241,13 +241,13 @@ func attr(typ uint, value []byte) pkcs11.Attribute {
 
 // pkcs11TestStore builds the store for the token NB_TEST_PKCS11_URI names, skipping when
 // no token is configured or this build lacks PKCS#11 support.
-func pkcs11TestStore(t *testing.T, certDir string) (*PKCS11Store, string) {
+func pkcs11TestStore(t *testing.T, certDir string) (*pkcs11Store, string) {
 	t.Helper()
 	uri := os.Getenv(testPKCS11URIEnv)
 	if uri == "" {
 		t.Skipf("set %s to a PKCS#11 URI with a PIN to run", testPKCS11URIEnv)
 	}
-	store, err := NewPKCS11Store(PKCS11Config{URI: uri}, certDir)
+	store, err := newPKCS11Store(PKCS11Config{URI: uri}, certDir)
 	require.NoError(t, err)
 	if _, err := pkcs11.Load(store.uri.Module()); errors.Is(err, pkcs11.ErrUnsupported) {
 		t.Skip(err)
@@ -297,17 +297,30 @@ func TestPKCS11Store_FileChains(t *testing.T) {
 	writeFile(t, dir, "sibling.key", certtest.KeyPEM(t, keyed))
 	writeFile(t, dir, "notes.txt", "not a certificate")
 
-	chains, err := (&PKCS11Store{uri: &pkcs11.URI{}, certDir: dir}).fileChains()
+	// An intermediate that only a keyed file carries still has to reach the pool a token
+	// certificate's chain is built from.
+	root := certtest.NewCA(t, "corp-root")
+	intermediateCA := certtest.NewIntermediate(t, root, "corp-intermediate")
+	chained := certtest.ECDSAKey(t)
+	writeFile(t, dir, "chained.pem", certtest.CertPEM(intermediateCA.Issue(t, chained, "chained"))+certtest.CertPEM(intermediateCA.Cert)+certtest.KeyPEM(t, chained))
+
+	chains, extra, err := (&pkcs11Store{uri: &pkcs11.URI{}, certDir: dir}).fileChains()
 	require.NoError(t, err)
+	require.NotEmpty(t, extra, "the keyed file's certificates are offered for chain building")
+	tokenLeaf := intermediateCA.Issue(t, certtest.ECDSAKey(t), "token-leaf")
+	chain := buildChain(tokenLeaf, extra)
+	require.Len(t, chain, 2, "a token certificate is completed through the intermediate only the keyed file holds")
+	assert.True(t, intermediateCA.Cert.Equal(chain[1]), "the second certificate is that intermediate")
 	var subjects []string
 	for _, chain := range chains {
 		subjects = append(subjects, chain[0].Subject.CommonName)
 	}
 	assert.ElementsMatch(t, []string{"device", "corp"}, subjects, "only key-less certificate files are left to the token")
 
-	chains, err = (&PKCS11Store{uri: &pkcs11.URI{}}).fileChains()
+	chains, extra, err = (&pkcs11Store{uri: &pkcs11.URI{}}).fileChains()
 	require.NoError(t, err)
 	assert.Empty(t, chains, "no directory configured means no file certificates")
+	assert.Empty(t, extra, "and no extra intermediates")
 }
 
 func TestNewPKCS11Store_PIN(t *testing.T) {
@@ -324,7 +337,7 @@ func TestNewPKCS11Store_PIN(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			store, err := NewPKCS11Store(tt.cfg, "")
+			store, err := newPKCS11Store(tt.cfg, "")
 			require.NoError(t, err)
 			pin, err := store.userPIN()
 			require.NoError(t, err)
@@ -333,7 +346,7 @@ func TestNewPKCS11Store_PIN(t *testing.T) {
 		})
 	}
 
-	_, err := NewPKCS11Store(PKCS11Config{URI: "not-a-pkcs11-uri", PIN: "1234"}, "")
+	_, err := newPKCS11Store(PKCS11Config{URI: "not-a-pkcs11-uri", PIN: "1234"}, "")
 	assert.Error(t, err, "a malformed URI must not be silently replaced by the defaults")
 
 	for name, cfg := range map[string]PKCS11Config{
@@ -342,7 +355,7 @@ func TestNewPKCS11Store_PIN(t *testing.T) {
 		"inline pin-value only":    {URI: "pkcs11:?pin-value=0000"},
 		"pin-source only":          {URI: "pkcs11:?pin-source=file:/etc/netbird/pkcs11.pin"},
 	} {
-		_, err := NewPKCS11Store(cfg, "")
+		_, err := newPKCS11Store(cfg, "")
 		assert.ErrorIs(t, err, errPINNeedsToken, "%s: a PIN must not go to whichever token is listed first", name)
 	}
 }
@@ -360,7 +373,7 @@ func TestPKCS11Store_WrongPINIsTriedOnce(t *testing.T) {
 	_, uri := pkcs11TestStore(t, "")
 
 	wrongPIN := "wrong-pin-" + t.Name()
-	store, err := NewPKCS11Store(PKCS11Config{URI: uri, PIN: wrongPIN}, "")
+	store, err := newPKCS11Store(PKCS11Config{URI: uri, PIN: wrongPIN}, "")
 	require.NoError(t, err)
 
 	_, err = store.Candidates(context.Background())
@@ -370,7 +383,7 @@ func TestPKCS11Store_WrongPINIsTriedOnce(t *testing.T) {
 	_, err = store.Candidates(context.Background())
 	assert.ErrorIs(t, err, errPINRejectedBefore, "the rejected PIN is not sent to the token again")
 
-	good, err := NewPKCS11Store(PKCS11Config{URI: uri}, "")
+	good, err := newPKCS11Store(PKCS11Config{URI: uri}, "")
 	require.NoError(t, err)
 	_, err = good.Candidates(context.Background())
 	assert.NoError(t, err, "the correct PIN for the same token is unaffected")
diff --git a/client/internal/certproof/signattempts.go b/client/internal/certproof/signattempts.go
new file mode 100644
index 000000000..b056991bf
--- /dev/null
+++ b/client/internal/certproof/signattempts.go
@@ -0,0 +1,24 @@
+package certproof
+
+import "errors"
+
+// signAttempts tracks the identities tried to sign with, for a certificate that can match
+// more than one of them.
+type signAttempts struct {
+	errs []error
+}
+
+// try runs sign and reports its signature and whether it succeeded. A failure is kept.
+func (a *signAttempts) try(sign func() ([]byte, error)) ([]byte, bool) {
+	signature, err := sign()
+	if err != nil {
+		a.errs = append(a.errs, err)
+		return nil, false
+	}
+	return signature, true
+}
+
+// err joins the failures of the attempts, nil when there were none.
+func (a *signAttempts) err() error {
+	return errors.Join(a.errs...)
+}
diff --git a/client/internal/certproof/signattempts_test.go b/client/internal/certproof/signattempts_test.go
new file mode 100644
index 000000000..f5a2fef4f
--- /dev/null
+++ b/client/internal/certproof/signattempts_test.go
@@ -0,0 +1,41 @@
+package certproof
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+var errNeedsApprovalForTest = errors.New("key needs approval")
+
+// TestSignAttempts_FallsThroughToTheNextIdentity: a certificate can sit in a keychain with
+// more than one key, of which only some can sign. A failure moves on, and an identity that
+// signs ends the search without reporting the earlier failure.
+func TestSignAttempts_FallsThroughToTheNextIdentity(t *testing.T) {
+	var attempts signAttempts
+
+	signature, ok := attempts.try(func() ([]byte, error) { return nil, errNeedsApprovalForTest })
+	assert.False(t, ok, "a failing identity does not end the search")
+	assert.Nil(t, signature)
+
+	signature, ok = attempts.try(func() ([]byte, error) { return []byte("sig"), nil })
+	require.True(t, ok, "the next identity signs")
+	assert.Equal(t, []byte("sig"), signature)
+}
+
+// TestSignAttempts_KeepsEveryFailure: when no identity signs, the approval a user has to
+// give must not be hidden behind the failure of a later identity.
+func TestSignAttempts_KeepsEveryFailure(t *testing.T) {
+	var attempts signAttempts
+	assert.NoError(t, attempts.err(), "no attempts, no error")
+
+	attempts.try(func() ([]byte, error) { return nil, errNeedsApprovalForTest })
+	attempts.try(func() ([]byte, error) { return nil, errors.New("key is gone") })
+
+	err := attempts.err()
+	require.Error(t, err)
+	assert.ErrorIs(t, err, errNeedsApprovalForTest, "the earlier approval error survives the later failure")
+	assert.ErrorContains(t, err, "key is gone")
+}
diff --git a/client/internal/certproof/store.go b/client/internal/certproof/store.go
index 295d6caa4..85ab7cda7 100644
--- a/client/internal/certproof/store.go
+++ b/client/internal/certproof/store.go
@@ -46,7 +46,7 @@ func (c Candidate) issuers() []*x509.Certificate {
 	return append(slices.Clip(c.Chain[1:]), c.Intermediates...)
 }
 
-// Store yields the certificates a peer may prove possession of. FileStore is the PEM
+// Store yields the certificates a peer may prove possession of. fileStore is the PEM
 // directory implementation; OS keystores (CNG, Keychain, PKCS#11) slot in here.
 type Store interface {
 	Candidates(ctx context.Context) ([]Candidate, error)
@@ -68,15 +68,15 @@ type Config struct {
 	OwnerUnknown bool
 }
 
-// FileStore reads PEM files from a directory. A file holds the chain (leaf first) and
+// fileStore reads PEM files from a directory. A file holds the chain (leaf first) and
 // either its private key or a sibling "<name>.key" file holds it. The key is a plain
 // PKCS#8, EC or RSA key, or a TSS2 key the TPM signs with.
-type FileStore struct {
+type fileStore struct {
 	dir string
 }
 
-func NewFileStore(dir string) *FileStore {
-	return &FileStore{dir: dir}
+func newFileStore(dir string) *fileStore {
+	return &fileStore{dir: dir}
 }
 
 func StoreDir() string {
@@ -86,7 +86,7 @@ func StoreDir() string {
 	return defaultStoreDir
 }
 
-func (s *FileStore) Candidates(_ context.Context) ([]Candidate, error) {
+func (s *fileStore) Candidates(_ context.Context) ([]Candidate, error) {
 	paths, err := certFiles(s.dir)
 	if err != nil {
 		return nil, err
diff --git a/client/internal/certproof/store_other.go b/client/internal/certproof/store_other.go
index e6646732b..eeecf3c39 100644
--- a/client/internal/certproof/store_other.go
+++ b/client/internal/certproof/store_other.go
@@ -14,13 +14,13 @@ var unsupportedTokenOnce sync.Once
 
 // DefaultStore is the PEM directory named by NB_CERT_STORE_DIR, or /etc/netbird/certs.
 func DefaultStore() Store {
-	return NewFileStore(StoreDir())
+	return newFileStore(StoreDir())
 }
 
 // storeWithToken reads the PEM directory cfg names, joined by the PKCS#11 token when cfg
 // names one. The token pairs the directory's key-less certificates with its own keys.
 func storeWithToken(cfg Config) Store {
-	files := NewFileStore(StoreDir())
+	files := newFileStore(StoreDir())
 	if cfg.PKCS11.URI == "" && cfg.PKCS11.PIN == "" {
 		return files
 	}
@@ -30,7 +30,7 @@ func storeWithToken(cfg Config) Store {
 		})
 		return files
 	}
-	token, err := NewPKCS11Store(cfg.PKCS11, StoreDir())
+	token, err := newPKCS11Store(cfg.PKCS11, StoreDir())
 	if err != nil {
 		log.Warnf("ignoring PKCS#11 URI: %v", err)
 		return files
diff --git a/client/internal/certproof/store_other_test.go b/client/internal/certproof/store_other_test.go
index 47b05f058..68b4df2a6 100644
--- a/client/internal/certproof/store_other_test.go
+++ b/client/internal/certproof/store_other_test.go
@@ -15,12 +15,12 @@ func TestStoreWithToken(t *testing.T) {
 	dir := storeDir(t)
 	t.Setenv(StoreDirEnv, dir)
 
-	files, ok := storeWithToken(Config{}).(*FileStore)
+	files, ok := storeWithToken(Config{}).(*fileStore)
 	require.True(t, ok, "no token configured reads the PEM directory alone")
 	assert.Equal(t, dir, files.dir, "the directory comes from NB_CERT_STORE_DIR")
 
-	assert.IsType(t, &FileStore{}, storeWithToken(Config{PKCS11: PKCS11Config{URI: "not-a-pkcs11-uri"}}), "an invalid URI must not hide the PEM directory")
-	assert.IsType(t, &FileStore{}, storeWithToken(Config{PKCS11: PKCS11Config{PIN: "1234"}}), "a PIN naming no token is refused and leaves the PEM directory")
+	assert.IsType(t, &fileStore{}, storeWithToken(Config{PKCS11: PKCS11Config{URI: "not-a-pkcs11-uri"}}), "an invalid URI must not hide the PEM directory")
+	assert.IsType(t, &fileStore{}, storeWithToken(Config{PKCS11: PKCS11Config{PIN: "1234"}}), "a PIN naming no token is refused and leaves the PEM directory")
 
 	configured := map[string]PKCS11Config{
 		"env pin with token uri": {URI: "pkcs11:token=netbird", PIN: "1234"},
@@ -28,7 +28,7 @@ func TestStoreWithToken(t *testing.T) {
 	}
 	if !pkcs11.Supported() {
 		for name, cfg := range configured {
-			assert.IsType(t, &FileStore{}, storeWithToken(Config{PKCS11: cfg}),
+			assert.IsType(t, &fileStore{}, storeWithToken(Config{PKCS11: cfg}),
 				"%s: a build without PKCS#11 support reads the PEM directory alone", name)
 		}
 		return
@@ -37,7 +37,7 @@ func TestStoreWithToken(t *testing.T) {
 		store, ok := storeWithToken(Config{PKCS11: cfg}).(Stores)
 		require.True(t, ok, "%s joins the token to the PEM directory", name)
 		require.Len(t, store, 2, name)
-		token, ok := store[1].(*PKCS11Store)
+		token, ok := store[1].(*pkcs11Store)
 		require.True(t, ok, name)
 		assert.Equal(t, dir, token.certDir, "%s: the token pairs certificates from the same directory", name)
 	}
diff --git a/client/internal/certproof/store_tpm_test.go b/client/internal/certproof/store_tpm_test.go
index f8a7a0960..cce570891 100644
--- a/client/internal/certproof/store_tpm_test.go
+++ b/client/internal/certproof/store_tpm_test.go
@@ -36,7 +36,7 @@ func TestFileStore_TPMKeyFile(t *testing.T) {
 	writeFile(t, dir, "locked.pem", certtest.CertPEM(ca.Issue(t, locked, "locked")))
 	writeFile(t, dir, "locked.key", tpmtest.KeyPEM(t, locked.Public().(*ecdsa.PublicKey), tpmtest.WithAuth()))
 
-	candidates, err := NewFileStore(dir).Candidates(context.Background())
+	candidates, err := newFileStore(dir).Candidates(context.Background())
 	require.NoError(t, err)
 	require.Len(t, candidates, 1, "only the key without an authorization value is usable")
 	assert.True(t, leaf.Equal(candidates[0].Chain[0]), "candidate must carry the device certificate")
@@ -73,7 +73,7 @@ func TestCollect_TPMKeyEndToEnd(t *testing.T) {
 	nonce := challenger.Nonce(peerKey, now)
 	checks := []*proto.Checks{{CertificateChallenge: &proto.CertificateChallenge{Nonce: nonce, CaCertificates: []string{ca.PEM}}}}
 
-	proofs := Collect(context.Background(), NewFileStore(dir), checks, peerKey)
+	proofs := Collect(context.Background(), newFileStore(dir), checks, peerKey)
 	require.Len(t, proofs, 1, "the TPM-held key must prove the certificate")
 	chain, err := challenger.Verify(proofs[0], peerKey, now)
 	require.NoError(t, err)
diff --git a/client/internal/certproof/storefile_unix_test.go b/client/internal/certproof/storefile_unix_test.go
index d35a4e759..9932388b6 100644
--- a/client/internal/certproof/storefile_unix_test.go
+++ b/client/internal/certproof/storefile_unix_test.go
@@ -26,7 +26,7 @@ func devicePair(t *testing.T, dir string) {
 
 func candidates(t *testing.T, dir string) ([]Candidate, error) {
 	t.Helper()
-	return NewFileStore(dir).Candidates(context.Background())
+	return newFileStore(dir).Candidates(context.Background())
 }
 
 func TestFileStore_AcceptsAPrivatePair(t *testing.T) {
diff --git a/client/internal/certproof/systemstore_windows.go b/client/internal/certproof/systemstore_windows.go
index 92aa03d4b..908899107 100644
--- a/client/internal/certproof/systemstore_windows.go
+++ b/client/internal/certproof/systemstore_windows.go
@@ -49,10 +49,10 @@ type bcryptPSSPaddingInfo struct {
 // DefaultStore is the local machine's personal certificate store, where device
 // certificates enrolled through AD or Intune are kept.
 func DefaultStore() Store {
-	return NewSystemStore()
+	return newSystemStore()
 }
 
-// SystemStore yields the identities of a personal certificate store, completing their
+// systemStore yields the identities of a personal certificate store, completing their
 // chains from the matching intermediate CA store. Keys are used through CNG and never
 // exported.
 //
@@ -60,22 +60,22 @@ func DefaultStore() Store {
 // a service reads; the current user store lives in the signed-in user's registry hive
 // with keys protected against their profile, so it is only readable while running as
 // that user.
-type SystemStore struct {
+type systemStore struct {
 	location uint32
 }
 
-// NewSystemStore reads the local machine store, which is what the daemon uses.
-func NewSystemStore() *SystemStore {
-	return &SystemStore{location: windows.CERT_SYSTEM_STORE_LOCAL_MACHINE}
+// newSystemStore reads the local machine store, which is what the daemon uses.
+func newSystemStore() *systemStore {
+	return &systemStore{location: windows.CERT_SYSTEM_STORE_LOCAL_MACHINE}
 }
 
-// NewUserStore reads the calling user's personal store. It is only useful in a process
+// newUserStore reads the calling user's personal store. It is only useful in a process
 // already running as that user, which is what the posture helper is.
-func NewUserStore() *SystemStore {
-	return &SystemStore{location: windows.CERT_SYSTEM_STORE_CURRENT_USER}
+func newUserStore() *systemStore {
+	return &systemStore{location: windows.CERT_SYSTEM_STORE_CURRENT_USER}
 }
 
-func (s *SystemStore) Candidates(_ context.Context) ([]Candidate, error) {
+func (s *systemStore) Candidates(_ context.Context) ([]Candidate, error) {
 	leaves, err := storeCertificates(s.location, personalStore)
 	if err != nil {
 		return nil, err
@@ -100,7 +100,7 @@ func (s *SystemStore) Candidates(_ context.Context) ([]Candidate, error) {
 }
 
 // String names the store location the way the Windows documentation does.
-func (s *SystemStore) String() string {
+func (s *systemStore) String() string {
 	if s.location == windows.CERT_SYSTEM_STORE_CURRENT_USER {
 		return "CurrentUser"
 	}
diff --git a/client/internal/pkcs11/driver_linux.go b/client/internal/pkcs11/driver_linux.go
index 93bf4a5ba..54a3863cb 100644
--- a/client/internal/pkcs11/driver_linux.go
+++ b/client/internal/pkcs11/driver_linux.go
@@ -32,6 +32,7 @@ const (
 	// signature is 2 KiB.
 	maxAttributeLen = 1 << 20
 	maxSignatureLen = 1 << 16
+	maxFoundObjects = 1 << 16
 )
 
 type version struct {
@@ -103,6 +104,15 @@ const (
 	fnSign              = 43
 )
 
+// checkFunctionListVersion refuses a module whose function list is older than the layout
+// functionList mirrors, which would otherwise be read past its end.
+func checkFunctionListVersion(v version) error {
+	if v.major < 2 {
+		return fmt.Errorf("PKCS#11 function list version %d.%d is older than 2.0", v.major, v.minor)
+	}
+	return nil
+}
+
 // module holds the entry points of one loaded library, bound straight from its
 // CK_FUNCTION_LIST.
 type module struct {
@@ -152,6 +162,10 @@ func load(path string) (_ driver, err error) {
 		return nil, Error{Op: "C_GetFunctionList", Code: uint(rv)}
 	}
 
+	if err := checkFunctionListVersion(list.version); err != nil {
+		return nil, fmt.Errorf("%s: %w", path, err)
+	}
+
 	m := &module{}
 	for _, entry := range []struct {
 		fn    any
@@ -185,21 +199,43 @@ func load(path string) (_ driver, err error) {
 	return m, nil
 }
 
+// slotListAttempts bounds how often the slot list is asked for again after it grew between
+// the size query and the read.
+const slotListAttempts = 3
+
+// slotList returns the slots with a token present. A token plugged in between the size
+// query and the read makes the module answer CKR_BUFFER_TOO_SMALL, in which case the list
+// is asked for again.
+func (m *module) slotList() ([]ulong, error) {
+	for range slotListAttempts {
+		var count ulong
+		if rv := m.cGetSlotList(1, nil, &count); rv != rvOK {
+			return nil, Error{Op: "C_GetSlotList", Code: uint(rv)}
+		}
+		if count == 0 {
+			return nil, nil
+		}
+		slots := make([]ulong, count)
+		rv := m.cGetSlotList(1, &slots[0], &count)
+		if rv == rvBufferTooSmall {
+			continue
+		}
+		if rv != rvOK {
+			return nil, Error{Op: "C_GetSlotList", Code: uint(rv)}
+		}
+		return slots[:count], nil
+	}
+	return nil, Error{Op: "C_GetSlotList", Code: rvBufferTooSmall}
+}
+
 func (m *module) tokens() ([]Token, error) {
-	var count ulong
-	if rv := m.cGetSlotList(1, nil, &count); rv != rvOK {
-		return nil, Error{Op: "C_GetSlotList", Code: uint(rv)}
-	}
-	if count == 0 {
-		return nil, nil
-	}
-	slots := make([]ulong, count)
-	if rv := m.cGetSlotList(1, &slots[0], &count); rv != rvOK {
-		return nil, Error{Op: "C_GetSlotList", Code: uint(rv)}
+	slots, err := m.slotList()
+	if err != nil {
+		return nil, err
 	}
 
-	tokens := make([]Token, 0, count)
-	for _, slot := range slots[:count] {
+	tokens := make([]Token, 0, len(slots))
+	for _, slot := range slots {
 		var info tokenInfo
 		if rv := m.cGetTokenInfo(slot, &info); rv != rvOK {
 			continue
@@ -262,11 +298,16 @@ func (m *module) findObjects(session uint, template []Attribute) ([]Object, erro
 		if count > findBatch {
 			return nil, fmt.Errorf("C_FindObjects reported %d handles for a batch of %d", count, findBatch)
 		}
+		// Only an empty batch ends the search: a module may return fewer handles than
+		// asked for before it has returned them all.
+		if count == 0 {
+			return objects, nil
+		}
 		for _, handle := range batch[:count] {
 			objects = append(objects, Object(handle))
 		}
-		if count < findBatch {
-			return objects, nil
+		if len(objects) > maxFoundObjects {
+			return nil, fmt.Errorf("C_FindObjects returned more than %d objects", maxFoundObjects)
 		}
 	}
 }
diff --git a/client/internal/pkcs11/driver_linux_test.go b/client/internal/pkcs11/driver_linux_test.go
index 408a3fabc..2362ee18f 100644
--- a/client/internal/pkcs11/driver_linux_test.go
+++ b/client/internal/pkcs11/driver_linux_test.go
@@ -70,3 +70,119 @@ func loadFirst(t *testing.T, paths ...string) *Module {
 	t.Skip("p11-kit trust module not installed")
 	return nil
 }
+
+// TestSlotList_RetriesWhenTheListGrows: a token plugged in between the size query and the
+// fill makes the module answer CKR_BUFFER_TOO_SMALL; the list has to be asked for again.
+func TestSlotList_RetriesWhenTheListGrows(t *testing.T) {
+	calls := 0
+	m := &module{cGetSlotList: func(_ byte, slots *ulong, count *ulong) ulong {
+		calls++
+		switch {
+		case slots == nil && calls == 1:
+			*count = 1
+		case slots != nil && calls == 2:
+			*count = 2
+			return rvBufferTooSmall
+		case slots == nil:
+			*count = 2
+		default:
+			*count = 2
+			backing := unsafe.Slice(slots, 2)
+			backing[0], backing[1] = 7, 9
+		}
+		return rvOK
+	}}
+
+	slots, err := m.slotList()
+
+	require.NoError(t, err)
+	assert.Equal(t, []ulong{7, 9}, slots, "the list is read again at its new size")
+}
+
+func TestSlotList_GivesUpOnAListThatKeepsGrowing(t *testing.T) {
+	m := &module{cGetSlotList: func(_ byte, slots *ulong, count *ulong) ulong {
+		if slots == nil {
+			*count = 1
+			return rvOK
+		}
+		return rvBufferTooSmall
+	}}
+
+	_, err := m.slotList()
+
+	assert.Error(t, err, "a module that never settles on a size is an error, not a loop")
+}
+
+func TestCheckFunctionListVersion(t *testing.T) {
+	assert.NoError(t, checkFunctionListVersion(version{major: 2, minor: 40}))
+	assert.NoError(t, checkFunctionListVersion(version{major: 3, minor: 0}))
+	assert.Error(t, checkFunctionListVersion(version{major: 1, minor: 0}), "a pre-2.0 list has no entry points to index")
+	assert.Error(t, checkFunctionListVersion(version{}), "an empty version is not a function list")
+}
+
+// fakeFindModule answers C_FindObjects from batches, a handle per entry, and reports how
+// the search was torn down.
+func fakeFindModule(batches [][]ulong, finalized *int) *module {
+	next := 0
+	return &module{
+		cFindObjectsInit:  func(ulong, *attribute, ulong) ulong { return rvOK },
+		cFindObjectsFinal: func(ulong) ulong { *finalized++; return rvOK },
+		cFindObjects: func(_ ulong, objects *ulong, max ulong, count *ulong) ulong {
+			if next >= len(batches) {
+				*count = 0
+				return rvOK
+			}
+			batch := batches[next]
+			next++
+			copy(unsafe.Slice(objects, max), batch)
+			*count = ulong(len(batch))
+			return rvOK
+		},
+	}
+}
+
+var findTemplate = []Attribute{{Type: AttrClass, Value: ULong(ClassPrivateKey)}}
+
+// TestFindObjects_ReadsPastAShortBatch: PKCS#11 ends a search with an empty batch, not with
+// one shorter than asked for, so a module that hands out its handles in small batches must
+// still have all of them returned.
+func TestFindObjects_ReadsPastAShortBatch(t *testing.T) {
+	finalized := 0
+	m := fakeFindModule([][]ulong{{1, 2}, {3}, {4, 5, 6}}, &finalized)
+
+	objects, err := m.findObjects(1, findTemplate)
+
+	require.NoError(t, err)
+	assert.Equal(t, []Object{1, 2, 3, 4, 5, 6}, objects, "every batch is read until the module returns an empty one")
+	assert.Equal(t, 1, finalized, "the search is finished once")
+}
+
+func TestFindObjects_StopsAtAnEmptyBatch(t *testing.T) {
+	finalized := 0
+	m := fakeFindModule(nil, &finalized)
+
+	objects, err := m.findObjects(1, findTemplate)
+
+	require.NoError(t, err)
+	assert.Empty(t, objects, "a search that finds nothing returns nothing")
+	assert.Equal(t, 1, finalized)
+}
+
+// TestFindObjects_BoundsAModuleThatNeverEnds: a module that keeps returning handles must
+// not make the daemon allocate without limit.
+func TestFindObjects_BoundsAModuleThatNeverEnds(t *testing.T) {
+	finalized := 0
+	endless := &module{
+		cFindObjectsInit:  func(ulong, *attribute, ulong) ulong { return rvOK },
+		cFindObjectsFinal: func(ulong) ulong { finalized++; return rvOK },
+		cFindObjects: func(_ ulong, _ *ulong, _ ulong, count *ulong) ulong {
+			*count = findBatch
+			return rvOK
+		},
+	}
+
+	_, err := endless.findObjects(1, findTemplate)
+
+	assert.Error(t, err, "an endless search is cut off")
+	assert.Equal(t, 1, finalized, "and still finished")
+}
diff --git a/client/internal/pkcs11/pkcs11.go b/client/internal/pkcs11/pkcs11.go
index da874fb62..4a34848d9 100644
--- a/client/internal/pkcs11/pkcs11.go
+++ b/client/internal/pkcs11/pkcs11.go
@@ -50,6 +50,7 @@ const (
 	rvPINExpired          = 0xa3
 	rvPINLocked           = 0xa4
 	rvUserAlreadyLoggedIn = 0x100
+	rvBufferTooSmall      = 0x150
 	rvAlreadyInitialized  = 0x191
 )
 
diff --git a/client/internal/pkcs11/publickey.go b/client/internal/pkcs11/publickey.go
index 4d59598e6..aac78524a 100644
--- a/client/internal/pkcs11/publickey.go
+++ b/client/internal/pkcs11/publickey.go
@@ -70,8 +70,10 @@ func rsaPublicKey(modulus, exponent []byte) (*rsa.PublicKey, error) {
 // uncompressed point wrapped in a DER OCTET STRING, which some modules hand out bare.
 func ecPublicKey(params, point []byte) (*ecdsa.PublicKey, error) {
 	var oid asn1.ObjectIdentifier
-	if _, err := asn1.Unmarshal(params, &oid); err != nil {
+	if rest, err := asn1.Unmarshal(params, &oid); err != nil {
 		return nil, fmt.Errorf("CKA_EC_PARAMS: %w", err)
+	} else if len(rest) != 0 {
+		return nil, errors.New("CKA_EC_PARAMS has trailing data")
 	}
 	curve, ok := curvesByOID[oid.String()]
 	if !ok {
@@ -80,8 +82,10 @@ func ecPublicKey(params, point []byte) (*ecdsa.PublicKey, error) {
 	size := (curve.Params().BitSize + 7) / 8
 	raw := point
 	if len(raw) != 1+2*size {
-		if _, err := asn1.Unmarshal(point, &raw); err != nil {
+		if rest, err := asn1.Unmarshal(point, &raw); err != nil {
 			return nil, fmt.Errorf("CKA_EC_POINT: %w", err)
+		} else if len(rest) != 0 {
+			return nil, errors.New("CKA_EC_POINT has trailing data")
 		}
 	}
 	if len(raw) != 1+2*size || raw[0] != 4 {
diff --git a/client/internal/pkcs11/publickey_test.go b/client/internal/pkcs11/publickey_test.go
index 527d6db46..70c1c9a15 100644
--- a/client/internal/pkcs11/publickey_test.go
+++ b/client/internal/pkcs11/publickey_test.go
@@ -6,6 +6,7 @@ import (
 	"crypto/rand"
 	"crypto/rsa"
 	"encoding/asn1"
+	"math"
 	"math/big"
 	"testing"
 
@@ -21,6 +22,8 @@ func TestECPublicKey(t *testing.T) {
 	}{
 		{"P-256", elliptic.P256(), asn1.ObjectIdentifier{1, 2, 840, 10045, 3, 1, 7}},
 		{"P-384", elliptic.P384(), asn1.ObjectIdentifier{1, 3, 132, 0, 34}},
+		// The wrapped P-521 point is 133 bytes, which needs the long form of the DER length.
+		{"P-521", elliptic.P521(), asn1.ObjectIdentifier{1, 3, 132, 0, 35}},
 	}
 	for _, tt := range curves {
 		t.Run(tt.name, func(t *testing.T) {
@@ -57,6 +60,13 @@ func TestECPublicKey_Rejections(t *testing.T) {
 	assert.Error(t, err, "a truncated point must be rejected")
 	_, err = ecPublicKey([]byte("junk"), point)
 	assert.Error(t, err, "malformed parameters must be rejected")
+
+	wrapped, err := asn1.Marshal(point)
+	require.NoError(t, err)
+	_, err = ecPublicKey(append(append([]byte{}, p256...), 0), point)
+	assert.Error(t, err, "bytes after the curve parameters must be rejected")
+	_, err = ecPublicKey(p256, append(append([]byte{}, wrapped...), 0))
+	assert.Error(t, err, "bytes after the wrapped point must be rejected")
 }
 
 func TestRSAPublicKey(t *testing.T) {
@@ -69,6 +79,12 @@ func TestRSAPublicKey(t *testing.T) {
 
 	_, err = rsaPublicKey(key.N.Bytes(), nil)
 	assert.Error(t, err, "a missing exponent must be rejected")
+	_, err = rsaPublicKey(key.N.Bytes(), big.NewInt(math.MaxInt32).Bytes())
+	assert.NoError(t, err, "the largest exponent an int holds is accepted")
+	_, err = rsaPublicKey(key.N.Bytes(), big.NewInt(math.MaxInt32+1).Bytes())
+	assert.Error(t, err, "an exponent past int32 must be rejected")
+	_, err = rsaPublicKey(key.N.Bytes(), []byte{0})
+	assert.Error(t, err, "a zero exponent must be rejected")
 }
 
 func TestULongRoundTrip(t *testing.T) {
diff --git a/client/internal/pkcs11/uri.go b/client/internal/pkcs11/uri.go
index c7248c10e..fb5dc2765 100644
--- a/client/internal/pkcs11/uri.go
+++ b/client/internal/pkcs11/uri.go
@@ -29,7 +29,7 @@ type URI struct {
 // module-path must be absolute and a module-name must be a bare name. Unknown query
 // attributes are ignored, as the RFC asks.
 func ParseURI(raw string) (*URI, error) {
-	rest, ok := strings.CutPrefix(raw, "pkcs11:")
+	rest, ok := cutPrefixFold(raw, "pkcs11:")
 	if !ok {
 		return nil, errors.New("PKCS#11 URI does not start with the pkcs11 scheme")
 	}
@@ -72,11 +72,61 @@ func (u *URI) setQueryAttribute(name, value string) error {
 	case "pin-value":
 		u.pinValue = &value
 	case "pin-source":
-		u.pinSource = value
+		path, err := pinSourcePath(value)
+		if err != nil {
+			return err
+		}
+		u.pinSource = path
 	}
 	return nil
 }
 
+// pinSourcePath turns a pin-source value into the file to read. A plain path is used as
+// it is; a file URI must name a local absolute path, with no host or localhost (RFC 8089
+// section 2), so a PIN is never read from somewhere the URI only appears to point to.
+func pinSourcePath(value string) (string, error) {
+	if value == "" {
+		return "", errors.New("PKCS#11 URI pin-source is empty")
+	}
+	rest, isFile := cutPrefixFold(value, "file:")
+	if !isFile {
+		return value, nil
+	}
+	authorityAndPath, hasAuthority := strings.CutPrefix(rest, "//")
+	if !hasAuthority {
+		if !isAbsolutePath(rest) {
+			return "", fmt.Errorf("PKCS#11 URI pin-source %q must be an absolute path", value)
+		}
+		return rest, nil
+	}
+	if isAbsolutePath(authorityAndPath) {
+		return authorityAndPath, nil
+	}
+	host, path, _ := strings.Cut(authorityAndPath, "/")
+	if host != "" && !strings.EqualFold(host, "localhost") {
+		return "", fmt.Errorf("PKCS#11 URI pin-source host %q is not the local machine", host)
+	}
+	if path == "" {
+		return "", fmt.Errorf("PKCS#11 URI pin-source %q names no file", value)
+	}
+	return "/" + path, nil
+}
+
+// isAbsolutePath reports whether p is absolute in a file URI. A path starting with a slash
+// is absolute there on every platform, including Windows, where filepath.IsAbs wants a
+// drive letter.
+func isAbsolutePath(p string) bool {
+	return strings.HasPrefix(p, "/") || filepath.IsAbs(p)
+}
+
+// cutPrefixFold is strings.CutPrefix with the prefix matched without regard to case.
+func cutPrefixFold(s, prefix string) (string, bool) {
+	if len(s) < len(prefix) || !strings.EqualFold(s[:len(prefix)], prefix) {
+		return s, false
+	}
+	return s[len(prefix):], true
+}
+
 // Module is the library to load, DefaultModule when the URI names none.
 func (u *URI) Module() string {
 	if u.ModulePath == "" {
@@ -99,8 +149,7 @@ func (u *URI) PIN() ([]byte, error) {
 	if u.pinSource == "" {
 		return nil, nil
 	}
-	path := strings.TrimPrefix(strings.TrimPrefix(u.pinSource, "file://"), "file:")
-	pin, err := os.ReadFile(path)
+	pin, err := os.ReadFile(u.pinSource)
 	if err != nil {
 		return nil, fmt.Errorf("read PIN: %w", err)
 	}
diff --git a/client/internal/pkcs11/uri_test.go b/client/internal/pkcs11/uri_test.go
index 54e8a0d91..09aede6a7 100644
--- a/client/internal/pkcs11/uri_test.go
+++ b/client/internal/pkcs11/uri_test.go
@@ -84,6 +84,10 @@ func TestParseURI_Rejections(t *testing.T) {
 		"module-name with dotdot":  "pkcs11:token=a?module-name=..",
 		"empty module-name":        "pkcs11:token=a?module-name=",
 		"pin-value and pin-source": "pkcs11:token=a?pin-value=1&pin-source=file:/etc/pin",
+		// Without a value the URI would silently mean "no PIN" and skip the login.
+		"empty pin-source":    "pkcs11:token=a?pin-source=",
+		"remote pin-source":   "pkcs11:token=a?pin-source=file://example.com/etc/pin",
+		"relative pin-source": "pkcs11:token=a?pin-source=file:pin",
 	}
 	for name, raw := range tests {
 		_, err := ParseURI(raw)
@@ -91,6 +95,31 @@ func TestParseURI_Rejections(t *testing.T) {
 	}
 }
 
+// TestParseURI_SchemeIsCaseInsensitive: RFC 3986 section 3.1 makes schemes case-insensitive.
+func TestParseURI_SchemeIsCaseInsensitive(t *testing.T) {
+	for _, raw := range []string{"PKCS11:token=netbird", "Pkcs11:token=netbird"} {
+		uri, err := ParseURI(raw)
+		require.NoError(t, err, raw)
+		assert.Equal(t, "netbird", uri.Token, raw)
+	}
+}
+
+func TestURI_PINFromLocalhostFileURI(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("file URIs with a host name are written differently on Windows")
+	}
+	path := filepath.Join(t.TempDir(), "pin")
+	require.NoError(t, os.WriteFile(path, []byte("secret\n"), 0o600))
+
+	for _, host := range []string{"localhost", "LocalHost"} {
+		uri, err := ParseURI("pkcs11:token=netbird?pin-source=file://" + host + path)
+		require.NoError(t, err, host)
+		pin, err := uri.PIN()
+		require.NoError(t, err, host)
+		assert.Equal(t, []byte("secret"), pin, "RFC 8089 names the local machine as localhost")
+	}
+}
+
 func TestURI_PINFromFile(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "pin")
 	require.NoError(t, os.WriteFile(path, []byte("secret\n"), 0o600))
@@ -117,3 +146,30 @@ func absModule(name string) string {
 	}
 	return "/lib/" + name
 }
+
+// TestPinSourcePath covers how a pin-source value becomes a file path, without touching the
+// file system, so the same cases run on every platform. A path starting with a slash is
+// absolute in a file URI everywhere, including Windows, where filepath.IsAbs would refuse it.
+func TestPinSourcePath(t *testing.T) {
+	tests := []struct {
+		value string
+		want  string
+	}{
+		{"/etc/netbird/pkcs11.pin", "/etc/netbird/pkcs11.pin"},
+		{"file:/etc/netbird/pkcs11.pin", "/etc/netbird/pkcs11.pin"},
+		{"file:///etc/netbird/pkcs11.pin", "/etc/netbird/pkcs11.pin"},
+		{"FILE:///etc/netbird/pkcs11.pin", "/etc/netbird/pkcs11.pin"},
+		{"file://localhost/etc/netbird/pkcs11.pin", "/etc/netbird/pkcs11.pin"},
+		{"file://LocalHost/etc/netbird/pkcs11.pin", "/etc/netbird/pkcs11.pin"},
+	}
+	for _, tt := range tests {
+		got, err := pinSourcePath(tt.value)
+		require.NoError(t, err, tt.value)
+		assert.Equal(t, tt.want, got, tt.value)
+	}
+
+	for _, value := range []string{"", "file:pin", "file://example.com/etc/pin", "file://localhost", "file://localhost/"} {
+		_, err := pinSourcePath(value)
+		assert.Error(t, err, "%q must be refused", value)
+	}
+}
diff --git a/management/internals/network_map_db/shared_types_test.go b/management/internals/network_map_db/shared_types_test.go
index 8a1239e26..34b69d265 100644
--- a/management/internals/network_map_db/shared_types_test.go
+++ b/management/internals/network_map_db/shared_types_test.go
@@ -4,6 +4,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestRecordTypeAndRdata(t *testing.T) {
@@ -36,3 +37,24 @@ func TestRecordTypeAndRdata(t *testing.T) {
 		})
 	}
 }
+
+// TestConvertToNmdataPeers_CarriesTheVerifiedCertificates: the certificate posture check is
+// evaluated on the chains stored in the peer meta, so a peer loaded through this path with
+// its certificates dropped would silently fail every certificate check.
+func TestConvertToNmdataPeers_CarriesTheVerifiedCertificates(t *testing.T) {
+	peers, _, err := ConvertToNmdataPeers([]Peer{
+		{MetaCertificates: []byte(`["-----BEGIN CERTIFICATE-----\nleaf\n-----END CERTIFICATE-----\n","chain-2"]`)},
+		{},
+	})
+
+	require.NoError(t, err)
+	require.Len(t, peers, 2)
+	assert.Equal(t, []string{"-----BEGIN CERTIFICATE-----\nleaf\n-----END CERTIFICATE-----\n", "chain-2"}, peers[0].Meta.Certificates)
+	assert.Empty(t, peers[1].Meta.Certificates, "a peer that proved nothing has no certificates")
+}
+
+func TestConvertToNmdataPeers_RejectsMalformedCertificates(t *testing.T) {
+	_, _, err := ConvertToNmdataPeers([]Peer{{MetaCertificates: []byte(`{"not":"a list"}`)}})
+
+	assert.Error(t, err, "a stored value that is not a list of chains must not load as no certificates")
+}
diff --git a/shared/management/certposture/certposture_test.go b/shared/management/certposture/certposture_test.go
index ae31a2203..e8f3d20c1 100644
--- a/shared/management/certposture/certposture_test.go
+++ b/shared/management/certposture/certposture_test.go
@@ -2,6 +2,8 @@ package certposture
 
 import (
 	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
 	"crypto/rand"
 	"crypto/rsa"
 	"crypto/sha256"
@@ -86,6 +88,7 @@ func TestSignVerify_RoundTripPerKeyType(t *testing.T) {
 	ca := certtest.NewCA(t, "root")
 	keys := map[string]crypto.Signer{
 		SigAlgECDSASHA256:  certtest.ECDSAKey(t),
+		SigAlgECDSASHA384:  p384Key(t),
 		SigAlgRSAPSSSHA256: certtest.RSAKey(t),
 		SigAlgEd25519:      certtest.Ed25519Key(t),
 	}
@@ -103,6 +106,24 @@ func TestSignVerify_RoundTripPerKeyType(t *testing.T) {
 	}
 }
 
+func p384Key(t *testing.T) crypto.Signer {
+	t.Helper()
+	key, err := ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
+	require.NoError(t, err)
+	return key
+}
+
+// TestSign_RefusesCurvesTheProofDoesNotName: a proof names its algorithm from the key, and
+// the verifier only knows P-256 and P-384, so P-521 is refused before anything is signed.
+func TestSign_RefusesCurvesTheProofDoesNotName(t *testing.T) {
+	key, err := ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
+	require.NoError(t, err)
+
+	_, _, err = Sign(key, NewChallenger(secret).Nonce(peerKey, now), peerKey)
+
+	assert.ErrorIs(t, err, ErrUnsupportedKey)
+}
+
 func TestVerify_Rejections(t *testing.T) {
 	ca := certtest.NewCA(t, "root")
 	c := NewChallenger(secret)
diff --git a/shared/management/client/grpc_test.go b/shared/management/client/grpc_test.go
index c947130fd..8c69cea1c 100644
--- a/shared/management/client/grpc_test.go
+++ b/shared/management/client/grpc_test.go
@@ -12,6 +12,8 @@ import (
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 
+	"github.com/netbirdio/netbird/client/system"
+	"github.com/netbirdio/netbird/shared/management/certposture"
 	mgmtProto "github.com/netbirdio/netbird/shared/management/proto"
 )
 
@@ -93,3 +95,25 @@ func TestMaxRecvMsgSizeIntegration(t *testing.T) {
 		assert.Len(t, resp.Key, payloadSize)
 	})
 }
+
+// TestInfoToMetaData_CarriesCertificateProofs: management verifies the proofs it receives
+// in the peer meta, so a field dropped by the mapping fails the certificate check without
+// any error on either side.
+func TestInfoToMetaData_CarriesCertificateProofs(t *testing.T) {
+	info := &system.Info{CertificateProofs: []certposture.Proof{
+		{Nonce: []byte("nonce-1"), Chain: [][]byte{[]byte("leaf"), []byte("intermediate")}, SigAlg: "ecdsa-sha256", Signature: []byte("sig-1")},
+		{Nonce: []byte("nonce-2"), Chain: [][]byte{[]byte("other")}, SigAlg: "rsa-pss-sha256", Signature: []byte("sig-2")},
+	}}
+
+	meta := infoToMetaData(info)
+
+	require.Len(t, meta.GetCertificateProofs(), 2, "every proof reaches the meta")
+	first := meta.GetCertificateProofs()[0]
+	assert.Equal(t, []byte("nonce-1"), first.GetNonce())
+	assert.Equal(t, [][]byte{[]byte("leaf"), []byte("intermediate")}, first.GetChain(), "the whole chain is carried, in order")
+	assert.Equal(t, "ecdsa-sha256", first.GetSigAlg())
+	assert.Equal(t, []byte("sig-1"), first.GetSignature())
+	assert.Equal(t, "rsa-pss-sha256", meta.GetCertificateProofs()[1].GetSigAlg())
+
+	assert.Empty(t, infoToMetaData(&system.Info{}).GetCertificateProofs(), "a device without proofs sends none")
+}
diff --git a/shared/management/http/api/openapi.yml b/shared/management/http/api/openapi.yml
index 8b97d5f47..fbf8bf5cd 100644
--- a/shared/management/http/api/openapi.yml
+++ b/shared/management/http/api/openapi.yml
@@ -1821,6 +1821,7 @@ components:
         ca_certificates:
           description: PEM encoded CA certificates the peer's certificate must chain to
           type: array
+          minItems: 1
           items:
             type: string
           example: ["-----BEGIN CERTIFICATE-----\nMIIB...\n-----END CERTIFICATE-----"]

From 547dd1f177bc1190558a680488f085550b1f39a4 Mon Sep 17 00:00:00 2001
From: Riccardo Manfrin <3090891+riccardomanfrin@users.noreply.github.com>
Date: Thu, 15 Oct 2026 12:19:57 +0200
Subject: [PATCH 65/70] [client] Detect default route changes in the Linux
 network monitor (#8216)

The Linux network monitor skipped every route update whose Dst was not
nil, treating a nil Dst as the default route. Since the bump to
vishvananda/netlink v1.3 (v0.43.0) the default route arrives as an
explicit 0.0.0.0/0 or ::/0, so every default route change was filtered
out and the monitor never fired on Linux, no matter how the underlay
moved.

Treat both a nil Dst and a zero-length prefix as the default route.
---
 .../networkmonitor/check_change_linux.go      | 13 +++++-
 .../networkmonitor/check_change_linux_test.go | 43 +++++++++++++++++++
 2 files changed, 55 insertions(+), 1 deletion(-)
 create mode 100644 client/internal/networkmonitor/check_change_linux_test.go

diff --git a/client/internal/networkmonitor/check_change_linux.go b/client/internal/networkmonitor/check_change_linux.go
index efd8b5884..4fbff4448 100644
--- a/client/internal/networkmonitor/check_change_linux.go
+++ b/client/internal/networkmonitor/check_change_linux.go
@@ -6,6 +6,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"net"
 	"syscall"
 
 	log "github.com/sirupsen/logrus"
@@ -35,7 +36,7 @@ func checkChange(ctx context.Context, nexthopv4, nexthopv6 systemops.Nexthop) er
 		// handle route changes
 		case route := <-routeChan:
 			// default route and main table
-			if route.Dst != nil || route.Table != syscall.RT_TABLE_MAIN {
+			if !isDefaultRoute(route.Dst) || route.Table != syscall.RT_TABLE_MAIN {
 				continue
 			}
 			switch route.Type {
@@ -52,3 +53,13 @@ func checkChange(ctx context.Context, nexthopv4, nexthopv6 systemops.Nexthop) er
 		}
 	}
 }
+
+// isDefaultRoute reports whether dst is a default route. netlink v1.3 reports
+// the default as 0.0.0.0/0 or ::/0, older versions as a nil Dst.
+func isDefaultRoute(dst *net.IPNet) bool {
+	if dst == nil {
+		return true
+	}
+	ones, _ := dst.Mask.Size()
+	return ones == 0
+}
diff --git a/client/internal/networkmonitor/check_change_linux_test.go b/client/internal/networkmonitor/check_change_linux_test.go
new file mode 100644
index 000000000..13e1c9e6d
--- /dev/null
+++ b/client/internal/networkmonitor/check_change_linux_test.go
@@ -0,0 +1,43 @@
+//go:build !android
+
+package networkmonitor
+
+import (
+	"net"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestIsDefaultRoute(t *testing.T) {
+	mustCIDR := func(s string) *net.IPNet {
+		t.Helper()
+		_, n, err := net.ParseCIDR(s)
+		if err != nil {
+			t.Fatalf("parse %s: %v", s, err)
+		}
+		return n
+	}
+
+	tests := []struct {
+		name string
+		dst  *net.IPNet
+		want bool
+	}{
+		// netlink before v1.3 left Dst nil for the default route.
+		{name: "nil dst", dst: nil, want: true},
+		// netlink v1.3 reports the default route with an explicit zero-length prefix.
+		{name: "v4 default", dst: mustCIDR("0.0.0.0/0"), want: true},
+		{name: "v6 default", dst: mustCIDR("::/0"), want: true},
+		// The exit node split routes and ordinary prefixes are not defaults.
+		{name: "v4 split half", dst: mustCIDR("0.0.0.0/1"), want: false},
+		{name: "v4 subnet", dst: mustCIDR("10.0.0.0/8"), want: false},
+		{name: "v4 host", dst: mustCIDR("1.1.1.1/32"), want: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, isDefaultRoute(tt.dst), "default route detection")
+		})
+	}
+}

From 357d8a2a7c565605e0e10cd79d1b46c5ea958555 Mon Sep 17 00:00:00 2001
From: Nicolas Frati <nicofrati@gmail.com>
Date: Thu, 15 Oct 2026 14:26:50 +0200
Subject: [PATCH 66/70] [proxy,client] Add --external-ip-map flag for the
 embedded client (#8185)

* [proxy] Add --external-ip-map flag for the embedded client

The proxy behind a NAT with a forwarded fixed --wg-port could not advertise
its public address as an ICE candidate, so peers fell back to relay. Expose
the agent's external IP map through embed.Options and a proxy flag
(NB_PROXY_EXTERNAL_IP_MAP).

* [proxy] Validate --external-ip-map at startup

The engine drops every external IP mapping when one fails to parse, so a
typo or a space after a comma silently disabled the feature. Move the
agent's validator to shared/externalipmap, run it from the proxy at
startup, and trim entries first.

* [client,proxy] Require an external IP first in --external-ip-map

The engine reads the first component as the external IP, so a mapping like
iface/10.0.0.5 passed validation and then dropped every mapping.
---
 client/cmd/up.go                      | 73 +--------------------------
 client/embed/embed.go                 |  4 ++
 proxy/cmd/proxy/cmd/root.go           | 20 ++++++++
 proxy/internal/roundtrip/netbird.go   |  4 ++
 proxy/lifecycle.go                    |  4 ++
 proxy/server.go                       | 12 +++--
 shared/externalipmap/validate.go      | 70 +++++++++++++++++++++++++
 shared/externalipmap/validate_test.go | 48 ++++++++++++++++++
 8 files changed, 160 insertions(+), 75 deletions(-)
 create mode 100644 shared/externalipmap/validate.go
 create mode 100644 shared/externalipmap/validate_test.go

diff --git a/client/cmd/up.go b/client/cmd/up.go
index 120a25595..e336ba257 100644
--- a/client/cmd/up.go
+++ b/client/cmd/up.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"net"
 	"net/netip"
 	"runtime"
 	"strings"
@@ -26,16 +25,11 @@ import (
 	"github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/client/server"
 	"github.com/netbirdio/netbird/client/system"
+	"github.com/netbirdio/netbird/shared/externalipmap"
 	"github.com/netbirdio/netbird/shared/management/domain"
 	"github.com/netbirdio/netbird/util"
 )
 
-const (
-	invalidInputType int = iota
-	ipInputType
-	interfaceInputType
-)
-
 const (
 	dnsLabelsFlag = "extra-dns-labels"
 
@@ -106,7 +100,7 @@ func upFunc(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("failed initializing log %v", err)
 	}
 
-	err = validateNATExternalIPs(natExternalIPs)
+	err = externalipmap.Validate(natExternalIPs)
 	if err != nil {
 		return err
 	}
@@ -836,36 +830,6 @@ func setupLoginRequest(providedSetupKey string, customDNSAddressConverted []byte
 	return &loginRequest, nil
 }
 
-func validateNATExternalIPs(list []string) error {
-	for _, element := range list {
-		if element == "" {
-			return fmt.Errorf("empty string is not a valid input for %s", externalIPMapFlag)
-		}
-
-		subElements := strings.Split(element, "/")
-		if len(subElements) > 2 {
-			return fmt.Errorf("%s is not a valid input for %s. it should be formatted as \"String\" or \"String/String\"", element, externalIPMapFlag)
-		}
-
-		if len(subElements) == 1 && !isValidIP(subElements[0]) {
-			return fmt.Errorf("%s is not a valid input for %s. it should be formatted as \"IP\" or \"IP/IP\", or \"IP/Interface Name\"", element, externalIPMapFlag)
-		}
-
-		last := 0
-		for _, singleElement := range subElements {
-			inputType, err := validateElement(singleElement)
-			if err != nil {
-				return fmt.Errorf("%s is not a valid input for %s. it should be an IP string or a network name", singleElement, externalIPMapFlag)
-			}
-			if last == interfaceInputType && inputType == interfaceInputType {
-				return fmt.Errorf("%s is not a valid input for %s. it should not contain two interface names", element, externalIPMapFlag)
-			}
-			last = inputType
-		}
-	}
-	return nil
-}
-
 func parseInterfaceName(name string) error {
 	if runtime.GOOS != "darwin" {
 		return nil
@@ -878,39 +842,6 @@ func parseInterfaceName(name string) error {
 	return fmt.Errorf("invalid interface name %s. Please use the prefix utun followed by a number on MacOS. e.g., utun1 or utun199", name)
 }
 
-func validateElement(element string) (int, error) {
-	if isValidIP(element) {
-		return ipInputType, nil
-	}
-	validIface, err := isValidInterface(element)
-	if err != nil {
-		return invalidInputType, fmt.Errorf("unable to validate the network interface name, error: %s", err)
-	}
-
-	if validIface {
-		return interfaceInputType, nil
-	}
-
-	return interfaceInputType, fmt.Errorf("invalid IP or network interface name not found")
-}
-
-func isValidIP(ip string) bool {
-	return net.ParseIP(ip) != nil
-}
-
-func isValidInterface(name string) (bool, error) {
-	netInterfaces, err := net.Interfaces()
-	if err != nil {
-		return false, err
-	}
-	for _, iface := range netInterfaces {
-		if iface.Name == name {
-			return true, nil
-		}
-	}
-	return false, nil
-}
-
 func parseCustomDNSAddress(modified bool) ([]byte, error) {
 	var parsed []byte
 	if modified {
diff --git a/client/embed/embed.go b/client/embed/embed.go
index 6fdddab48..208e71817 100644
--- a/client/embed/embed.go
+++ b/client/embed/embed.go
@@ -118,6 +118,9 @@ type Options struct {
 	MTU *uint16
 	// DNSLabels defines additional DNS labels configured in the peer.
 	DNSLabels []string
+	// NATExternalIPs maps external IPs to internal IPs or interfaces for ICE
+	// candidates, same format as the agent's --external-ip-map flag.
+	NATExternalIPs []string
 	// Performance configures the tunnel's buffer pool cap and batch size.
 	Performance Performance
 }
@@ -224,6 +227,7 @@ func New(opts Options) (*Client, error) {
 		WireguardPort:       opts.WireguardPort,
 		MTU:                 opts.MTU,
 		DNSLabels:           parsedLabels,
+		NATExternalIPs:      opts.NATExternalIPs,
 	}
 	if opts.ConfigPath != "" {
 		config, err = profilemanager.UpdateOrCreateConfig(input)
diff --git a/proxy/cmd/proxy/cmd/root.go b/proxy/cmd/proxy/cmd/root.go
index 765d5c05a..5734efe4e 100644
--- a/proxy/cmd/proxy/cmd/root.go
+++ b/proxy/cmd/proxy/cmd/root.go
@@ -6,6 +6,7 @@ import (
 	"os"
 	"os/signal"
 	"strconv"
+	"strings"
 	"syscall"
 	"time"
 
@@ -13,6 +14,7 @@ import (
 	"github.com/spf13/cobra"
 	"golang.org/x/crypto/acme"
 
+	"github.com/netbirdio/netbird/shared/externalipmap"
 	"github.com/netbirdio/netbird/shared/management/domain"
 	"github.com/netbirdio/netbird/shared/profiling"
 
@@ -74,6 +76,7 @@ var (
 	certLockMethod        string
 	wildcardCertDir       string
 	wgPort                uint16
+	externalIPMap         []string
 	proxyProtocol         bool
 	preSharedKey          string
 	supportsCustomPorts   bool
@@ -117,6 +120,7 @@ func init() {
 	rootCmd.Flags().StringVar(&certLockMethod, "cert-lock-method", envStringOrDefault("NB_PROXY_CERT_LOCK_METHOD", "auto"), "Certificate lock method for cross-replica coordination: auto, flock, or k8s-lease")
 	rootCmd.Flags().StringVar(&wildcardCertDir, "wildcard-cert-dir", envStringOrDefault("NB_PROXY_WILDCARD_CERT_DIR", ""), "Directory containing wildcard certificate pairs (<name>.crt/<name>.key). Wildcard patterns are extracted from SANs automatically")
 	rootCmd.Flags().Uint16Var(&wgPort, "wg-port", envUint16OrDefault("NB_PROXY_WG_PORT", 0), "WireGuard listen port (0 = random). Fixed port only works with single-account deployments")
+	rootCmd.Flags().StringSliceVar(&externalIPMap, "external-ip-map", envStringSliceOrDefault("NB_PROXY_EXTERNAL_IP_MAP", nil), "Comma-separated external IPs to advertise as ICE candidates, as IP or IP/internal-IP-or-interface (e.g. '203.0.113.5/10.0.0.5'). Requires a fixed --wg-port forwarded on the NAT")
 	rootCmd.Flags().BoolVar(&proxyProtocol, "proxy-protocol", envBoolOrDefault("NB_PROXY_PROXY_PROTOCOL", false), "Enable PROXY protocol on TCP listeners to preserve client IPs behind L4 proxies")
 	rootCmd.Flags().StringVar(&preSharedKey, "preshared-key", envStringOrDefault("NB_PROXY_PRESHARED_KEY", ""), "Define a pre-shared key for the tunnel between proxy and peers")
 	rootCmd.Flags().BoolVar(&supportsCustomPorts, "supports-custom-ports", envBoolOrDefault("NB_PROXY_SUPPORTS_CUSTOM_PORTS", true), "Whether the proxy can bind arbitrary ports for UDP/TCP passthrough")
@@ -221,6 +225,13 @@ func runServer(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("invalid --trusted-proxies: %w", err)
 	}
 
+	for i := range externalIPMap {
+		externalIPMap[i] = strings.TrimSpace(externalIPMap[i])
+	}
+	if err := externalipmap.Validate(externalIPMap); err != nil {
+		return fmt.Errorf("invalid --external-ip-map: %w", err)
+	}
+
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGTERM, syscall.SIGINT)
 	defer stop()
 
@@ -248,6 +259,7 @@ func runServer(cmd *cobra.Command, args []string) error {
 		CertLockMethod:           nbacme.CertLockMethod(certLockMethod),
 		WildcardCertDir:          wildcardCertDir,
 		WireguardPort:            wgPort,
+		NATExternalIPs:           externalIPMap,
 		Performance:              perf,
 		ProxyProtocol:            proxyProtocol,
 		PreSharedKey:             preSharedKey,
@@ -286,6 +298,14 @@ func envStringOrDefault(key string, def string) string {
 	return v
 }
 
+func envStringSliceOrDefault(key string, def []string) []string {
+	v, exists := os.LookupEnv(key)
+	if !exists || v == "" {
+		return def
+	}
+	return strings.Split(v, ",")
+}
+
 func envUint16OrDefault(key string, def uint16) uint16 {
 	v, exists := os.LookupEnv(key)
 	if !exists {
diff --git a/proxy/internal/roundtrip/netbird.go b/proxy/internal/roundtrip/netbird.go
index 07b497c46..21feb59b7 100644
--- a/proxy/internal/roundtrip/netbird.go
+++ b/proxy/internal/roundtrip/netbird.go
@@ -144,6 +144,8 @@ type ClientConfig struct {
 	WGPort       uint16
 	PreSharedKey string
 	Performance  embed.Performance
+	// NATExternalIPs mirrors embed.Options.NATExternalIPs.
+	NATExternalIPs []string
 	// BlockInbound mirrors embed.Options.BlockInbound. Set to true on the
 	// standalone proxy where the embedded client never accepts inbound;
 	// set to false on the private/embedded proxy so the engine creates
@@ -402,6 +404,7 @@ func (n *NetBird) createClientEntry(ctx context.Context, accountID types.Account
 		WireguardPort:  &wgPort,
 		PreSharedKey:   n.clientCfg.PreSharedKey,
 		Performance:    n.clientCfg.Performance,
+		NATExternalIPs: n.clientCfg.NATExternalIPs,
 	}
 	logEmbedOptions(n.logger, accountID, serviceID, publicKey.String(), embedOpts)
 	client, err := embed.New(embedOpts)
@@ -914,6 +917,7 @@ func logEmbedOptions(logger *log.Logger, accountID types.AccountID, serviceID ty
 		"management_url":        opts.ManagementURL,
 		"log_level":             opts.LogLevel,
 		"wg_port":               wgPort,
+		"nat_external_ips":      opts.NATExternalIPs,
 		"mtu":                   mtu,
 		"block_inbound":         opts.BlockInbound,
 		"block_lan_access":      opts.BlockLANAccess,
diff --git a/proxy/lifecycle.go b/proxy/lifecycle.go
index f8c74d8b5..206c296ac 100644
--- a/proxy/lifecycle.go
+++ b/proxy/lifecycle.go
@@ -89,6 +89,9 @@ type Config struct {
 	// WireguardPort is the UDP port for the embedded NetBird tunnel.
 	// Zero asks the OS for a random port.
 	WireguardPort uint16
+	// NATExternalIPs are external IPs advertised as ICE candidates by the
+	// embedded tunnel. Requires a fixed WireguardPort forwarded on the NAT.
+	NATExternalIPs []string
 	// ProxyProtocol enables PROXY protocol (v1/v2) on TCP listeners.
 	ProxyProtocol bool
 	// PreSharedKey is the WireGuard pre-shared key used between the
@@ -160,6 +163,7 @@ func New(ctx context.Context, cfg Config) *Server {
 		ForwardedProto:           cfg.ForwardedProto,
 		TrustedProxies:           cfg.TrustedProxies,
 		WireguardPort:            cfg.WireguardPort,
+		NATExternalIPs:           cfg.NATExternalIPs,
 		ProxyProtocol:            cfg.ProxyProtocol,
 		PreSharedKey:             cfg.PreSharedKey,
 		Performance:              cfg.Performance,
diff --git a/proxy/server.go b/proxy/server.go
index 083449962..9ad81b50f 100644
--- a/proxy/server.go
+++ b/proxy/server.go
@@ -203,6 +203,9 @@ type Server struct {
 	// single-account deployments; multiple accounts will fail to bind
 	// the same port.
 	WireguardPort uint16
+	// NATExternalIPs maps external IPs advertised as ICE candidates by every
+	// embedded client. Requires a fixed WireguardPort forwarded on the NAT.
+	NATExternalIPs []string
 	// Performance configures the tunnel pool/batch sizes for every
 	// embedded client this proxy spawns.
 	Performance embed.Performance
@@ -581,10 +584,11 @@ func (s *Server) initManagementClient() error {
 // inbound listeners.
 func (s *Server) initNetBirdClient() error {
 	s.netbird = roundtrip.NewNetBird(s.ctx, s.ID, s.ProxyURL, roundtrip.ClientConfig{
-		MgmtAddr:     s.ManagementAddress,
-		WGPort:       s.WireguardPort,
-		PreSharedKey: s.PreSharedKey,
-		Performance:  s.Performance,
+		MgmtAddr:       s.ManagementAddress,
+		WGPort:         s.WireguardPort,
+		PreSharedKey:   s.PreSharedKey,
+		Performance:    s.Performance,
+		NATExternalIPs: s.NATExternalIPs,
 		// On --private the embedded client serves per-account inbound
 		// listeners and must apply management's ACL: keep BlockInbound off
 		// so the engine creates the ACL manager. On the standalone proxy
diff --git a/shared/externalipmap/validate.go b/shared/externalipmap/validate.go
new file mode 100644
index 000000000..30517007c
--- /dev/null
+++ b/shared/externalipmap/validate.go
@@ -0,0 +1,70 @@
+// Package externalipmap validates the --external-ip-map flag shared by the
+// agent and the proxy.
+package externalipmap
+
+import (
+	"fmt"
+	"net"
+	"strings"
+)
+
+const flagName = "external-ip-map"
+
+// Validate checks each element is formatted as "IP", "IP/IP" or
+// "IP/interface". The engine drops every mapping when one element fails to
+// parse, so callers should reject bad input up front.
+func Validate(list []string) error {
+	for _, element := range list {
+		if element == "" {
+			return fmt.Errorf("empty string is not a valid input for %s", flagName)
+		}
+
+		subElements := strings.Split(element, "/")
+		if len(subElements) > 2 {
+			return fmt.Errorf("%s is not a valid input for %s. it should be formatted as \"String\" or \"String/String\"", element, flagName)
+		}
+
+		if !isValidIP(subElements[0]) {
+			return fmt.Errorf("%s is not a valid input for %s. it should be formatted as \"IP\" or \"IP/IP\", or \"IP/Interface Name\"", element, flagName)
+		}
+
+		if len(subElements) == 2 {
+			if err := validateInternal(subElements[1]); err != nil {
+				return fmt.Errorf("%s is not a valid input for %s. it should be an IP string or a network name: %w", subElements[1], flagName, err)
+			}
+		}
+	}
+	return nil
+}
+
+func validateInternal(element string) error {
+	if isValidIP(element) {
+		return nil
+	}
+	validIface, err := isValidInterface(element)
+	if err != nil {
+		return fmt.Errorf("validate network interface name: %w", err)
+	}
+	if !validIface {
+		return fmt.Errorf("invalid IP or network interface name not found")
+	}
+	return nil
+}
+
+// isValidIP uses net.ParseIP to match the engine's parser exactly.
+func isValidIP(ip string) bool {
+	return net.ParseIP(ip) != nil
+}
+
+func isValidInterface(name string) (bool, error) {
+	netInterfaces, err := net.Interfaces()
+	if err != nil {
+		return false, err
+	}
+	for _, iface := range netInterfaces {
+		if iface.Name == name {
+			return true, nil
+		}
+	}
+	return false, nil
+}
diff --git a/shared/externalipmap/validate_test.go b/shared/externalipmap/validate_test.go
new file mode 100644
index 000000000..baf3cf787
--- /dev/null
+++ b/shared/externalipmap/validate_test.go
@@ -0,0 +1,48 @@
+package externalipmap
+
+import (
+	"net"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestValidate(t *testing.T) {
+	ifaces, err := net.Interfaces()
+	require.NoError(t, err)
+	require.NotEmpty(t, ifaces, "host must have at least one interface")
+	iface := ifaces[0].Name
+
+	tests := []struct {
+		name    string
+		input   []string
+		wantErr bool
+	}{
+		{name: "nil", input: nil},
+		{name: "single IP", input: []string{"203.0.113.5"}},
+		{name: "IP to IP", input: []string{"203.0.113.5/10.0.0.5"}},
+		{name: "IP to interface", input: []string{"203.0.113.5/" + iface}},
+		{name: "several", input: []string{"203.0.113.5", "203.0.113.6/10.0.0.6"}},
+		{name: "empty element", input: []string{""}, wantErr: true},
+		// The engine rejects padded values, so validation must too.
+		{name: "space padded", input: []string{"203.0.113.5", " 203.0.113.6"}, wantErr: true},
+		{name: "not an IP", input: []string{"not-an-ip"}, wantErr: true},
+		{name: "too many slashes", input: []string{"203.0.113.5/10.0.0.5/10.0.0.6"}, wantErr: true},
+		{name: "unknown interface", input: []string{"203.0.113.5/nb-no-such-iface0"}, wantErr: true},
+		{name: "external interface", input: []string{iface}, wantErr: true},
+		{name: "interface to IP", input: []string{iface + "/10.0.0.5"}, wantErr: true},
+		{name: "two interfaces", input: []string{iface + "/" + iface}, wantErr: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := Validate(tt.input)
+			if tt.wantErr {
+				assert.Error(t, err, "input %q should be rejected", tt.input)
+				return
+			}
+			assert.NoError(t, err, "input %q should be accepted", tt.input)
+		})
+	}
+}

From 89c1b47e9ca73d7bc037f431760674ff919435eb Mon Sep 17 00:00:00 2001
From: Pascal Fischer <32096965+pascal-fischer@users.noreply.github.com>
Date: Thu, 15 Oct 2026 16:23:29 +0200
Subject: [PATCH 67/70] [management] cancel peer expiration for account if
 account is gone (#8218)

---
 management/server/account.go      | 21 +++++++++++++++++++--
 management/server/account_test.go | 24 ++++++++++++++++++++++++
 management/server/peer.go         |  6 ++++++
 3 files changed, 49 insertions(+), 2 deletions(-)

diff --git a/management/server/account.go b/management/server/account.go
index 90e384ac0..59991a4e4 100644
--- a/management/server/account.go
+++ b/management/server/account.go
@@ -770,7 +770,12 @@ func (am *DefaultAccountManager) peerLoginExpirationJob(ctx context.Context, acc
 		ctx = context.WithValue(ctx, hook.ExecutionContextKey, fmt.Sprintf("%s-PEER-EXPIRATION", hook.SystemSource))
 
 		expiredPeers, err := am.getExpiredPeers(ctx, accountID)
+		if isNotFound(err) {
+			log.WithContext(ctx).Debugf("account %s not found, stopping peer login expiration job", accountID)
+			return 0, false
+		}
 		if err != nil {
+			log.WithContext(ctx).Errorf("failed getting expired peers for account %s: %v", accountID, err)
 			return peerSchedulerRetryInterval, true
 		}
 
@@ -806,8 +811,12 @@ func (am *DefaultAccountManager) schedulePeerLoginExpiration(ctx context.Context
 func (am *DefaultAccountManager) peerInactivityExpirationJob(ctx context.Context, accountID string) func() (time.Duration, bool) {
 	return func() (time.Duration, bool) {
 		inactivePeers, err := am.getInactivePeers(ctx, accountID)
+		if isNotFound(err) {
+			log.WithContext(ctx).Debugf("account %s not found, stopping peer inactivity expiration job", accountID)
+			return 0, false
+		}
 		if err != nil {
-			log.WithContext(ctx).Errorf("failed getting inactive peers for account %s", accountID)
+			log.WithContext(ctx).Errorf("failed getting inactive peers for account %s: %v", accountID, err)
 			return peerSchedulerRetryInterval, true
 		}
 
@@ -827,6 +836,14 @@ func (am *DefaultAccountManager) peerInactivityExpirationJob(ctx context.Context
 	}
 }
 
+func isNotFound(err error) bool {
+	if err == nil {
+		return false
+	}
+	sErr, ok := status.FromError(err)
+	return ok && sErr.Type() == status.NotFound
+}
+
 // checkAndSchedulePeerInactivityExpiration periodically checks for inactive peers to end their sessions
 func (am *DefaultAccountManager) checkAndSchedulePeerInactivityExpiration(ctx context.Context, accountID string) {
 	am.peerInactivityExpiry.Cancel(ctx, []string{accountID})
@@ -978,8 +995,8 @@ func (am *DefaultAccountManager) DeleteAccount(ctx context.Context, accountID, u
 		log.WithContext(ctx).Errorf("failed deleting account %s. error: %s", accountID, err)
 		return err
 	}
-	// cancel peer login expiry job
 	am.peerLoginExpiry.Cancel(ctx, []string{account.Id})
+	am.peerInactivityExpiry.Cancel(ctx, []string{account.Id})
 	am.certChallenges.Forget(account.Id)
 
 	meta := map[string]any{"account_id": account.Id, "domain": account.Domain, "created_at": account.CreatedAt}
diff --git a/management/server/account_test.go b/management/server/account_test.go
index 7aa88ee64..ef7525961 100644
--- a/management/server/account_test.go
+++ b/management/server/account_test.go
@@ -4990,3 +4990,27 @@ func TestUpdateUserAuthWithSingleMode(t *testing.T) {
 		assert.Contains(t, err.Error(), "query failed")
 	})
 }
+
+func TestDefaultAccountManager_ExpirationJobsStopForDeletedAccount(t *testing.T) {
+	manager, _, err := createManager(t)
+	require.NoError(t, err, "unable to create account manager")
+
+	ctx := context.Background()
+	accountID, err := manager.GetAccountIDByUserID(ctx, auth.UserAuth{UserId: userID})
+	require.NoError(t, err, "unable to create an account")
+
+	account, err := manager.Store.GetAccount(ctx, accountID)
+	require.NoError(t, err, "unable to get account")
+	require.NoError(t, manager.Store.DeleteAccount(ctx, account), "unable to delete account")
+
+	jobs := map[string]func() (time.Duration, bool){
+		"login":      manager.peerLoginExpirationJob(ctx, accountID),
+		"inactivity": manager.peerInactivityExpirationJob(ctx, accountID),
+	}
+	for name, job := range jobs {
+		t.Run(name, func(t *testing.T) {
+			_, reschedule := job()
+			assert.False(t, reschedule, "job must not reschedule for a deleted account")
+		})
+	}
+}
diff --git a/management/server/peer.go b/management/server/peer.go
index 1e3f72a3c..f21e5ebc9 100644
--- a/management/server/peer.go
+++ b/management/server/peer.go
@@ -1702,6 +1702,9 @@ func (am *DefaultAccountManager) getNextPeerExpiration(ctx context.Context, acco
 	}
 
 	settings, err := am.Store.GetAccountSettings(ctx, store.LockingStrengthNone, accountID)
+	if isNotFound(err) {
+		return 0, false
+	}
 	if err != nil {
 		log.WithContext(ctx).Errorf("failed to get account settings: %v", err)
 		return peerSchedulerRetryInterval, true
@@ -1745,6 +1748,9 @@ func (am *DefaultAccountManager) getNextInactivePeerExpiration(ctx context.Conte
 	}
 
 	settings, err := am.Store.GetAccountSettings(ctx, store.LockingStrengthNone, accountID)
+	if isNotFound(err) {
+		return 0, false
+	}
 	if err != nil {
 		log.WithContext(ctx).Errorf("failed to get account settings: %v", err)
 		return peerSchedulerRetryInterval, true

From dd830f089086790e988b345e5a5f9415ce8e3e15 Mon Sep 17 00:00:00 2001
From: Pascal Fischer <32096965+pascal-fischer@users.noreply.github.com>
Date: Thu, 15 Oct 2026 16:26:04 +0200
Subject: [PATCH 68/70] [management] clean nul byte strings in peer meta
 (#8219)

---
 .../internals/shared/grpc/peer_meta_test.go   | 45 +++++++++++++++++++
 management/internals/shared/grpc/server.go    | 41 +++++++++--------
 2 files changed, 68 insertions(+), 18 deletions(-)
 create mode 100644 management/internals/shared/grpc/peer_meta_test.go

diff --git a/management/internals/shared/grpc/peer_meta_test.go b/management/internals/shared/grpc/peer_meta_test.go
new file mode 100644
index 000000000..c6336ff1b
--- /dev/null
+++ b/management/internals/shared/grpc/peer_meta_test.go
@@ -0,0 +1,45 @@
+package grpc
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+func TestExtractPeerMeta_RemovesNulAndInvalidUTF8(t *testing.T) {
+	meta := extractPeerMeta(context.Background(), &proto.PeerSystemMeta{
+		Hostname:        "host\x00name",
+		OS:              "\x00\x00\x00\x00\x00\x00s",
+		OSVersion:       "11\xff",
+		SysSerialNumber: "SN\x00\x00",
+		Environment:     &proto.Environment{Cloud: "\x00aws"},
+		NetworkAddresses: []*proto.NetworkAddress{
+			{NetIP: "192.168.0.1/24", Mac: "e0:d5\x00"},
+		},
+		Files: []*proto.File{{Path: "C:\\x\x00.exe"}},
+	})
+
+	assert.Equal(t, "hostname", meta.Hostname)
+	assert.Equal(t, "s", meta.OS)
+	assert.Equal(t, "11", meta.OSVersion)
+	assert.Equal(t, "SN", meta.SystemSerialNumber)
+	assert.Equal(t, "aws", meta.Environment.Cloud)
+	assert.Equal(t, "e0:d5", meta.NetworkAddresses[0].Mac)
+	assert.Equal(t, "C:\\x.exe", meta.Files[0].Path)
+}
+
+func TestCleanClientString(t *testing.T) {
+	tests := map[string]string{
+		"":                    "",
+		"\x00\x00":            "",
+		"Wïndows":             "Wïndows",
+		"ssh-ed25519 AAA\x00": "ssh-ed25519 AAA",
+		"bad\xc3\x28utf8":     "bad(utf8",
+	}
+	for in, want := range tests {
+		assert.Equal(t, want, cleanClientString(in), "input %q", in)
+	}
+}
diff --git a/management/internals/shared/grpc/server.go b/management/internals/shared/grpc/server.go
index 51023c34d..b48a86d55 100644
--- a/management/internals/shared/grpc/server.go
+++ b/management/internals/shared/grpc/server.go
@@ -553,9 +553,9 @@ func extractPeerMeta(ctx context.Context, meta *proto.PeerSystemMeta) nbpeer.Pee
 		return nbpeer.PeerSystemMeta{}
 	}
 
-	osVersion := meta.GetOSVersion()
+	osVersion := cleanClientString(meta.GetOSVersion())
 	if osVersion == "" {
-		osVersion = meta.GetCore()
+		osVersion = cleanClientString(meta.GetCore())
 	}
 
 	networkAddresses := make([]nbpeer.NetworkAddress, 0, len(meta.GetNetworkAddresses()))
@@ -567,36 +567,36 @@ func extractPeerMeta(ctx context.Context, meta *proto.PeerSystemMeta) nbpeer.Pee
 		}
 		networkAddresses = append(networkAddresses, nbpeer.NetworkAddress{
 			NetIP: netAddr,
-			Mac:   addr.GetMac(),
+			Mac:   cleanClientString(addr.GetMac()),
 		})
 	}
 
 	files := make([]nbpeer.File, 0, len(meta.GetFiles()))
 	for _, file := range meta.GetFiles() {
 		files = append(files, nbpeer.File{
-			Path:             file.GetPath(),
+			Path:             cleanClientString(file.GetPath()),
 			Exist:            file.GetExist(),
 			ProcessIsRunning: file.GetProcessIsRunning(),
 		})
 	}
 
 	return nbpeer.PeerSystemMeta{
-		Hostname:           meta.GetHostname(),
-		GoOS:               meta.GetGoOS(),
-		Kernel:             meta.GetKernel(),
-		Platform:           meta.GetPlatform(),
-		OS:                 meta.GetOS(),
+		Hostname:           cleanClientString(meta.GetHostname()),
+		GoOS:               cleanClientString(meta.GetGoOS()),
+		Kernel:             cleanClientString(meta.GetKernel()),
+		Platform:           cleanClientString(meta.GetPlatform()),
+		OS:                 cleanClientString(meta.GetOS()),
 		OSVersion:          osVersion,
-		WtVersion:          meta.GetNetbirdVersion(),
-		UIVersion:          meta.GetUiVersion(),
-		KernelVersion:      meta.GetKernelVersion(),
+		WtVersion:          cleanClientString(meta.GetNetbirdVersion()),
+		UIVersion:          cleanClientString(meta.GetUiVersion()),
+		KernelVersion:      cleanClientString(meta.GetKernelVersion()),
 		NetworkAddresses:   networkAddresses,
-		SystemSerialNumber: meta.GetSysSerialNumber(),
-		SystemProductName:  meta.GetSysProductName(),
-		SystemManufacturer: meta.GetSysManufacturer(),
+		SystemSerialNumber: cleanClientString(meta.GetSysSerialNumber()),
+		SystemProductName:  cleanClientString(meta.GetSysProductName()),
+		SystemManufacturer: cleanClientString(meta.GetSysManufacturer()),
 		Environment: nbpeer.Environment{
-			Cloud:    meta.GetEnvironment().GetCloud(),
-			Platform: meta.GetEnvironment().GetPlatform(),
+			Cloud:    cleanClientString(meta.GetEnvironment().GetCloud()),
+			Platform: cleanClientString(meta.GetEnvironment().GetPlatform()),
 		},
 		Flags: nbpeer.Flags{
 			RosenpassEnabled:      meta.GetFlags().GetRosenpassEnabled(),
@@ -618,6 +618,11 @@ func extractPeerMeta(ctx context.Context, meta *proto.PeerSystemMeta) nbpeer.Pee
 	}
 }
 
+// cleanClientString removes NUL bytes and invalid UTF-8 from a client-reported string, which Postgres rejects in text columns.
+func cleanClientString(s string) string {
+	return strings.ToValidUTF8(strings.ReplaceAll(s, "\x00", ""), "")
+}
+
 func capabilitiesToInt32(caps []proto.PeerCapability) []int32 {
 	result := make([]int32, len(caps))
 	for i, c := range caps {
@@ -711,7 +716,7 @@ func (s *Server) Login(ctx context.Context, req *proto.EncryptedMessage) (*proto
 
 	peer, network, postureChecks, enableSSH, err := s.accountManager.LoginPeer(ctx, types.PeerLogin{
 		WireGuardPubKey: peerKey.String(),
-		SSHKey:          string(sshKey),
+		SSHKey:          cleanClientString(string(sshKey)),
 		Meta:            peerMeta,
 		UserID:          userID,
 		SetupKey:        loginReq.GetSetupKey(),

From afd5c6df6a26eec3c0a81df2374dfe1ce9983ea8 Mon Sep 17 00:00:00 2001
From: Pascal Fischer <32096965+pascal-fischer@users.noreply.github.com>
Date: Thu, 15 Oct 2026 16:27:36 +0200
Subject: [PATCH 69/70] [management] fix proxy conn lifecycle during acks
 (#8220)

---
 management/internals/shared/grpc/proxy.go     | 57 ++++++++++++---
 .../shared/grpc/sync_mappings_test.go         | 72 +++++++++++++++++++
 proxy/server.go                               |  8 +++
 3 files changed, 127 insertions(+), 10 deletions(-)

diff --git a/management/internals/shared/grpc/proxy.go b/management/internals/shared/grpc/proxy.go
index 8e93f77b0..439ff1dba 100644
--- a/management/internals/shared/grpc/proxy.go
+++ b/management/internals/shared/grpc/proxy.go
@@ -152,6 +152,10 @@ type ProxyServiceServer struct {
 	// initial snapshot delivery. Configurable via NB_PROXY_SNAPSHOT_BATCH_SIZE.
 	snapshotBatchSize int
 
+	// snapshotAckTimeout bounds the wait for each snapshot batch ack.
+	// Defaults to defaultSnapshotAckTimeout when zero.
+	snapshotAckTimeout time.Duration
+
 	cancel context.CancelFunc
 }
 
@@ -168,6 +172,8 @@ const defaultProxyTokenTTL = 5 * time.Minute
 
 const defaultSnapshotBatchSize = 500
 
+const defaultSnapshotAckTimeout = 5 * time.Minute
+
 func snapshotBatchSizeFromEnv() int {
 	if v := os.Getenv("NB_PROXY_SNAPSHOT_BATCH_SIZE"); v != "" {
 		if n, err := strconv.Atoi(v); err == nil && n > 0 {
@@ -185,6 +191,14 @@ func (s *ProxyServiceServer) proxyTokenTTL() time.Duration {
 	return defaultProxyTokenTTL
 }
 
+// snapshotAckWait returns the configured snapshot ack timeout or the default when unset.
+func (s *ProxyServiceServer) snapshotAckWait() time.Duration {
+	if s.snapshotAckTimeout > 0 {
+		return s.snapshotAckTimeout
+	}
+	return defaultSnapshotAckTimeout
+}
+
 // proxyConnection represents a connected proxy
 type proxyConnection struct {
 	proxyID      string
@@ -484,7 +498,7 @@ func (s *ProxyServiceServer) SyncMappings(stream proto.ProxyService_SyncMappings
 		return err
 	}
 
-	if err := s.sendSnapshotSync(stream.Context(), conn, stream); err != nil {
+	if err := s.sendSnapshotSync(conn.ctx, conn, stream); err != nil {
 		s.cleanupFailedSnapshot(stream.Context(), conn)
 		return fmt.Errorf("send snapshot to proxy %s: %w", params.proxyID, err)
 	}
@@ -728,7 +742,7 @@ func (s *ProxyServiceServer) sendSnapshotSync(ctx context.Context, conn *proxyCo
 			return fmt.Errorf("send snapshot batch: %w", err)
 		}
 
-		if err := waitForAck(stream); err != nil {
+		if err := waitForAck(ctx, stream, s.snapshotAckWait()); err != nil {
 			return err
 		}
 	}
@@ -740,7 +754,7 @@ func (s *ProxyServiceServer) sendSnapshotSync(ctx context.Context, conn *proxyCo
 			return fmt.Errorf("send snapshot completion: %w", err)
 		}
 
-		if err := waitForAck(stream); err != nil {
+		if err := waitForAck(ctx, stream, s.snapshotAckWait()); err != nil {
 			return err
 		}
 	}
@@ -748,15 +762,38 @@ func (s *ProxyServiceServer) sendSnapshotSync(ctx context.Context, conn *proxyCo
 	return nil
 }
 
-func waitForAck(stream proto.ProxyService_SyncMappingsServer) error {
-	msg, err := stream.Recv()
-	if err != nil {
-		return fmt.Errorf("receive ack: %w", err)
+// waitForAck waits for the proxy to ack a snapshot batch. It gives up when ctx
+// is canceled or no ack arrives within timeout, since a proxy that abandoned the
+// stream without closing it would otherwise block the handler indefinitely.
+func waitForAck(ctx context.Context, stream proto.ProxyService_SyncMappingsServer, timeout time.Duration) error {
+	type recvResult struct {
+		msg *proto.SyncMappingsRequest
+		err error
 	}
-	if msg.GetAck() == nil {
-		return fmt.Errorf("expected ack, got %T", msg.GetMsg())
+	// Recv returns once the handler exits and gRPC tears the stream down.
+	result := make(chan recvResult, 1)
+	go func() {
+		msg, err := stream.Recv()
+		result <- recvResult{msg: msg, err: err}
+	}()
+
+	timer := time.NewTimer(timeout)
+	defer timer.Stop()
+
+	select {
+	case r := <-result:
+		if r.err != nil {
+			return fmt.Errorf("receive ack: %w", r.err)
+		}
+		if r.msg.GetAck() == nil {
+			return fmt.Errorf("expected ack, got %T", r.msg.GetMsg())
+		}
+		return nil
+	case <-ctx.Done():
+		return fmt.Errorf("wait for ack: %w", ctx.Err())
+	case <-timer.C:
+		return fmt.Errorf("no ack within %s", timeout)
 	}
-	return nil
 }
 
 // heartbeat updates the proxy's last_seen timestamp every minute and
diff --git a/management/internals/shared/grpc/sync_mappings_test.go b/management/internals/shared/grpc/sync_mappings_test.go
index 6949b79e9..753142ea0 100644
--- a/management/internals/shared/grpc/sync_mappings_test.go
+++ b/management/internals/shared/grpc/sync_mappings_test.go
@@ -409,3 +409,75 @@ func TestConnectionSendResponse_RoutesToLegacyStream(t *testing.T) {
 	require.Len(t, stream.messages, 1)
 	assert.Equal(t, "svc-2", stream.messages[0].Mapping[0].Id)
 }
+
+// blockingSyncStream is a ProxyService_SyncMappingsServer whose Recv blocks
+// until the test ends, like a proxy that stopped acking without closing the stream.
+type blockingSyncStream struct {
+	grpc.ServerStream
+	done chan struct{}
+}
+
+func (s *blockingSyncStream) Recv() (*proto.SyncMappingsRequest, error) {
+	<-s.done
+	return nil, context.Canceled
+}
+
+func (s *blockingSyncStream) Send(*proto.SyncMappingsResponse) error { return nil }
+
+func newBlockingSyncStream(t *testing.T) *blockingSyncStream {
+	t.Helper()
+	s := &blockingSyncStream{done: make(chan struct{})}
+	t.Cleanup(func() { close(s.done) })
+	return s
+}
+
+func TestWaitForAck_Ack(t *testing.T) {
+	stream := &syncRecordingStream{recvMsgs: []*proto.SyncMappingsRequest{ackMsg()}}
+
+	require.NoError(t, waitForAck(context.Background(), stream, time.Second))
+}
+
+func TestWaitForAck_UnexpectedMessage(t *testing.T) {
+	stream := &syncRecordingStream{recvMsgs: []*proto.SyncMappingsRequest{
+		{Msg: &proto.SyncMappingsRequest_Init{Init: &proto.SyncMappingsInit{}}},
+	}}
+
+	assert.ErrorContains(t, waitForAck(context.Background(), stream, time.Second), "expected ack")
+}
+
+func TestWaitForAck_TimesOutWhenProxyStopsAcking(t *testing.T) {
+	stream := newBlockingSyncStream(t)
+
+	start := time.Now()
+	err := waitForAck(context.Background(), stream, 50*time.Millisecond)
+
+	assert.ErrorContains(t, err, "no ack within")
+	assert.Less(t, time.Since(start), time.Second)
+}
+
+func TestWaitForAck_ReturnsWhenConnectionCanceled(t *testing.T) {
+	stream := newBlockingSyncStream(t)
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	assert.ErrorIs(t, waitForAck(ctx, stream, time.Minute), context.Canceled)
+}
+
+func TestSendSnapshotSync_GivesUpWhenProxyStopsAcking(t *testing.T) {
+	const cluster = "cluster.example.com"
+
+	ctrl := gomock.NewController(t)
+	mgr := rpservice.NewMockManager(ctrl)
+	mgr.EXPECT().GetGlobalServices(gomock.Any()).Return(makeServices(1, cluster), nil)
+
+	s := newSnapshotTestServer(t, 10)
+	s.serviceManager = mgr
+	s.snapshotAckTimeout = 50 * time.Millisecond
+
+	stream := newBlockingSyncStream(t)
+	conn := &proxyConnection{proxyID: "proxy-a", address: cluster, syncStream: stream}
+
+	err := s.sendSnapshotSync(context.Background(), conn, stream)
+
+	assert.ErrorContains(t, err, "no ack within")
+}
diff --git a/proxy/server.go b/proxy/server.go
index 9ad81b50f..3bba38644 100644
--- a/proxy/server.go
+++ b/proxy/server.go
@@ -1303,6 +1303,10 @@ func (s *Server) proxyCapabilities() *proto.ProxyCapabilities {
 }
 
 func (s *Server) tryGetMappingUpdate(ctx context.Context, client proto.ProxyServiceClient, initialSyncDone *bool, onConnected func()) error {
+	// Canceling closes the stream on management; a bare return leaves it open.
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
 	connectTime := time.Now()
 	mappingClient, err := client.GetMappingUpdate(ctx, &proto.GetMappingUpdateRequest{
 		ProxyId:      s.ID,
@@ -1325,6 +1329,10 @@ func (s *Server) tryGetMappingUpdate(ctx context.Context, client proto.ProxyServ
 }
 
 func (s *Server) trySyncMappings(ctx context.Context, client proto.ProxyServiceClient, initialSyncDone *bool, onConnected func()) error {
+	// Canceling closes the stream on management; a bare return leaves it open.
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
 	connectTime := time.Now()
 	stream, err := client.SyncMappings(ctx)
 	if err != nil {

From 28657607c14d4b5135c48cb79fcb9f4fd0600b42 Mon Sep 17 00:00:00 2001
From: Zoltan Papp <zoltan.pmail@gmail.com>
Date: Fri, 16 Oct 2026 02:16:45 +0200
Subject: [PATCH 70/70] [client] Keep interface discovery out of the bind open
 path (#8226)

* [client] Keep interface discovery out of the bind open path

Since 0.81.0 a userspace-mode agent whose interface name is not covered
by the interface blacklist deadlocks while bringing the device up, and
the daemon, the GUI and the service stop all hang. wireguard-go holds
the device net lock across bind.Open, our bind builds the UDP mux there,
the mux enumerated interfaces in its constructor, and the interface
filter probed every unlisted name through wgctrl. For the agent's own
interface that probe connected to the daemon's own UAPI endpoint and
waited, with no deadline, for a reply the handler could only give after
taking the same lock. #7346 moved the first enumeration from the stdnet
constructor, which ran before the device existed, to this call site.

The mux no longer discovers interfaces when it is constructed. It
records whether its socket is bound to an unspecified address and
GetConn uses that instead of the length of the discovered list, while
GetListenAddresses keeps refreshing on demand, which pion calls during
candidate gathering outside the device locks. The WireGuard detector
also answers for the agent's own interface without probing, so no
filter asks the daemon about itself.

* [client] Take the agent's own interface name in the detector constructor

Every device implementation reports the configured name, so there is no
later name to follow and the setter was state without a reader that
needed it. The detector takes the name once and compares without a lock.

* [client] Create the default mux Net in the constructor

With discovery moved to GetListenAddresses, the nil Net fallback ran
there as well, and the first concurrent callers raced on writing it.
stdnet.NewNet does no discovery, so the constructor can create it before
the mux is shared and the address refresh only reads it.

* [client] Follow the created interface name in the detector

Android ignores the configured interface name and keeps the TUN name
returned by CreateUnmonitoredTUNFromFD, so the detector built from the
configuration would still probe the agent's real interface. The engine
updates the detector with wgInterface.Name() once the interface exists.

* [client] Keep the detector's own interface name immutable

On Android the kernel names the TUN and the name can change again on
renew, while the UAPI socket cannot be opened there at all, so neither
the probe nor a name set after creation can identify the agent's own
interface reliably. Excluding that interface on Android belongs to the
interface discovery the app provides. Everywhere else the configured
name is the created name, so the constructor argument is enough and the
detector needs no setter and no lock on the hot path.
---
 client/iface/bind/ice_bind_test.go        | 88 ++++++++++++++++++++
 client/iface/udpmux/mux.go                | 20 ++---
 client/iface/udpmux/mux_test.go           | 99 +++++++++++++++++++++++
 client/internal/engine.go                 |  2 +-
 client/internal/stdnet/wgdetector.go      | 19 ++++-
 client/internal/stdnet/wgdetector_test.go | 36 +++++++++
 6 files changed, 250 insertions(+), 14 deletions(-)
 create mode 100644 client/iface/udpmux/mux_test.go

diff --git a/client/iface/bind/ice_bind_test.go b/client/iface/bind/ice_bind_test.go
index 0b8db7640..8dd82d7df 100644
--- a/client/iface/bind/ice_bind_test.go
+++ b/client/iface/bind/ice_bind_test.go
@@ -2,17 +2,22 @@ package bind
 
 import (
 	"fmt"
+	"io"
 	"net"
 	"net/netip"
 	"sync"
+	"sync/atomic"
 	"testing"
 	"time"
 
+	"github.com/pion/transport/v3"
 	"github.com/pion/transport/v3/stdnet"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/net/ipv4"
 	"golang.org/x/net/ipv6"
+	"golang.zx2c4.com/wireguard/device"
+	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 )
@@ -326,3 +331,86 @@ func listenUDP(t *testing.T, network, addr string) *net.UDPConn {
 	require.NoError(t, err)
 	return conn
 }
+
+type countingNet struct {
+	transport.Net
+	calls  atomic.Int64
+	ifaces []*transport.Interface
+	before func()
+}
+
+func (n *countingNet) Interfaces() ([]*transport.Interface, error) {
+	n.calls.Add(1)
+	if n.before != nil {
+		n.before()
+	}
+	return n.ifaces, nil
+}
+
+func TestICEBind_OpenDoesNotDiscoverInterfaces(t *testing.T) {
+	n := newCountingNet()
+	iceBind := NewICEBind(n, testAddress(), 1280)
+
+	for i := 0; i < 2; i++ {
+		_, port, err := iceBind.Open(0)
+		require.NoError(t, err)
+		require.NotZero(t, port, "the bind listens on a port")
+		assert.Equal(t, int64(0), n.calls.Load(), "opening the bind must not enumerate interfaces, attempt %d", i+1)
+		require.NoError(t, iceBind.Close())
+	}
+
+	_, _, err := iceBind.Open(0)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = iceBind.Close() })
+
+	mux, err := iceBind.GetICEMux()
+	require.NoError(t, err)
+	assert.NotEmpty(t, mux.SingleSocketUDPMux.GetListenAddresses(), "listen addresses come from the discovered interfaces")
+	assert.Equal(t, int64(1), n.calls.Load(), "interfaces are discovered when the listen addresses are asked for")
+}
+
+func TestICEBind_DeviceUpDoesNotWaitOnInterfaceDiscovery(t *testing.T) {
+	tunDev, _, err := netstack.CreateNetTUN([]netip.Addr{netip.MustParseAddr("100.64.0.1")}, nil, 1280)
+	require.NoError(t, err)
+
+	var dev *device.Device
+	n := newCountingNet()
+	n.before = func() {
+		_ = dev.IpcGetOperation(io.Discard)
+	}
+	iceBind := NewICEBind(n, testAddress(), 1280)
+	dev = device.NewDevice(tunDev, iceBind, device.NewLogger(device.LogLevelSilent, ""))
+
+	upDone := make(chan error, 1)
+	go func() {
+		upDone <- dev.Up()
+	}()
+
+	select {
+	case err := <-upDone:
+		require.NoError(t, err)
+	case <-time.After(5 * time.Second):
+		t.Fatal("device Up did not return: interface discovery ran under the device lock and waited on the device itself")
+	}
+	t.Cleanup(dev.Close)
+
+	assert.Equal(t, int64(0), n.calls.Load(), "bringing the device up must not enumerate interfaces")
+
+	mux, err := iceBind.GetICEMux()
+	require.NoError(t, err)
+	assert.NotEmpty(t, mux.SingleSocketUDPMux.GetListenAddresses(), "discovery that talks to the device succeeds once the device is up")
+	assert.Equal(t, int64(1), n.calls.Load(), "interfaces are discovered outside the device lock")
+}
+
+func newCountingNet() *countingNet {
+	ifc := transport.NewInterface(net.Interface{Index: 1, MTU: 1500, Name: "eth0", Flags: net.FlagUp | net.FlagMulticast})
+	ifc.AddAddress(&net.IPNet{IP: net.IPv4(192, 168, 1, 10), Mask: net.CIDRMask(24, 32)})
+	return &countingNet{ifaces: []*transport.Interface{ifc}}
+}
+
+func testAddress() wgaddr.Address {
+	return wgaddr.Address{
+		IP:      netip.MustParseAddr("100.64.0.1"),
+		Network: netip.MustParsePrefix("100.64.0.0/10"),
+	}
+}
diff --git a/client/iface/udpmux/mux.go b/client/iface/udpmux/mux.go
index 3aa0b4d88..2f7287b53 100644
--- a/client/iface/udpmux/mux.go
+++ b/client/iface/udpmux/mux.go
@@ -47,6 +47,7 @@ type SingleSocketUDPMux struct {
 
 	// for UDP connection listen at unspecified address
 	localAddrsForUnspecified []net.Addr
+	unspecified              bool
 }
 
 const maxAddrSize = 512
@@ -157,6 +158,9 @@ func NewSingleSocketUDPMux(params Params) *SingleSocketUDPMux {
 	if params.Logger == nil {
 		params.Logger = getLogger()
 	}
+	if params.Net == nil {
+		params.Net = stdnet.NewNet(context.Background(), nil, nil)
+	}
 
 	mux := &SingleSocketUDPMux{
 		addressMap:       map[string][]*udpMuxedConn{},
@@ -165,6 +169,7 @@ func NewSingleSocketUDPMux(params Params) *SingleSocketUDPMux {
 		connsIPv6:        make(map[string]*udpMuxedConn),
 		candidateConnMap: make(map[string]*udpMuxedConn),
 		closedChan:       make(chan struct{}, 1),
+		unspecified:      isUnspecified(params.UDPConn.LocalAddr()),
 		pool: &sync.Pool{
 			New: func() interface{} {
 				// big enough buffer to fit both packet and address
@@ -173,7 +178,6 @@ func NewSingleSocketUDPMux(params Params) *SingleSocketUDPMux {
 		},
 	}
 
-	mux.updateLocalAddresses()
 	return mux
 }
 
@@ -199,10 +203,6 @@ func (m *SingleSocketUDPMux) updateLocalAddresses() {
 			m.params.Logger.Errorf("LocalAddr expected IPV4 or IPV6, got %T", m.params.UDPConn.LocalAddr())
 		}
 		if len(networks) > 0 {
-			if m.params.Net == nil {
-				m.params.Net = stdnet.NewNet(context.Background(), nil, nil)
-			}
-
 			ips, err := localInterfaces(m.params.Net, m.params.InterfaceFilter, nil, networks, true)
 			if err == nil {
 				for _, ip := range ips {
@@ -241,10 +241,7 @@ func (m *SingleSocketUDPMux) GetListenAddresses() []net.Addr {
 // creates the connection if an existing one can't be found
 func (m *SingleSocketUDPMux) GetConn(ufrag string, addr net.Addr, candidateID string) (net.PacketConn, error) {
 	// don't check addr for mux using unspecified address
-	m.mu.Lock()
-	lenLocalAddrs := len(m.localAddrsForUnspecified)
-	m.mu.Unlock()
-	if lenLocalAddrs == 0 && m.params.UDPConn.LocalAddr().String() != addr.String() {
+	if !m.unspecified && m.params.UDPConn.LocalAddr().String() != addr.String() {
 		return nil, fmt.Errorf("invalid address %s", addr.String())
 	}
 
@@ -508,3 +505,8 @@ func getLogger() logging.LeveledLogger {
 	//fac.Writer = log.StandardLogger().Writer()
 	return fac.NewLogger("ice")
 }
+
+func isUnspecified(addr net.Addr) bool {
+	udpAddr, ok := addr.(*net.UDPAddr)
+	return ok && udpAddr.IP.IsUnspecified()
+}
diff --git a/client/iface/udpmux/mux_test.go b/client/iface/udpmux/mux_test.go
new file mode 100644
index 000000000..2e2770282
--- /dev/null
+++ b/client/iface/udpmux/mux_test.go
@@ -0,0 +1,99 @@
+package udpmux
+
+import (
+	"fmt"
+	"net"
+	"sync"
+	"sync/atomic"
+	"testing"
+
+	"github.com/pion/transport/v3"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type countingNet struct {
+	transport.Net
+	calls  atomic.Int64
+	ifaces []*transport.Interface
+}
+
+func (n *countingNet) Interfaces() ([]*transport.Interface, error) {
+	n.calls.Add(1)
+	return n.ifaces, nil
+}
+
+func TestNewSingleSocketUDPMux_DoesNotDiscoverInterfaces(t *testing.T) {
+	conn := listenUDP(t, net.IPv4zero)
+	n := &countingNet{ifaces: []*transport.Interface{testInterface("eth0", net.IPv4(192, 168, 1, 10))}}
+
+	mux := NewSingleSocketUDPMux(Params{UDPConn: conn, Net: n})
+	t.Cleanup(func() { _ = mux.Close() })
+
+	assert.Equal(t, int64(0), n.calls.Load(), "constructing the mux must not enumerate interfaces")
+
+	addrs := mux.GetListenAddresses()
+	assert.Equal(t, int64(1), n.calls.Load(), "listen addresses are discovered when they are asked for")
+
+	port := conn.LocalAddr().(*net.UDPAddr).Port
+	require.Len(t, addrs, 1, "one address per discovered interface IP")
+	assert.Equal(t, fmt.Sprintf("192.168.1.10:%d", port), addrs[0].String(), "the discovered IP is paired with the socket port")
+}
+
+func TestSingleSocketUDPMux_GetConnWithoutListenAddresses(t *testing.T) {
+	t.Run("unspecified socket accepts any address", func(t *testing.T) {
+		conn := listenUDP(t, net.IPv4zero)
+		n := &countingNet{}
+		mux := NewSingleSocketUDPMux(Params{UDPConn: conn, Net: n})
+		t.Cleanup(func() { _ = mux.Close() })
+
+		port := conn.LocalAddr().(*net.UDPAddr).Port
+		pc, err := mux.GetConn("ufrag", &net.UDPAddr{IP: net.IPv4(192, 168, 1, 10), Port: port}, "candidate")
+		require.NoError(t, err)
+		assert.NotNil(t, pc, "a connection is created for a local address of an unspecified socket")
+		assert.Equal(t, int64(0), n.calls.Load(), "GetConn must not depend on a prior discovery")
+	})
+
+	t.Run("specific socket rejects a foreign address", func(t *testing.T) {
+		conn := listenUDP(t, net.IPv4(127, 0, 0, 1))
+		mux := NewSingleSocketUDPMux(Params{UDPConn: conn})
+		t.Cleanup(func() { _ = mux.Close() })
+
+		_, err := mux.GetConn("ufrag", &net.UDPAddr{IP: net.IPv4(192, 168, 1, 10), Port: 1234}, "candidate")
+		assert.Error(t, err, "an address the socket is not bound to must be rejected")
+
+		pc, err := mux.GetConn("ufrag", conn.LocalAddr(), "candidate")
+		require.NoError(t, err)
+		assert.NotNil(t, pc, "the bound address is accepted")
+	})
+}
+
+func listenUDP(t *testing.T, ip net.IP) *net.UDPConn {
+	t.Helper()
+	conn, err := net.ListenUDP("udp4", &net.UDPAddr{IP: ip, Port: 0})
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = conn.Close() })
+	return conn
+}
+
+func testInterface(name string, ip net.IP) *transport.Interface {
+	ifc := transport.NewInterface(net.Interface{Index: 1, MTU: 1500, Name: name, Flags: net.FlagUp | net.FlagMulticast})
+	ifc.AddAddress(&net.IPNet{IP: ip, Mask: net.CIDRMask(24, 32)})
+	return ifc
+}
+
+func TestSingleSocketUDPMux_ConcurrentListenAddressesWithDefaultNet(t *testing.T) {
+	conn := listenUDP(t, net.IPv4zero)
+	mux := NewSingleSocketUDPMux(Params{UDPConn: conn})
+	t.Cleanup(func() { _ = mux.Close() })
+
+	var wg sync.WaitGroup
+	for i := 0; i < 8; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			assert.NotEmpty(t, mux.GetListenAddresses(), "every caller gets at least the socket address")
+		}()
+	}
+	wg.Wait()
+}
diff --git a/client/internal/engine.go b/client/internal/engine.go
index fdf89ae06..c4bdf5121 100644
--- a/client/internal/engine.go
+++ b/client/internal/engine.go
@@ -387,7 +387,7 @@ func NewEngine(
 		mgmClient:          services.MgmClient,
 		relayManager:       services.RelayManager,
 		peerStore:          peerstore.NewConnStore(),
-		wgDetector:         stdnet.NewWGDetector(),
+		wgDetector:         stdnet.NewWGDetector(config.WgIfaceName),
 		syncMsgMux:         &sync.Mutex{},
 		config:             config,
 		mobileDep:          mobileDep,
diff --git a/client/internal/stdnet/wgdetector.go b/client/internal/stdnet/wgdetector.go
index f34e469e1..8ed290190 100644
--- a/client/internal/stdnet/wgdetector.go
+++ b/client/internal/stdnet/wgdetector.go
@@ -34,6 +34,8 @@ type WGDetector struct {
 	// probe is replaced in tests; it is the call this type exists to avoid repeating.
 	probe func(string) bool
 
+	ownIface string
+
 	mu    sync.RWMutex
 	cache map[string]wgDetectorEntry
 
@@ -41,11 +43,12 @@ type WGDetector struct {
 }
 
 // NewWGDetector returns a detector with the default time to live.
-func NewWGDetector() *WGDetector {
+func NewWGDetector(ownIface string) *WGDetector {
 	return &WGDetector{
-		ttl:   wgDetectorTTL,
-		probe: probeWireGuard,
-		cache: make(map[string]wgDetectorEntry),
+		ttl:      wgDetectorTTL,
+		probe:    probeWireGuard,
+		ownIface: ownIface,
+		cache:    make(map[string]wgDetectorEntry),
 	}
 }
 
@@ -57,6 +60,10 @@ func (d *WGDetector) IsWireGuard(iFace string) bool {
 		return probeWireGuard(iFace)
 	}
 
+	if d.isOwnInterface(iFace) {
+		return true
+	}
+
 	if isWireGuard, ok := d.cached(iFace); ok {
 		return isWireGuard
 	}
@@ -104,6 +111,10 @@ func (d *WGDetector) store(iFace string, isWireGuard bool) {
 	d.cache[iFace] = wgDetectorEntry{isWireGuard: isWireGuard, expireAt: now.Add(d.ttl)}
 }
 
+func (d *WGDetector) isOwnInterface(iFace string) bool {
+	return d.ownIface != "" && iFace == d.ownIface
+}
+
 func probeWireGuard(iFace string) bool {
 	wg, err := wgctrl.New()
 	if err != nil {
diff --git a/client/internal/stdnet/wgdetector_test.go b/client/internal/stdnet/wgdetector_test.go
index 68260ae59..28cf85f6a 100644
--- a/client/internal/stdnet/wgdetector_test.go
+++ b/client/internal/stdnet/wgdetector_test.go
@@ -150,3 +150,39 @@ func TestWGDetectorDropsExpiredEntries(t *testing.T) {
 	assert.Len(t, d.cache, 1, "expired entries of vanished interfaces must be dropped")
 	assert.Contains(t, d.cache, "eth0", "the fresh answer must be kept")
 }
+
+func TestWGDetectorOwnInterfaceIsWireGuardWithoutProbing(t *testing.T) {
+	d, calls := newCountingDetector(t, time.Minute, false)
+	d.ownIface = "NetBird"
+
+	assert.True(t, d.IsWireGuard("NetBird"), "the agent's own interface is a WireGuard device")
+	assert.Equal(t, int64(0), calls.Load(), "the own interface must never reach the probe")
+
+	assert.False(t, d.IsWireGuard("NetBird2"), "only the exact own name is answered without probing")
+	assert.Equal(t, int64(1), calls.Load(), "a different interface is probed")
+}
+
+func TestWGDetectorWithoutOwnInterfaceProbesEmptyName(t *testing.T) {
+	d, calls := newCountingDetector(t, time.Minute, false)
+
+	assert.False(t, d.IsWireGuard(""), "an unnamed interface is not mistaken for the own one")
+	assert.Equal(t, int64(1), calls.Load(), "with no own interface set every name is probed")
+}
+
+func TestInterfaceFilterRejectsOwnInterfaceRegardlessOfDisallowList(t *testing.T) {
+	d, calls := newCountingDetector(t, time.Minute, false)
+	d.ownIface = "NetBird"
+	filter := InterfaceFilter([]string{"wt"}, d)
+
+	assert.False(t, filter("NetBird"), "the own interface is rejected even when the disallow list does not cover it")
+	assert.Equal(t, int64(0), calls.Load(), "the own interface is not probed")
+
+	assert.True(t, filter("eth0"), "an ordinary interface stays available")
+	assert.Equal(t, int64(1), calls.Load(), "an ordinary interface is still probed")
+}
+
+func TestNewWGDetectorKeepsTheOwnInterface(t *testing.T) {
+	d := NewWGDetector("NetbirdWT")
+
+	assert.True(t, d.IsWireGuard("NetbirdWT"), "the constructor records the own interface")
+}