diff --git a/infrastructure_files/migrate.sh b/infrastructure_files/migrate.sh
new file mode 100755
index 000000000..67895fab6
--- /dev/null
+++ b/infrastructure_files/migrate.sh
@@ -0,0 +1,1286 @@
+#!/bin/bash
+#
+# NetBird Migration Script: Pre-v0.65.0 → Combined Container Setup
+#
+# Migrates from the old 5-container deployment (dashboard, signal, relay, management, coturn)
+# to the new 2-container setup (Traefik + combined netbird-server).
+#
+# Supported: Embedded IdP (Dex) setups with embedded Caddy or custom reverse proxy.
+# Not supported: External IdP (Auth0, Keycloak, etc.) — use getting-started.sh for fresh setup.
+#
+# Usage:
+#   ./migrate.sh [--install-dir /path/to/netbird] [--non-interactive]
+
+set -euo pipefail
+
+############################################
+# Constants
+############################################
+
+readonly SCRIPT_VERSION="1.0.0"
+readonly DASHBOARD_IMAGE="netbirdio/dashboard:latest"
+readonly NETBIRD_SERVER_IMAGE="netbirdio/netbird-server:latest"
+readonly SED_STRIP_PADDING='s/=//g'
+readonly MSG_SEPARATOR="=========================================="
+readonly PROXY_TYPE_CADDY="caddy_embedded"
+
+# Colors (disabled if not a terminal)
+if [[ -t 1 ]]; then
+  readonly RED='\033[0;31m'
+  readonly GREEN='\033[0;32m'
+  readonly YELLOW='\033[1;33m'
+  readonly BLUE='\033[0;34m'
+  readonly NC='\033[0m'
+else
+  readonly RED=''
+  readonly GREEN=''
+  readonly YELLOW=''
+  readonly BLUE=''
+  readonly NC=''
+fi
+
+############################################
+# Global Variables (set during detection)
+############################################
+
+INSTALL_DIR=""
+NON_INTERACTIVE=false
+DOCKER_COMPOSE_CMD=""
+
+# Detection results
+PROXY_TYPE=""          # caddy_embedded | traefik | external
+IDP_TYPE=""            # embedded | external
+MGMT_VOLUME=""         # detected management volume name
+DOMAIN=""
+LETSENCRYPT_EMAIL=""
+STORE_ENGINE="sqlite"
+STORE_DSN=""
+ENCRYPTION_KEY=""
+RELAY_SECRET=""
+SIGNKEY_REFRESH="true"
+TRUSTED_PROXIES=""
+TRUSTED_PROXIES_COUNT=""
+TRUSTED_PEERS=""
+MANAGEMENT_JSON_PATH=""
+BACKUP_DIR=""
+
+############################################
+# Utility Functions
+############################################
+
+log_info() {
+  local msg="$1"
+  echo -e "${BLUE}[INFO]${NC} ${msg}"
+  return 0
+}
+
+log_warn() {
+  local msg="$1"
+  echo -e "${YELLOW}[WARN]${NC} ${msg}"
+  return 0
+}
+
+log_error() {
+  local msg="$1"
+  echo -e "${RED}[ERROR]${NC} ${msg}" >&2
+  return 0
+}
+
+log_success() {
+  local msg="$1"
+  echo -e "${GREEN}[OK]${NC} ${msg}"
+  return 0
+}
+
+print_banner() {
+  echo ""
+  echo "$MSG_SEPARATOR"
+  echo "  NetBird Migration Tool v${SCRIPT_VERSION}"
+  echo "  Pre-v0.65.0 → Combined Container Setup"
+  echo "$MSG_SEPARATOR"
+  echo ""
+  return 0
+}
+
+confirm_action() {
+  local prompt="$1"
+  if [[ "$NON_INTERACTIVE" == "true" ]]; then
+    return 0
+  fi
+  echo ""
+  echo -n "$prompt [y/N]: "
+  read -r response < /dev/tty
+  if [[ ! "$response" =~ ^[Yy]$ ]]; then
+    log_error "Aborted by user."
+    exit 1
+  fi
+  return 0
+}
+
+############################################
+# Phase 0: Preflight & Detection
+############################################
+
+check_dependencies() {
+  log_info "Checking dependencies..."
+
+  local missing=()
+
+  if ! command -v docker &>/dev/null; then
+    missing+=("docker")
+  fi
+
+  if command -v docker-compose &>/dev/null; then
+    DOCKER_COMPOSE_CMD="docker-compose"
+  elif docker compose --help &>/dev/null 2>&1; then
+    DOCKER_COMPOSE_CMD="docker compose"
+  else
+    missing+=("docker-compose")
+  fi
+
+  if ! command -v jq &>/dev/null; then
+    missing+=("jq")
+  fi
+
+  if ! command -v openssl &>/dev/null; then
+    missing+=("openssl")
+  fi
+
+  if ! command -v curl &>/dev/null; then
+    missing+=("curl")
+  fi
+
+  if [[ ${#missing[@]} -gt 0 ]]; then
+    log_error "Missing required dependencies: ${missing[*]}"
+    echo "Please install them and re-run the script."
+    exit 1
+  fi
+
+  log_success "All dependencies found (docker compose: '$DOCKER_COMPOSE_CMD')"
+  return 0
+}
+
+detect_install_dir() {
+  if [[ -n "$INSTALL_DIR" ]]; then
+    if [[ ! -d "$INSTALL_DIR" ]]; then
+      log_error "Specified install directory does not exist: $INSTALL_DIR"
+      exit 1
+    fi
+    return 0
+  fi
+
+  log_info "Detecting installation directory..."
+
+  local search_paths=("$PWD" "/opt/netbird" "/opt/wiretrustee")
+  for dir in "${search_paths[@]}"; do
+    if [[ -f "$dir/management.json" ]] || [[ -f "$dir/artifacts/management.json" ]]; then
+      INSTALL_DIR="$dir"
+      log_success "Found installation at: $INSTALL_DIR"
+      return 0
+    fi
+  done
+
+  if [[ "$NON_INTERACTIVE" == "true" ]]; then
+    log_error "Could not auto-detect installation directory. Use --install-dir to specify."
+    exit 1
+  fi
+
+  echo ""
+  echo -n "Enter the path to your NetBird installation directory: "
+  read -r INSTALL_DIR < /dev/tty
+  if [[ ! -d "$INSTALL_DIR" ]]; then
+    log_error "Directory does not exist: $INSTALL_DIR"
+    exit 1
+  fi
+  return 0
+}
+
+validate_old_setup() {
+  log_info "Validating old setup..."
+
+  # Find management.json — check both root and artifacts/
+  if [[ -f "$INSTALL_DIR/management.json" ]]; then
+    MANAGEMENT_JSON_PATH="$INSTALL_DIR/management.json"
+  elif [[ -f "$INSTALL_DIR/artifacts/management.json" ]]; then
+    MANAGEMENT_JSON_PATH="$INSTALL_DIR/artifacts/management.json"
+  else
+    log_error "Cannot find management.json in $INSTALL_DIR or $INSTALL_DIR/artifacts/"
+    echo "This doesn't appear to be a valid NetBird installation."
+    exit 1
+  fi
+
+  # Check for docker-compose.yml (in root or artifacts/)
+  local compose_found=false
+  if [[ -f "$INSTALL_DIR/docker-compose.yml" ]]; then
+    compose_found=true
+  elif [[ -f "$INSTALL_DIR/artifacts/docker-compose.yml" ]]; then
+    compose_found=true
+  fi
+
+  if [[ "$compose_found" != "true" ]]; then
+    log_error "Cannot find docker-compose.yml in $INSTALL_DIR or $INSTALL_DIR/artifacts/"
+    exit 1
+  fi
+
+  log_success "Found management.json at: $MANAGEMENT_JSON_PATH"
+  return 0
+}
+
+check_already_migrated() {
+  if [[ -f "$INSTALL_DIR/config.yaml" ]]; then
+    log_warn "config.yaml already exists in $INSTALL_DIR"
+    echo "It appears this installation has already been migrated."
+    echo "If you want to re-run the migration, remove config.yaml first."
+    exit 0
+  fi
+  return 0
+}
+
+detect_reverse_proxy() {
+  log_info "Detecting reverse proxy type..."
+
+  local compose_file=""
+  if [[ -f "$INSTALL_DIR/docker-compose.yml" ]]; then
+    compose_file="$INSTALL_DIR/docker-compose.yml"
+  elif [[ -f "$INSTALL_DIR/artifacts/docker-compose.yml" ]]; then
+    compose_file="$INSTALL_DIR/artifacts/docker-compose.yml"
+  fi
+
+  # Check for Traefik service or labels
+  if grep -q 'traefik' "$compose_file" 2>/dev/null; then
+    PROXY_TYPE="traefik"
+    log_info "Detected: Traefik reverse proxy"
+    return 0
+  fi
+
+  # Check for embedded Caddy — two patterns:
+  # 1. Old configure.sh: dashboard container with LETSENCRYPT_DOMAIN env var + ports 80/443
+  # 2. v0.62+ getting-started.sh: Caddy service in compose or standalone Caddyfile
+  if grep -q 'LETSENCRYPT_DOMAIN' "$compose_file" 2>/dev/null && { grep -q '443:443' "$compose_file" 2>/dev/null || grep -q '443:' "$compose_file" 2>/dev/null; }; then
+    PROXY_TYPE="$PROXY_TYPE_CADDY"
+    log_info "Detected: Embedded Caddy (dashboard container with Let's Encrypt)"
+    return 0
+  fi
+
+  # Check for Caddy service in docker-compose.yml (v0.62+ pattern)
+  if grep -qE '^\s+caddy:|^\s+image:.*caddy' "$compose_file" 2>/dev/null; then
+    PROXY_TYPE="$PROXY_TYPE_CADDY"
+    log_info "Detected: Caddy reverse proxy (in Docker Compose)"
+    return 0
+  fi
+
+  # Check for standalone Caddyfile in install directory (v0.62+ getting-started.sh)
+  if [[ -f "$INSTALL_DIR/Caddyfile" ]]; then
+    # Verify Caddy is referenced in docker-compose.yml or running as a container
+    if grep -q 'caddy' "$compose_file" 2>/dev/null || grep -q 'Caddyfile' "$compose_file" 2>/dev/null; then
+      PROXY_TYPE="$PROXY_TYPE_CADDY"
+      log_info "Detected: Caddy reverse proxy (Caddyfile + Docker Compose)"
+      return 0
+    fi
+    # Caddyfile exists but not in compose — might be running on host
+    PROXY_TYPE="$PROXY_TYPE_CADDY"
+    log_info "Detected: Caddy reverse proxy (standalone Caddyfile)"
+    return 0
+  fi
+
+  # Check for disabled Let's Encrypt (external proxy)
+  if [[ -f "$INSTALL_DIR/setup.env" ]] && grep -q 'NETBIRD_DISABLE_LETSENCRYPT=true' "$INSTALL_DIR/setup.env" 2>/dev/null; then
+    PROXY_TYPE="external"
+    log_info "Detected: External reverse proxy (Let's Encrypt disabled)"
+    return 0
+  fi
+
+  # Default to external
+  PROXY_TYPE="external"
+  log_info "Detected: External/custom reverse proxy"
+  return 0
+}
+
+detect_idp_type() {
+  log_info "Detecting identity provider type..."
+
+  # Check for embedded IdP (v0.62.0+ getting-started.sh format)
+  local embedded_enabled
+  embedded_enabled=$(jq -r '.EmbeddedIdP.Enabled // false' "$MANAGEMENT_JSON_PATH" 2>/dev/null || echo "false")
+  if [[ "$embedded_enabled" == "true" ]]; then
+    IDP_TYPE="embedded"
+    log_success "IdP type: embedded (suitable for migration)"
+    return 0
+  fi
+
+  # Check IdpManagerConfig.ManagerType (old configure.sh format)
+  local manager_type
+  manager_type=$(jq -r '.IdpManagerConfig.ManagerType // ""' "$MANAGEMENT_JSON_PATH" 2>/dev/null || echo "")
+
+  if [[ -n "$manager_type" && "$manager_type" != "null" && "$manager_type" != "none" && "$manager_type" != "" ]]; then
+    IDP_TYPE="external"
+    log_error "External IdP detected: $manager_type"
+    echo ""
+    echo "This migration script only supports embedded IdP setups."
+    echo "External IdP providers (Auth0, Keycloak, Zitadel, etc.) require"
+    echo "a fresh installation using getting-started.sh."
+    echo ""
+    echo "Please refer to the NetBird documentation for upgrade instructions:"
+    echo "  https://docs.netbird.io/selfhosted/getting-started"
+    exit 1
+  fi
+
+  # Check HttpConfig.AuthIssuer for well-known external providers
+  local auth_issuer
+  auth_issuer=$(jq -r '.HttpConfig.AuthIssuer // ""' "$MANAGEMENT_JSON_PATH" 2>/dev/null || echo "")
+
+  if [[ -n "$auth_issuer" && "$auth_issuer" != "null" ]]; then
+    for provider in "auth0.com" "accounts.google.com" "login.microsoftonline.com" "keycloak" "zitadel" "authentik"; do
+      if echo "$auth_issuer" | grep -qi "$provider" 2>/dev/null; then
+        log_error "External OIDC provider detected: $auth_issuer"
+        echo ""
+        echo "This migration script only supports embedded IdP setups."
+        echo "Please use getting-started.sh for a fresh installation."
+        exit 1
+      fi
+    done
+  fi
+
+  # No embedded IdP and no external IdP detected — assume old setup without IdP manager
+  IDP_TYPE="embedded"
+  log_success "IdP type: embedded (suitable for migration)"
+  return 0
+}
+
+detect_volumes() {
+  log_info "Detecting Docker volumes..."
+
+  local volumes_list
+  volumes_list=$(docker volume ls --format '{{.Name}}' 2>/dev/null || echo "")
+
+  # Check for well-known volume name patterns (exact match)
+  local volume_patterns=(
+    "wiretrustee-mgmt"
+    "netbird-mgmt"
+  )
+  for pattern in "${volume_patterns[@]}"; do
+    if echo "$volumes_list" | grep -q "^${pattern}$"; then
+      MGMT_VOLUME="$pattern"
+      log_success "Found management volume: $MGMT_VOLUME"
+      return 0
+    fi
+  done
+
+  # Check compose-prefixed patterns (e.g., netbird_netbird-mgmt, infrastructure_files_netbird-mgmt)
+  local compose_prefixed
+  compose_prefixed=$(echo "$volumes_list" | grep -E '(netbird|wiretrustee).*mgmt' | head -n1 || echo "")
+  if [[ -n "$compose_prefixed" ]]; then
+    MGMT_VOLUME="$compose_prefixed"
+    log_success "Found management volume (compose-prefixed): $MGMT_VOLUME"
+    return 0
+  fi
+
+  # Try to extract volume name from old docker-compose.yml
+  local compose_file=""
+  if [[ -f "$INSTALL_DIR/docker-compose.yml" ]]; then
+    compose_file="$INSTALL_DIR/docker-compose.yml"
+  elif [[ -f "$INSTALL_DIR/artifacts/docker-compose.yml" ]]; then
+    compose_file="$INSTALL_DIR/artifacts/docker-compose.yml"
+  fi
+  if [[ -n "$compose_file" ]]; then
+    # Look for volume mount on /var/lib/netbird in management or netbird-server service
+    local vol_name
+    vol_name=$(grep -E '^\s+-\s+\S+:/var/lib/netbird' "$compose_file" 2>/dev/null | head -1 | sed 's/.*- //' | sed 's/:.*//' | tr -d ' ' || echo "")
+    if [[ -n "$vol_name" && "$vol_name" != "." && "$vol_name" != "/" ]]; then
+      # Check if this volume exists in Docker
+      local full_vol
+      full_vol=$(echo "$volumes_list" | grep -F "$vol_name" | head -1 || echo "")
+      if [[ -n "$full_vol" ]]; then
+        MGMT_VOLUME="$full_vol"
+        log_success "Found management volume (from compose): $MGMT_VOLUME"
+        return 0
+      fi
+    fi
+  fi
+
+  log_warn "Could not detect management volume. A new volume will be created."
+  MGMT_VOLUME=""
+  return 0
+}
+
+detect_domain() {
+  log_info "Detecting domain..."
+
+  # Try setup.env first
+  if [[ -z "$DOMAIN" && -f "$INSTALL_DIR/setup.env" ]]; then
+    DOMAIN=$(grep '^NETBIRD_DOMAIN=' "$INSTALL_DIR/setup.env" 2>/dev/null | cut -d'=' -f2 | tr -d '"' | tr -d "'" || echo "")
+  fi
+
+  # Try EmbeddedIdP.Issuer (v0.62.0+ getting-started.sh format)
+  if [[ -z "$DOMAIN" ]]; then
+    local issuer
+    issuer=$(jq -r '.EmbeddedIdP.Issuer // ""' "$MANAGEMENT_JSON_PATH" 2>/dev/null || echo "")
+    if [[ -n "$issuer" && "$issuer" != "null" ]]; then
+      DOMAIN=$(echo "$issuer" | sed 's|https\?://||' | sed 's|/.*||' | sed 's|:.*||')
+    fi
+  fi
+
+  # Try HttpConfig.AuthIssuer (old configure.sh format)
+  if [[ -z "$DOMAIN" ]]; then
+    local issuer
+    issuer=$(jq -r '.HttpConfig.AuthIssuer // ""' "$MANAGEMENT_JSON_PATH" 2>/dev/null || echo "")
+    if [[ -n "$issuer" && "$issuer" != "null" ]]; then
+      DOMAIN=$(echo "$issuer" | sed 's|https\?://||' | sed 's|/.*||' | sed 's|:.*||')
+    fi
+  fi
+
+  # Try dashboard.env NETBIRD_MGMT_API_ENDPOINT
+  if [[ -z "$DOMAIN" && -f "$INSTALL_DIR/dashboard.env" ]]; then
+    local endpoint
+    endpoint=$(grep '^NETBIRD_MGMT_API_ENDPOINT=' "$INSTALL_DIR/dashboard.env" 2>/dev/null | cut -d'=' -f2 | tr -d '"' | tr -d "'" || echo "")
+    if [[ -n "$endpoint" ]]; then
+      DOMAIN=$(echo "$endpoint" | sed 's|https\?://||' | sed 's|/.*||' | sed 's|:.*||')
+    fi
+  fi
+
+  if [[ -z "$DOMAIN" ]]; then
+    log_error "Could not detect domain from management.json, setup.env, or dashboard.env."
+    exit 1
+  fi
+
+  # Detect Let's Encrypt email from setup.env or dashboard.env LETSENCRYPT_DOMAIN
+  if [[ -f "$INSTALL_DIR/setup.env" ]]; then
+    LETSENCRYPT_EMAIL=$(grep '^NETBIRD_LETSENCRYPT_EMAIL=' "$INSTALL_DIR/setup.env" 2>/dev/null | cut -d'=' -f2 | tr -d '"' | tr -d "'" || echo "")
+  fi
+
+  log_success "Domain: $DOMAIN"
+  if [[ -n "$LETSENCRYPT_EMAIL" ]]; then
+    log_success "Let's Encrypt email: $LETSENCRYPT_EMAIL"
+  fi
+  return 0
+}
+
+detect_store_config() {
+  log_info "Detecting store configuration..."
+
+  # Engine from management.json
+  local engine
+  engine=$(jq -r '.StoreConfig.Engine // ""' "$MANAGEMENT_JSON_PATH" 2>/dev/null || echo "")
+  if [[ -n "$engine" && "$engine" != "null" && "$engine" != "" ]]; then
+    STORE_ENGINE="$engine"
+  fi
+
+  # DSN from environment files
+  if [[ -f "$INSTALL_DIR/setup.env" ]]; then
+    local pg_dsn
+    pg_dsn=$(grep '^NETBIRD_STORE_ENGINE_POSTGRES_DSN=' "$INSTALL_DIR/setup.env" 2>/dev/null | sed 's/^NETBIRD_STORE_ENGINE_POSTGRES_DSN=//' | tr -d '"' || echo "")
+    if [[ -n "$pg_dsn" ]]; then
+      STORE_DSN="$pg_dsn"
+    fi
+
+    local mysql_dsn
+    mysql_dsn=$(grep '^NETBIRD_STORE_ENGINE_MYSQL_DSN=' "$INSTALL_DIR/setup.env" 2>/dev/null | sed 's/^NETBIRD_STORE_ENGINE_MYSQL_DSN=//' | tr -d '"' || echo "")
+    if [[ -n "$mysql_dsn" ]]; then
+      STORE_DSN="$mysql_dsn"
+    fi
+  fi
+
+  # Also check base.setup.env
+  if [[ -z "$STORE_DSN" && -f "$INSTALL_DIR/base.setup.env" ]]; then
+    local pg_dsn
+    pg_dsn=$(grep '^NETBIRD_STORE_ENGINE_POSTGRES_DSN=' "$INSTALL_DIR/base.setup.env" 2>/dev/null | sed 's/^NETBIRD_STORE_ENGINE_POSTGRES_DSN=//' | tr -d '"' || echo "")
+    if [[ -n "$pg_dsn" ]]; then
+      STORE_DSN="$pg_dsn"
+    fi
+
+    local mysql_dsn
+    mysql_dsn=$(grep '^NETBIRD_STORE_ENGINE_MYSQL_DSN=' "$INSTALL_DIR/base.setup.env" 2>/dev/null | sed 's/^NETBIRD_STORE_ENGINE_MYSQL_DSN=//' | tr -d '"' || echo "")
+    if [[ -n "$mysql_dsn" ]]; then
+      STORE_DSN="$mysql_dsn"
+    fi
+  fi
+
+  log_success "Store engine: $STORE_ENGINE"
+  if [[ -n "$STORE_DSN" ]]; then
+    log_success "Store DSN: [detected]"
+  fi
+  return 0
+}
+
+extract_config_values() {
+  log_info "Extracting configuration from management.json..."
+
+  # DataStoreEncryptionKey
+  ENCRYPTION_KEY=$(jq -r '.DataStoreEncryptionKey // ""' "$MANAGEMENT_JSON_PATH" 2>/dev/null || echo "")
+  if [[ -z "$ENCRYPTION_KEY" || "$ENCRYPTION_KEY" == "null" ]]; then
+    ENCRYPTION_KEY=$(openssl rand -base64 32)
+    log_warn "No encryption key found in management.json — generated a new one."
+    log_warn "IMPORTANT: Save this key! Without it, existing encrypted data cannot be read."
+    echo "  Encryption key: $ENCRYPTION_KEY"
+  fi
+
+  # Relay secret from management.json
+  RELAY_SECRET=$(jq -r '.Relay.Secret // ""' "$MANAGEMENT_JSON_PATH" 2>/dev/null || echo "")
+
+  # Fallback: relay secret from setup.env
+  if [[ (-z "$RELAY_SECRET" || "$RELAY_SECRET" == "null") && -f "$INSTALL_DIR/setup.env" ]]; then
+    RELAY_SECRET=$(grep '^NETBIRD_RELAY_AUTH_SECRET=' "$INSTALL_DIR/setup.env" 2>/dev/null | cut -d'=' -f2 | tr -d '"' | tr -d "'" || echo "")
+  fi
+
+  # Fallback: relay secret from base.setup.env
+  if [[ (-z "$RELAY_SECRET" || "$RELAY_SECRET" == "null") && -f "$INSTALL_DIR/base.setup.env" ]]; then
+    RELAY_SECRET=$(grep '^NETBIRD_RELAY_AUTH_SECRET=' "$INSTALL_DIR/base.setup.env" 2>/dev/null | cut -d'=' -f2 | tr -d '"' | tr -d "'" || echo "")
+  fi
+
+  # Generate if still empty
+  if [[ -z "$RELAY_SECRET" || "$RELAY_SECRET" == "null" ]]; then
+    RELAY_SECRET=$(openssl rand -base64 32 | sed "$SED_STRIP_PADDING")
+    log_warn "No relay secret found — generated a new one."
+  fi
+
+  # IdpSignKeyRefreshEnabled — check both HttpConfig and EmbeddedIdP locations
+  local signkey_raw
+  signkey_raw=$(jq -r '(.HttpConfig.IdpSignKeyRefreshEnabled // .EmbeddedIdP.SignKeyRefreshEnabled) // "true"' "$MANAGEMENT_JSON_PATH" 2>/dev/null || echo "true")
+  if [[ "$signkey_raw" == "false" ]]; then
+    SIGNKEY_REFRESH="false"
+  else
+    SIGNKEY_REFRESH="true"
+  fi
+
+  # ReverseProxy settings (may not exist in v0.62+ getting-started.sh format)
+  TRUSTED_PROXIES=$(jq -c '.ReverseProxy.TrustedHTTPProxies // []' "$MANAGEMENT_JSON_PATH" 2>/dev/null || echo "[]")
+  TRUSTED_PROXIES_COUNT=$(jq -r '.ReverseProxy.TrustedHTTPProxiesCount // 0' "$MANAGEMENT_JSON_PATH" 2>/dev/null || echo "0")
+  TRUSTED_PEERS=$(jq -c '.ReverseProxy.TrustedPeers // []' "$MANAGEMENT_JSON_PATH" 2>/dev/null || echo "[]")
+
+  log_success "Configuration values extracted"
+  return 0
+}
+
+print_detection_summary() {
+  echo ""
+  echo "$MSG_SEPARATOR"
+  echo "  Migration Summary"
+  echo "$MSG_SEPARATOR"
+  echo ""
+  echo "  Install directory:  $INSTALL_DIR"
+  echo "  Domain:             $DOMAIN"
+  echo "  Reverse proxy:      $PROXY_TYPE"
+  echo "  Store engine:       $STORE_ENGINE"
+  if [[ -n "$STORE_DSN" ]]; then
+    echo "  Store DSN:          [configured]"
+  fi
+  if [[ -n "$MGMT_VOLUME" ]]; then
+    echo "  Management volume:  $MGMT_VOLUME"
+  else
+    echo "  Management volume:  [new volume will be created]"
+  fi
+  echo "  Encryption key:     ${ENCRYPTION_KEY:0:8}..."
+  echo "  Relay secret:       ${RELAY_SECRET:0:8}..."
+  echo ""
+
+  if [[ "$PROXY_TYPE" == "$PROXY_TYPE_CADDY" ]]; then
+    echo "  Migration mode:     AUTOMATIC"
+    echo "  A Traefik-based docker-compose.yml will be generated and services"
+    echo "  will be stopped and restarted automatically."
+  else
+    echo "  Migration mode:     MANUAL"
+    echo "  New config files will be generated. You will need to stop old"
+    echo "  containers, replace docker-compose.yml, and restart manually."
+  fi
+  echo ""
+  return 0
+}
+
+############################################
+# Phase 1: Backup
+############################################
+
+create_backup() {
+  BACKUP_DIR="$INSTALL_DIR/backup-$(date +%Y%m%d-%H%M%S)"
+  log_info "Creating backup at: $BACKUP_DIR"
+  mkdir -p "$BACKUP_DIR"
+
+  # Copy config files
+  local files_to_backup=(
+    "docker-compose.yml"
+    "management.json"
+    "setup.env"
+    "base.setup.env"
+    "turnserver.conf"
+    "dashboard.env"
+  )
+
+  for f in "${files_to_backup[@]}"; do
+    if [[ -f "$INSTALL_DIR/$f" ]]; then
+      cp "$INSTALL_DIR/$f" "$BACKUP_DIR/$f"
+    fi
+  done
+
+  # Back up artifacts/ if it exists
+  if [[ -d "$INSTALL_DIR/artifacts" ]]; then
+    cp -r "$INSTALL_DIR/artifacts" "$BACKUP_DIR/artifacts"
+  fi
+
+  # Record state
+  {
+    echo "# NetBird migration backup state"
+    echo "# Created: $(date -u '+%Y-%m-%d %H:%M:%S UTC')"
+    echo ""
+    echo "## Docker volumes"
+    docker volume ls --format '{{.Name}}' 2>/dev/null | grep -E '(netbird|wiretrustee)' || echo "(none found)"
+    echo ""
+    echo "## Running containers"
+    docker ps --format '{{.Names}}\t{{.Image}}\t{{.Status}}' 2>/dev/null | grep -E '(netbird|wiretrustee|dashboard|signal|relay|management|coturn)' || echo "(none running)"
+  } > "$BACKUP_DIR/state.txt"
+
+  # Generate rollback script
+  generate_rollback_script
+
+  log_success "Backup created at: $BACKUP_DIR"
+  return 0
+}
+
+generate_rollback_script() {
+  cat > "$BACKUP_DIR/rollback.sh" <<'ROLLBACK_HEADER'
+#!/bin/bash
+set -euo pipefail
+
+# NetBird Migration Rollback Script
+# Restores the pre-migration configuration and restarts old containers.
+
+ROLLBACK_HEADER
+
+  cat >> "$BACKUP_DIR/rollback.sh" <<ROLLBACK_BODY
+INSTALL_DIR="$INSTALL_DIR"
+BACKUP_DIR="$BACKUP_DIR"
+
+echo "Restoring NetBird configuration from backup..."
+
+# Stop new containers if running
+cd "\$INSTALL_DIR"
+if command -v docker-compose &>/dev/null; then
+  COMPOSE_CMD="docker-compose"
+elif docker compose --help &>/dev/null 2>&1; then
+  COMPOSE_CMD="docker compose"
+else
+  echo "ERROR: docker compose not found" >&2
+  exit 1
+fi
+
+echo "Stopping current containers..."
+\$COMPOSE_CMD down 2>/dev/null || true
+
+# Restore old config files
+echo "Restoring configuration files..."
+for f in docker-compose.yml management.json setup.env base.setup.env turnserver.conf dashboard.env; do
+  if [[ -f "\$BACKUP_DIR/\$f" ]]; then
+    cp "\$BACKUP_DIR/\$f" "\$INSTALL_DIR/\$f"
+    echo "  Restored: \$f"
+  fi
+done
+
+# Remove new config files
+for f in config.yaml; do
+  if [[ -f "\$INSTALL_DIR/\$f" ]]; then
+    rm "\$INSTALL_DIR/\$f"
+    echo "  Removed: \$f"
+  fi
+done
+
+# Restart old containers
+echo "Starting old containers..."
+cd "\$INSTALL_DIR"
+\$COMPOSE_CMD up -d
+
+echo ""
+echo "Rollback complete. Old containers are running."
+echo "Verify with: \$COMPOSE_CMD ps"
+ROLLBACK_BODY
+
+  chmod +x "$BACKUP_DIR/rollback.sh"
+  return 0
+}
+
+############################################
+# Phase 3: Generate New Configuration Files
+############################################
+
+generate_config_yaml() {
+  log_info "Generating config.yaml..."
+
+  local dsn_line=""
+  if [[ -n "$STORE_DSN" ]]; then
+    dsn_line="    dsn: \"$STORE_DSN\""
+  fi
+
+  local reverse_proxy_section=""
+  # Only add reverseProxy if there are non-default values
+  local has_proxy_config=false
+  if [[ "$TRUSTED_PROXIES" != "[]" && -n "$TRUSTED_PROXIES" ]]; then
+    has_proxy_config=true
+  fi
+  if [[ "$TRUSTED_PROXIES_COUNT" != "0" && -n "$TRUSTED_PROXIES_COUNT" ]]; then
+    has_proxy_config=true
+  fi
+  if [[ "$TRUSTED_PEERS" != "[]" && -n "$TRUSTED_PEERS" ]]; then
+    # Check if it's only the default ["0.0.0.0/0"]
+    local default_peers='["0.0.0.0/0"]'
+    if [[ "$TRUSTED_PEERS" != "$default_peers" ]]; then
+      has_proxy_config=true
+    fi
+  fi
+
+  if [[ "$has_proxy_config" == "true" ]]; then
+    reverse_proxy_section="
+  reverseProxy:"
+    if [[ "$TRUSTED_PROXIES" != "[]" && -n "$TRUSTED_PROXIES" ]]; then
+      reverse_proxy_section+="
+    trustedHTTPProxies:"
+      for proxy in $(echo "$TRUSTED_PROXIES" | jq -r '.[]' 2>/dev/null); do
+        reverse_proxy_section+="
+      - \"$proxy\""
+      done
+    fi
+    if [[ "$TRUSTED_PROXIES_COUNT" != "0" && -n "$TRUSTED_PROXIES_COUNT" ]]; then
+      reverse_proxy_section+="
+    trustedHTTPProxiesCount: $TRUSTED_PROXIES_COUNT"
+    fi
+    if [[ "$TRUSTED_PEERS" != "[]" && -n "$TRUSTED_PEERS" ]]; then
+      reverse_proxy_section+="
+    trustedPeers:"
+      for peer in $(echo "$TRUSTED_PEERS" | jq -r '.[]' 2>/dev/null); do
+        reverse_proxy_section+="
+      - \"$peer\""
+      done
+    fi
+  fi
+
+  {
+    cat <<EOF
+# Combined NetBird Server Configuration (Simplified)
+# Generated by migrate.sh on $(date -u '+%Y-%m-%d %H:%M:%S UTC')
+
+server:
+  listenAddress: ":80"
+  exposedAddress: "https://${DOMAIN}:443"
+  stunPorts:
+    - 3478
+  metricsPort: 9090
+  healthcheckAddress: ":9000"
+  logLevel: "info"
+  logFile: "console"
+
+  authSecret: "${RELAY_SECRET}"
+  dataDir: "/var/lib/netbird"
+
+  auth:
+    issuer: "https://${DOMAIN}/oauth2"
+    signKeyRefreshEnabled: ${SIGNKEY_REFRESH}
+    dashboardRedirectURIs:
+      - "https://${DOMAIN}/nb-auth"
+      - "https://${DOMAIN}/nb-silent-auth"
+    cliRedirectURIs:
+      - "http://localhost:53000/"
+
+  store:
+    engine: "${STORE_ENGINE}"
+    encryptionKey: "${ENCRYPTION_KEY}"
+EOF
+    if [[ -n "$dsn_line" ]]; then
+      echo "$dsn_line"
+    fi
+    if [[ -n "$reverse_proxy_section" ]]; then
+      echo "$reverse_proxy_section"
+    fi
+  } > "$INSTALL_DIR/config.yaml"
+
+  log_success "Generated config.yaml"
+  return 0
+}
+
+generate_dashboard_env() {
+  log_info "Generating dashboard.env..."
+
+  cat > "$INSTALL_DIR/dashboard.env" <<EOF
+# Endpoints
+NETBIRD_MGMT_API_ENDPOINT=https://${DOMAIN}
+NETBIRD_MGMT_GRPC_API_ENDPOINT=https://${DOMAIN}
+# OIDC - using embedded IdP
+AUTH_AUDIENCE=netbird-dashboard
+AUTH_CLIENT_ID=netbird-dashboard
+AUTH_CLIENT_SECRET=
+AUTH_AUTHORITY=https://${DOMAIN}/oauth2
+USE_AUTH0=false
+AUTH_SUPPORTED_SCOPES=openid profile email groups
+AUTH_REDIRECT_URI=/nb-auth
+AUTH_SILENT_REDIRECT_URI=/nb-silent-auth
+# SSL
+NGINX_SSL_PORT=443
+# Letsencrypt
+LETSENCRYPT_DOMAIN=none
+EOF
+
+  log_success "Generated dashboard.env"
+  return 0
+}
+
+generate_docker_compose_traefik() {
+  log_info "Generating docker-compose.yml (Traefik)..."
+
+  local acme_email="${LETSENCRYPT_EMAIL:-admin@${DOMAIN}}"
+
+  # Volume config: use old volume if detected
+  local volume_config=""
+  if [[ -n "$MGMT_VOLUME" ]]; then
+    volume_config="  netbird_data:
+    external: true
+    name: ${MGMT_VOLUME}"
+  else
+    volume_config="  netbird_data:"
+  fi
+
+  cat > "$INSTALL_DIR/docker-compose.yml" <<EOF
+services:
+  # Traefik reverse proxy (automatic TLS via Let's Encrypt)
+  traefik:
+    image: traefik:v3.6
+    container_name: netbird-traefik
+    restart: unless-stopped
+    networks:
+      netbird:
+        ipv4_address: 172.30.0.10
+    command:
+      # Logging
+      - "--log.level=INFO"
+      - "--accesslog=true"
+      # Docker provider
+      - "--providers.docker=true"
+      - "--providers.docker.exposedbydefault=false"
+      - "--providers.docker.network=netbird"
+      # Entrypoints
+      - "--entrypoints.web.address=:80"
+      - "--entrypoints.websecure.address=:443"
+      - "--entrypoints.websecure.allowACMEByPass=true"
+      # Disable timeouts for long-lived gRPC streams
+      - "--entrypoints.websecure.transport.respondingTimeouts.readTimeout=0"
+      - "--entrypoints.websecure.transport.respondingTimeouts.writeTimeout=0"
+      - "--entrypoints.websecure.transport.respondingTimeouts.idleTimeout=0"
+      # HTTP to HTTPS redirect
+      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
+      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
+      # Let's Encrypt ACME
+      - "--certificatesresolvers.letsencrypt.acme.email=${acme_email}"
+      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
+      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
+      # gRPC transport settings
+      - "--serverstransport.forwardingtimeouts.responseheadertimeout=0s"
+      - "--serverstransport.forwardingtimeouts.idleconntimeout=0s"
+    ports:
+      - '443:443'
+      - '80:80'
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - netbird_traefik_letsencrypt:/letsencrypt
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "500m"
+        max-file: "2"
+
+  # UI dashboard
+  dashboard:
+    image: ${DASHBOARD_IMAGE}
+    container_name: netbird-dashboard
+    restart: unless-stopped
+    networks: [netbird]
+    env_file:
+      - ./dashboard.env
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.netbird-dashboard.rule=Host(\`${DOMAIN}\`)
+      - traefik.http.routers.netbird-dashboard.entrypoints=websecure
+      - traefik.http.routers.netbird-dashboard.tls=true
+      - traefik.http.routers.netbird-dashboard.tls.certresolver=letsencrypt
+      - traefik.http.routers.netbird-dashboard.service=dashboard
+      - traefik.http.routers.netbird-dashboard.priority=1
+      - traefik.http.services.dashboard.loadbalancer.server.port=80
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "500m"
+        max-file: "2"
+
+  # Combined server (Management + Signal + Relay + STUN)
+  netbird-server:
+    image: ${NETBIRD_SERVER_IMAGE}
+    container_name: netbird-server
+    restart: unless-stopped
+    networks: [netbird]
+    ports:
+      - '3478:3478/udp'
+    volumes:
+      - netbird_data:/var/lib/netbird
+      - ./config.yaml:/etc/netbird/config.yaml
+    command: ["--config", "/etc/netbird/config.yaml"]
+    labels:
+      - traefik.enable=true
+      # gRPC router (needs h2c backend for HTTP/2 cleartext)
+      - traefik.http.routers.netbird-grpc.rule=Host(\`${DOMAIN}\`) && (PathPrefix(\`/signalexchange.SignalExchange/\`) || PathPrefix(\`/management.ManagementService/\`))
+      - traefik.http.routers.netbird-grpc.entrypoints=websecure
+      - traefik.http.routers.netbird-grpc.tls=true
+      - traefik.http.routers.netbird-grpc.tls.certresolver=letsencrypt
+      - traefik.http.routers.netbird-grpc.service=netbird-server-h2c
+      - traefik.http.routers.netbird-grpc.priority=100
+      # Backend router (relay, WebSocket, API, OAuth2)
+      - traefik.http.routers.netbird-backend.rule=Host(\`${DOMAIN}\`) && (PathPrefix(\`/relay\`) || PathPrefix(\`/ws-proxy/\`) || PathPrefix(\`/api\`) || PathPrefix(\`/oauth2\`))
+      - traefik.http.routers.netbird-backend.entrypoints=websecure
+      - traefik.http.routers.netbird-backend.tls=true
+      - traefik.http.routers.netbird-backend.tls.certresolver=letsencrypt
+      - traefik.http.routers.netbird-backend.service=netbird-server
+      - traefik.http.routers.netbird-backend.priority=100
+      # Services
+      - traefik.http.services.netbird-server.loadbalancer.server.port=80
+      - traefik.http.services.netbird-server-h2c.loadbalancer.server.port=80
+      - traefik.http.services.netbird-server-h2c.loadbalancer.server.scheme=h2c
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "500m"
+        max-file: "2"
+
+volumes:
+${volume_config}
+  netbird_traefik_letsencrypt:
+
+networks:
+  netbird:
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 172.30.0.0/24
+          gateway: 172.30.0.1
+EOF
+
+  log_success "Generated docker-compose.yml"
+  return 0
+}
+
+generate_docker_compose_exposed_ports() {
+  log_info "Generating docker-compose.yml (exposed ports for custom proxy)..."
+
+  # Volume config: use old volume if detected
+  local volume_config=""
+  if [[ -n "$MGMT_VOLUME" ]]; then
+    volume_config="  netbird_data:
+    external: true
+    name: ${MGMT_VOLUME}"
+  else
+    volume_config="  netbird_data:"
+  fi
+
+  cat > "$INSTALL_DIR/docker-compose.yml" <<EOF
+services:
+  # UI dashboard
+  dashboard:
+    image: ${DASHBOARD_IMAGE}
+    container_name: netbird-dashboard
+    restart: unless-stopped
+    networks: [netbird]
+    ports:
+      - '127.0.0.1:8080:80'
+    env_file:
+      - ./dashboard.env
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "500m"
+        max-file: "2"
+
+  # Combined server (Management + Signal + Relay + STUN)
+  netbird-server:
+    image: ${NETBIRD_SERVER_IMAGE}
+    container_name: netbird-server
+    restart: unless-stopped
+    networks: [netbird]
+    ports:
+      - '127.0.0.1:8081:80'
+      - '3478:3478/udp'
+    volumes:
+      - netbird_data:/var/lib/netbird
+      - ./config.yaml:/etc/netbird/config.yaml
+    command: ["--config", "/etc/netbird/config.yaml"]
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "500m"
+        max-file: "2"
+
+volumes:
+${volume_config}
+
+networks:
+  netbird:
+EOF
+
+  log_success "Generated docker-compose.yml"
+  return 0
+}
+
+generate_docker_compose() {
+  if [[ "$PROXY_TYPE" == "$PROXY_TYPE_CADDY" ]]; then
+    generate_docker_compose_traefik
+  else
+    generate_docker_compose_exposed_ports
+  fi
+  return 0
+}
+
+############################################
+# Phase 4: Apply Migration
+############################################
+
+stop_old_services() {
+  log_info "Stopping old containers..."
+
+  # Try to find old compose file location
+  local old_compose_dir="$INSTALL_DIR"
+  if [[ -f "$INSTALL_DIR/artifacts/docker-compose.yml" && ! -f "$INSTALL_DIR/docker-compose.yml" ]]; then
+    old_compose_dir="$INSTALL_DIR/artifacts"
+  fi
+
+  (cd "$old_compose_dir" && $DOCKER_COMPOSE_CMD down 2>/dev/null) || true
+
+  log_success "Old containers stopped"
+  return 0
+}
+
+start_new_services() {
+  log_info "Starting new containers..."
+
+  (cd "$INSTALL_DIR" && $DOCKER_COMPOSE_CMD up -d)
+
+  log_success "New containers started"
+  return 0
+}
+
+wait_for_health() {
+  log_info "Waiting for services to become healthy..."
+
+  local max_attempts=60
+  local attempt=0
+
+  set +e
+  echo -n "  Checking"
+  while [[ $attempt -lt $max_attempts ]]; do
+    # Try OIDC endpoint through reverse proxy
+    if curl -sk -f -o /dev/null "https://${DOMAIN}/oauth2/.well-known/openid-configuration" 2>/dev/null; then
+      echo " done"
+      set -e
+      log_success "Services are healthy"
+      return 0
+    fi
+
+    # Also try health check endpoint directly
+    if curl -sk -f -o /dev/null "http://127.0.0.1:9000/" 2>/dev/null; then
+      echo " done"
+      set -e
+      log_success "Services are healthy (via healthcheck)"
+      return 0
+    fi
+
+    echo -n " ."
+    sleep 2
+    attempt=$((attempt + 1))
+
+    if [[ $attempt -eq 30 ]]; then
+      echo ""
+      log_warn "Taking longer than expected. Checking container logs..."
+      (cd "$INSTALL_DIR" && $DOCKER_COMPOSE_CMD logs --tail=10 netbird-server 2>/dev/null) || true
+      echo -n "  Still checking"
+    fi
+  done
+  echo ""
+  set -e
+
+  log_warn "Health check timed out after $((max_attempts * 2)) seconds."
+  log_warn "Services may still be starting. Check with: cd $INSTALL_DIR && $DOCKER_COMPOSE_CMD logs"
+  return 0
+}
+
+############################################
+# Phase 5: Verification & Summary
+############################################
+
+verify_migration() {
+  log_info "Running verification checks..."
+
+  local checks_passed=0
+  local checks_total=3
+
+  # Check 1: Container health
+  local running
+  running=$(cd "$INSTALL_DIR" && $DOCKER_COMPOSE_CMD ps --format '{{.Name}}' 2>/dev/null | wc -l || echo "0")
+  if [[ "$running" -ge 2 ]]; then
+    log_success "Containers are running ($running services)"
+    checks_passed=$((checks_passed + 1))
+  else
+    log_warn "Expected at least 2 running containers, found $running"
+  fi
+
+  # Check 2: OIDC endpoint
+  local oidc_status
+  oidc_status=$(curl -sk -o /dev/null -w '%{http_code}' "https://${DOMAIN}/oauth2/.well-known/openid-configuration" 2>/dev/null || echo "000")
+  if [[ "$oidc_status" == "200" ]]; then
+    log_success "OIDC endpoint responding (HTTP $oidc_status)"
+    checks_passed=$((checks_passed + 1))
+  else
+    log_warn "OIDC endpoint returned HTTP $oidc_status (expected 200)"
+  fi
+
+  # Check 3: Management API (expect 401 = working but needs auth, not 502 = proxy error)
+  local api_status
+  api_status=$(curl -sk -o /dev/null -w '%{http_code}' "https://${DOMAIN}/api/accounts" 2>/dev/null || echo "000")
+  if [[ "$api_status" == "401" || "$api_status" == "200" || "$api_status" == "403" ]]; then
+    log_success "Management API responding (HTTP $api_status)"
+    checks_passed=$((checks_passed + 1))
+  else
+    log_warn "Management API returned HTTP $api_status (expected 401/200/403)"
+  fi
+
+  echo ""
+  echo "  Verification: $checks_passed/$checks_total checks passed"
+  return 0
+}
+
+print_summary() {
+  echo ""
+  echo "$MSG_SEPARATOR"
+  echo "  Migration Complete"
+  echo "$MSG_SEPARATOR"
+  echo ""
+
+  if [[ "$PROXY_TYPE" == "$PROXY_TYPE_CADDY" ]]; then
+    echo "  What was done:"
+    echo "    - Old 5-container setup stopped"
+    echo "    - New config.yaml generated (combined server config)"
+    echo "    - New dashboard.env generated (embedded IdP)"
+    echo "    - New docker-compose.yml generated (Traefik + combined server)"
+    echo "    - New containers started"
+  else
+    echo "  What was done:"
+    echo "    - New config.yaml generated (combined server config)"
+    echo "    - New dashboard.env generated (embedded IdP)"
+    echo "    - New docker-compose.yml generated (exposed ports)"
+    echo ""
+    echo "  What you need to do:"
+    echo "    1. Stop old containers:"
+    echo "       cd $INSTALL_DIR && $DOCKER_COMPOSE_CMD down"
+    echo ""
+    echo "    2. Start new containers:"
+    echo "       cd $INSTALL_DIR && $DOCKER_COMPOSE_CMD up -d"
+    echo ""
+    echo "    3. Update your reverse proxy to route:"
+    echo "       - /signalexchange.SignalExchange/*  -> 127.0.0.1:8081 (gRPC/h2c)"
+    echo "       - /management.ManagementService/*   -> 127.0.0.1:8081 (gRPC/h2c)"
+    echo "       - /relay*, /ws-proxy/*              -> 127.0.0.1:8081 (WebSocket)"
+    echo "       - /api/*, /oauth2/*                 -> 127.0.0.1:8081 (HTTP)"
+    echo "       - /*                                -> 127.0.0.1:8080 (dashboard)"
+  fi
+
+  echo ""
+  echo "  Backup location: $BACKUP_DIR"
+  echo "  Rollback command: bash $BACKUP_DIR/rollback.sh"
+  echo ""
+  echo "  IMPORTANT:"
+  echo "    - Existing peers, routes, and policies are preserved in the database."
+  echo "    - The embedded IdP data is preserved in the management volume."
+  echo "    - Clients should reconnect automatically; if not: netbird down && netbird up"
+  echo ""
+  echo "  Next steps:"
+  echo "    - Access the dashboard: https://$DOMAIN"
+  echo "    - Re-authenticate all clients: netbird down && netbird up"
+  echo "    - Check logs: cd $INSTALL_DIR && $DOCKER_COMPOSE_CMD logs -f"
+  echo ""
+  return 0
+}
+
+############################################
+# Main
+############################################
+
+main() {
+  # Parse arguments
+  while [[ $# -gt 0 ]]; do
+    local arg="$1"
+    case "$arg" in
+      --install-dir)
+        local dir_value="$2"
+        INSTALL_DIR="$dir_value"
+        shift 2
+        ;;
+      --non-interactive)
+        NON_INTERACTIVE=true
+        shift
+        ;;
+      --help|-h)
+        echo "Usage: $0 [--install-dir /path/to/netbird] [--non-interactive]"
+        echo ""
+        echo "Migrates a pre-v0.65.0 NetBird deployment to the combined container setup."
+        echo ""
+        echo "Options:"
+        echo "  --install-dir DIR    Path to existing NetBird installation"
+        echo "  --non-interactive    Skip confirmation prompts (for automation)"
+        echo "  -h, --help           Show this help message"
+        exit 0
+        ;;
+      *)
+        log_error "Unknown option: $arg"
+        echo "Use --help for usage information."
+        exit 1
+        ;;
+    esac
+  done
+
+  print_banner
+
+  # Phase 0: Preflight & Detection
+  check_dependencies
+  detect_install_dir
+  validate_old_setup
+  check_already_migrated
+  detect_reverse_proxy
+  detect_idp_type
+  detect_volumes
+  detect_domain
+  detect_store_config
+  extract_config_values
+  print_detection_summary
+
+  confirm_action "Proceed with migration?"
+
+  # Phase 1: Backup
+  create_backup
+
+  # Phase 4: Apply migration
+  if [[ "$PROXY_TYPE" == "$PROXY_TYPE_CADDY" ]]; then
+    # Stop old containers BEFORE overwriting docker-compose.yml
+    stop_old_services
+
+    # Phase 2 + 3: Generate new configuration files
+    generate_config_yaml
+    generate_dashboard_env
+    generate_docker_compose
+
+    start_new_services
+    sleep 3
+    wait_for_health
+
+    # Phase 5: Verification
+    verify_migration
+  else
+    # For manual proxy setups, just generate files (don't stop/start)
+    generate_config_yaml
+    generate_dashboard_env
+    generate_docker_compose
+  fi
+
+  print_summary
+  return 0
+}
+
+main "$@"