Adds MDM 1m diff checker & reloader

client/server/mdm.go

@@ -15,6 +15,29 @@ import (
 // active MDM policy. Tests override this to inject a fake policy.
 var loadMDMPolicy = mdm.LoadPolicy
 
+// onMDMPolicyChange is invoked by the MDM reload ticker every time the
+// OS-native managed-config store reports a diff vs the last observation.
+// The handler cancels the active engine context (if any) so the
+// connectWithRetryRuns goroutine re-resolves the profile config —
+// re-running profilemanager.Config.apply() picks up the freshly-loaded
+// policy as the highest-priority override layer, and the engine restarts
+// with the new values.
+//
+// The callback runs in the ticker's own goroutine; it must not block on
+// long-running work nor take s.mutex for longer than the cancel call.
+// Ticker has already logged the per-key diff before invoking this hook.
+func (s *Server) onMDMPolicyChange(_, _ *mdm.Policy) {
+	log.Warn("MDM policy changed; cancelling engine context so connectWithRetryRuns re-resolves config")
+
+	s.mutex.Lock()
+	cancel := s.actCancel
+	s.mutex.Unlock()
+
+	if cancel != nil {
+		cancel()
+	}
+}
+
 // requestedMDMManagedKeys returns the names of MDM-managed keys whose
 // corresponding field is set in the SetConfigRequest. Only keys with an
 // MDM mapping are considered; other fields are ignored.

client/server/server.go

@@ -24,6 +24,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/expose"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	sleephandler "github.com/netbirdio/netbird/client/internal/sleep/handler"
+	"github.com/netbirdio/netbird/client/mdm"
 	"github.com/netbirdio/netbird/client/system"
 	mgm "github.com/netbirdio/netbird/shared/management/client"
 	"github.com/netbirdio/netbird/shared/management/domain"
@@ -98,6 +99,11 @@ type Server struct {
 
 	sleepHandler *sleephandler.SleepHandler
 
+	// mdmTicker periodically re-reads the OS-native MDM policy and triggers
+	// an engine restart when the policy changes. Launched once by Start;
+	// stopped by the rootCtx cancellation.
+	mdmTicker *mdm.Ticker
+
 	updateManager *updater.Manager
 
 	jwtCache *jwtCache
@@ -155,6 +161,17 @@ func (s *Server) Start() error {
 		s.updateManager.CheckUpdateSuccess(s.rootCtx)
 	}
 
+	// MDM policy reload ticker: every minute the desktop daemon re-reads
+	// the OS-native managed-config store and, on diff vs the previous
+	// observation, cancels the active engine context so connectWithRetry-
+	// Runs re-resolves Config (re-running profilemanager.Config.apply which
+	// applies the freshly-read MDM policy as the last layer) and brings
+	// the engine back with the new values.
+	if s.mdmTicker == nil {
+		s.mdmTicker = mdm.NewTicker(mdm.DefaultReloadInterval, s.onMDMPolicyChange)
+		go s.mdmTicker.Run(s.rootCtx)
+	}
+
 	// if current state contains any error, return it
 	// in all other cases we can continue execution only if status is idle and up command was
 	// not in the progress or already successfully established connection.