From ad03081e1fb8a65f052a6795d5812a5476a7c16c Mon Sep 17 00:00:00 2001
From: Maycon Santos <mlsmaycon@gmail.com>
Date: Mon, 5 Oct 2026 15:37:06 +0200
Subject: [PATCH 01/18] [management] Refresh only affected peers on IPv6
 settings changes (#8051)

Account settings changes refreshed every peer, even an IPv6 group toggle
that re-addresses a few, and the refresh goroutine got the request context,
so it could be cancelled when the handler returned. Group paths that
reconcile IPv6 addresses only walked the changed group, so peers reaching a
re-addressed peer through its other groups missed the new address.

The IPv6 reconcile now returns the peers whose address changed and callers
pass them as changed peers. An IPv6-only settings change dispatches affected
peers, adding every IPv6 holder on a range change since the interface prefix
comes from the range. IPv4 range and account-wide changes keep the full
refresh with a detached context.
---
 management/server/account.go                  | 115 +++++++--
 management/server/affected_peers_ipv6_test.go | 243 ++++++++++++++++++
 management/server/affected_peers_user_test.go |  10 +-
 management/server/group.go                    |  46 +++-
 management/server/user.go                     |   4 +-
 5 files changed, 372 insertions(+), 46 deletions(-)
 create mode 100644 management/server/affected_peers_ipv6_test.go

diff --git a/management/server/account.go b/management/server/account.go
index 1c09c8252..038c5d8db 100644
--- a/management/server/account.go
+++ b/management/server/account.go
@@ -334,6 +334,9 @@ func (am *DefaultAccountManager) UpdateAccountSettings(ctx context.Context, acco
 	var groupChangesAffectPeers bool
 	var reloadReverseProxy bool
 	var effectiveOldNetworkRange netip.Prefix
+	var ipv6Changed bool
+	var ipv6Snap *affectedpeers.Snapshot
+	var ipv6Change affectedpeers.Change
 
 	err = am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
 		var groupsUpdated bool
@@ -379,10 +382,10 @@ func (am *DefaultAccountManager) UpdateAccountSettings(ctx context.Context, acco
 		}
 
 		if ipv6SettingsChanged(oldSettings, newSettings) {
-			if err = am.updatePeerIPv6Addresses(ctx, transaction, accountID, newSettings); err != nil {
+			if ipv6Change, err = am.applyIPv6SettingsChange(ctx, transaction, accountID, oldSettings, newSettings); err != nil {
 				return err
 			}
-			updateAccountPeers = true
+			ipv6Changed = true
 		}
 
 		if oldSettings.RoutingPeerDNSResolutionEnabled != newSettings.RoutingPeerDNSResolutionEnabled ||
@@ -419,12 +422,20 @@ func (am *DefaultAccountManager) UpdateAccountSettings(ctx context.Context, acco
 			return err
 		}
 
-		if updateAccountPeers || groupsUpdated {
+		if updateAccountPeers || groupsUpdated || ipv6Changed {
 			if err = transaction.IncrementNetworkSerial(ctx, accountID); err != nil {
 				return err
 			}
 		}
 
+		// A full account refresh already covers the IPv6 change, so the affected-peers
+		// snapshot is only needed when nothing account-wide changed.
+		if ipv6Changed && !updateAccountPeers && !groupChangesAffectPeers {
+			if ipv6Snap, err = affectedpeers.Load(ctx, transaction, accountID, ipv6Change); err != nil {
+				return fmt.Errorf("load affected peers: %w", err)
+			}
+		}
+
 		return nil
 	})
 	if err != nil {
@@ -486,13 +497,34 @@ func (am *DefaultAccountManager) UpdateAccountSettings(ctx context.Context, acco
 		}
 	}
 
-	if updateAccountPeers || extraSettingsChanged || groupChangesAffectPeers {
-		go am.UpdateAccountPeers(ctx, accountID, types.UpdateReason{Resource: types.UpdateResourceAccountSettings, Operation: types.UpdateOperationUpdate})
+	switch {
+	case updateAccountPeers || extraSettingsChanged || groupChangesAffectPeers:
+		go am.UpdateAccountPeers(context.WithoutCancel(ctx), accountID, types.UpdateReason{Resource: types.UpdateResourceAccountSettings, Operation: types.UpdateOperationUpdate})
+	case ipv6Snap != nil:
+		am.ExpandAndUpdateAffected(ctx, accountID, ipv6Snap, ipv6Change)
 	}
 
 	return newSettings, nil
 }
 
+// applyIPv6SettingsChange reconciles peer IPv6 addresses for new IPv6 settings and
+// returns the affected-peers change: peers whose address changed refresh together
+// with every peer that reaches them. On a range change every peer holding an address
+// also refreshes itself, since its interface prefix comes from the account range even
+// when its address stays inside the new one.
+func (am *DefaultAccountManager) applyIPv6SettingsChange(ctx context.Context, transaction store.Store, accountID string, oldSettings, newSettings *types.Settings) (affectedpeers.Change, error) {
+	result, err := am.updatePeerIPv6Addresses(ctx, transaction, accountID, newSettings)
+	if err != nil {
+		return affectedpeers.Change{}, err
+	}
+
+	change := affectedpeers.Change{ChangedPeerIDs: result.changed}
+	if oldSettings.NetworkRangeV6 != newSettings.NetworkRangeV6 {
+		change.OutputPeerIDs = result.withIPv6
+	}
+	return change, nil
+}
+
 func ipv6SettingsChanged(old, updated *types.Settings) bool {
 	if old.NetworkRangeV6 != updated.NetworkRangeV6 {
 		return true
@@ -1742,9 +1774,11 @@ func (am *DefaultAccountManager) SyncUserJWTGroups(ctx context.Context, userAuth
 
 			change.LinkGroups = allGroupChanges
 
-			if err = am.reconcileIPv6ForGroupChanges(ctx, transaction, userAuth.AccountId, allGroupChanges); err != nil {
+			ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, userAuth.AccountId, allGroupChanges)
+			if err != nil {
 				return fmt.Errorf("reconcile IPv6 for group changes: %w", err)
 			}
+			change.ChangedPeerIDs = append(change.ChangedPeerIDs, ipv6Changed...)
 
 			if err = transaction.IncrementNetworkSerial(ctx, userAuth.AccountId); err != nil {
 				return fmt.Errorf("error incrementing network serial: %w", err)
@@ -2334,7 +2368,8 @@ func (am *DefaultAccountManager) propagateUserGroupMemberships(ctx context.Conte
 		return false, false, err
 	}
 
-	if err = am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, updatedGroups); err != nil {
+	ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, updatedGroups)
+	if err != nil {
 		return false, false, fmt.Errorf("reconcile IPv6 for group changes: %w", err)
 	}
 
@@ -2343,7 +2378,7 @@ func (am *DefaultAccountManager) propagateUserGroupMemberships(ctx context.Conte
 		return false, false, fmt.Errorf("error checking if group changes affect peers: %w", err)
 	}
 
-	return len(updatedGroups) > 0, peersAffected, nil
+	return len(updatedGroups) > 0, peersAffected || len(ipv6Changed) > 0, nil
 }
 
 // propagateAutoGroupsForUsers adds each user's peers to their AutoGroups where not already present.
@@ -2440,56 +2475,78 @@ func (am *DefaultAccountManager) checkIPv6Collision(ctx context.Context, transac
 	return nil
 }
 
-func (am *DefaultAccountManager) updatePeerIPv6Addresses(ctx context.Context, transaction store.Store, accountID string, settings *types.Settings) error {
+// ipv6Reassignment reports the outcome of an IPv6 address reconciliation.
+type ipv6Reassignment struct {
+	// changed are the peers whose IPv6 address was assigned, removed or reallocated.
+	changed []string
+	// withIPv6 are all peers holding an IPv6 address after the reconciliation.
+	withIPv6 []string
+}
+
+func (am *DefaultAccountManager) updatePeerIPv6Addresses(ctx context.Context, transaction store.Store, accountID string, settings *types.Settings) (ipv6Reassignment, error) {
 	peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthUpdate, accountID, "", "", "")
 	if err != nil {
-		return fmt.Errorf("get peers: %w", err)
+		return ipv6Reassignment{}, fmt.Errorf("get peers: %w", err)
 	}
 
 	network, err := transaction.GetAccountNetwork(ctx, store.LockingStrengthUpdate, accountID)
 	if err != nil {
-		return fmt.Errorf("get network: %w", err)
+		return ipv6Reassignment{}, fmt.Errorf("get network: %w", err)
 	}
 
 	if err := am.ensureIPv6Subnet(ctx, transaction, accountID, settings, network); err != nil {
-		return err
+		return ipv6Reassignment{}, err
 	}
 
 	allowedPeers, err := am.buildIPv6AllowedPeers(ctx, transaction, accountID, settings)
 	if err != nil {
-		return err
+		return ipv6Reassignment{}, err
 	}
 
 	v6Prefix, err := netip.ParsePrefix(network.NetV6.String())
 	if err != nil {
-		return fmt.Errorf("parse IPv6 prefix: %w", err)
+		return ipv6Reassignment{}, fmt.Errorf("parse IPv6 prefix: %w", err)
 	}
 
-	if err := am.assignPeerIPv6Addresses(ctx, transaction, accountID, peers, network, allowedPeers, v6Prefix); err != nil {
-		return err
+	changed, err := am.assignPeerIPv6Addresses(ctx, transaction, accountID, peers, network, allowedPeers, v6Prefix)
+	if err != nil {
+		return ipv6Reassignment{}, err
 	}
 
-	log.WithContext(ctx).Infof("updated IPv6 addresses for %d peers in account %s (groups=%d)",
-		len(peers), accountID, len(settings.IPv6EnabledGroups))
+	result := ipv6Reassignment{changed: changed}
+	for _, peer := range peers {
+		if peer.IPv6.IsValid() {
+			result.withIPv6 = append(result.withIPv6, peer.ID)
+		}
+	}
 
-	return nil
+	log.WithContext(ctx).Infof("updated IPv6 addresses for %d of %d peers in account %s (groups=%d)",
+		len(changed), len(peers), accountID, len(settings.IPv6EnabledGroups))
+
+	return result, nil
 }
 
 // reconcileIPv6ForGroupChanges checks whether the given group IDs overlap with
 // the account's IPv6EnabledGroups. If they do, it runs a full IPv6 address
 // reconciliation so that peers gaining or losing membership in an IPv6-enabled
-// group get their addresses assigned or removed.
-func (am *DefaultAccountManager) reconcileIPv6ForGroupChanges(ctx context.Context, transaction store.Store, accountID string, groupIDs []string) error {
+// group get their addresses assigned or removed. It returns the peers whose IPv6
+// address changed, which callers pass as changed peers so every peer that can
+// reach them refreshes.
+func (am *DefaultAccountManager) reconcileIPv6ForGroupChanges(ctx context.Context, transaction store.Store, accountID string, groupIDs []string) ([]string, error) {
 	settings, err := transaction.GetAccountSettings(ctx, store.LockingStrengthNone, accountID)
 	if err != nil {
-		return fmt.Errorf("get account settings: %w", err)
+		return nil, fmt.Errorf("get account settings: %w", err)
 	}
 
 	if !ipv6ReconcileNeeded(settings, groupIDs) {
-		return nil
+		return nil, nil
 	}
 
-	return am.updatePeerIPv6Addresses(ctx, transaction, accountID, settings)
+	result, err := am.updatePeerIPv6Addresses(ctx, transaction, accountID, settings)
+	if err != nil {
+		return nil, err
+	}
+	return result.changed, nil
 }
 
 // ipv6ReconcileNeeded reports whether changes to the given groups trigger an IPv6
@@ -2528,7 +2585,7 @@ func (am *DefaultAccountManager) assignPeerIPv6Addresses(
 	ctx context.Context, transaction store.Store, accountID string,
 	peers []*nbpeer.Peer, network *types.Network,
 	allowedPeers map[string]struct{}, v6Prefix netip.Prefix,
-) error {
+) ([]string, error) {
 	takenV6 := make(map[netip.Addr]struct{})
 	for _, peer := range peers {
 		if _, ok := allowedPeers[peer.ID]; ok && peer.IPv6.IsValid() && network.NetV6.Contains(peer.IPv6.AsSlice()) {
@@ -2536,6 +2593,7 @@ func (am *DefaultAccountManager) assignPeerIPv6Addresses(
 		}
 	}
 
+	var changed []string
 	for _, peer := range peers {
 		_, allowed := allowedPeers[peer.ID]
 		oldIPv6 := peer.IPv6
@@ -2545,7 +2603,7 @@ func (am *DefaultAccountManager) assignPeerIPv6Addresses(
 		} else if !peer.IPv6.IsValid() || !network.NetV6.Contains(peer.IPv6.AsSlice()) {
 			newIP, err := allocateIPv6WithRetry(v6Prefix, takenV6, peer.ID)
 			if err != nil {
-				return err
+				return nil, err
 			}
 			peer.IPv6 = newIP
 		}
@@ -2555,10 +2613,11 @@ func (am *DefaultAccountManager) assignPeerIPv6Addresses(
 		}
 
 		if err := transaction.SavePeer(ctx, accountID, peer); err != nil {
-			return fmt.Errorf("save peer %s: %w", peer.ID, err)
+			return nil, fmt.Errorf("save peer %s: %w", peer.ID, err)
 		}
+		changed = append(changed, peer.ID)
 	}
-	return nil
+	return changed, nil
 }
 
 func allocateIPv6WithRetry(prefix netip.Prefix, taken map[netip.Addr]struct{}, peerID string) (netip.Addr, error) {
diff --git a/management/server/affected_peers_ipv6_test.go b/management/server/affected_peers_ipv6_test.go
new file mode 100644
index 000000000..c64360016
--- /dev/null
+++ b/management/server/affected_peers_ipv6_test.go
@@ -0,0 +1,243 @@
+package server
+
+import (
+	"context"
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+const (
+	ipv6GroupA = "ipv6-grp-a"
+	ipv6GroupB = "ipv6-grp-b"
+	ipv6GroupC = "ipv6-grp-c"
+	ipv6GroupD = "ipv6-grp-d"
+)
+
+// ipv6AffectedTest holds three peers: peer1 in group A, peer2 in group B, peer3 in
+// group C, with a single A<->B policy. peer3 is unrelated to peer1 and peer2. Group D
+// is empty and referenced by nothing.
+type ipv6AffectedTest struct {
+	manager                   *DefaultAccountManager
+	accountID                 string
+	peer1, peer2, peer3       *nbpeer.Peer
+	updMsg1, updMsg2, updMsg3 <-chan *network_map.UpdateMessage
+}
+
+func setupIPv6AffectedTest(t *testing.T, ipv6Groups []string) *ipv6AffectedTest {
+	t.Helper()
+
+	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	ctx := context.Background()
+	accountID := account.Id
+
+	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
+	require.NoError(t, err)
+	for _, p := range policies {
+		require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID))
+	}
+
+	for _, g := range []*types.Group{
+		{ID: ipv6GroupA, Name: "IPv6-A", Peers: []string{peer1.ID}},
+		{ID: ipv6GroupB, Name: "IPv6-B", Peers: []string{peer2.ID}},
+		{ID: ipv6GroupC, Name: "IPv6-C", Peers: []string{peer3.ID}},
+		{ID: ipv6GroupD, Name: "IPv6-D"},
+	} {
+		require.NoError(t, manager.CreateGroup(ctx, accountID, userID, g))
+	}
+
+	_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+		Enabled: true,
+		Rules: []*types.PolicyRule{{
+			Enabled:       true,
+			Sources:       []string{ipv6GroupA},
+			Destinations:  []string{ipv6GroupB},
+			Bidirectional: true,
+			Action:        types.PolicyTrafficActionAccept,
+		}},
+	}, true)
+	require.NoError(t, err)
+
+	// New accounts enable IPv6 for the All group; start from the requested groups.
+	updateIPv6TestSettings(t, manager, accountID, func(s *types.Settings) {
+		s.IPv6EnabledGroups = ipv6Groups
+	})
+
+	tc := &ipv6AffectedTest{
+		manager:   manager,
+		accountID: accountID,
+		peer1:     peer1,
+		peer2:     peer2,
+		peer3:     peer3,
+	}
+	tc.updMsg1 = updateManager.CreateChannel(ctx, peer1.ID)
+	tc.updMsg2 = updateManager.CreateChannel(ctx, peer2.ID)
+	tc.updMsg3 = updateManager.CreateChannel(ctx, peer3.ID)
+	t.Cleanup(func() {
+		updateManager.CloseChannel(ctx, peer1.ID)
+		updateManager.CloseChannel(ctx, peer2.ID)
+		updateManager.CloseChannel(ctx, peer3.ID)
+	})
+
+	// The setup changes above dispatch asynchronously and can land after the
+	// channels open, so drop them before the test acts.
+	drainPeerUpdates(tc.updMsg1)
+	drainPeerUpdates(tc.updMsg2)
+	drainPeerUpdates(tc.updMsg3)
+
+	return tc
+}
+
+// updateIPv6TestSettings applies mutate to a copy of the current settings, so only
+// the mutated fields differ from what is stored.
+func updateIPv6TestSettings(t *testing.T, manager *DefaultAccountManager, accountID string, mutate func(*types.Settings)) {
+	t.Helper()
+	ctx := context.Background()
+
+	current, err := manager.Store.GetAccountSettings(ctx, store.LockingStrengthNone, accountID)
+	require.NoError(t, err)
+
+	updated := current.Copy()
+	mutate(updated)
+
+	_, err = manager.UpdateAccountSettings(ctx, accountID, userID, updated)
+	require.NoError(t, err)
+}
+
+func (tc *ipv6AffectedTest) peerIPv6(t *testing.T, peerID string) netip.Addr {
+	t.Helper()
+	peer, err := tc.manager.Store.GetPeerByID(context.Background(), store.LockingStrengthNone, tc.accountID, peerID)
+	require.NoError(t, err)
+	return peer.IPv6
+}
+
+func TestAffectedPeers_IPv6GroupEnabled_RefreshesOnlyReachablePeers(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, nil)
+
+	updateIPv6TestSettings(t, tc.manager, tc.accountID, func(s *types.Settings) {
+		s.IPv6EnabledGroups = []string{ipv6GroupA}
+	})
+	require.True(t, tc.peerIPv6(t, tc.peer1.ID).IsValid(), "peer1 should get an IPv6 address")
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldReceiveUpdate(t, tc.updMsg2)
+	peerShouldNotReceiveUpdate(t, tc.updMsg3)
+}
+
+func TestAffectedPeers_IPv6GroupDisabled_RefreshesOnlyReachablePeers(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, []string{ipv6GroupA})
+	require.True(t, tc.peerIPv6(t, tc.peer1.ID).IsValid(), "peer1 should start with an IPv6 address")
+
+	updateIPv6TestSettings(t, tc.manager, tc.accountID, func(s *types.Settings) {
+		s.IPv6EnabledGroups = []string{}
+	})
+	require.False(t, tc.peerIPv6(t, tc.peer1.ID).IsValid(), "peer1 should lose its IPv6 address")
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldReceiveUpdate(t, tc.updMsg2)
+	peerShouldNotReceiveUpdate(t, tc.updMsg3)
+}
+
+// Widening the IPv6 range keeps peer addresses, but each holder's interface prefix
+// comes from the range, so holders refresh while peers that only reach them do not.
+func TestAffectedPeers_IPv6RangeWidened_RefreshesAddressHolders(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, []string{ipv6GroupA})
+	oldIPv6 := tc.peerIPv6(t, tc.peer1.ID)
+	require.True(t, oldIPv6.IsValid(), "peer1 should start with an IPv6 address")
+
+	// The range is allocated on the account network; settings may leave it empty.
+	network, err := tc.manager.Store.GetAccountNetwork(context.Background(), store.LockingStrengthNone, tc.accountID)
+	require.NoError(t, err)
+	current := prefixFromIPNet(network.NetV6)
+	require.True(t, current.IsValid(), "account should have an IPv6 range")
+	widened := netip.PrefixFrom(current.Addr(), current.Bits()-8).Masked()
+
+	updateIPv6TestSettings(t, tc.manager, tc.accountID, func(s *types.Settings) {
+		s.NetworkRangeV6 = widened
+	})
+	require.Equal(t, oldIPv6, tc.peerIPv6(t, tc.peer1.ID), "peer1 should keep its address inside the widened range")
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldNotReceiveUpdate(t, tc.updMsg2)
+	peerShouldNotReceiveUpdate(t, tc.updMsg3)
+}
+
+func TestAffectedPeers_IPv4RangeChange_RefreshesWholeAccount(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, nil)
+
+	updateIPv6TestSettings(t, tc.manager, tc.accountID, func(s *types.Settings) {
+		s.NetworkRange = netip.MustParsePrefix("100.70.0.0/16")
+	})
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldReceiveUpdate(t, tc.updMsg2)
+	peerShouldReceiveUpdate(t, tc.updMsg3)
+}
+
+func TestAffectedPeers_IPv6WithAccountWideChange_RefreshesWholeAccount(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, nil)
+
+	updateIPv6TestSettings(t, tc.manager, tc.accountID, func(s *types.Settings) {
+		s.IPv6EnabledGroups = []string{ipv6GroupA}
+		s.LazyConnectionEnabled = !s.LazyConnectionEnabled
+	})
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldReceiveUpdate(t, tc.updMsg2)
+	peerShouldReceiveUpdate(t, tc.updMsg3)
+}
+
+// Joining an IPv6-enabled group that no policy references gives peer1 an address.
+// peer2 reaches peer1 through group A, not through the joined group, and must still
+// learn the new address.
+func TestAffectedPeers_GroupAddPeerIPv6_RefreshesPeersReachingThroughOtherGroups(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, []string{ipv6GroupD})
+
+	require.NoError(t, tc.manager.GroupAddPeer(context.Background(), tc.accountID, ipv6GroupD, tc.peer1.ID))
+	require.True(t, tc.peerIPv6(t, tc.peer1.ID).IsValid(), "peer1 should get an IPv6 address")
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldReceiveUpdate(t, tc.updMsg2)
+	peerShouldNotReceiveUpdate(t, tc.updMsg3)
+}
+
+func TestAffectedPeers_UpdateGroupIPv6_RefreshesPeersReachingThroughOtherGroups(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, []string{ipv6GroupD})
+
+	require.NoError(t, tc.manager.UpdateGroup(context.Background(), tc.accountID, userID, &types.Group{
+		ID:    ipv6GroupD,
+		Name:  "IPv6-D",
+		Peers: []string{tc.peer1.ID},
+	}))
+	require.True(t, tc.peerIPv6(t, tc.peer1.ID).IsValid(), "peer1 should get an IPv6 address")
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldReceiveUpdate(t, tc.updMsg2)
+	peerShouldNotReceiveUpdate(t, tc.updMsg3)
+}
+
+// Deleting an IPv6-enabled group removes its members' addresses after the
+// pre-delete snapshot was taken.
+func TestAffectedPeers_DeleteIPv6Group_RefreshesFormerMembersAndReachablePeers(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, []string{ipv6GroupD})
+	ctx := context.Background()
+
+	require.NoError(t, tc.manager.GroupAddPeer(ctx, tc.accountID, ipv6GroupD, tc.peer1.ID))
+	require.True(t, tc.peerIPv6(t, tc.peer1.ID).IsValid(), "peer1 should get an IPv6 address")
+	drainPeerUpdates(tc.updMsg1)
+	drainPeerUpdates(tc.updMsg2)
+	drainPeerUpdates(tc.updMsg3)
+
+	require.NoError(t, tc.manager.DeleteGroup(ctx, tc.accountID, userID, ipv6GroupD))
+	require.False(t, tc.peerIPv6(t, tc.peer1.ID).IsValid(), "peer1 should lose its IPv6 address")
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldReceiveUpdate(t, tc.updMsg2)
+	peerShouldNotReceiveUpdate(t, tc.updMsg3)
+}
diff --git a/management/server/affected_peers_user_test.go b/management/server/affected_peers_user_test.go
index c0dbbb84f..3d73bbed0 100644
--- a/management/server/affected_peers_user_test.go
+++ b/management/server/affected_peers_user_test.go
@@ -108,11 +108,13 @@ func TestAffectedPeers_SaveUser_OnlyAffectedPeersUpdated(t *testing.T) {
 	})
 
 	t.Run("auto group change reassigning IPv6 refreshes the changed peers and their observers", func(t *testing.T) {
-		account, err := manager.Store.GetAccount(ctx, accountID)
-		require.NoError(t, err)
-		account.Settings.IPv6EnabledGroups = []string{"ug-v6"}
-		require.NoError(t, manager.Store.SaveAccount(ctx, account))
 		require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-v6", Name: "ug-v6"}))
+		// Apply through the settings API so the reconciliation that strips the other
+		// peers' addresses happens here, leaving the target as the only peer the
+		// user update reassigns.
+		updateIPv6TestSettings(t, manager, accountID, func(s *types.Settings) {
+			s.IPv6EnabledGroups = []string{"ug-v6"}
+		})
 
 		drainPeerUpdates(updTarget)
 		drainPeerUpdates(upd2)
diff --git a/management/server/group.go b/management/server/group.go
index 88295e2f6..8d91df3ab 100644
--- a/management/server/group.go
+++ b/management/server/group.go
@@ -166,9 +166,11 @@ func (am *DefaultAccountManager) UpdateGroup(ctx context.Context, accountID, use
 			return err
 		}
 
-		if err = am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{newGroup.ID}); err != nil {
+		ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{newGroup.ID})
+		if err != nil {
 			return err
 		}
+		change.ChangedPeerIDs = ipv6Changed
 
 		// A membership change does not alter which entities reference the group, so
 		// the dependency walk runs once against the post-change snapshot. The new
@@ -321,7 +323,7 @@ func (am *DefaultAccountManager) UpdateGroups(ctx context.Context, accountID, us
 	var globalErr error
 	for _, newGroup := range groups {
 		change := affectedpeers.Change{ChangedGroupIDs: []string{newGroup.ID}}
-		events, snap, err := am.updateSingleGroup(ctx, accountID, userID, newGroup, change)
+		events, snap, change, err := am.updateSingleGroup(ctx, accountID, userID, newGroup, change)
 		if err != nil {
 			log.WithContext(ctx).Errorf("failed to update group %s: %v", newGroup.ID, err)
 			if len(groups) == 1 {
@@ -344,7 +346,7 @@ func (am *DefaultAccountManager) UpdateGroups(ctx context.Context, accountID, us
 	return globalErr
 }
 
-func (am *DefaultAccountManager) updateSingleGroup(ctx context.Context, accountID, userID string, newGroup *types.Group, change affectedpeers.Change) ([]func(), *affectedpeers.Snapshot, error) {
+func (am *DefaultAccountManager) updateSingleGroup(ctx context.Context, accountID, userID string, newGroup *types.Group, change affectedpeers.Change) ([]func(), *affectedpeers.Snapshot, affectedpeers.Change, error) {
 	var events []func()
 	var snap *affectedpeers.Snapshot
 	err := am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
@@ -364,9 +366,11 @@ func (am *DefaultAccountManager) updateSingleGroup(ctx context.Context, accountI
 			return err
 		}
 
-		if err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{newGroup.ID}); err != nil {
+		ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{newGroup.ID})
+		if err != nil {
 			return err
 		}
+		change.ChangedPeerIDs = ipv6Changed
 
 		if err := transaction.IncrementNetworkSerial(ctx, accountID); err != nil {
 			return err
@@ -377,7 +381,7 @@ func (am *DefaultAccountManager) updateSingleGroup(ctx context.Context, accountI
 		snap, err = affectedpeers.Load(ctx, transaction, accountID, change)
 		return err
 	})
-	return events, snap, err
+	return events, snap, change, err
 }
 
 // prepareGroupEvents prepares a list of event functions to be stored.
@@ -480,8 +484,8 @@ func (am *DefaultAccountManager) DeleteGroups(ctx context.Context, accountID, us
 	var allErrors error
 	var groupIDsToDelete []string
 	var deletedGroups []*types.Group
-	var snap *affectedpeers.Snapshot
-	var change affectedpeers.Change
+	var snap, ipv6Snap *affectedpeers.Snapshot
+	var change, ipv6Change affectedpeers.Change
 
 	extraSettings, err := am.settingsManager.GetExtraSettings(ctx, accountID)
 	if err != nil {
@@ -510,10 +514,20 @@ func (am *DefaultAccountManager) DeleteGroups(ctx context.Context, accountID, us
 			return err
 		}
 
-		if err = am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, groupIDsToDelete); err != nil {
+		ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, groupIDsToDelete)
+		if err != nil {
 			return err
 		}
 
+		// Members of a deleted IPv6-enabled group lose their address, which the
+		// pre-delete snapshot cannot see, so they are resolved post-delete.
+		if len(ipv6Changed) > 0 {
+			ipv6Change = affectedpeers.Change{ChangedPeerIDs: ipv6Changed}
+			if ipv6Snap, err = affectedpeers.Load(ctx, transaction, accountID, ipv6Change); err != nil {
+				return err
+			}
+		}
+
 		return transaction.IncrementNetworkSerial(ctx, accountID)
 	})
 	if err != nil {
@@ -524,7 +538,7 @@ func (am *DefaultAccountManager) DeleteGroups(ctx context.Context, accountID, us
 		am.StoreEvent(ctx, userID, group.ID, accountID, activity.GroupDeleted, group.EventMeta())
 	}
 
-	am.ExpandAndUpdateAffected(ctx, accountID, snap, change)
+	go am.dispatchAffected(ctx, accountID, []*affectedpeers.Snapshot{snap, ipv6Snap}, []affectedpeers.Change{change, ipv6Change})
 
 	return allErrors
 }
@@ -564,11 +578,14 @@ func (am *DefaultAccountManager) GroupAddPeer(ctx context.Context, accountID, gr
 			return err
 		}
 
-		if err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{groupID}); err != nil {
+		ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{groupID})
+		if err != nil {
 			return err
 		}
+		// A peer whose IPv6 address changed is visible to every peer that reaches it
+		// through any of its groups, not only through this one.
+		change.ChangedPeerIDs = ipv6Changed
 
-		var err error
 		if snap, err = affectedpeers.Load(ctx, transaction, accountID, change); err != nil {
 			return err
 		}
@@ -634,11 +651,14 @@ func (am *DefaultAccountManager) GroupDeletePeer(ctx context.Context, accountID,
 			return err
 		}
 
-		if err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{groupID}); err != nil {
+		ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{groupID})
+		if err != nil {
 			return err
 		}
+		// A peer whose IPv6 address changed is visible to every peer that reaches it
+		// through any of its groups, not only through this one.
+		change.ChangedPeerIDs = ipv6Changed
 
-		var err error
 		if snap, err = affectedpeers.Load(ctx, transaction, accountID, change); err != nil {
 			return err
 		}
diff --git a/management/server/user.go b/management/server/user.go
index 3510a624b..5f29f4df7 100644
--- a/management/server/user.go
+++ b/management/server/user.go
@@ -861,9 +861,11 @@ func (am *DefaultAccountManager) processUserUpdate(ctx context.Context, transact
 		allGroupChanges := slices.Concat(removedGroups, addedGroups)
 		change.LinkGroups = allGroupChanges
 
-		if err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, allGroupChanges); err != nil {
+		ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, allGroupChanges)
+		if err != nil {
 			return change, nil, nil, nil, fmt.Errorf("reconcile IPv6 for group changes: %w", err)
 		}
+		change.ChangedPeerIDs = append(change.ChangedPeerIDs, ipv6Changed...)
 	}
 
 	userEventsToAdd := am.prepareUserUpdateEvents(ctx, updatedUser.AccountID, initiatorUserId, oldUser, updatedUser, transferredOwnerRole, isNewUser, removedGroups, addedGroups, transaction)

From f175e402c7d2b7a4caa1315310206c6434de2fb3 Mon Sep 17 00:00:00 2001
From: Riccardo Manfrin <3090891+riccardomanfrin@users.noreply.github.com>
Date: Mon, 5 Oct 2026 15:59:31 +0200
Subject: [PATCH 02/18] [client] stop offering to every peer when the relay
 transport drops (#7092)

* [client] stop offering to every peer when the relay transport drops

The relay transport is shared: one connection per relay server carries the
streams of every peer using it. When it drops, each of those peers gets a
Disconnected verdict from evalConnStatus even when ICE is still carrying its
traffic, because peerUsesRelay comes from HasRelayAddress(), which only reports
that management offered relay servers, not that we are connected to one. The
guard answers Disconnected with the aggressive retry, so every peer starts
sending offers over signal for a transport that no offer can restore: the relay
client's own guard is what reconnects it.

Feed relayManager.Ready() into the status inputs and return PartiallyConnected
when ICE is up and the missing side is the shared transport. That is the
existing "one path works, the other does not" branch, which retries three times
and then hourly instead of walking the exponential ladder forever.

Peers are not left waiting for the hourly tick: when the transport comes back,
Manager.onServerConnected notifies srWatcher, the guard resets the ticker to
800ms and iceState.reset() clears the hourly mode.

The verdict is unchanged when the transport is up but this peer is unreachable
over relay - it may have moved to another server, and only an offer carries its
new relay address - and in force-relay mode, where relay is the only transport.

* Renaming according to actual meanings

* Don't consider an in progress ICE as "partially connected"

when the relay is not..

* Aligns tests

* Address wrong comments
---
 client/internal/peer/conn.go                  | 28 ++++---
 client/internal/peer/conn_status.go           | 15 ++--
 client/internal/peer/conn_status_eval_test.go | 83 ++++++++++++++++---
 client/internal/peer/guard/guard.go           |  8 +-
 client/internal/peer/worker_relay.go          |  4 +
 5 files changed, 104 insertions(+), 34 deletions(-)

diff --git a/client/internal/peer/conn.go b/client/internal/peer/conn.go
index d73144773..17823e043 100644
--- a/client/internal/peer/conn.go
+++ b/client/internal/peer/conn.go
@@ -828,7 +828,8 @@ func (conn *Conn) evalStatus() ConnStatus {
 //
 // The result is a tri-state:
 //   - ConnStatusConnected:          all available transports are up
-//   - ConnStatusPartiallyConnected: relay is up but ICE is still pending/reconnecting
+//   - ConnStatusPartiallyConnected: one transport carries the traffic and the other does
+//     not: relay up with ICE down, or ICE up with the shared relay transport down
 //   - ConnStatusDisconnected:       no working transport
 func (conn *Conn) isConnectedOnAllWay() (status guard.ConnStatus) {
 	defer func() {
@@ -845,13 +846,14 @@ func (conn *Conn) isConnectedOnAllWay() (status guard.ConnStatus) {
 	}
 
 	return evalConnStatus(connStatusInputs{
-		forceRelay:          IsForceRelayed(),
-		peerUsesRelay:       conn.workerRelay.IsRelayConnectionSupportedWithPeer(),
-		relayConnected:      conn.statusRelay.Get() == worker.StatusConnected,
-		remoteSupportsICE:   conn.handshaker.RemoteICESupported(),
-		iceWorkerCreated:    iceWorkerCreated,
-		iceStatusConnecting: conn.statusICE.Get() != worker.StatusDisconnected,
-		iceInProgress:       iceInProgress,
+		forceRelay:              IsForceRelayed(),
+		peerUsesRelay:           conn.workerRelay.IsRelayConnectionSupportedWithPeer(),
+		relayConnected:          conn.statusRelay.Get() == worker.StatusConnected,
+		relayTransportConnected: conn.workerRelay.IsTransportConnected(),
+		remoteSupportsICE:       conn.handshaker.RemoteICESupported(),
+		iceWorkerCreated:        iceWorkerCreated,
+		iceStatusConnected:      conn.statusICE.Get() == worker.StatusConnected,
+		iceInProgress:           iceInProgress,
 	})
 }
 
@@ -1060,19 +1062,21 @@ func evalConnStatus(in connStatusInputs) guard.ConnStatus {
 		return boolToConnStatus(relayUsedAndUp)
 	}
 
-	// ICE counts as "up" when the status is anything other than Disconnected, OR
-	// when a negotiation is currently in progress (so we don't spam offers while one is in flight).
-	iceUp := in.iceStatusConnecting || in.iceInProgress
+	// ICE counts as "running" when either connected or attempting to connect.
+	iceRunning := in.iceStatusConnected || in.iceInProgress
 
 	// Relay side is acceptable if the peer doesn't rely on relay, or relay is connected.
 	relayOK := !in.peerUsesRelay || in.relayConnected
 
 	switch {
-	case iceUp && relayOK:
+	case iceRunning && relayOK:
 		return guard.ConnStatusConnected
 	case relayUsedAndUp:
 		// Relay is up but ICE is down — partially connected.
 		return guard.ConnStatusPartiallyConnected
+	case in.iceStatusConnected && !in.relayTransportConnected:
+		// ICE is up and the shared relay transport is down — offers cannot restore it.
+		return guard.ConnStatusPartiallyConnected
 	default:
 		return guard.ConnStatusDisconnected
 	}
diff --git a/client/internal/peer/conn_status.go b/client/internal/peer/conn_status.go
index d6ad37b70..acf271534 100644
--- a/client/internal/peer/conn_status.go
+++ b/client/internal/peer/conn_status.go
@@ -17,13 +17,14 @@ const (
 // tri-state connection classification. Extracted so the decision logic can be unit-tested
 // without constructing full Worker/Handshaker objects.
 type connStatusInputs struct {
-	forceRelay          bool // NB_FORCE_RELAY or JS/WASM
-	peerUsesRelay       bool // remote peer advertises relay support AND local has relay
-	relayConnected      bool // statusRelay reports Connected (independent of whether peer uses relay)
-	remoteSupportsICE   bool // remote peer sent ICE credentials
-	iceWorkerCreated    bool // local WorkerICE exists (false in force-relay mode)
-	iceStatusConnecting bool // statusICE is anything other than Disconnected
-	iceInProgress       bool // a negotiation is currently in flight
+	forceRelay              bool // NB_FORCE_RELAY or JS/WASM
+	peerUsesRelay           bool // remote peer advertises relay support AND local has relay
+	relayConnected          bool // statusRelay reports Connected (independent of whether peer uses relay)
+	relayTransportConnected bool // the relay transport shared by all peers on that server is up
+	remoteSupportsICE       bool // remote peer sent ICE credentials
+	iceWorkerCreated        bool // local WorkerICE exists (false in force-relay mode)
+	iceStatusConnected      bool // statusICE reports Connected
+	iceInProgress           bool // a negotiation is currently in flight
 }
 
 // ConnStatus describe the status of a peer's connection
diff --git a/client/internal/peer/conn_status_eval_test.go b/client/internal/peer/conn_status_eval_test.go
index 66393cafe..a239196dc 100644
--- a/client/internal/peer/conn_status_eval_test.go
+++ b/client/internal/peer/conn_status_eval_test.go
@@ -30,6 +30,21 @@ func TestEvalConnStatus_ForceRelay(t *testing.T) {
 			},
 			want: guard.ConnStatusDisconnected,
 		},
+		{
+			name: "force relay, relay up but the shared transport reports down",
+			in: connStatusInputs{
+				forceRelay:              true,
+				peerUsesRelay:           true,
+				relayConnected:          true,
+				relayTransportConnected: false,
+				// The ICE inputs are set so that the force-relay return is the only branch
+				// that can produce Connected here: without it the peer would fall through to
+				// relayUsedAndUp and report PartiallyConnected.
+				remoteSupportsICE: true,
+				iceWorkerCreated:  true,
+			},
+			want: guard.ConnStatusConnected,
+		},
 		{
 			name: "force relay, peer does NOT use relay - disconnected forever",
 			in: connStatusInputs{
@@ -123,24 +138,28 @@ func TestEvalConnStatus_FullyAvailable(t *testing.T) {
 			mutator: func(in *connStatusInputs) {
 				in.peerUsesRelay = true
 				in.relayConnected = true
-				in.iceStatusConnecting = true
+				in.relayTransportConnected = true
+				in.iceStatusConnected = true
 			},
 			want: guard.ConnStatusConnected,
 		},
 		{
-			name: "ICE connected, peer does NOT use relay",
+			name: "ICE connected, peer does NOT use relay, shared transport down",
 			mutator: func(in *connStatusInputs) {
 				in.peerUsesRelay = false
 				in.relayConnected = false
-				in.iceStatusConnecting = true
+				in.relayTransportConnected = false
+				in.iceStatusConnected = true
 			},
+			// A peer that does not rely on relay is unaffected by the shared transport:
+			// relayOK is true, so the first arm matches before the transport is considered.
 			want: guard.ConnStatusConnected,
 		},
 		{
 			name: "ICE InProgress only, peer does NOT use relay",
 			mutator: func(in *connStatusInputs) {
 				in.peerUsesRelay = false
-				in.iceStatusConnecting = false
+				in.iceStatusConnected = false
 				in.iceInProgress = true
 			},
 			want: guard.ConnStatusConnected,
@@ -150,7 +169,8 @@ func TestEvalConnStatus_FullyAvailable(t *testing.T) {
 			mutator: func(in *connStatusInputs) {
 				in.peerUsesRelay = true
 				in.relayConnected = true
-				in.iceStatusConnecting = false
+				in.relayTransportConnected = true
+				in.iceStatusConnected = false
 				in.iceInProgress = false
 			},
 			want: guard.ConnStatusPartiallyConnected,
@@ -160,21 +180,60 @@ func TestEvalConnStatus_FullyAvailable(t *testing.T) {
 			mutator: func(in *connStatusInputs) {
 				in.peerUsesRelay = false
 				in.relayConnected = false
-				in.iceStatusConnecting = false
+				in.iceStatusConnected = false
 				in.iceInProgress = false
 			},
 			want: guard.ConnStatusDisconnected,
 		},
 		{
-			name: "ICE up, peer uses relay but relay down -> partial (relay required, ICE ignored)",
+			name: "ICE connected, relay down for this peer but the shared transport is up -> disconnected",
 			mutator: func(in *connStatusInputs) {
 				in.peerUsesRelay = true
 				in.relayConnected = false
-				in.iceStatusConnecting = true
+				in.relayTransportConnected = true
+				in.iceStatusConnected = true
+			},
+			// The transport is fine, so the peer itself is unreachable over relay: it may have
+			// moved to another server, and only an offer carries its new relay address.
+			want: guard.ConnStatusDisconnected,
+		},
+		{
+			name: "ICE connected, the shared relay transport is down -> partial",
+			mutator: func(in *connStatusInputs) {
+				in.peerUsesRelay = true
+				in.relayConnected = false
+				in.relayTransportConnected = false
+				in.iceStatusConnected = true
+			},
+			// ICE carries the traffic and the relay transport is restored by the relay client's
+			// own guard, not by offers, so this must not trigger the aggressive retry.
+			want: guard.ConnStatusPartiallyConnected,
+		},
+		{
+			name: "ICE only negotiating while the shared relay transport is down -> disconnected",
+			mutator: func(in *connStatusInputs) {
+				in.peerUsesRelay = true
+				in.relayConnected = false
+				in.relayTransportConnected = false
+				in.iceStatusConnected = false
+				in.iceInProgress = true
+			},
+			// A negotiation in flight is not a working transport, so this peer has no path at
+			// all and must keep the aggressive retry. Calling it partially connected spends the
+			// ICE retry budget and parks the guard on the hourly ticker, and nothing wakes it
+			// when the negotiation then fails: onICEStateDisconnected is only reached once ICE
+			// has reached Connected (worker_ice.go onConnectionStateChange).
+			want: guard.ConnStatusDisconnected,
+		},
+		{
+			name: "ICE down and the shared relay transport is down -> disconnected",
+			mutator: func(in *connStatusInputs) {
+				in.peerUsesRelay = true
+				in.relayConnected = false
+				in.relayTransportConnected = false
+				in.iceStatusConnected = false
+				in.iceInProgress = false
 			},
-			// relayOK = false (peer uses relay but it's down), iceUp = true
-			// first switch arm fails (relayOK false), relayUsedAndUp = false (relay down),
-			// falls into default: Disconnected.
 			want: guard.ConnStatusDisconnected,
 		},
 		{
@@ -182,7 +241,7 @@ func TestEvalConnStatus_FullyAvailable(t *testing.T) {
 			mutator: func(in *connStatusInputs) {
 				in.peerUsesRelay = false
 				in.relayConnected = true // not actually used since peer doesn't rely on it
-				in.iceStatusConnecting = false
+				in.iceStatusConnected = false
 				in.iceInProgress = false
 			},
 			want: guard.ConnStatusDisconnected,
diff --git a/client/internal/peer/guard/guard.go b/client/internal/peer/guard/guard.go
index 73bab2a89..15028d91c 100644
--- a/client/internal/peer/guard/guard.go
+++ b/client/internal/peer/guard/guard.go
@@ -14,7 +14,8 @@ type ConnStatus int
 const (
 	// ConnStatusDisconnected means neither ICE nor Relay is connected.
 	ConnStatusDisconnected ConnStatus = iota
-	// ConnStatusPartiallyConnected means Relay is connected but ICE is not.
+	// ConnStatusPartiallyConnected means one transport is usable and the other is not:
+	// relay connected with ICE down, or ICE connected with the shared relay transport down.
 	ConnStatusPartiallyConnected
 	// ConnStatusConnected means all required connections are established.
 	ConnStatusConnected
@@ -87,8 +88,9 @@ func (g *Guard) SetICEConnDisconnected() {
 //   - Connected: no action, the peer is fully reachable.
 //   - Disconnected (neither ICE nor Relay): retries aggressively with exponential backoff (800ms doubling
 //     up to timeout), never gives up. This ensures rapid recovery when the peer has no connectivity at all.
-//   - PartiallyConnected (Relay up, ICE not): retries up to 3 times with exponential backoff, then switches
-//     to one attempt per hour. This limits signaling traffic when relay already provides connectivity.
+//   - PartiallyConnected (one transport usable, the other not): retries up to 3 times
+//     with exponential backoff, then switches to one attempt per hour. This limits
+//     signaling traffic while the peer still has a working path.
 //
 // External events (relay/ICE disconnect, signal/relay reconnect, candidate changes) reset the retry
 // counter and backoff ticker, giving ICE a fresh chance after network conditions change.
diff --git a/client/internal/peer/worker_relay.go b/client/internal/peer/worker_relay.go
index fc3489992..694207847 100644
--- a/client/internal/peer/worker_relay.go
+++ b/client/internal/peer/worker_relay.go
@@ -101,6 +101,10 @@ func (w *WorkerRelay) RelayIsSupportedLocally() bool {
 	return w.relayManager.HasRelayAddress()
 }
 
+func (w *WorkerRelay) IsTransportConnected() bool {
+	return w.relayManager.Ready()
+}
+
 func (w *WorkerRelay) CloseConn() {
 	w.relayLock.Lock()
 	conn := w.relayedConn

From 2b5293687f3e6aa4a6a1f070a6e95353155e21c4 Mon Sep 17 00:00:00 2001
From: Zoltan Papp <zoltan.pmail@gmail.com>
Date: Mon, 5 Oct 2026 16:31:43 +0200
Subject: [PATCH 03/18] [client] Skip late session warnings on desktop and
 schedule them in the app on Android (#7548)

* Skip session warnings that fire after their window

The warning timers run on the monotonic clock, which does not advance
while an Android device is suspended. A timer armed for T-10 or T-2 can
therefore fire long after the window it was armed for, delivering a
"session expires soon" notification once that window is already gone.

Gate both callbacks on the wall clock at fire time: the T-10 warning is
skipped once the final-warning window has been reached, and the final
warning is skipped once the deadline itself has passed. Both set their
edge guard before returning so a skipped warning cannot fire again for
the same deadline.

* Harden the late-warning guards

Clamp a non-positive final lead to zero in the T-10 guard so a disabled
final warning cannot move the cutoff past the deadline, matching how
armTimerLocked already treats it.

Strip the monotonic reading from both sides of the comparison so the
guard measures wall-clock time regardless of how the caller built the
deadline. The production deadline comes from a protobuf timestamp and
has no monotonic reading; this keeps the guard correct for callers that
derive one from time.Now.

* Log the deadline and lateness on skipped warnings

Include the deadline and how far past the cutoff the timer fired, so a
debug bundle shows how long the device was suspended.

* Inject the clock into the late-warning guard and cover it with tests

The guard read time.Now internally, so the skip paths were reachable
only through a deadline already in the past and the boundary depended
on real time. Extract the comparison into isLate and read the time
through a nowFn field, so tests can place a resume anywhere around the
deadline without sleeping.

* Send the final warning when the T-10 timer fires inside its window

A suspend between roughly eight and ten minutes long made the T-10
timer fire inside the final-warning window and the final timer fire
after the deadline, so both were skipped and a user who resumed with
time left got no warning at all. When the T-10 timer fires late but
before the deadline, send the final warning in its place and mark it
fired so the delayed final timer does not repeat it.

* Respect dismissal when promoting a late warning to the final one

fireFinal skips the final warning once the user dismissed the deadline,
but the promoted path did not, so a dismissed deadline could still get
a final warning. Check the dismissal first, and give each skip reason
its own log line so an already-fired final warning no longer logs a
negative lateness.

* Add a deadline-only mode to the session watcher

Android will schedule its own expiry warnings from the deadline, so
the engine must not arm the T-10 and T-2 timers there. NewDeadlineOnly
keeps the deadline validation, the recorder propagation and the
logging, and skips only the timers, so the status snapshot the app
reads stays correct and an out-of-range deadline is still rejected.

* Use the deadline-only watcher on Android and drop the warning callbacks

The warning timers run on the monotonic clock, which does not advance
while the device sleeps, so a warning armed for T-10 could fire long
after its window. The app now schedules the warnings itself with
WorkManager, anchored to the wall clock, from the deadline it reads
through SessionExpiresAtUnix on every OnStateChanged.

Wire the deadline-only watcher into the android build and remove the
event-driven path from the gomobile surface: OnSessionExpiring, the
event subscription behind it and DismissSessionWarning, which the app
never called.

* Describe the late-warning guard without naming Android

The guard stays for the desktop builds, where a timer can also stall
across a sleep. Android no longer arms the timers at all.
---
 client/android/client.go                      |   3 +-
 client/android/session.go                     |  91 +-------
 client/internal/auth/sessionwatch/watcher.go  |  70 ++++++-
 .../auth/sessionwatch/watcher_test.go         | 198 ++++++++++++++++++
 client/internal/engine_sessionwatch.go        |  12 +-
 .../internal/engine_sessionwatch_android.go   |  12 ++
 6 files changed, 295 insertions(+), 91 deletions(-)
 create mode 100644 client/internal/engine_sessionwatch_android.go

diff --git a/client/android/client.go b/client/android/client.go
index 6f5eaacf3..9705db8e0 100644
--- a/client/android/client.go
+++ b/client/android/client.go
@@ -104,8 +104,7 @@ type Client struct {
 
 	stateChangeMu    sync.Mutex
 	stateChangeSubID string
-	eventSub         *peer.EventSubscription
-	// Closed to stop the watch goroutines from delivering buffered items to a
+	// Closed to stop the watch goroutine from delivering buffered ticks to a
 	// listener that has been removed or replaced. See stopStateChangeWatchLocked.
 	stateChangeDone chan struct{}
 
diff --git a/client/android/session.go b/client/android/session.go
index d5da09c93..1ce97f074 100644
--- a/client/android/session.go
+++ b/client/android/session.go
@@ -6,13 +6,8 @@ import (
 	"context"
 	"fmt"
 
-	log "github.com/sirupsen/logrus"
-
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/auth"
-	"github.com/netbirdio/netbird/client/internal/auth/sessionwatch"
-	"github.com/netbirdio/netbird/client/internal/peer"
-	cProto "github.com/netbirdio/netbird/client/proto"
 )
 
 // StateChangeListener receives client state notifications.
@@ -21,16 +16,11 @@ import (
 // changed: connection state, the run-loop status label (e.g. NeedsLogin) or
 // the session deadline. It mirrors the daemon's SubscribeStatus stream
 // trigger — on each signal the consumer pulls the fresh values via
-// Status() / SessionExpiresAtUnix().
-//
-// OnSessionExpiring forwards the engine's session-expiry warnings, fired at
-// sessionwatch.WarningLead before the deadline and again at FinalWarningLead
-// (finalWarning true). The second one is suppressed when the user dismissed
-// the first via DismissSessionWarning. The daemon turns the same events into
-// its tray notification.
+// Status() / SessionExpiresAtUnix(). The engine arms no expiry-warning
+// timers on Android; the app schedules the warnings from the deadline it
+// reads here.
 type StateChangeListener interface {
 	OnStateChanged()
-	OnSessionExpiring(expiresAtUnix int64, leadMinutes int64, finalWarning bool)
 }
 
 // Status returns the connect run-loop's status label — the same value the
@@ -110,11 +100,11 @@ func (c *Client) SetStateChangeListener(listener StateChangeListener) {
 		return
 	}
 
-	// Both subscriptions are buffered (one pending tick, ten pending events),
-	// so unsubscribing is not enough to stop callbacks: the loops would drain
-	// what is already queued and deliver it to a listener the caller has
-	// already removed or replaced. Gate every callback on this registration's
-	// own signal, which is closed before unsubscribing.
+	// The subscription is buffered (one pending tick), so unsubscribing is
+	// not enough to stop callbacks: the loop would drain what is already
+	// queued and deliver it to a listener the caller has already removed or
+	// replaced. Gate every callback on this registration's own signal, which
+	// is closed before unsubscribing.
 	done := make(chan struct{})
 	c.stateChangeDone = done
 
@@ -133,9 +123,6 @@ func (c *Client) SetStateChangeListener(listener StateChangeListener) {
 			listener.OnStateChanged()
 		}
 	}()
-
-	c.eventSub = c.recorder.SubscribeToEvents()
-	go watchSessionWarnings(c.eventSub, listener, done)
 }
 
 // RemoveStateChangeListener unregisters the state notification listener.
@@ -145,21 +132,6 @@ func (c *Client) RemoveStateChangeListener() {
 	c.stopStateChangeWatchLocked()
 }
 
-// DismissSessionWarning records the user's "Dismiss" on the first expiry
-// warning and suppresses the final one for the current deadline. A refreshed
-// deadline re-arms both. No-op while the engine is not running.
-func (c *Client) DismissSessionWarning() {
-	cc := c.getConnectClient()
-	if cc == nil {
-		return
-	}
-	engine := cc.Engine()
-	if engine == nil {
-		return
-	}
-	engine.DismissSessionWarning()
-}
-
 // ExtendAuthSession runs the interactive SSO flow to obtain a fresh JWT and
 // asks the management server to extend the session deadline. The tunnel is
 // untouched: no resync, no reconnect. Async; the result arrives on the
@@ -201,8 +173,8 @@ func (c *Client) CancelExtendAuthSession() {
 }
 
 func (c *Client) stopStateChangeWatchLocked() {
-	// Signal first, unsubscribe second: closing the channels only stops new
-	// items, and the loops would still hand whatever is buffered to a listener
+	// Signal first, unsubscribe second: closing the channel only stops new
+	// items, and the loop would still hand whatever is buffered to a listener
 	// that is no longer registered.
 	if c.stateChangeDone != nil {
 		close(c.stateChangeDone)
@@ -212,49 +184,6 @@ func (c *Client) stopStateChangeWatchLocked() {
 		c.recorder.UnsubscribeFromStateChanges(c.stateChangeSubID)
 		c.stateChangeSubID = ""
 	}
-	if c.eventSub != nil {
-		// Closes the channel, which ends watchSessionWarnings.
-		c.recorder.UnsubscribeFromEvents(c.eventSub)
-		c.eventSub = nil
-	}
-}
-
-// watchSessionWarnings forwards the engine's session-expiry warnings to the
-// listener. The event stream also carries unrelated traffic — network-map
-// updates on every sync, DNS and route errors — so everything but an
-// AUTHENTICATION event carrying the session-warning marker is dropped. Exits
-// when the subscription is closed by UnsubscribeFromEvents, or earlier when
-// done is closed — the stream buffers up to ten events, and a deregistered
-// listener must not receive the ones already queued.
-func watchSessionWarnings(sub *peer.EventSubscription, listener StateChangeListener, done <-chan struct{}) {
-	for ev := range sub.Events() {
-		select {
-		case <-done:
-			return
-		default:
-		}
-		if ev.GetCategory() != cProto.SystemEvent_AUTHENTICATION {
-			continue
-		}
-		meta := ev.GetMetadata()
-		if meta[sessionwatch.MetaSessionWarning] != "true" {
-			// Other AUTHENTICATION events exist (e.g. a deadline rejected as
-			// out of range); they carry no warning marker.
-			continue
-		}
-		deadline, err := sessionwatch.ParseExpiresAt(meta[sessionwatch.MetaSessionExpiresAt])
-		if err != nil {
-			log.Warnf("session warning event with unparsable deadline: %v", err)
-			continue
-		}
-		lead, err := sessionwatch.ParseLeadMinutes(meta[sessionwatch.MetaSessionLeadMinutes])
-		if err != nil {
-			// Informational only — the deadline above is what drives the UI.
-			lead = 0
-		}
-		listener.OnSessionExpiring(deadline.Unix(), int64(lead),
-			meta[sessionwatch.MetaSessionFinal] == "true")
-	}
 }
 
 func (c *Client) beginExtend() (context.Context, error) {
diff --git a/client/internal/auth/sessionwatch/watcher.go b/client/internal/auth/sessionwatch/watcher.go
index e685c28d0..496903044 100644
--- a/client/internal/auth/sessionwatch/watcher.go
+++ b/client/internal/auth/sessionwatch/watcher.go
@@ -90,8 +90,9 @@ type StatusRecorder interface {
 // fallback T-FinalWarningLead dialog (suppressed when the user dismissed
 // the first one for the same deadline). Safe for concurrent use.
 type Watcher struct {
-	lead      time.Duration
-	finalLead time.Duration
+	lead         time.Duration
+	finalLead    time.Duration
+	deadlineOnly bool
 
 	mu           sync.Mutex
 	current      time.Time
@@ -102,6 +103,7 @@ type Watcher struct {
 	dismissedAt  time.Time // deadline value the user dismissed via Dismiss(); gates fireFinal
 	closed       bool
 	recorder     StatusRecorder
+	nowFn        func() time.Time
 }
 
 // New returns a watcher with the package defaults WarningLead and
@@ -122,9 +124,17 @@ func NewWithLeads(lead, final time.Duration, recorder StatusRecorder) *Watcher {
 		lead:      lead,
 		finalLead: final,
 		recorder:  recorder,
+		nowFn:     time.Now,
 	}
 }
 
+// NewDeadlineOnly returns a watcher that validates and records deadlines but arms no warning timers.
+func NewDeadlineOnly(recorder StatusRecorder) *Watcher {
+	w := New(recorder)
+	w.deadlineOnly = true
+	return w
+}
+
 // Update sets the latest deadline. Pass the zero time to clear (e.g. when
 // a Sync push from the server omits the field because login expiration
 // was disabled).
@@ -181,7 +191,7 @@ func (w *Watcher) Update(deadline time.Time) error {
 	w.finalFiredAt = time.Time{}
 	w.dismissedAt = time.Time{}
 
-	if deadline.After(now) {
+	if deadline.After(now) && !w.deadlineOnly {
 		w.armTimerLocked(deadline)
 	}
 	recorder := w.recorder
@@ -303,6 +313,11 @@ func (w *Watcher) fire(armedFor time.Time) {
 		w.mu.Unlock()
 		return
 	}
+	now := w.nowFn()
+	if isLate(now, armedFor, max(w.finalLead, 0)) {
+		w.fireLateLocked(armedFor, now)
+		return
+	}
 	w.firedAt = armedFor
 	recorder := w.recorder
 	w.mu.Unlock()
@@ -331,6 +346,14 @@ func (w *Watcher) fireFinal(armedFor time.Time) {
 		log.Infof("auth session final-warning skipped (dismissed by user)")
 		return
 	}
+	now := w.nowFn()
+	if isLate(now, armedFor, 0) {
+		w.finalFiredAt = armedFor
+		w.mu.Unlock()
+		log.Infof("auth session final-warning skipped for deadline %s (passed %s ago)",
+			armedFor.Format(time.RFC3339), now.Round(0).Sub(armedFor).Round(time.Second))
+		return
+	}
 	w.finalFiredAt = armedFor
 	recorder := w.recorder
 	w.mu.Unlock()
@@ -341,6 +364,39 @@ func (w *Watcher) fireFinal(armedFor time.Time) {
 	publishWarning(recorder, armedFor, true)
 }
 
+// fireLateLocked handles a T-WarningLead callback that fired inside the
+// final-warning window: it sends the final warning in its place while the
+// deadline has not passed and the user has not dismissed it, so a resume
+// with time left still warns. The caller must hold w.mu; this helper
+// releases it.
+func (w *Watcher) fireLateLocked(armedFor, now time.Time) {
+	w.firedAt = armedFor
+	switch {
+	case w.dismissedAt.Equal(armedFor):
+		w.mu.Unlock()
+		log.Infof("auth session expiry soon warning skipped (dismissed by user)")
+		return
+	case w.finalFiredAt.Equal(armedFor):
+		w.mu.Unlock()
+		log.Infof("auth session expiry soon warning skipped (final warning already fired)")
+		return
+	case isLate(now, armedFor, 0):
+		w.mu.Unlock()
+		log.Infof("auth session expiry soon warning skipped for deadline %s (passed %s ago)",
+			armedFor.Format(time.RFC3339), now.Round(0).Sub(armedFor).Round(time.Second))
+		return
+	}
+	w.finalFiredAt = armedFor
+	recorder := w.recorder
+	w.mu.Unlock()
+	if recorder == nil {
+		return
+	}
+	log.Infof("auth session expiry soon warning fired inside the final-warning window, sending final warning for deadline %s",
+		armedFor.Format(time.RFC3339))
+	publishWarning(recorder, armedFor, true)
+}
+
 // armOneShotLocked schedules cb at fireAt. When fireAt is already in the
 // past it dispatches on the next scheduler tick so a state-change recorder
 // notification (invoked after w.mu is released) lands first. Caller must
@@ -380,3 +436,11 @@ func publishWarning(recorder StatusRecorder, deadline time.Time, final bool) {
 		meta,
 	)
 }
+
+// isLate reports whether the wall clock now has already reached armedFor
+// minus cutoffLead. The timers run on the monotonic clock, which can stall
+// while the host sleeps, so a timer can fire long after the window it was
+// armed for.
+func isLate(now, armedFor time.Time, cutoffLead time.Duration) bool {
+	return !now.Round(0).Before(armedFor.Add(-cutoffLead).Round(0))
+}
diff --git a/client/internal/auth/sessionwatch/watcher_test.go b/client/internal/auth/sessionwatch/watcher_test.go
index 4b49a94b6..cb2800978 100644
--- a/client/internal/auth/sessionwatch/watcher_test.go
+++ b/client/internal/auth/sessionwatch/watcher_test.go
@@ -527,3 +527,201 @@ func TestDismissBeforeUpdateIsNoop(t *testing.T) {
 	}
 	t.Fatalf("final-warning did not publish after no-op pre-Update Dismiss, events=%+v", r.snapshot())
 }
+
+func TestIsLate(t *testing.T) {
+	armedFor := time.Date(2026, 10, 1, 12, 0, 0, 0, time.UTC)
+	lead := 2 * time.Minute
+	tests := []struct {
+		name       string
+		now        time.Time
+		cutoffLead time.Duration
+		want       bool
+	}{
+		{"before cutoff", armedFor.Add(-3 * time.Minute), lead, false},
+		{"at cutoff", armedFor.Add(-lead), lead, true},
+		{"after cutoff", armedFor.Add(-time.Minute), lead, true},
+		{"zero lead before deadline", armedFor.Add(-time.Second), 0, false},
+		{"zero lead at deadline", armedFor, 0, true},
+		{"zero lead after deadline", armedFor.Add(time.Second), 0, true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := isLate(tt.now, armedFor, tt.cutoffLead); got != tt.want {
+				t.Fatalf("isLate(%s, %s, %s) = %v, want %v", tt.now, armedFor, tt.cutoffLead, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestIsLateIgnoresMonotonicReading(t *testing.T) {
+	now := time.Now()
+	wallOnly := now.Round(0)
+	if isLate(now, wallOnly.Add(time.Second), 0) {
+		t.Fatalf("now with monotonic reading must compare as wall clock before a later wall-only deadline")
+	}
+	if !isLate(now, wallOnly, 0) {
+		t.Fatalf("now with monotonic reading must compare as wall clock at an equal wall-only deadline")
+	}
+}
+
+func TestLateTimerFiring(t *testing.T) {
+	tests := []struct {
+		name       string
+		final      bool
+		beforeDl   time.Duration
+		wantWarns  int
+		wantFinals int
+	}{
+		{"warning on resume inside window", false, 3 * time.Minute, 1, 0},
+		{"warning promoted to final inside final window", false, time.Minute, 0, 1},
+		{"warning skipped past deadline", false, -time.Minute, 0, 0},
+		{"final on resume before deadline", true, time.Minute, 0, 1},
+		{"final skipped past deadline", true, -time.Minute, 0, 0},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := &fakeRecorder{}
+			w := New(r)
+			defer w.Close()
+
+			// The deadline is an hour out so the real timers never fire
+			// during the test; the late callback is invoked directly with an
+			// injected clock that simulates a resume near the deadline.
+			d := time.Now().Add(time.Hour).Round(0)
+			w.nowFn = func() time.Time { return d.Add(-tt.beforeDl) }
+			if err := w.Update(d); err != nil {
+				t.Fatalf("Update: %v", err)
+			}
+
+			if tt.final {
+				w.fireFinal(d)
+			} else {
+				w.fire(d)
+			}
+
+			events := r.snapshot()
+			if got := countWhere(events, event.isWarning); got != tt.wantWarns {
+				t.Fatalf("expected %d warning publishes, got %d: %+v", tt.wantWarns, got, events)
+			}
+			if got := countWhere(events, event.isFinalWarning); got != tt.wantFinals {
+				t.Fatalf("expected %d final-warning publishes, got %d: %+v", tt.wantFinals, got, events)
+			}
+		})
+	}
+}
+
+func TestPromotedFinalWarningIsNotRepeated(t *testing.T) {
+	r := &fakeRecorder{}
+	w := New(r)
+	defer w.Close()
+
+	d := time.Now().Add(time.Hour).Round(0)
+	now := d.Add(-time.Minute)
+	w.nowFn = func() time.Time { return now }
+	if err := w.Update(d); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+
+	w.fire(d)
+	// The final timer was suspended too, so it fires even later than the
+	// warning timer, here still just before the deadline.
+	now = d.Add(-30 * time.Second)
+	w.fireFinal(d)
+
+	events := r.snapshot()
+	if got := countWhere(events, event.isFinalWarning); got != 1 {
+		t.Fatalf("expected exactly 1 final-warning publish, got %d: %+v", got, events)
+	}
+	if got := countWhere(events, event.isWarning); got != 0 {
+		t.Fatalf("expected no regular warning publish, got %d: %+v", got, events)
+	}
+}
+
+func TestPromotionRespectsDismiss(t *testing.T) {
+	r := &fakeRecorder{}
+	w := New(r)
+	defer w.Close()
+
+	d := time.Now().Add(time.Hour).Round(0)
+	w.nowFn = func() time.Time { return d.Add(-time.Minute) }
+	if err := w.Update(d); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+
+	w.Dismiss()
+	w.fire(d)
+
+	events := r.snapshot()
+	if got := countWhere(events, func(e event) bool { return e.kind == publish }); got != 0 {
+		t.Fatalf("expected no publish after dismiss, got %d: %+v", got, events)
+	}
+}
+
+func TestPromotionSkippedWhenFinalAlreadyFired(t *testing.T) {
+	r := &fakeRecorder{}
+	w := New(r)
+	defer w.Close()
+
+	// Both timers fall in the past after a long suspend and are dispatched
+	// with a zero delay, so the final callback can run before the warning one.
+	d := time.Now().Add(time.Hour).Round(0)
+	w.nowFn = func() time.Time { return d.Add(-time.Minute) }
+	if err := w.Update(d); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+
+	w.fireFinal(d)
+	w.fire(d)
+
+	events := r.snapshot()
+	if got := countWhere(events, event.isFinalWarning); got != 1 {
+		t.Fatalf("expected exactly 1 final-warning publish, got %d: %+v", got, events)
+	}
+	if got := countWhere(events, event.isWarning); got != 0 {
+		t.Fatalf("expected no regular warning publish, got %d: %+v", got, events)
+	}
+}
+
+func TestDeadlineOnlyRecordsDeadlineWithoutWarnings(t *testing.T) {
+	r := &fakeRecorder{}
+	w := NewDeadlineOnly(r)
+	defer w.Close()
+
+	// With the default leads this deadline would otherwise fire both
+	// timers on the next tick.
+	d := time.Now().Add(50 * time.Millisecond).Round(0)
+	if err := w.Update(d); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+	if got := r.deadline(); !got.Equal(d) {
+		t.Fatalf("expected recorder deadline %v, got %v", d, got)
+	}
+
+	time.Sleep(100 * time.Millisecond)
+
+	events := r.snapshot()
+	if got := countWhere(events, func(e event) bool { return e.kind == publish }); got != 0 {
+		t.Fatalf("expected no publish in deadline-only mode, got %d: %+v", got, events)
+	}
+	if w.timer != nil || w.finalTimer != nil {
+		t.Fatal("expected no timers armed in deadline-only mode")
+	}
+}
+
+func TestDeadlineOnlyStillRejectsOutOfRangeDeadlines(t *testing.T) {
+	r := &fakeRecorder{}
+	w := NewDeadlineOnly(r)
+	defer w.Close()
+
+	if err := w.Update(time.Now().Add(time.Hour)); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+
+	err := w.Update(time.Now().Add(-maxPastHorizon - time.Hour))
+	if !errors.Is(err, ErrDeadlineInPast) {
+		t.Fatalf("expected ErrDeadlineInPast, got %v", err)
+	}
+	if got := r.deadline(); !got.IsZero() {
+		t.Fatalf("expected recorder cleared after rejection, got %v", got)
+	}
+}
diff --git a/client/internal/engine_sessionwatch.go b/client/internal/engine_sessionwatch.go
index a46d73f87..05b46a465 100644
--- a/client/internal/engine_sessionwatch.go
+++ b/client/internal/engine_sessionwatch.go
@@ -1,4 +1,4 @@
-//go:build !js
+//go:build !js && !android
 
 package internal
 
@@ -7,10 +7,12 @@ import (
 	"github.com/netbirdio/netbird/client/internal/peer"
 )
 
-// newSessionWatcher returns the real SSO session expiry watcher for every
-// non-wasm build. The js/wasm build gets a no-op stub from
-// engine_sessionwatch_js.go so the sessionwatch package (and its timer
-// machinery) never links into the wasm binary.
+// newSessionWatcher returns the real SSO session expiry watcher. The js/wasm
+// build gets a no-op stub from engine_sessionwatch_js.go so the sessionwatch
+// package (and its timer machinery) never links into the wasm binary; the
+// android build gets a deadline-only watcher from
+// engine_sessionwatch_android.go because the app schedules the warnings
+// itself.
 func newSessionWatcher(recorder *peer.Status) sessionDeadlineWatcher {
 	return sessionwatch.New(recorder)
 }
diff --git a/client/internal/engine_sessionwatch_android.go b/client/internal/engine_sessionwatch_android.go
new file mode 100644
index 000000000..8317f9165
--- /dev/null
+++ b/client/internal/engine_sessionwatch_android.go
@@ -0,0 +1,12 @@
+//go:build android
+
+package internal
+
+import (
+	"github.com/netbirdio/netbird/client/internal/auth/sessionwatch"
+	"github.com/netbirdio/netbird/client/internal/peer"
+)
+
+func newSessionWatcher(recorder *peer.Status) sessionDeadlineWatcher {
+	return sessionwatch.NewDeadlineOnly(recorder)
+}

From eb5a98c059891a2ba78284daf5446cc8c4bfa5fd Mon Sep 17 00:00:00 2001
From: Pascal Fischer <32096965+pascal-fischer@users.noreply.github.com>
Date: Mon, 5 Oct 2026 16:48:48 +0200
Subject: [PATCH 04/18] [management] add tenant delete endpoint to openapi
 (#8054)

---
 shared/management/http/api/openapi.yml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/shared/management/http/api/openapi.yml b/shared/management/http/api/openapi.yml
index 4b7077cac..90b87462f 100644
--- a/shared/management/http/api/openapi.yml
+++ b/shared/management/http/api/openapi.yml
@@ -10625,6 +10625,28 @@ paths:
           $ref: "#/components/responses/requires_authentication"
         "500":
           $ref: "#/components/responses/internal_error"
+    delete:
+      summary: Delete MSP tenant
+      tags:
+        - MSP
+      parameters:
+        - in: path
+          name: id
+          required: true
+          schema:
+            type: string
+          description: The unique identifier of a tenant account
+      responses:
+        "200":
+          description: Successfully deleted the tenant
+        "400":
+          $ref: "#/components/responses/bad_request"
+        "403":
+          $ref: "#/components/responses/requires_authentication"
+        "404":
+          description: The tenant was not found
+        "500":
+          $ref: "#/components/responses/internal_error"
   /api/integrations/msp/tenants/{id}/unlink:
     post:
       summary: Unlink a tenant

From d6340ba0de1d1448623fe906e985fdf2a5b53bdd Mon Sep 17 00:00:00 2001
From: Nicolas Frati <nicofrati@gmail.com>
Date: Tue, 6 Oct 2026 01:04:36 +0200
Subject: [PATCH 05/18] [self-hosted] Add a UBI image variant for the combined
 server (#7953)

* [self-hosted] Add a UBI image variant for the combined server

OpenShift and other Red Hat environments expect UBI-based images that run
as an arbitrary non-root UID. The proxy and rootless client already ship
-ubi variants; this adds the same for netbird-server, published as
<version>-ubi and ubi-latest for amd64 and arm64.

* [self-hosted] Check the license output path before creating temp files

The existing-output exit ran before the cleanup trap was registered, so it
left the two mktemp files behind.

* [self-hosted] Certify the netbird-server UBI image

Adds netbird-server to the Red Hat certification components. Its Partner
Connect component ID goes in the REDHAT_CERT_ID_NETBIRD_SERVER repository
variable.
---
 .github/workflows/redhat-certify.yml |  2 +
 .goreleaser.yaml                     | 35 ++++++++++++
 combined/Dockerfile.ubi              | 31 +++++++++++
 combined/collect-licenses.sh         | 81 ++++++++++++++++++++++++++++
 4 files changed, 149 insertions(+)
 create mode 100644 combined/Dockerfile.ubi
 create mode 100644 combined/collect-licenses.sh

diff --git a/.github/workflows/redhat-certify.yml b/.github/workflows/redhat-certify.yml
index e592dabc2..fa0a87c64 100644
--- a/.github/workflows/redhat-certify.yml
+++ b/.github/workflows/redhat-certify.yml
@@ -32,6 +32,7 @@ on:
           - all
           - client-rootless
           - reverse-proxy
+          - netbird-server
       version:
         description: "Released version, e.g. v0.80.0"
         type: string
@@ -66,6 +67,7 @@ jobs:
           components=(
             "client-rootless ghcr.io/netbirdio/netbird -rootless-ubi"
             "reverse-proxy ghcr.io/netbirdio/reverse-proxy -ubi"
+            "netbird-server ghcr.io/netbirdio/netbird-server -ubi"
           )
           matrix="[]"
           missing=()
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 275c1cd7b..ba9e56a50 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -511,6 +511,41 @@ dockers_v2:
        "org.opencontainers.image.revision": "{{.FullCommit}}"
        "org.opencontainers.image.source": "{{.GitURL}}"
        "maintainer": "dev@netbird.io"
+   - id: netbird-server-ubi
+     disable: "{{ .Env.SKIP_DOCKER_PUSH }}"
+     ids:
+       - netbird-server
+     images:
+       - netbirdio/netbird-server
+       - ghcr.io/netbirdio/netbird-server
+     tags:
+       - "{{ .Version }}-ubi"
+       - "{{ if eq .Env.SKIP_PUBLISH \"false\" }}ubi-latest{{ end }}"
+     dockerfile: combined/Dockerfile.ubi
+     platforms:
+       - linux/amd64
+       - linux/arm64
+     build_args:
+       VERSION: "{{ .Version }}"
+       RELEASE: "{{ .Timestamp }}"
+     hooks:
+       pre:
+         - cmd: 'sh combined/collect-licenses.sh "{{ .ContextDir }}/licenses" amd64 arm64'
+           env:
+             - GOOS=linux
+             - CGO_ENABLED=1
+     labels:
+       "org.opencontainers.image.created": "{{.Date}}"
+       "org.opencontainers.image.version": "{{.Version}}"
+       "org.opencontainers.image.revision": "{{.FullCommit}}"
+       "org.opencontainers.image.source": "{{.GitURL}}"
+     annotations:
+       "org.opencontainers.image.created": "{{.Date}}"
+       "org.opencontainers.image.title": "{{.ProjectName}}"
+       "org.opencontainers.image.version": "{{.Version}}"
+       "org.opencontainers.image.revision": "{{.FullCommit}}"
+       "org.opencontainers.image.source": "{{.GitURL}}"
+       "maintainer": "dev@netbird.io"
    - id: netbird-proxy
      disable: "{{ .Env.SKIP_DOCKER_PUSH }}"
      ids:
diff --git a/combined/Dockerfile.ubi b/combined/Dockerfile.ubi
new file mode 100644
index 000000000..66ef55a34
--- /dev/null
+++ b/combined/Dockerfile.ubi
@@ -0,0 +1,31 @@
+FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93
+
+ARG TARGETPLATFORM
+ARG VERSION=dev
+ARG RELEASE=1
+
+LABEL name="netbird-server" \
+      maintainer="NetBird <dev@netbird.io>" \
+      vendor="NetBird GmbH" \
+      version="${VERSION}" \
+      release="${RELEASE}" \
+      summary="NetBird Server" \
+      description="NetBird Server runs the Management, Signal, Relay and STUN services of a self-hosted NetBird deployment in a single process."
+
+COPY --chmod=0555 ${TARGETPLATFORM}/netbird-server /go/bin/netbird-server
+COPY licenses/ /licenses/
+# Only the data directory shares the root group for arbitrary non-root UIDs.
+# Runtime-created keys and databases retain the application's restrictive modes.
+RUN mkdir -p /var/lib/netbird /etc/netbird && \
+    chown 1000:0 /var/lib/netbird && \
+    chmod 0770 /var/lib/netbird && \
+    chmod -R a+rX /licenses
+
+USER 1000:0
+ENV HOME=/var/lib/netbird
+# Runtimes such as OpenShift and Podman reserve ports below 1024 for root, so
+# the mounted config must set server.listenAddress to an unprivileged port.
+EXPOSE 8443 3478/udp
+STOPSIGNAL SIGTERM
+ENTRYPOINT ["/go/bin/netbird-server"]
+CMD ["--config", "/etc/netbird/config.yaml"]
diff --git a/combined/collect-licenses.sh b/combined/collect-licenses.sh
new file mode 100644
index 000000000..ae618e46b
--- /dev/null
+++ b/combined/collect-licenses.sh
@@ -0,0 +1,81 @@
+#!/bin/sh
+set -eu
+
+if [ "$#" -lt 2 ]; then
+	printf '%s\n' "usage: $0 OUTPUT_DIRECTORY GOARCH..." >&2
+	exit 2
+fi
+
+repo_root=$(CDPATH='' cd -- "$(dirname "$0")/.." && pwd)
+output_name=$(basename "$1")
+if [ -z "$output_name" ] || [ "$output_name" = . ] || [ "$output_name" = .. ] || [ "$output_name" = / ]; then
+	printf '%s\n' "OUTPUT_DIRECTORY must name a directory" >&2
+	exit 2
+fi
+output_parent=$(CDPATH='' cd -- "$(dirname "$1")" && pwd)
+output="$output_parent/$output_name"
+shift
+
+if [ -e "$output" ] || [ -L "$output" ]; then
+	printf 'output directory already exists: %s\n' "$output" >&2
+	exit 1
+fi
+modules=$(mktemp "${TMPDIR:-/tmp}/netbird-server-licenses.modules.XXXXXX")
+sorted_modules=$(mktemp "${TMPDIR:-/tmp}/netbird-server-licenses.sorted.XXXXXX")
+# Assemble beside the target and rename on success, so a failed run leaves
+# nothing behind that would block the next attempt.
+staging=$(mktemp -d "$output_parent/.$output_name.XXXXXX")
+trap 'rm -f "$modules" "$sorted_modules"; rm -rf "$staging"' EXIT HUP INT TERM
+mkdir "$staging/third_party"
+
+cp "$repo_root/combined/LICENSE" "$staging/AGPL-3.0.txt"
+cp "$repo_root/LICENSE" "$staging/BSD-3-Clause.txt"
+
+cd "$repo_root"
+for arch in "$@"; do
+	GOOS=${GOOS:-linux} GOARCH="$arch" CGO_ENABLED=${CGO_ENABLED:-1} \
+		go list -deps -f '{{with .Module}}{{if .Replace}}{{.Replace.Path}}{{"\t"}}{{.Replace.Version}}{{"\t"}}{{.Replace.Dir}}{{else}}{{.Path}}{{"\t"}}{{.Version}}{{"\t"}}{{.Dir}}{{end}}{{end}}' ./combined >>"$modules"
+done
+LC_ALL=C sort -u "$modules" >"$sorted_modules"
+
+goroot=$(go env GOROOT)
+for term in LICENSE PATENTS; do
+	if [ ! -f "$goroot/$term" ]; then
+		printf 'missing Go standard-library term: %s\n' "$goroot/$term" >&2
+		exit 1
+	fi
+	cp "$goroot/$term" "$staging/Go-$term"
+done
+
+while IFS='	' read -r module version module_dir; do
+	[ -n "$module" ] || continue
+	[ "$module" = "github.com/netbirdio/netbird" ] && continue
+
+	if [ -z "$version" ] || [ ! -d "$module_dir" ]; then
+		printf 'cannot collect terms for module %s at version %s\n' "$module" "$version" >&2
+		exit 1
+	fi
+
+	destination="$staging/third_party/$module/$version"
+	mkdir -p "$destination"
+	printf 'module: %s\nversion: %s\n' "$module" "$version" >"$destination/MODULE"
+
+	found=false
+	for term in \
+		"$module_dir"/LICENSE* "$module_dir"/License* "$module_dir"/license* \
+		"$module_dir"/LICENCE* "$module_dir"/Licence* "$module_dir"/licence* \
+		"$module_dir"/COPYING* "$module_dir"/Copying* "$module_dir"/copying* \
+		"$module_dir"/NOTICE* "$module_dir"/Notice* "$module_dir"/notice* \
+		"$module_dir"/PATENTS* "$module_dir"/Patents* "$module_dir"/patents*; do
+		[ -f "$term" ] || continue
+		cp "$term" "$destination/"
+		found=true
+	done
+
+	if [ "$found" = false ]; then
+		printf 'no root license terms found for module %s at %s\n' "$module" "$module_dir" >&2
+		exit 1
+	fi
+done <"$sorted_modules"
+
+mv "$staging" "$output"

From ab79aebd88a359da506b4443203b15808b1e6ccb Mon Sep 17 00:00:00 2001
From: Nicolas Frati <nicofrati@gmail.com>
Date: Tue, 6 Oct 2026 10:25:57 +0200
Subject: [PATCH 06/18] [misc] Share one license collection script across the
 UBI images (#8055)

* [self-hosted] Add a UBI image variant for the combined server

OpenShift and other Red Hat environments expect UBI-based images that run
as an arbitrary non-root UID. The proxy and rootless client already ship
-ubi variants; this adds the same for netbird-server, published as
<version>-ubi and ubi-latest for amd64 and arm64.

* [self-hosted] Check the license output path before creating temp files

The existing-output exit ran before the cleanup trap was registered, so it
left the two mktemp files behind.

* [self-hosted] Certify the netbird-server UBI image

Adds netbird-server to the Red Hat certification components. Its Partner
Connect component ID goes in the REDHAT_CERT_ID_NETBIRD_SERVER repository
variable.

* [misc] Share one license collection script across the UBI images

The client, proxy and combined images each carried a near-identical copy of
collect-licenses.sh, and the signal and relay variants would add two more.
The copies differed only in the Go package, build tags, component license
and the proxy's web licenses, which are now options of one script in
release_files/. The client gains the staged write the others already had.
---
 .github/workflows/release.yml                 |  2 +-
 .goreleaser.yaml                              |  6 +-
 client/collect-licenses.sh                    | 77 -----------------
 proxy/collect-licenses.sh                     | 82 -------------------
 .../collect-licenses.sh                       | 46 +++++++++--
 5 files changed, 41 insertions(+), 172 deletions(-)
 delete mode 100644 client/collect-licenses.sh
 delete mode 100644 proxy/collect-licenses.sh
 rename {combined => release_files}/collect-licenses.sh (61%)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index dee4d398d..a79357505 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -199,7 +199,7 @@ jobs:
         with:
           node-version: '22'
       - name: Install proxy web dependencies for license collection
-        # proxy/collect-licenses.sh reads the UI's license terms from node_modules.
+        # release_files/collect-licenses.sh -w reads the proxy UI's license terms from node_modules.
         working-directory: proxy/web
         run: npm ci --ignore-scripts
       - name: Set up QEMU
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index ba9e56a50..59d8274e9 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -385,7 +385,7 @@ dockers_v2:
        RELEASE: "{{ .Timestamp }}"
      hooks:
        pre:
-         - cmd: 'sh client/collect-licenses.sh "{{ .ContextDir }}/licenses" amd64 arm64'
+         - cmd: 'sh release_files/collect-licenses.sh -t load_wgnt_from_rsrc "{{ .ContextDir }}/licenses" ./client amd64 arm64'
            env:
              - GOOS=linux
              - CGO_ENABLED=0
@@ -530,7 +530,7 @@ dockers_v2:
        RELEASE: "{{ .Timestamp }}"
      hooks:
        pre:
-         - cmd: 'sh combined/collect-licenses.sh "{{ .ContextDir }}/licenses" amd64 arm64'
+         - cmd: 'sh release_files/collect-licenses.sh -l combined/LICENSE "{{ .ContextDir }}/licenses" ./combined amd64 arm64'
            env:
              - GOOS=linux
              - CGO_ENABLED=1
@@ -587,7 +587,7 @@ dockers_v2:
        RELEASE: "{{ .Timestamp }}"
      hooks:
        pre:
-         - cmd: 'sh proxy/collect-licenses.sh "{{ .ContextDir }}/licenses" amd64 arm64'
+         - cmd: 'sh release_files/collect-licenses.sh -l proxy/LICENSE -w "{{ .ContextDir }}/licenses" ./proxy/cmd/proxy amd64 arm64'
            env:
              - GOOS=linux
              - CGO_ENABLED=0
diff --git a/client/collect-licenses.sh b/client/collect-licenses.sh
deleted file mode 100644
index 7dfabada9..000000000
--- a/client/collect-licenses.sh
+++ /dev/null
@@ -1,77 +0,0 @@
-#!/bin/sh
-set -eu
-
-if [ "$#" -lt 2 ]; then
-	printf '%s\n' "usage: $0 OUTPUT_DIRECTORY GOARCH..." >&2
-	exit 2
-fi
-
-repo_root=$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)
-output_name=$(basename "$1")
-if [ -z "$output_name" ] || [ "$output_name" = "." ] ||
-	[ "$output_name" = ".." ] || [ "$output_name" = "/" ]; then
-	printf '%s\n' "OUTPUT_DIRECTORY must name a directory" >&2
-	exit 2
-fi
-output_parent=$(CDPATH= cd -- "$(dirname "$1")" && pwd)
-output="$output_parent/$output_name"
-shift
-modules=$(mktemp "${TMPDIR:-/tmp}/netbird-client-licenses.modules.XXXXXX")
-sorted_modules=$(mktemp "${TMPDIR:-/tmp}/netbird-client-licenses.sorted.XXXXXX")
-trap 'rm -f "$modules" "$sorted_modules"' EXIT HUP INT TERM
-
-if [ -e "$output" ] || [ -L "$output" ]; then
-	printf 'output directory already exists: %s\n' "$output" >&2
-	exit 1
-fi
-mkdir "$output"
-mkdir "$output/third_party"
-
-cp "$repo_root/LICENSE" "$output/BSD-3-Clause.txt"
-
-cd "$repo_root"
-for arch in "$@"; do
-	GOOS=${GOOS:-linux} GOARCH="$arch" CGO_ENABLED=${CGO_ENABLED:-0} \
-		go list -deps -f '{{with .Module}}{{if .Replace}}{{.Replace.Path}}{{"\t"}}{{.Replace.Version}}{{"\t"}}{{.Replace.Dir}}{{else}}{{.Path}}{{"\t"}}{{.Version}}{{"\t"}}{{.Dir}}{{end}}{{end}}' -tags load_wgnt_from_rsrc ./client >>"$modules"
-done
-LC_ALL=C sort -u "$modules" >"$sorted_modules"
-
-goroot=$(go env GOROOT)
-for term in LICENSE PATENTS; do
-	if [ ! -f "$goroot/$term" ]; then
-		printf 'missing Go standard-library term: %s\n' "$goroot/$term" >&2
-		exit 1
-	fi
-	cp "$goroot/$term" "$output/Go-$term"
-done
-
-while IFS='	' read -r module version module_dir; do
-	[ -n "$module" ] || continue
-	[ "$module" = "github.com/netbirdio/netbird" ] && continue
-
-	if [ -z "$version" ] || [ ! -d "$module_dir" ]; then
-		printf 'cannot collect terms for module %s at version %s\n' "$module" "$version" >&2
-		exit 1
-	fi
-
-	destination="$output/third_party/$module/$version"
-	mkdir -p "$destination"
-	printf 'module: %s\nversion: %s\n' "$module" "$version" >"$destination/MODULE"
-
-	found=false
-	for term in \
-		"$module_dir"/LICENSE* "$module_dir"/License* "$module_dir"/license* \
-		"$module_dir"/LICENCE* "$module_dir"/Licence* "$module_dir"/licence* \
-		"$module_dir"/COPYING* "$module_dir"/Copying* "$module_dir"/copying* \
-		"$module_dir"/NOTICE* "$module_dir"/Notice* "$module_dir"/notice* \
-		"$module_dir"/PATENTS* "$module_dir"/Patents* "$module_dir"/patents*; do
-		[ -f "$term" ] || continue
-		cp "$term" "$destination/"
-		found=true
-	done
-
-	if [ "$found" = false ]; then
-		printf 'no root license terms found for module %s at %s\n' "$module" "$module_dir" >&2
-		exit 1
-	fi
-done <"$sorted_modules"
diff --git a/proxy/collect-licenses.sh b/proxy/collect-licenses.sh
deleted file mode 100644
index ccf5f4dd6..000000000
--- a/proxy/collect-licenses.sh
+++ /dev/null
@@ -1,82 +0,0 @@
-#!/bin/sh
-set -eu
-
-if [ "$#" -lt 2 ]; then
-	printf '%s\n' "usage: $0 OUTPUT_DIRECTORY GOARCH..." >&2
-	exit 2
-fi
-
-repo_root=$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)
-output_name=$(basename "$1")
-if [ -z "$output_name" ] || [ "$output_name" = . ] || [ "$output_name" = .. ] || [ "$output_name" = / ]; then
-	printf '%s\n' "OUTPUT_DIRECTORY must name a directory" >&2
-	exit 2
-fi
-output_parent=$(CDPATH= cd -- "$(dirname "$1")" && pwd)
-output="$output_parent/$output_name"
-shift
-modules=$(mktemp "${TMPDIR:-/tmp}/netbird-proxy-licenses.modules.XXXXXX")
-sorted_modules=$(mktemp "${TMPDIR:-/tmp}/netbird-proxy-licenses.sorted.XXXXXX")
-
-if [ -e "$output" ] || [ -L "$output" ]; then
-	printf 'output directory already exists: %s\n' "$output" >&2
-	exit 1
-fi
-# Assemble beside the target and rename on success, so a failed run leaves
-# nothing behind that would block the next attempt.
-staging=$(mktemp -d "$output_parent/.$output_name.XXXXXX")
-trap 'rm -f "$modules" "$sorted_modules"; rm -rf "$staging"' EXIT HUP INT TERM
-mkdir "$staging/third_party"
-
-cp "$repo_root/proxy/LICENSE" "$staging/AGPL-3.0.txt"
-cp "$repo_root/LICENSE" "$staging/BSD-3-Clause.txt"
-node "$repo_root/proxy/web/scripts/third-party-licenses.mjs" >"$staging/Web-THIRD-PARTY-LICENSES"
-
-cd "$repo_root"
-for arch in "$@"; do
-	GOOS=${GOOS:-linux} GOARCH="$arch" CGO_ENABLED=${CGO_ENABLED:-0} \
-		go list -deps -f '{{with .Module}}{{if .Replace}}{{.Replace.Path}}{{"\t"}}{{.Replace.Version}}{{"\t"}}{{.Replace.Dir}}{{else}}{{.Path}}{{"\t"}}{{.Version}}{{"\t"}}{{.Dir}}{{end}}{{end}}' ./proxy/cmd/proxy >>"$modules"
-done
-LC_ALL=C sort -u "$modules" >"$sorted_modules"
-
-goroot=$(go env GOROOT)
-for term in LICENSE PATENTS; do
-	if [ ! -f "$goroot/$term" ]; then
-		printf 'missing Go standard-library term: %s\n' "$goroot/$term" >&2
-		exit 1
-	fi
-	cp "$goroot/$term" "$staging/Go-$term"
-done
-
-while IFS='	' read -r module version module_dir; do
-	[ -n "$module" ] || continue
-	[ "$module" = "github.com/netbirdio/netbird" ] && continue
-
-	if [ -z "$version" ] || [ ! -d "$module_dir" ]; then
-		printf 'cannot collect terms for module %s at version %s\n' "$module" "$version" >&2
-		exit 1
-	fi
-
-	destination="$staging/third_party/$module/$version"
-	mkdir -p "$destination"
-	printf 'module: %s\nversion: %s\n' "$module" "$version" >"$destination/MODULE"
-
-	found=false
-	for term in \
-		"$module_dir"/LICENSE* "$module_dir"/License* "$module_dir"/license* \
-		"$module_dir"/LICENCE* "$module_dir"/Licence* "$module_dir"/licence* \
-		"$module_dir"/COPYING* "$module_dir"/Copying* "$module_dir"/copying* \
-		"$module_dir"/NOTICE* "$module_dir"/Notice* "$module_dir"/notice* \
-		"$module_dir"/PATENTS* "$module_dir"/Patents* "$module_dir"/patents*; do
-		[ -f "$term" ] || continue
-		cp "$term" "$destination/"
-		found=true
-	done
-
-	if [ "$found" = false ]; then
-		printf 'no root license terms found for module %s at %s\n' "$module" "$module_dir" >&2
-		exit 1
-	fi
-done <"$sorted_modules"
-
-mv "$staging" "$output"
diff --git a/combined/collect-licenses.sh b/release_files/collect-licenses.sh
similarity index 61%
rename from combined/collect-licenses.sh
rename to release_files/collect-licenses.sh
index ae618e46b..8481c9c3e 100644
--- a/combined/collect-licenses.sh
+++ b/release_files/collect-licenses.sh
@@ -1,10 +1,32 @@
 #!/bin/sh
+#
+# Collect the license terms shipped in /licenses of the UBI images: NetBird's
+# own licenses, the Go standard library terms, and the root license files of
+# every module the Go package links on the given architectures.
+#
+#   -l FILE   component license, copied as AGPL-3.0.txt (path from repo root)
+#   -t TAGS   build tags used for the dependency walk
+#   -w        add the proxy web UI's third-party licenses (needs proxy/web/node_modules)
 set -eu
 
-if [ "$#" -lt 2 ]; then
-	printf '%s\n' "usage: $0 OUTPUT_DIRECTORY GOARCH..." >&2
+usage() {
+	printf '%s\n' "usage: $0 [-l LICENSE_FILE] [-t TAGS] [-w] OUTPUT_DIRECTORY PACKAGE GOARCH..." >&2
 	exit 2
-fi
+}
+
+component_license=""
+tags=""
+web=false
+while getopts l:t:w opt; do
+	case "$opt" in
+	l) component_license=$OPTARG ;;
+	t) tags=$OPTARG ;;
+	w) web=true ;;
+	*) usage ;;
+	esac
+done
+shift $((OPTIND - 1))
+[ "$#" -ge 3 ] || usage
 
 repo_root=$(CDPATH='' cd -- "$(dirname "$0")/.." && pwd)
 output_name=$(basename "$1")
@@ -14,27 +36,33 @@ if [ -z "$output_name" ] || [ "$output_name" = . ] || [ "$output_name" = .. ] ||
 fi
 output_parent=$(CDPATH='' cd -- "$(dirname "$1")" && pwd)
 output="$output_parent/$output_name"
-shift
+package=$2
+shift 2
 
 if [ -e "$output" ] || [ -L "$output" ]; then
 	printf 'output directory already exists: %s\n' "$output" >&2
 	exit 1
 fi
-modules=$(mktemp "${TMPDIR:-/tmp}/netbird-server-licenses.modules.XXXXXX")
-sorted_modules=$(mktemp "${TMPDIR:-/tmp}/netbird-server-licenses.sorted.XXXXXX")
+modules=$(mktemp "${TMPDIR:-/tmp}/netbird-licenses.modules.XXXXXX")
+sorted_modules=$(mktemp "${TMPDIR:-/tmp}/netbird-licenses.sorted.XXXXXX")
 # Assemble beside the target and rename on success, so a failed run leaves
 # nothing behind that would block the next attempt.
 staging=$(mktemp -d "$output_parent/.$output_name.XXXXXX")
 trap 'rm -f "$modules" "$sorted_modules"; rm -rf "$staging"' EXIT HUP INT TERM
 mkdir "$staging/third_party"
 
-cp "$repo_root/combined/LICENSE" "$staging/AGPL-3.0.txt"
+if [ -n "$component_license" ]; then
+	cp "$repo_root/$component_license" "$staging/AGPL-3.0.txt"
+fi
 cp "$repo_root/LICENSE" "$staging/BSD-3-Clause.txt"
+if [ "$web" = true ]; then
+	node "$repo_root/proxy/web/scripts/third-party-licenses.mjs" >"$staging/Web-THIRD-PARTY-LICENSES"
+fi
 
 cd "$repo_root"
 for arch in "$@"; do
-	GOOS=${GOOS:-linux} GOARCH="$arch" CGO_ENABLED=${CGO_ENABLED:-1} \
-		go list -deps -f '{{with .Module}}{{if .Replace}}{{.Replace.Path}}{{"\t"}}{{.Replace.Version}}{{"\t"}}{{.Replace.Dir}}{{else}}{{.Path}}{{"\t"}}{{.Version}}{{"\t"}}{{.Dir}}{{end}}{{end}}' ./combined >>"$modules"
+	GOOS=${GOOS:-linux} GOARCH="$arch" CGO_ENABLED=${CGO_ENABLED:-0} \
+		go list -deps -tags "$tags" -f '{{with .Module}}{{if .Replace}}{{.Replace.Path}}{{"\t"}}{{.Replace.Version}}{{"\t"}}{{.Replace.Dir}}{{else}}{{.Path}}{{"\t"}}{{.Version}}{{"\t"}}{{.Dir}}{{end}}{{end}}' "$package" >>"$modules"
 done
 LC_ALL=C sort -u "$modules" >"$sorted_modules"
 

From d622e03d4019e5ca5324530f6e150417de810c32 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Janek=20H=C3=A4rtter?=
 <108095150+janekhaertter@users.noreply.github.com>
Date: Tue, 6 Oct 2026 10:32:23 +0200
Subject: [PATCH 07/18] [misc] Use ASCII hyphens in the LICENSE header (#8065)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The first line of LICENSE spelled BSD-3-Clause with non-breaking
hyphens (U+2011). The Windows NSIS installer shows LICENSE on its
license page and reads it in the system ANSI code page, so the UTF-8
bytes rendered as "BSD‑3‑Clause". Plain hyphens also match the
SPDX identifier and keep the file ASCII-only.
---
 LICENSE | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/LICENSE b/LICENSE
index d922f155a..cea6f8f0b 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1,4 +1,4 @@
-This BSD‑3‑Clause license applies to all parts of the repository except for the directories management/, signal/, relay/ and combined/.
+This BSD-3-Clause license applies to all parts of the repository except for the directories management/, signal/, relay/ and combined/.
 Those directories are licensed under the GNU Affero General Public License version 3.0 (AGPLv3). See the respective LICENSE files inside each directory.
 
 BSD 3-Clause License

From a8dff998ef3cb38f435c1e4c9648dcd129ce48c1 Mon Sep 17 00:00:00 2001
From: Riccardo Manfrin <3090891+riccardomanfrin@users.noreply.github.com>
Date: Tue, 6 Oct 2026 11:39:22 +0200
Subject: [PATCH 08/18] [client] Gate settings updates on value, not on field
 presence (#7398)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* [client] Gate settings updates on value, not on field presence

The update-settings kill switch (--disable-update-settings /
NB_DISABLE_UPDATE_SETTINGS / the MDM DisableUpdateSettings key) forbids
changing settings, but it decided what a "change" was by looking at
whether a field was present in the request. The CLI fills the whole
config surface of SetConfigRequest and LoginRequest from its flags and
environment on every `netbird up` (setupSetConfigReq in cmd/up.go), so a
client configured by environment restates its own configuration on every
start and tripped the gate every time.

SetConfig only warned about that, but Login carries the same fields and
was gated the same way, and Login runs inside the CLI's backoff loop: the
daemon answered every attempt with codes.Unavailable, `netbird up` never
completed, and a container with NB_DISABLE_UPDATE_SETTINGS plus any
config env var (NB_MANAGEMENT_URL, for one) could not come up at all.

Both gates now compare values. Config.WouldChange is the dry-run half of
UpdateConfig: it runs the very same diff logic (Config.apply) against a
copy of the stored config, so the gate cannot drift from what an actual
update would do, nor go stale when a field is added. A request that
restates what the profile already holds changes nothing and is allowed; a
request that diverges is refused exactly as before, and a dry run that
cannot be evaluated fails closed. A profile with no config on disk yet is
judged against the config the daemon would create for it.

For Login, the compared input comes from loginOverridesInput, which
persistLoginOverrides also uses to perform the write, so the gate judges
precisely the two fields a login can persist (management URL, pre-shared
key) and no field it ignores.

Two adjacent defects surfaced while making the comparison exact:

- Config.apply compared URLs as raw strings, so the same endpoint spelled
  without its default port ("https://api.netbird.io" vs
  "https://api.netbird.io:443") counted as a new value and rewrote the
  config. It now compares the parsed forms.
- UpdateConfig did not collapse the redacted pre-shared key, unlike
  UpdateOrCreateConfig and DirectUpdateConfig, so a UI round-trip of the
  mask replaced the stored key with asterisks.

The CLI warning for a refused SetConfig said the method was not available
in the daemon, which sent people looking for a version mismatch that was
not there; it now reports the refusal.

* [client] Do not write the profile config while only reading it to decide

The update-settings gate needs the stored config to decide whether a request
changes anything, so the previous commit moved that read ahead of the refusal.
The read is not side-effect free: profilemanager.GetConfig writes the config
back whenever apply() has to fill in a default the file was missing. A request
that the gate then refuses had therefore already rewritten the profile file.

PeekConfig is GetConfig without that write-back. The returned config is still
normalized in memory, which is what the decision needs; the file is left
exactly as it was found. Every caller of storedConfigAtPath feeds a gate that
can refuse, so they all peek.

Note for reviewers: the daemon still normalizes the file on startup and on
every real update, so nothing depends on a read performing that write.

* [client] Compare service URLs as endpoints, not as strings

Three places in one request path each had their own notion of "same
management URL": the config layer compared the parsed URLs as strings, the
privileged-change gate compared scheme + host + effective port, and the MDM
conflict check compared strings after filling in the default port. Only the
middle one was right.

A string comparison answers the wrong question. "https://api.netbird.io",
"https://api.netbird.io/" and "https://API.netbird.io:443" are one endpoint
written three ways, so a client restating its own management URL with a
trailing slash — a normal way to write it — was still read as a client asking
to be repointed, and the update-settings gate refused it. The MDM check had
the same flaw against the enforced value.

profilemanager.SameServiceURL is now the single comparison: same scheme, same
host case-insensitively as DNS names are, same effective port. The config
layer, the privileged-change gate and the MDM conflict check all defer to it,
so there is one answer to "did this URL change?" instead of three.

* [client] Stop the config dry run from generating throwaway keys

The dry run's baseline for a profile with no config file yet went through
createNewConfig, and apply() generates a WireGuard and an SSH key whenever it
finds those fields empty. The baseline is compared against and discarded, so
every evaluation minted a keypair it threw away — and logged "generated new
Wireguard key". The CLI retries Login in a backoff loop, so a first `netbird up`
on a fresh profile filled the daemon log with what reads like peer-key rotation.

The baseline now starts from the shared skeleton with placeholder keys, so
apply() has nothing to generate. No ConfigInput field maps to either key, so
the comparison is unaffected.

* [client] Cover the login the update-settings gate used to refuse

The gate's decision procedure was tested directly, but no test drove the Login
RPC that the refusal actually broke: the CLI retries Login in a backoff loop,
so a refused no-op login is what kept a client configured by environment from
ever coming up. The handler-level coverage stopped at the refusal case, which
passes on the pre-fix code too.

This test fails on the pre-fix daemon with "update settings are disabled" and
passes now. Past the gate the handler does real work the test does not stand
up, so it asserts only that the refusal did not happen.

* [client] Re-take the update-settings decision under the config lock

Login checks twice on purpose: the first check refuses the ordinary case
early, and authorizeAndPrepareLogin re-takes the authoritative one under
guardedConfigMu because the first is unsynchronized against a concurrent
privileged request. The update-settings decision is now equally
value-dependent — it compares the request against the stored config — but it
was taken only in the first, unlocked check.

So a login that was a no-op when it was checked could be written after a
concurrent writer had repointed the profile, which is exactly the window the
lock exists to close. The decision is now re-taken alongside the privilege one,
which also makes it the last read before persistLoginOverrides writes.

The test drives that interleaving through the existing afterLoginPreCheck seam
and fails without the re-check.

* [client] Drop an unreachable guard and fix two stale comments

- loginOverridesInput's nil-message guard cannot be reached: Login
  dereferences the message well before it, in storedLoginConfig.
- The docstring above afterLoginPreCheck described persistLoginOverrides,
  which lives further down the file and now carries its own.
- UpdateConfig's comment named DirectUpdateConfig; the function is
  DirectUpdateOrCreateConfig.

* [client] Make config reads pure and provision the identity explicitly

Reading a config wrote it back. profilemanager.readConfig persisted whatever
apply() had filled in, and ReadConfig created and wrote the file outright when
it was absent, so every reader was quietly a writer: a gate deciding whether to
refuse a request, a UI listing profiles, a mobile getter reading one preference.
The previous commit worked around that with a PeekConfig variant, which left
two read functions with opposite side effects and the antipattern still there
for everyone else.

Only one thing in a read genuinely had to be persisted: apply() generated the
WireGuard and SSH keys when it found them empty, and a generated key cannot be
recomputed — losing it means the peer comes back with a different identity and
registers again. Everything else apply() fills in is a deterministic default
that the next read recomputes anyway.

So identity provisioning is now its own step, Config.EnsureIdentity, and the
callers that provision write the result out themselves, in the open:

- Server.getConfig, the daemon's provisioning point;
- the CLI's foreground login, which is about to dial management;
- update() / directUpdate(), the config write paths — a stored profile can
  legitimately carry no identity, since a mobile logout clears the keys in
  place, and the next write is what has to mint a new one.

ReadConfig and GetConfig no longer write anything, PeekConfig is gone, and the
dry-run baseline no longer needs placeholder keys to keep apply() from minting
real ones.

One deliberate leftover: readConfig still calls util.EnforcePermission, which
chmods a config file whose permissions are too broad. It changes no content and
is idempotent, and dropping it would leave a legacy file world-readable until
its first write.

* [client] Name the two config readers for what they do

ReadConfig and GetConfig differed in one thing — what happens when the file is
absent — and neither name said which was which:

- ReadConfig      -> ReadOrGenerateConfig  (reads it, or generates one in memory)
- GetConfig       -> GetExistingConfig     (reads it, or fails)

Three comments went with them:

- GetConfig's said "return with Config and if it was created. Errors out if it
  does not exist", which described a bool it does not return and a creation it
  never performs.
- ReadConfig's explained that it does not write, which is what a reader is
  supposed to do anyway.
- Server.getConfig's said it "errors out if it does not exist", which it does
  not — it resolves a default config, and now provisions the identity too.

* [client] Do not panic on a config with no sync message version

apply() wrote the incoming sync message version through the stored pointer,
without checking it was there: a config that carries no version yet made it
dereference nil. Reachable from the update-settings dry run, which runs inside
a request handler — where failing closed is the worst acceptable outcome, and a
panic is not one.

The field is now reassigned like every other optional one, which also means
apply() no longer mutates anything the caller still holds through a pointer, so
the dry run's copy has one less field to detach.

Reported by cubic-dev-ai on PR #7398.

* [client] Compare the client certificate paths before reporting a change

apply() assigned the incoming mTLS certificate and key paths and set updated
unconditionally, without comparing them to what the config already held. It is
the same presence-instead-of-value mistake this branch set out to fix, one
layer down: a caller restating its own certificate paths was reported as
changing them, which trips the value-aware update-settings gate.

Reported by cubic-dev-ai on PR #7398.

* [client] Address the remaining bot findings on PR #7398

- Login logged the active-profile-state error and returned the same cause; the
  repo's guidelines call for one or the other, and the wrapped error is the one
  that carries context. (CodeRabbit)
- `netbird up` reported a codes.Unavailable SetConfig failure as "the daemon
  refused the settings update", but that code also covers a daemon that became
  unreachable. It now reports what the daemon said without asserting why.
  (cubic-dev-ai)
- TestLogin_ChangingTheManagementURLIsRefused asserted the error and nothing
  else, while "refused before it can touch daemon state" is the contract. It now
  checks the stored management URL, the in-progress login and the active profile,
  matching its SetConfig counterpart. (cubic-dev-ai)

* [client] Keep the peer identity out of a read that finds no file

ReadOrGenerateConfig resolves a default config when the profile has no file
yet, and createNewConfig was minting the WireGuard and SSH keys while doing so.
That defeated the provisioning pair it was meant to serve: the CLI's foreground
login calls EnsureIdentity to find out whether it has to persist the keys, got
generated == false because the read had already generated them, and so never
wrote them out. The login then dialed management with an identity that only
existed in memory, and the next login registered a second peer.

createNewConfig no longer provisions. createProvisionedConfig is the variant
that does, and the callers whose contract is "usable as it comes back" use it:
CreateInMemoryConfig, whose callers connect with the result, and the two
create-and-write branches. A read gets a config with no identity, so the
caller's own EnsureIdentity reports the work and triggers the write.

Reported by CodeRabbit and cubic-dev-ai on PR #7398, both on the same defect.

* [client] Stop the gate test from dialing the real management server

TestLogin_RestatingTheStoredConfigPassesTheGate asserts that the gate lets a
no-op login through, and the handler then went on to do the login for real:
isLoginRequired builds an auth client when isLoginRequiredFn is unset, so the
test dialed the profile's management URL — api.netbird.io:443. It took 1.05s
locally and would hang on a runner with no egress, for a fact about the gate
that needs no network at all.

Stubbed like the login_outcome tests do. The test now runs in 0.00s.

Reported by cubic-dev-ai on PR #7398.

* [client] Keep the admin panel path part of its identity

The endpoint comparison introduced for the management URL was applied to the
admin URL too, and that one is opened in a browser rather than dialed over
gRPC: a panel served under /netbird is not the panel served at the root. So a
config whose admin URL differed only by path reported no change, and the new
path was never persisted — a custom panel URL could not be updated at all.

SameServiceURLIncludingPath adds what a URL carries past its endpoint (path,
query, fragment, userinfo) while still treating equivalent spellings as equal:
a missing path and "/" are the same root, and so is a trailing slash. The
management URL keeps the endpoint-only comparison, since only the endpoint is
ever dialed.

Ports are also normalized numerically now, so ":0443" and ":443" are one port.

Reported by cubic-dev-ai on PR #7398 (two findings).

* [client] Treat a profile with no identity as already deregistered

Two findings on the same consequence of pure reads: a profile can legitimately
carry no keys, because logging out clears them in place.

- sendLogoutRequestWithConfig went straight to wgtypes.ParseKey and failed with
  "incorrect key size: 0" on the second logout of the same profile. There is
  nothing to deregister for a peer that was never registered, so it returns
  cleanly. Before pure reads this case was hidden: the read minted a key and
  the daemon dialed management with one it had never seen.
- The mobile logout read the config with the generating reader right after
  checking the file exists. The two are not atomic, so a profile removed in
  between was resolved from the defaults and recreated by the write that
  follows. It uses the existing-file reader now.

Reported by cubic-dev-ai and CodeRabbit on PR #7398.

* [client] Fail `netbird up` when the daemon refuses the settings update

With the update-settings kill switch on, `netbird up --enable-rosenpass`
connected and said almost nothing: SetConfig refused the change, the CLI
downgraded that to a warning, and Login carries no rosenpass field to apply, so
the flag was silently dropped. The setting stayed disabled, which is the point
of the switch, but the caller was never told their request had been ignored.

The refusal now travels as codes.FailedPrecondition instead of
codes.Unavailable, and the CLI fails on it. Unavailable means "the daemon
cannot serve this call", which is why the CLI downgraded it and why
client/ui/services reads it as an unreachable daemon — both wrong for a daemon
that answered and refused. FailedPrecondition also matches what the MDM gate
already returns for a managed field, so both refusals are now one class of
error, and it is added to the login backoff's early-exit codes so a refused
login stops instead of retrying for 30s.

This does not put the container back in the deadlock: with the value-aware
gate, a client restating its own configuration is not refused at all, so
nothing reaches this path unless a real change was asked for.

* [client] Name the reader storedConfigAtPath actually calls

The purity note still said profilemanager.GetConfig, which the rename two
commits later turned into GetExistingConfig.

Reported by cubic-dev-ai on PR #7398.

* [client] Restore the gofmt alignment of the error constants

The comment added above errUpdateSettingsDisabled in the previous commit split
the const block's alignment group, so gofmt wants the two constants above it
re-aligned. CI runs gofmt, so this would have failed the lint job.

* [client] Let an unprivileged caller log out a profile with no identity

The empty-key check sat behind requirePrivilegeForDeregistration, so an
unprivileged logout of an identity-less profile was refused with
PermissionDenied instead of completing as the no-op it is. And it was refused
for most profiles, not a corner case: the gate arms whenever the SSH server is
enabled, and sshServerEnabled reads an absent ServerSSHAllowed as enabled, so
every legacy profile qualifies.

The check now runs first. What the gate protects against is handing this
machine's registered key to another management server; with no key there is
nothing to hand over and nothing to protect.

Reported by CodeRabbit and cubic-dev-ai on PR #7398, both on the same defect.

* [client] Stop `netbird login` from retrying a refusal for 30 seconds

`netbird up` and `netbird login` both run Login through the backoff cycle, and
each carried its own copy of the list of codes that end it. Only up.go learned
about codes.FailedPrecondition, so a refused `netbird login` kept retrying and
then reported "login backoff cycle failed" instead of what the daemon said.

terminalLoginError is now that list, once, next to WithBackOff — the duplicated
copies are what let the two commands disagree in the first place.

Reported by cubic-dev-ai on PR #7398.

* [client] Answer terminalLoginError's nil case on its own terms

A successful Login reaches terminalLoginError with a nil error, and nothing
covered that. It happens to work on grpc v1.80.0 — gstatus.FromError(nil)
answers (nil, true), and Status.Code tolerates a nil receiver by returning
codes.OK, which is not in the terminal set — but that is a chain of internal
details to be relying on for the common path, and none of it was asserted.

Now the nil error is handled where it is obvious, and the table covers it.

Reported by CodeRabbit on PR #7398, which called it a panic; measured on
v1.80.0 it is not one. The gap was the untested reliance, not a crash.

* [client] Treat an unset optional field as its default when diffing a config

Seven Config fields mean "the effective default" when they hold no value:
the five SSH toggles, the SSH JWT cache TTL, and the network monitor. Every
consumer already reads a nil as that default, but apply() diffed them by
presence — `config.X == nil || *input.X != *config.X` — so an input restating
the default counted as a change.

That made the update-settings gate refuse `netbird up` outright. The CLI
sends every flag whose value came from an environment variable
(SetFlagsFromEnvVars goes through pflag's FlagSet.Set, which marks the flag
Changed), and the config a plain login writes leaves all seven unset, so a
container configured with, say, NB_ENABLE_SSH_ROOT=false restated a default
the file held as null on every start and was answered with
FailedPrecondition.

apply() now resolves the seven up front, the way it already did for
ServerSSHAllowed and RemoteJobsAllowed, which also repairs such a profile on
its next write. With the values named, the comparisons below diff values
instead of presence, so their nil branches are gone.

The network monitor keeps its platform default — on for windows and darwin —
and naming it as false elsewhere is what createEngineConfig already read a
nil to be. getJWTCacheTTL reaches the same 0 through its own default, and
Android's GetEnableSSH* getters already answered nil with false.

* [client] Normalize the config before diffing it in WouldChange

apply() reports two different things through one bool: an input that changed
a value, and a field it had to fill in because the config carried none. The
update-settings gate reads that bool as "the caller asked for a change", so
any config still missing a default answered a request that asks for nothing
with a refusal.

Readers already hand out normalized configs — readConfig applies an empty
input for exactly this reason — which is why the gate got away with it. But a
handler that refuses a request must not depend on where its caller obtained
the config, and it must not start reading "this profile predates a field" as
"the caller asked for a change" the day someone adds one with a default.

WouldChange now runs the filling-in as a pass of its own and discards its
verdict, so the pass that answers the caller measures only what the input
did.

* [client] Stop the last config write that skipped normalization

Every path that creates or updates a profile config goes through apply(),
which resolves an optional field to its default — except RenameProfile,
which read the file with a bare json.Unmarshal, set the name, and wrote it
straight back. That copied whatever the file held, so a config written by a
client that stored these fields as null kept them null. It could not
introduce a null, only carry one forward, but renaming a profile is a poor
place to leave a half-resolved config behind. It now reads through
GetExistingConfig, which normalizes what it hands out.

The tests state the invariant the fix completes, over the *bool fields of
Config listed by reflection so a field added later is covered without
touching them: none may come out of apply() unset, and no write may store
one as null. An optional bool that can be nil, true or false forces every
reader to invent the meaning of nil, and makes a diff of the config compare
presence rather than value — which is exactly what refused `netbird up` for
a client restating its own defaults.

SyncMessageVersion stays a genuine three-state field and is not covered: it
is an *int whose absence means the client pins no version, and it travels to
management that way.

* [client] Refuse a serialized config that carries no peer identity

ConfigFromJSON still promised a "fully initialized" config after this PR
moved key generation out of apply() into EnsureIdentity, but identity stopped
being one of the defaults it applies. Its two callers both connect with what
they get back: the iOS SDK's Client.SetConfigFromJSON keeps it as the
preloaded config Run() uses on tvOS, and Auth.SetConfigFromJSON as the config
it authenticates with.

No caller feeds it a document without keys today — every stored document
comes from Auth.GetConfigJSON, whose config is provisioned by
DirectUpdateOrCreateConfig or CreateInMemoryConfig, and the tvOS app only
ever edits fields of a document it already has. This is a safety net for the
next caller, not a live bug.

Provisioning the identity here would be the wrong net. Neither caller can
hand a generated key back to the store the document came from — Client
exports no config at all — so the peer would connect under an identity
nothing persists and register anew on every launch, which is the failure the
EnsureIdentity split exists to prevent. A document with no identity means
nobody has logged in yet, and saying so is the only useful answer.

Both keys are required because both are dead ends when missing: an empty
WireGuard key fails the management login on its size, and an empty SSH key
fails ssh.GeneratePublicKey in ConnectClient before the engine starts.

* [client] Say that the null-on-disk fixture is synthesized, not written

The test comment described the null state in the present tense — "the config
a plain login writes leaves every one of them unset" — which was true before
this branch and is not any more: apply() now resolves those fields, so a
login writes them set. unsetOnDisk puts the null state back deliberately, to
stand in for a profile an older client wrote. Comments only.

* [client] Gather the optional-field defaults into one function

Resolving an unset optional field was spread over five places: the two
values newConfigSkeleton pre-sets, the block this branch added for the SSH
toggles, the network monitor's own if, the `else if` tails of
ServerSSHAllowed and RemoteJobsAllowed, and a trailing if for
DisableNotifications several hundred lines further down. Reading apply() left
no single answer to "what does this field default to, and who decides".

They now live in Config.resolveUnsetDefaults, which apply() calls before it
compares anything — the ordering being the point, since it is what lets
every comparison below diff values instead of presence. The comparisons for
ServerSSHAllowed, RemoteJobsAllowed and DisableNotifications lose their
`config.X == nil ||` clauses accordingly, as the other six already had.

newConfigSkeleton keeps its two, and that is the one asymmetry worth naming:
ServerSSHAllowed defaults to false for a new profile and to true for a
legacy one, and it only works because the skeleton runs first. The doc
comment says so, where before it was implied by the order of two distant
blocks.

Pure refactor. Verified as one: for the four fields whose branches moved,
plus two that did not and the JWT TTL, all 63 combinations of stored value
(nil/false/true) against input value (absent/false/true) produce byte-
identical resolved values and `updated` verdicts before and after.

* [client] Resolve the merge conflicts left in the tree

262ce8c3b landed with the conflict markers still in it, so client/server and
the iOS SDK did not compile. Four regions, resolved as follows.

client/server/mdm.go — main moved the MDM conflict-check machinery into the
mdm package (mdm.ResolveConflicts, mdm.ConflictBool, mdm.ConflictURL, ...).
This branch had edited the local copies, which are now dead: dropped, along
with the profilemanager import that only the local conflictURL needed.

client/server/server.go, Login gate — this branch's value-aware gate stays
(the point of the PR: refuse a real divergence, let a restatement through),
so main's presence-based `loginRequestHasConfigOverrides` block goes; that
helper no longer exists here anyway. Main's other change in the same lines
is real and kept: the MDM policy now comes from the daemon-owned
s.mdmLoader.Load() instead of the package-level loadMDMPolicy, which main
removed. The stale call right below the conflict was the reason the file
would not have compiled even with the markers gone.

client/server/server.go, getConfig — both sides add something and both are
needed. The identity is provisioned and persisted first, then the MDM
overlay is applied, so what reaches disk stays the profile's own config: the
overlay is runtime-only and re-derived on every load.

client/ios/NetBirdSDK/client.go — main reworked SetConfigFromJSON to store
the JSON and re-parse it on each load, which is the shape kept; the parse is
now only a validity check, and this branch's reason for it (a document with
no peer identity is refused, not just an unparseable one) moves into that
comment.

client/server/update_settings_gate_test.go — follows the sentinel constant
to its new home, mdm.PreSharedKeyRedactedSentinel.

* [client] Reuse util's service-URL comparison instead of a second copy

The endpoint-comparison rules this branch introduced now live in util (PR
#7472 moved them there so the MDM conflict check could stop comparing URLs
as strings). Keeping a copy here is what produced that bug in the first
place: two implementations of "is this the same endpoint?" drift, and the
one that drifts starts refusing a URL that addresses the very server it
already points at.

So SameServiceURL delegates the port normalization to util.ServiceURLPort
and drops the local one, and SameServiceURLIncludingPath — endpoint plus
path, for the admin panel URL, which is opened rather than dialed — is
util.SameServiceURL plus the query, fragment and userinfo it adds on top,
so the local path normalization goes too.

What stays here is the distinction util does not make: SameServiceURL is
endpoint-only, because a management URL is dialed and only its host and port
are, while util.SameServiceURL includes the path.

Pure refactor. Verified as one: all 198 pairs of a 14-spelling matrix
(default and zero-padded ports, host case, trailing slash, path, query,
fragment, userinfo, both schemes, nil operands) answer identically for both
functions before and after.

* [client] Give a newly added profile its identity (review item 1)

AddProfile writes the config it builds straight to disk, but built it with
createNewConfig, which stopped generating the peer's keys when identity
generation moved out of apply() into EnsureIdentity. The profile file landed
with an empty PrivateKey and SSHKey.

Nothing lost the keys permanently — the daemon's own getConfig provisions and
persists them on first use — but every reader that does not write got a
config that cannot connect in the meantime, which is exactly the set this
branch grew: the update-settings gate deciding whether to refuse a request,
and the mobile SDKs loading a stored profile.

createProvisionedConfig exists for callers that persist or connect, and this
is one; before the split, createNewConfig produced the keys here too.

* [client] Let a logged-out profile deserialize again (review item 2)

ConfigFromJSON refused a document with no WireGuard or SSH key. A config
legitimately has none between a logout and the next login: mobile
LogoutProfile clears both in place and writes the profile back, so the peer
re-registers on the next login instead of returning as itself.

So the refusal broke the mobile flows it was meant to protect. On iOS and
tvOS the stored JSON of a logged-out profile stopped loading through
Client.SetConfigFromJSON and Auth.SetConfigFromJSON, and copyConfig — which
round-trips a Config through JSON to take an in-memory copy before applying
the MDM overlay — failed on the same document. Where the old code silently
minted a key, this returned an error, which is worse for logout and profile
switching alike: neither is asking to connect.

The deserializer now stays out of the identity question in both directions:
it does not generate one (a read cannot hand back keys nothing will write
down) and does not refuse one that is absent. Whoever goes on to connect is
where an absent identity has to be answered — and it already is, by the
login path that provisions and persists.

ErrConfigWithoutIdentity goes with it; nothing else used it.

* [client] Fold the scheme case here too, like util does (review item 6)

profilemanager.SameServiceURL compared the scheme with ==, util.SameServiceURL
with EqualFold. No observable difference — net/url lowercases the scheme when
it parses, and both functions take parsed URLs — but two functions of the same
name with two different rules is a trap for whoever reads one and assumes the
other.

* [client] Classify the daemon's refusals in the GUI (review item 3)

FailedPrecondition reached the classifier unmatched, so a refusal showed as
"Operation failed". It is the code both of the daemon's deliberate refusals
carry: the update-settings kill switch, and a field an MDM policy manages.

Both are now named — settings_locked and settings_managed_by_mdm, matched on
the message the daemon composes — and FailedPrecondition itself falls back to
change_refused, so a refusal the daemon grows later still reads as a refusal
rather than a failure.

Only the English strings are added. Bundle.Translate falls back to the
default language for a missing key, so other locales show English until the
usual translation pass, rather than the bare "error.<code>" the classifier
would otherwise surface.

Note: the package needs GTK4/WebKit to build, which this machine has not, so
the test is type-checked (go vet, GOOS=windows) but was not executed locally;
CI's Linux job runs it.

* [client] Cover the mobile profile round trip: create, logout, reload

Both mobile regressions this branch's review turned up lived on the same
path, and neither was visible from the desktop client: a profile created
without an identity, and a logged-out profile that would no longer
deserialize. The desktop never meets the second one — it is mobile logout
that clears the peer's keys in place, so the next login registers a new peer
instead of bringing the old one back.

The test walks a profile through the round its user puts it through —
created, logged out, loaded again, switched away from and back — and loads it
at each step the way the SDKs do: read the stored config, serialize it, load
it back. That is Client.SetConfigFromJSON storing the document for tvOS,
Auth.SetConfigFromJSON authenticating with it, and copyConfig taking an
in-memory copy before the MDM overlay.

Verified to fail on each regression separately: restoring the bare
constructor in AddProfile fails it with "a new profile was written with no
identity", and restoring the identity check in ConfigFromJSON fails it at
"load the profile back".

client/mobile already had the coverage for the first one in
TestLogoutProfile_DisableProfiles — which arrived from main with the MDM
work, and which I had not been running.

* [client] Name only the refusals, not every FailedPrecondition

The classifier gained a blanket FailedPrecondition -> change_refused fallback
so a refusal would stop reading as "Operation failed". It reaches too far:
the daemon returns that code for two dozen states that are not settings
refusals — "not logged in", "client is not running", "another capture is
already running", "session can no longer be extended, log in again to
reconnect" — and errorClassifier is shared with the session and connection
services, not just the settings save.

So the user was told the service had refused their change while what they
actually had to do was log in again. The two refusals the daemon composes
stay named by their message; everything else goes back to the generic
message, which says nothing rather than something wrong.

Reported by cubic on the PR.

* [client] Say what each assertion was checking in the mobile test

AGENTS.md asks for a context message on comparison and boolean assertions,
and four of the ones added with this test had none, so a failure would have
read as a bare Empty/Equal with no hint of which step of the round trip broke.

Reported by cubic on the PR.

* [client] Translate the two new error strings into every locale

The GUI classifier gained error.settings_locked and
error.settings_managed_by_mdm, and only the English strings were added: the
bundle falls back to the default language for a missing key, so nothing would
have shown a bare "error.<code>" to a user.

CI disagrees, and it is right to: check-translations.mjs requires every
locale to carry the full English key set, so English-only fails the gate
rather than degrading quietly.

The ten locales now carry both strings. These are my translations, not a
localization pass — worth a second pass by whoever owns the language, in
particular for the phrasing of "an administrator has locked them".

The uk file also loses two lines of stray 8-space indentation, normalized by
rewriting the file; no key or value changed with it.

* [client] Persist the profile before overlaying MDM on it (review item)

`netbird login` read the config, applied the MDM policy on top, and only then
provisioned the identity and wrote the result out. On a profile with no
identity yet — a first login — that write persisted the enforced values into
the user's own config file: an MDM-managed management URL or pre-shared key
became indistinguishable from one the user set, and stayed behind once the
policy was withdrawn.

Provisioning and its write now come first, and the overlay is applied to the
in-memory config afterwards, where it belongs: it is re-derived on every load
and never meant to reach disk from here. Server.getConfig already orders the
two this way; the two paths now agree.

Reported by cubic on the PR.

* [client] Assert against the stored config, not a resolved default (review item)

The login-gate test read the profile back with ReadOrGenerateConfig, which
resolves a default config in memory when the file is missing — and that
default's management URL is the very value the assertion checks. An erased or
mislocated profile would have passed the test instead of failing it.

The file is written by the test itself, so GetExistingConfig is the right
reader: it errors when the file is gone.

Reported by cubic on the PR.

* [client] Keep the mTLS pair off the gate's dry run (review item)

WouldChange runs the real apply() against a throwaway copy, and apply() loads
the client mTLS certificate and key from disk whenever the config names them.
So every gated SetConfig and Login read the pair — twice per request, once for
the normalization pass and once for the verdict — including requests that were
about to be refused or that changed nothing, and logged an error per request
when the files were missing. The gate used to be presence-based and never
called apply(), so this was new work on a request path.

The loaded pair feeds the connection and never the comparison: nothing in
apply() reads it back, and it does not move the `updated` verdict. A config
built only to be compared against now says so, and apply() skips the load for
it.

Reported by cubic on the PR.

* Makes it explicit that RenameProfile does write on disk

* [client] Provision the peer identity under the config lock (review item)

Login took the authoritative update-settings and privilege decisions under
guardedConfigMu, then released it and called getConfig, which mints the peer's
identity and writes the config out. Between that read and that write, a
SetConfig holding the same lock could land a change and answer its caller —
and then be overwritten by the config the login had already read.

The window is narrow: getConfig only writes when the profile has no identity
or no file, so in practice a first login racing a settings change on the same
profile. It is also narrower than before this branch, where the write happened
inside the reader on every read that filled in a default.

Provisioning now runs where the decision it belongs to runs: at the end of
authorizeAndPrepareLogin, with the lock already held, next to
persistLoginOverrides, which writes there too. No lock is taken that was not
held before, so the documented guardedConfigMu-then-mutex order is untouched.

getConfig keeps its behaviour by calling the same extracted helper; on the
login path it now finds the identity already there and writes nothing. The
other callers are unchanged, and still provision outside any lock — a
concurrent SetConfig is not part of their flow.

Reported by cubic on the PR.

* [client] Declare the probe marker to the debug-bundle field check

TestAddConfig_AllFieldsCovered walks Config by reflection and fails until every
field is either rendered in the debug bundle or listed as excluded with a
reason. The probe marker added for the gate's dry run was neither, so the
client unit suite went red on every platform.

It is excluded: it marks a throwaway copy built to be compared against and
discarded, so it is never set on a config anyone runs with, and rendering it
would only ever print false.

* [client] Provision the peer identity on the iOS login path

Key generation used to happen inside apply(), so a config loaded from JSON with
no keys got them in memory on the way in, the login worked, and the app stored
the result. This branch moved generation into EnsureIdentity, and nothing in
the iOS SDK called it.

The consequence lands on the flow the mobile logout sets up: logout clears both
keys in place so the next login registers a new peer. The app then hands that
keyless JSON to Auth.SetConfigFromJSON, and the login calls auth.NewAuth with
an empty WireGuard key, which fails on key size before the SSO flow starts —
the user cannot sign back in.

Auth.setBaseConfig now provisions, which covers both entry points (NewAuth and
SetConfigFromJSON). It mints on the base config, the one GetConfigJSON returns
for the caller to persist, and writes it to disk itself when the profile has a
file — non-atomically, like NewAuth's own write, since the tvOS App Group
sandbox blocks temp-file-and-rename.

Not covered by a test: the package builds only under GOOS=ios, which the test
jobs do not run. Verified by building and vetting for GOOS=ios/arm64.

Reported by pappz in review.

* [client] Name the resolving reader for what it does, not what it makes

ReadOrGenerateConfig reads the profile config and falls back to the defaults in
memory when there is no file. "Generate" reads as "produces and stores", which
is the opposite of the property the rename it came from was meant to advertise:
the read is pure, writes nothing and mints no identity.

ReadConfigOrDefault says the same without the side effect, and pairs with
GetExistingConfig, which fails where this one falls back. Its doc comment now
states the absence of a write rather than only the fallback.

Pure rename; the two remaining mentions of the pre-branch name ReadConfig in
the tests go with it.

Reported by pappz in review.

* [client] Read an emptied NAT list as the absent one it matches

apply() compared NATExternalIPs with reflect.DeepEqual, which calls a nil
slice and an empty slice different. Both mean the same thing — no NAT
mappings — and the two meet on a perfectly ordinary start: a profile stores
the absent list as JSON null and reads it back nil, while `netbird up` sends
CleanNATExternalIPs, an empty list, whenever NB_EXTERNAL_IP_MAP is set to
nothing, which a deployment template does by default.

So the gate saw a change where nothing changed and refused the request with
FailedPrecondition. That is the same deadlock this branch exists to remove,
reached through another field: a container with the kill switch on could not
come up, and `netbird up` reported "the daemon refused the settings update".

The DNS label list next to it already used slices.Equal, which treats nil and
empty as the same list. The NAT list now does too, and the last use of
reflect in the package goes with it.

Reported by pappz in review.
---
 client/android/preferences.go                 |  34 +-
 client/cmd/login.go                           |  27 +-
 client/cmd/root.go                            |  39 ++
 client/cmd/up.go                              |  35 +-
 client/cmd/up_setconfig_refusal_test.go       |  85 +++
 client/internal/debug/debug_test.go           |   1 +
 client/internal/profilemanager/config.go      | 483 ++++++++++++----
 .../profilemanager/config_json_test.go        |  44 ++
 .../config_optional_fields_test.go            | 131 +++++
 .../profilemanager/config_probe_test.go       |  96 ++++
 client/internal/profilemanager/config_test.go |   2 +-
 .../config_would_change_test.go               | 529 ++++++++++++++++++
 client/internal/profilemanager/service.go     |  33 +-
 .../internal/profilemanager/service_test.go   |  24 +
 client/ios/NetBirdSDK/client.go               |   4 +
 client/ios/NetBirdSDK/login.go                |  29 +
 client/ios/NetBirdSDK/preferences.go          |  14 +-
 client/mobile/profile_lifecycle_test.go       |  97 ++++
 client/mobile/profile_manager.go              |   5 +-
 client/server/login_gate_test.go              |   2 +-
 client/server/login_overrides_test.go         |   8 +-
 client/server/logout_gate_test.go             |   2 +-
 client/server/mdm.go                          |  86 ---
 client/server/provision_identity_test.go      |  59 ++
 client/server/server.go                       | 204 ++++---
 client/server/setconfig_mdm_test.go           |   2 +-
 client/server/setconfig_test.go               |   2 +-
 client/server/ssh_gate.go                     |  18 +-
 client/server/update_settings_gate.go         |  55 ++
 client/server/update_settings_gate_test.go    | 390 +++++++++++++
 client/ui/i18n/locales/de/common.json         |   6 +
 client/ui/i18n/locales/en/common.json         |   8 +
 client/ui/i18n/locales/es/common.json         |   6 +
 client/ui/i18n/locales/fr/common.json         |   6 +
 client/ui/i18n/locales/hu/common.json         |   6 +
 client/ui/i18n/locales/it/common.json         |   6 +
 client/ui/i18n/locales/ja/common.json         |   6 +
 client/ui/i18n/locales/pt/common.json         |   6 +
 client/ui/i18n/locales/ru/common.json         |   6 +
 client/ui/i18n/locales/uk/common.json         |   6 +
 client/ui/i18n/locales/zh-CN/common.json      |   6 +
 client/ui/services/errors.go                  |  11 +
 client/ui/services/errors_test.go             |  23 +
 43 files changed, 2315 insertions(+), 327 deletions(-)
 create mode 100644 client/cmd/up_setconfig_refusal_test.go
 create mode 100644 client/internal/profilemanager/config_json_test.go
 create mode 100644 client/internal/profilemanager/config_optional_fields_test.go
 create mode 100644 client/internal/profilemanager/config_probe_test.go
 create mode 100644 client/internal/profilemanager/config_would_change_test.go
 create mode 100644 client/mobile/profile_lifecycle_test.go
 create mode 100644 client/server/provision_identity_test.go
 create mode 100644 client/server/update_settings_gate.go
 create mode 100644 client/server/update_settings_gate_test.go

diff --git a/client/android/preferences.go b/client/android/preferences.go
index 5ce31026c..3623de23f 100644
--- a/client/android/preferences.go
+++ b/client/android/preferences.go
@@ -46,7 +46,7 @@ func (p *Preferences) GetManagementURL() (string, error) {
 		return p.configInput.ManagementURL, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return "", err
 	}
@@ -64,7 +64,7 @@ func (p *Preferences) GetAdminURL() (string, error) {
 		return p.configInput.AdminURL, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return "", err
 	}
@@ -86,7 +86,7 @@ func (p *Preferences) HasPreSharedKey() (bool, error) {
 		return *p.configInput.PreSharedKey != "", nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -112,7 +112,7 @@ func (p *Preferences) GetRosenpassEnabled() (bool, error) {
 		return *p.configInput.RosenpassEnabled, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -133,7 +133,7 @@ func (p *Preferences) GetRosenpassPermissive() (bool, error) {
 		return *p.configInput.RosenpassPermissive, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -149,7 +149,7 @@ func (p *Preferences) GetDisableClientRoutes() (bool, error) {
 		return *p.configInput.DisableClientRoutes, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -170,7 +170,7 @@ func (p *Preferences) GetDisableServerRoutes() (bool, error) {
 		return *p.configInput.DisableServerRoutes, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -188,7 +188,7 @@ func (p *Preferences) GetDisableDNS() (bool, error) {
 		return *p.configInput.DisableDNS, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -206,7 +206,7 @@ func (p *Preferences) GetDisableFirewall() (bool, error) {
 		return *p.configInput.DisableFirewall, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -227,7 +227,7 @@ func (p *Preferences) GetServerSSHAllowed() (bool, error) {
 		return *p.configInput.ServerSSHAllowed, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -249,7 +249,7 @@ func (p *Preferences) GetEnableSSHRoot() (bool, error) {
 		return *p.configInput.EnableSSHRoot, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -271,7 +271,7 @@ func (p *Preferences) GetEnableSSHSFTP() (bool, error) {
 		return *p.configInput.EnableSSHSFTP, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -293,7 +293,7 @@ func (p *Preferences) GetEnableSSHLocalPortForwarding() (bool, error) {
 		return *p.configInput.EnableSSHLocalPortForwarding, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -315,7 +315,7 @@ func (p *Preferences) GetEnableSSHRemotePortForwarding() (bool, error) {
 		return *p.configInput.EnableSSHRemotePortForwarding, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -340,7 +340,7 @@ func (p *Preferences) GetBlockInbound() (bool, error) {
 		return *p.configInput.BlockInbound, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -358,7 +358,7 @@ func (p *Preferences) GetDisableIPv6() (bool, error) {
 		return *p.configInput.DisableIPv6, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -377,7 +377,7 @@ func (p *Preferences) GetRemoteJobsAllowed() (bool, error) {
 		return *p.configInput.RemoteJobsAllowed, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
diff --git a/client/cmd/login.go b/client/cmd/login.go
index 11867be09..1dc2d0d09 100644
--- a/client/cmd/login.go
+++ b/client/cmd/login.go
@@ -9,8 +9,6 @@ import (
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 	"golang.org/x/term"
-	"google.golang.org/grpc/codes"
-	gstatus "google.golang.org/grpc/status"
 
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/auth"
@@ -145,10 +143,7 @@ func doDaemonLogin(ctx context.Context, cmd *cobra.Command, providedSetupKey str
 	err = WithBackOff(func() error {
 		var backOffErr error
 		loginResp, backOffErr = client.Login(ctx, &loginRequest)
-		if s, ok := gstatus.FromError(backOffErr); ok && (s.Code() == codes.InvalidArgument ||
-			s.Code() == codes.PermissionDenied ||
-			s.Code() == codes.NotFound ||
-			s.Code() == codes.Unimplemented) {
+		if terminalLoginError(backOffErr) {
 			loginErr = backOffErr
 			return nil
 		}
@@ -327,10 +322,28 @@ func doForegroundLogin(ctx context.Context, cmd *cobra.Command, setupKey string,
 
 	}
 
-	config, err := profilemanager.ReadConfig(configFilePath)
+	config, err := profilemanager.ReadConfigOrDefault(configFilePath)
 	if err != nil {
 		return fmt.Errorf("read config file %s: %v", configFilePath, err)
 	}
+	// Reading a config does not provision one: this login is about to dial
+	// management with the profile's identity, so mint the keys if the profile
+	// has none yet and put them on disk — a key that stayed in memory would
+	// come back different on the next run and register a second peer.
+	//
+	// Before the MDM overlay below, on purpose: the file must keep the
+	// profile's own values. The overlay is runtime-only and re-derived on
+	// every load, so persisting it would turn an enforced management URL or
+	// pre-shared key into one the user appears to own once the policy is
+	// withdrawn.
+	if generated, err := config.EnsureIdentity(); err != nil {
+		return fmt.Errorf("ensure profile identity: %v", err)
+	} else if generated {
+		if err := profilemanager.WriteOutConfig(configFilePath, config); err != nil {
+			return fmt.Errorf("write out config file %s: %v", configFilePath, err)
+		}
+	}
+
 	// CLI standalone login: profilemanager no longer auto-applies MDM,
 	// so layer in the OS-native policy here. Desktop builds construct
 	// a Loader with no fetcher — the build-tagged loadPlatform reads
diff --git a/client/cmd/root.go b/client/cmd/root.go
index be6479440..2ca14c39c 100644
--- a/client/cmd/root.go
+++ b/client/cmd/root.go
@@ -20,6 +20,8 @@ import (
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
 
 	"github.com/netbirdio/netbird/client/anonymize"
 	daddr "github.com/netbirdio/netbird/client/internal/daemonaddr"
@@ -285,6 +287,43 @@ func DialClientGRPCServer(ctx context.Context, addr string) (*grpc.ClientConn, e
 	return grpc.DialContext(ctx, target, opts...)
 }
 
+// terminalLoginError reports whether a Login failure is final, so the backoff
+// cycle stops and the caller is told what the daemon said instead of "login
+// backoff cycle failed" thirty seconds later. Retrying cannot change any of
+// these answers: the request is malformed, the caller is not allowed, the
+// target does not exist, a precondition on the daemon refuses it (the
+// update-settings kill switch, an MDM-managed field), or the method is not
+// implemented.
+//
+// Both `netbird up` and `netbird login` run Login through the backoff, and
+// they each carried their own copy of this list — which is how one of them
+// ended up retrying a refusal the other treated as final.
+func terminalLoginError(err error) bool {
+	// A successful Login reaches here with a nil error, and that is not a
+	// terminal failure. Handled explicitly rather than left to
+	// gstatus.FromError, which answers (nil, true) for a nil error and leans on
+	// Status.Code tolerating a nil receiver to come back as codes.OK.
+	if err == nil {
+		return false
+	}
+
+	s, ok := gstatus.FromError(err)
+	if !ok {
+		return false
+	}
+
+	switch s.Code() {
+	case codes.InvalidArgument,
+		codes.PermissionDenied,
+		codes.NotFound,
+		codes.FailedPrecondition,
+		codes.Unimplemented:
+		return true
+	default:
+		return false
+	}
+}
+
 // WithBackOff execute function in backoff cycle.
 func WithBackOff(bf func() error) error {
 	return backoff.RetryNotify(bf, CLIBackOffSettings, func(err error, duration time.Duration) {
diff --git a/client/cmd/up.go b/client/cmd/up.go
index f5fac9749..120a25595 100644
--- a/client/cmd/up.go
+++ b/client/cmd/up.go
@@ -357,9 +357,17 @@ func runInDaemonMode(ctx context.Context, cmd *cobra.Command, pm *profilemanager
 	// set the new config
 	req := setupSetConfigReq(customDNSAddressConverted, cmd, activeProf.ID.String(), username.Username)
 	if _, err := client.SetConfig(ctx, req); err != nil {
-		if st, ok := gstatus.FromError(err); ok && st.Code() == codes.Unavailable {
-			log.Warnf("setConfig method is not available in the daemon: %s", st.Message())
-		} else {
+		switch reason, refused := refusedSettingsUpdate(err); {
+		case refused:
+			// Failing here is the point: carrying on would connect while
+			// silently dropping the settings the caller asked for, since
+			// nothing further down the line applies them.
+			return fmt.Errorf("the daemon refused the settings update: %s", reason)
+		case gstatus.Code(err) == codes.Unavailable:
+			// The daemon cannot serve the method at all, which is what this
+			// code means; an older daemon without it lands here.
+			log.Warnf("the daemon did not apply the settings update: %s", gstatus.Convert(err).Message())
+		default:
 			return daemonCallError("call service setConfig method", err)
 		}
 	}
@@ -400,10 +408,7 @@ func doDaemonUp(ctx context.Context, cmd *cobra.Command, client proto.DaemonServ
 	err = WithBackOff(func() error {
 		var backOffErr error
 		loginResp, backOffErr = client.Login(ctx, loginRequest)
-		if s, ok := gstatus.FromError(backOffErr); ok && (s.Code() == codes.InvalidArgument ||
-			s.Code() == codes.PermissionDenied ||
-			s.Code() == codes.NotFound ||
-			s.Code() == codes.Unimplemented) {
+		if terminalLoginError(backOffErr) {
 			loginErr = backOffErr
 			return nil
 		}
@@ -472,6 +477,22 @@ func setSSHSetConfigFields(req *proto.SetConfigRequest, cmd *cobra.Command) {
 	}
 }
 
+// refusedSettingsUpdate reports whether err is the daemon refusing the settings
+// a request carried — the update-settings kill switch, or a field an MDM policy
+// manages — and returns the reason it gave.
+//
+// The distinction that matters is against codes.Unavailable, which means the
+// daemon cannot serve the call: that one is worth a warning, because an older
+// daemon without the method lands there and the rest of `netbird up` still
+// works. A refusal is not, because the settings would be silently dropped.
+func refusedSettingsUpdate(err error) (string, bool) {
+	st, ok := gstatus.FromError(err)
+	if !ok || st.Code() != codes.FailedPrecondition {
+		return "", false
+	}
+	return st.Message(), true
+}
+
 func setupSetConfigReq(customDNSAddressConverted []byte, cmd *cobra.Command, profileName, username string) *proto.SetConfigRequest {
 	var req proto.SetConfigRequest
 	req.ProfileName = profileName
diff --git a/client/cmd/up_setconfig_refusal_test.go b/client/cmd/up_setconfig_refusal_test.go
new file mode 100644
index 000000000..fdf580102
--- /dev/null
+++ b/client/cmd/up_setconfig_refusal_test.go
@@ -0,0 +1,85 @@
+package cmd
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+)
+
+// A refused settings update has to fail `netbird up`, or a caller that asked
+// for a setting the daemon will not apply connects as if it had been applied.
+// The daemon being unable to serve the call is the case that stays a warning.
+func TestRefusedSettingsUpdate(t *testing.T) {
+	tests := []struct {
+		name        string
+		err         error
+		wantRefused bool
+	}{
+		{
+			name:        "the kill switch refused the change",
+			err:         gstatus.Errorf(codes.FailedPrecondition, "update settings are disabled, you cannot use this feature without update settings enabled"),
+			wantRefused: true,
+		},
+		{
+			name:        "an MDM policy manages the field",
+			err:         gstatus.Errorf(codes.FailedPrecondition, "fields managed by MDM policy: managementURL"),
+			wantRefused: true,
+		},
+		{
+			name:        "the daemon cannot serve the call",
+			err:         gstatus.Errorf(codes.Unavailable, "connection refused"),
+			wantRefused: false,
+		},
+		{
+			name:        "any other RPC failure",
+			err:         gstatus.Errorf(codes.Internal, "boom"),
+			wantRefused: false,
+		},
+		{
+			name:        "not a status error at all",
+			err:         errors.New("boom"),
+			wantRefused: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			reason, refused := refusedSettingsUpdate(tt.err)
+			require.Equal(t, tt.wantRefused, refused)
+			if tt.wantRefused {
+				require.Equal(t, gstatus.Convert(tt.err).Message(), reason, "the daemon's reason must reach the caller")
+			}
+		})
+	}
+}
+
+// Both `netbird up` and `netbird login` drive Login through the backoff cycle,
+// and a final answer has to stop it: retrying a refusal only replaces the
+// daemon's reason with "login backoff cycle failed" thirty seconds later.
+func TestTerminalLoginError(t *testing.T) {
+	tests := []struct {
+		name         string
+		err          error
+		wantTerminal bool
+	}{
+		{name: "settings refused by the kill switch", err: gstatus.Errorf(codes.FailedPrecondition, "update settings are disabled"), wantTerminal: true},
+		{name: "field managed by MDM", err: gstatus.Errorf(codes.FailedPrecondition, "fields managed by MDM policy: managementURL"), wantTerminal: true},
+		{name: "caller not allowed", err: gstatus.Errorf(codes.PermissionDenied, "nope"), wantTerminal: true},
+		{name: "malformed request", err: gstatus.Errorf(codes.InvalidArgument, "nope"), wantTerminal: true},
+		{name: "profile not found", err: gstatus.Errorf(codes.NotFound, "nope"), wantTerminal: true},
+		{name: "method missing on an older daemon", err: gstatus.Errorf(codes.Unimplemented, "nope"), wantTerminal: true},
+		{name: "daemon unreachable, worth retrying", err: gstatus.Errorf(codes.Unavailable, "connection refused"), wantTerminal: false},
+		{name: "transient internal failure", err: gstatus.Errorf(codes.Internal, "boom"), wantTerminal: false},
+		{name: "not a status error", err: errors.New("boom"), wantTerminal: false},
+		{name: "no error at all, the login succeeded", err: nil, wantTerminal: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			require.Equal(t, tt.wantTerminal, terminalLoginError(tt.err))
+		})
+	}
+}
diff --git a/client/internal/debug/debug_test.go b/client/internal/debug/debug_test.go
index 6a810bccc..0f74490f2 100644
--- a/client/internal/debug/debug_test.go
+++ b/client/internal/debug/debug_test.go
@@ -846,6 +846,7 @@ func TestAddConfig_AllFieldsCovered(t *testing.T) {
 		"ClientCertKeyPair":    "non-config: parsed cert pair, not serialized",
 		"Name":                 "non-config: profile name is not needed for debug purposes",
 		"policy":               "non-config: in-memory MDM policy snapshot, surfaced via Config.Policy() / GetConfigResponse.MDMManagedFields",
+		"probing":              "non-config: marks a throwaway copy built to be diffed against; never set on a config anyone runs with",
 		"DebugBundleUploadURL": "sensitive: MDM-provided upload URL may carry credentials or query tokens; kept out of the shared bundle",
 	}
 
diff --git a/client/internal/profilemanager/config.go b/client/internal/profilemanager/config.go
index 412f81b5c..ac1b90a62 100644
--- a/client/internal/profilemanager/config.go
+++ b/client/internal/profilemanager/config.go
@@ -10,7 +10,6 @@ import (
 	"os"
 	"os/user"
 	"path/filepath"
-	"reflect"
 	"runtime"
 	"slices"
 	"strings"
@@ -198,6 +197,11 @@ type Config struct {
 
 	MTU uint16
 
+	// probing marks a config that exists only to be compared against and then
+	// thrown away, so apply() can skip the work that feeds no verdict.
+	// Unexported, so it never reaches the JSON.
+	probing bool
+
 	// policy is the MDM policy that produced the currently-set values
 	// for any MDM-enforced fields. Set by ApplyMDMPolicy on every
 	// invocation. Never persisted to disk. Callers query enforcement
@@ -300,9 +304,11 @@ func fileExists(path string) (bool, error) {
 	return false, err
 }
 
-// createNewConfig creates a new config generating a new Wireguard key and saving to file
-func createNewConfig(input ConfigInput) (*Config, error) {
-	config := &Config{
+// newConfigSkeleton returns the field values a brand-new profile config starts
+// from, before apply() fills in the rest. Shared with the dry-run baseline so
+// the two cannot disagree about what "a new config" means.
+func newConfigSkeleton() *Config {
+	return &Config{
 		// defaults to false only for new (post 0.26) configurations
 		ServerSSHAllowed: util.False(),
 		// Remote jobs are an explicit opt-in and default off, including for
@@ -310,6 +316,91 @@ func createNewConfig(input ConfigInput) (*Config, error) {
 		RemoteJobsAllowed: util.False(),
 		WgPort:            iface.DefaultWgPort,
 	}
+}
+
+// resolveUnsetDefaults is the single place where an optional field that carries
+// no value gets one, and the only place that states what each of those defaults
+// is. apply() runs it before it compares anything, and that ordering is the
+// point: with the values named, every comparison below it diffs values instead
+// of presence.
+//
+// Presence-based comparison is what broke `netbird up` for a client configured
+// through the environment. These fields mean "the effective default" when they
+// hold nothing — every consumer already reads a nil as the value resolved here,
+// the SSH toggles in engine_ssh.go and the network monitor in
+// createEngineConfig — so naming them changes nothing about what runs. But
+// while they stayed nil, an input restating the default read as a change, and
+// since the CLI sends every flag whose value came from an environment variable
+// on each `netbird up`, a client with NB_ENABLE_SSH_ROOT=false restated it
+// every time and the update-settings gate refused it.
+//
+// Filling a field in is not a settings change, so a caller measuring change
+// must not read the returned bool as one: see WouldChange, which runs a pass
+// for this and discards its verdict.
+//
+// ServerSSHAllowed is the one field whose default depends on the config's age.
+// A brand-new profile gets false from newConfigSkeleton, which runs before
+// this, so what is resolved here is only the legacy case: a config written by a
+// version that had no such field keeps SSH on, for backwards compatibility.
+func (config *Config) resolveUnsetDefaults() (updated bool) {
+	// Fields that default to false on every platform.
+	for _, field := range []**bool{
+		&config.EnableSSHRoot,
+		&config.EnableSSHSFTP,
+		&config.EnableSSHLocalPortForwarding,
+		&config.EnableSSHRemotePortForwarding,
+		&config.DisableSSHAuth,
+		// Remote jobs are an explicit opt-in: unlike SSH, a pre-existing config
+		// with no value defaults to disabled rather than being turned on.
+		&config.RemoteJobsAllowed,
+	} {
+		if *field == nil {
+			*field = util.False()
+			updated = true
+		}
+	}
+
+	if config.DisableNotifications == nil {
+		log.Infof("setting notifications to disabled by default")
+		config.DisableNotifications = util.True()
+		updated = true
+	}
+
+	if config.SSHJWTCacheTTL == nil {
+		// A zero TTL disables the JWT cache, which is what no value meant.
+		config.SSHJWTCacheTTL = new(int)
+		updated = true
+	}
+
+	if config.NetworkMonitor == nil {
+		// network monitoring is on by default on windows and darwin clients
+		enabled := runtime.GOOS == "windows" || runtime.GOOS == "darwin"
+		config.NetworkMonitor = &enabled
+		updated = true
+	}
+
+	if config.ServerSSHAllowed == nil {
+		if runtime.GOOS == "android" {
+			// default to disabled SSH on Android for security
+			log.Infof("setting SSH server to false by default on Android")
+			config.ServerSSHAllowed = util.False()
+		} else {
+			// enables SSH for configs from old versions to preserve backwards compatibility
+			log.Infof("falling back to enabled SSH server for pre-existing configuration")
+			config.ServerSSHAllowed = util.True()
+		}
+		updated = true
+	}
+
+	return updated
+}
+
+// createNewConfig resolves a new config in memory, with no identity: whoever
+// needs the peer's keys calls EnsureIdentity and persists the result, so a read
+// that lands on a missing file cannot hand back a config carrying keys that
+// nothing will ever write down.
+func createNewConfig(input ConfigInput) (*Config, error) {
+	config := newConfigSkeleton()
 
 	if _, err := config.apply(input); err != nil {
 		return nil, err
@@ -318,6 +409,52 @@ func createNewConfig(input ConfigInput) (*Config, error) {
 	return config, nil
 }
 
+// createProvisionedConfig is createNewConfig plus the peer's identity, for the
+// callers that go on to persist the config or to connect with it.
+func createProvisionedConfig(input ConfigInput) (*Config, error) {
+	config, err := createNewConfig(input)
+	if err != nil {
+		return nil, err
+	}
+
+	if _, err := config.EnsureIdentity(); err != nil {
+		return nil, err
+	}
+
+	return config, nil
+}
+
+// EnsureIdentity generates the keys that identify this peer if the config does
+// not carry them yet, reporting whether it had to generate any.
+//
+// It is deliberately not part of apply(). Everything apply() fills in is a
+// default it can recompute on the next read, but a generated key is not: it
+// has to be persisted, or the peer comes back with a different WireGuard
+// identity and re-registers. Having apply() generate keys is what forced every
+// read of a config to write it back — so identity provisioning is its own step
+// now, and the callers that perform it write the result out explicitly.
+func (config *Config) EnsureIdentity() (bool, error) {
+	generated := false
+
+	if config.PrivateKey == "" {
+		log.Infof("generated new Wireguard key")
+		config.PrivateKey = generateKey()
+		generated = true
+	}
+
+	if config.SSHKey == "" {
+		log.Infof("generated new SSH key")
+		pem, err := ssh.GeneratePrivateKey(ssh.ED25519)
+		if err != nil {
+			return generated, err
+		}
+		config.SSHKey = string(pem)
+		generated = true
+	}
+
+	return generated, nil
+}
+
 func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 	if config.Name != "" {
 		sanitized, err := sanitizeDisplayName(config.Name)
@@ -329,6 +466,13 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 			updated = true
 		}
 	}
+
+	// Every optional field gets its value here, before anything below compares
+	// one. See resolveUnsetDefaults for why that ordering is the point.
+	if config.resolveUnsetDefaults() {
+		updated = true
+	}
+
 	if config.ManagementURL == nil {
 		log.Infof("using default Management URL %s", DefaultManagementURL)
 		config.ManagementURL, err = parseURL("Management URL", DefaultManagementURL)
@@ -336,20 +480,21 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 			return false, err
 		}
 	}
-	if input.ManagementURL != "" && input.ManagementURL != config.ManagementURL.String() {
-		log.Infof("new Management URL provided, updated to %#v (old value %#v)",
-			input.ManagementURL, config.ManagementURL.String())
+	// The comparison is on the endpoint the URL addresses, not on its
+	// spelling: the same endpoint can be written several ways (an implicit
+	// :443, a trailing slash, a different host case), and treating an
+	// equivalent URL as new would rewrite the config and report a settings
+	// change where the configuration does not actually change.
+	if input.ManagementURL != "" {
 		URL, err := parseURL("Management URL", input.ManagementURL)
 		if err != nil {
 			return false, err
 		}
-		config.ManagementURL = URL
-		updated = true
-	} else if config.ManagementURL == nil {
-		log.Infof("using default Management URL %s", DefaultManagementURL)
-		config.ManagementURL, err = parseURL("Management URL", DefaultManagementURL)
-		if err != nil {
-			return false, err
+		if !SameServiceURL(URL, config.ManagementURL) {
+			log.Infof("new Management URL provided, updated to %#v (old value %#v)",
+				URL.String(), config.ManagementURL.String())
+			config.ManagementURL = URL
+			updated = true
 		}
 	}
 
@@ -360,31 +505,20 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 			return false, err
 		}
 	}
-	if input.AdminURL != "" && input.AdminURL != config.AdminURL.String() {
-		log.Infof("new Admin Panel URL provided, updated to %#v (old value %#v)",
-			input.AdminURL, config.AdminURL.String())
+	// The admin panel is opened, not dialed, so unlike the Management URL its
+	// path is part of what identifies it: a panel served under /netbird is not
+	// the one served at the root.
+	if input.AdminURL != "" {
 		newURL, err := parseURL("Admin Panel URL", input.AdminURL)
 		if err != nil {
 			return updated, err
 		}
-		config.AdminURL = newURL
-		updated = true
-	}
-
-	if config.PrivateKey == "" {
-		log.Infof("generated new Wireguard key")
-		config.PrivateKey = generateKey()
-		updated = true
-	}
-
-	if config.SSHKey == "" {
-		log.Infof("generated new SSH key")
-		pem, err := ssh.GeneratePrivateKey(ssh.ED25519)
-		if err != nil {
-			return false, err
+		if !SameServiceURLIncludingPath(newURL, config.AdminURL) {
+			log.Infof("new Admin Panel URL provided, updated to %#v (old value %#v)",
+				newURL.String(), config.AdminURL.String())
+			config.AdminURL = newURL
+			updated = true
 		}
-		config.SSHKey = string(pem)
-		updated = true
 	}
 
 	if input.WireguardPort != nil && *input.WireguardPort != config.WgPort {
@@ -405,7 +539,14 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.NATExternalIPs != nil && !reflect.DeepEqual(config.NATExternalIPs, input.NATExternalIPs) {
+	// slices.Equal, not reflect.DeepEqual, and for the same reason the DNS
+	// labels below use it: DeepEqual calls a nil slice and an empty one
+	// different, while both mean "no NAT mappings". A profile stores the
+	// absent list as JSON null and reads it back nil, and `netbird up` sends
+	// CleanNATExternalIPs — an empty list — whenever NB_EXTERNAL_IP_MAP is set
+	// to nothing, so the two met on every start and the gate read a no-op as a
+	// settings change.
+	if input.NATExternalIPs != nil && !slices.Equal(config.NATExternalIPs, input.NATExternalIPs) {
 		log.Infof("updating NAT External IP [ %s ] (old value: [ %s ])",
 			strings.Join(input.NATExternalIPs, " "),
 			strings.Join(config.NATExternalIPs, " "))
@@ -443,21 +584,12 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.NetworkMonitor != nil && (config.NetworkMonitor == nil || *input.NetworkMonitor != *config.NetworkMonitor) {
+	if input.NetworkMonitor != nil && *input.NetworkMonitor != *config.NetworkMonitor {
 		log.Infof("switching Network Monitor to %t", *input.NetworkMonitor)
 		config.NetworkMonitor = input.NetworkMonitor
 		updated = true
 	}
 
-	if config.NetworkMonitor == nil {
-		// enable network monitoring by default on windows and darwin clients
-		if runtime.GOOS == "windows" || runtime.GOOS == "darwin" {
-			enabled := true
-			config.NetworkMonitor = &enabled
-			updated = true
-		}
-	}
-
 	if input.CustomDNSAddress != nil && string(input.CustomDNSAddress) != config.CustomDNSAddress {
 		log.Infof("updating custom DNS address %#v (old value %#v)",
 			string(input.CustomDNSAddress), config.CustomDNSAddress)
@@ -490,7 +622,7 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.ServerSSHAllowed != nil && (config.ServerSSHAllowed == nil || *input.ServerSSHAllowed != *config.ServerSSHAllowed) {
+	if input.ServerSSHAllowed != nil && *input.ServerSSHAllowed != *config.ServerSSHAllowed {
 		if *input.ServerSSHAllowed {
 			log.Infof("enabling SSH server")
 		} else {
@@ -498,20 +630,9 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		}
 		config.ServerSSHAllowed = input.ServerSSHAllowed
 		updated = true
-	} else if config.ServerSSHAllowed == nil {
-		if runtime.GOOS == "android" {
-			// default to disabled SSH on Android for security
-			log.Infof("setting SSH server to false by default on Android")
-			config.ServerSSHAllowed = util.False()
-		} else {
-			// enables SSH for configs from old versions to preserve backwards compatibility
-			log.Infof("falling back to enabled SSH server for pre-existing configuration")
-			config.ServerSSHAllowed = util.True()
-		}
-		updated = true
 	}
 
-	if input.RemoteJobsAllowed != nil && (config.RemoteJobsAllowed == nil || *input.RemoteJobsAllowed != *config.RemoteJobsAllowed) {
+	if input.RemoteJobsAllowed != nil && *input.RemoteJobsAllowed != *config.RemoteJobsAllowed {
 		if *input.RemoteJobsAllowed {
 			log.Infof("enabling remote jobs")
 		} else {
@@ -519,14 +640,9 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		}
 		config.RemoteJobsAllowed = input.RemoteJobsAllowed
 		updated = true
-	} else if config.RemoteJobsAllowed == nil {
-		// Remote jobs are an explicit opt-in: unlike SSH, a pre-existing config
-		// with no value defaults to disabled rather than being turned on.
-		config.RemoteJobsAllowed = util.False()
-		updated = true
 	}
 
-	if input.EnableSSHRoot != nil && (config.EnableSSHRoot == nil || *input.EnableSSHRoot != *config.EnableSSHRoot) {
+	if input.EnableSSHRoot != nil && *input.EnableSSHRoot != *config.EnableSSHRoot {
 		if *input.EnableSSHRoot {
 			log.Infof("enabling SSH root login")
 		} else {
@@ -536,7 +652,7 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.EnableSSHSFTP != nil && (config.EnableSSHSFTP == nil || *input.EnableSSHSFTP != *config.EnableSSHSFTP) {
+	if input.EnableSSHSFTP != nil && *input.EnableSSHSFTP != *config.EnableSSHSFTP {
 		if *input.EnableSSHSFTP {
 			log.Infof("enabling SSH SFTP subsystem")
 		} else {
@@ -546,7 +662,7 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.EnableSSHLocalPortForwarding != nil && (config.EnableSSHLocalPortForwarding == nil || *input.EnableSSHLocalPortForwarding != *config.EnableSSHLocalPortForwarding) {
+	if input.EnableSSHLocalPortForwarding != nil && *input.EnableSSHLocalPortForwarding != *config.EnableSSHLocalPortForwarding {
 		if *input.EnableSSHLocalPortForwarding {
 			log.Infof("enabling SSH local port forwarding")
 		} else {
@@ -556,7 +672,7 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.EnableSSHRemotePortForwarding != nil && (config.EnableSSHRemotePortForwarding == nil || *input.EnableSSHRemotePortForwarding != *config.EnableSSHRemotePortForwarding) {
+	if input.EnableSSHRemotePortForwarding != nil && *input.EnableSSHRemotePortForwarding != *config.EnableSSHRemotePortForwarding {
 		if *input.EnableSSHRemotePortForwarding {
 			log.Infof("enabling SSH remote port forwarding")
 		} else {
@@ -566,7 +682,7 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.DisableSSHAuth != nil && (config.DisableSSHAuth == nil || *input.DisableSSHAuth != *config.DisableSSHAuth) {
+	if input.DisableSSHAuth != nil && *input.DisableSSHAuth != *config.DisableSSHAuth {
 		if *input.DisableSSHAuth {
 			log.Infof("disabling SSH authentication")
 		} else {
@@ -576,7 +692,7 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.SSHJWTCacheTTL != nil && (config.SSHJWTCacheTTL == nil || *input.SSHJWTCacheTTL != *config.SSHJWTCacheTTL) {
+	if input.SSHJWTCacheTTL != nil && *input.SSHJWTCacheTTL != *config.SSHJWTCacheTTL {
 		log.Infof("updating SSH JWT cache TTL to %d seconds", *input.SSHJWTCacheTTL)
 		config.SSHJWTCacheTTL = input.SSHJWTCacheTTL
 		updated = true
@@ -659,13 +775,16 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.SyncMessageVersion != nil && *input.SyncMessageVersion != *config.SyncMessageVersion {
+	// Assigning the pointer, not writing through it: a config that carries no
+	// version yet would otherwise be a nil dereference, and a panic inside a
+	// request handler is not a way to fail.
+	if input.SyncMessageVersion != nil && (config.SyncMessageVersion == nil || *input.SyncMessageVersion != *config.SyncMessageVersion) {
 		log.Infof("setting SyncMessageVersion to %v", *input.SyncMessageVersion)
-		*config.SyncMessageVersion = *input.SyncMessageVersion
+		config.SyncMessageVersion = input.SyncMessageVersion
 		updated = true
 	}
 
-	if input.DisableNotifications != nil && (config.DisableNotifications == nil || *input.DisableNotifications != *config.DisableNotifications) {
+	if input.DisableNotifications != nil && *input.DisableNotifications != *config.DisableNotifications {
 		if *input.DisableNotifications {
 			log.Infof("disabling notifications")
 		} else {
@@ -675,24 +794,24 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if config.DisableNotifications == nil {
-		disabled := true
-		config.DisableNotifications = &disabled
-		log.Infof("setting notifications to disabled by default")
-		updated = true
-	}
-
-	if input.ClientCertKeyPath != "" {
+	// Compared, not just assigned: restating the path a config already holds
+	// changes nothing, and reporting it as an update makes a caller that
+	// re-sends its own configuration look like one asking to change it.
+	if input.ClientCertKeyPath != "" && input.ClientCertKeyPath != config.ClientCertKeyPath {
 		config.ClientCertKeyPath = input.ClientCertKeyPath
 		updated = true
 	}
 
-	if input.ClientCertPath != "" {
+	if input.ClientCertPath != "" && input.ClientCertPath != config.ClientCertPath {
 		config.ClientCertPath = input.ClientCertPath
 		updated = true
 	}
 
-	if config.ClientCertPath != "" && config.ClientCertKeyPath != "" {
+	// Not on a probe: the loaded pair feeds the connection, never the
+	// comparison, and this would otherwise run on every gated SetConfig and
+	// Login — twice per request — including those that are refused or change
+	// nothing, logging an error per request when the files are missing.
+	if !config.probing && config.ClientCertPath != "" && config.ClientCertKeyPath != "" {
 		cert, err := tls.LoadX509KeyPair(config.ClientCertPath, config.ClientCertKeyPath)
 		if err != nil {
 			log.Error("Failed to load mTLS cert/key pair: ", err)
@@ -886,6 +1005,49 @@ func ParseServiceURL(serviceName, serviceURL string) (*url.URL, error) {
 	return parseURL(serviceName, serviceURL)
 }
 
+// SameServiceURL reports whether two service URLs address the same endpoint:
+// same scheme, same host compared case-insensitively as DNS names are, and
+// same effective port, where an absent port means the scheme's default.
+//
+// This is the one comparison every caller deciding "did this URL change?" must
+// use. A string comparison answers a different question: "https://host",
+// "https://host/" and "https://HOST:443" are one endpoint written three ways,
+// and reading them as three values makes a client that restates its own
+// management URL look like a client asking to be repointed. A nil operand
+// matches only another nil one.
+//
+// The path plays no part: a management URL is dialed, and only its host and
+// port are. util.SameServiceURL is this comparison plus the path, which is
+// what SameServiceURLIncludingPath needs and delegates to.
+func SameServiceURL(a, b *url.URL) bool {
+	if a == nil || b == nil {
+		return a == b
+	}
+
+	return strings.EqualFold(a.Scheme, b.Scheme) &&
+		strings.EqualFold(a.Hostname(), b.Hostname()) &&
+		util.ServiceURLPort(a) == util.ServiceURLPort(b)
+}
+
+// SameServiceURLIncludingPath is SameServiceURL plus everything a URL carries
+// past its endpoint: path, query, fragment and userinfo.
+//
+// Use it for a URL that gets opened rather than dialed. The admin panel can
+// live under a path, so two URLs with the same endpoint and different paths are
+// two different panels — where for a URL the client dials over gRPC only the
+// endpoint is ever used. Equivalent spellings still compare equal: a missing
+// path and "/" are the same root, and so is a trailing slash on any path.
+func SameServiceURLIncludingPath(a, b *url.URL) bool {
+	if a == nil || b == nil {
+		return a == b
+	}
+
+	return util.SameServiceURL(a, b) &&
+		a.RawQuery == b.RawQuery &&
+		a.Fragment == b.Fragment &&
+		a.User.String() == b.User.String()
+}
+
 func parseURL(serviceName, serviceURL string) (*url.URL, error) {
 	parsedMgmtURL, err := url.ParseRequestURI(serviceURL)
 	if err != nil {
@@ -930,6 +1092,84 @@ func isPreSharedKeyHidden(preSharedKey *string) bool {
 	return false
 }
 
+// WouldChange reports whether applying input would modify any field the
+// config persists, leaving the receiver untouched. It is the dry-run half of
+// UpdateConfig and reuses the very same diff logic (Config.apply), so a
+// caller asking "is this a settings change?" cannot drift from what an
+// actual update would do, nor go stale when a new field is added.
+//
+// A redacted pre-shared key is collapsed to "unset" exactly as
+// UpdateOrCreateConfig does, so a UI that round-trips the mask is not read as
+// a request for a new key.
+//
+// A nil receiver means the profile holds no config yet, so the baseline is the
+// config the daemon would create for it: input values matching those defaults
+// change nothing, anything else does.
+func (config *Config) WouldChange(input ConfigInput) (bool, error) {
+	probe := config.clone()
+	if probe == nil {
+		baseline, err := newDryRunBaseline(input.ConfigPath)
+		if err != nil {
+			return true, fmt.Errorf("build default config baseline: %w", err)
+		}
+		probe = baseline
+	}
+	probe.probing = true
+
+	// Normalize before measuring. apply() reports two different things through
+	// one bool: an input that changed a value, and a field it had to fill in
+	// because the config carried none. Only the first is a settings change, so
+	// the filling-in gets a pass of its own whose verdict is discarded, and the
+	// pass that answers the caller runs against a config with nothing left to
+	// fill in.
+	//
+	// Readers already hand out normalized configs — readConfig applies an empty
+	// input for this very reason — so this is normally a no-op. But a gate that
+	// refuses a request must not depend on where its caller got the config
+	// from, and it must not start reading "this profile predates a field" as
+	// "the caller asked for a change" the day someone adds one.
+	if _, err := probe.apply(ConfigInput{ConfigPath: input.ConfigPath}); err != nil {
+		return true, fmt.Errorf("normalize the config to diff against: %w", err)
+	}
+
+	if isPreSharedKeyHidden(input.PreSharedKey) {
+		input.PreSharedKey = nil
+	}
+
+	return probe.apply(input)
+}
+
+// newDryRunBaseline builds the config a brand-new profile would start from, for
+// a dry run to compare an input against. It is createNewConfig without the
+// identity: this config exists only to be compared against and thrown away, and
+// no ConfigInput field maps to either key.
+func newDryRunBaseline(configPath string) (*Config, error) {
+	baseline := newConfigSkeleton()
+
+	if _, err := baseline.apply(ConfigInput{ConfigPath: configPath}); err != nil {
+		return nil, err
+	}
+
+	return baseline, nil
+}
+
+// clone returns a copy of the config that apply can be run against without the
+// original observing the writes, or nil for a nil receiver. Only what apply
+// mutates in place needs detaching, which is the slices it replaces or appends
+// to: every pointer field it touches is reassigned rather than written through,
+// and ClientCertKeyPair is only overwritten.
+func (config *Config) clone() *Config {
+	if config == nil {
+		return nil
+	}
+
+	probe := *config
+	probe.IFaceBlackList = slices.Clone(config.IFaceBlackList)
+	probe.NATExternalIPs = slices.Clone(config.NATExternalIPs)
+	probe.DNSLabels = slices.Clone(config.DNSLabels)
+	return &probe
+}
+
 // UpdateConfig update existing configuration according to input configuration and return with the configuration
 func UpdateConfig(input ConfigInput) (*Config, error) {
 	configExists, err := fileExists(input.ConfigPath)
@@ -940,6 +1180,14 @@ func UpdateConfig(input ConfigInput) (*Config, error) {
 		return nil, fmt.Errorf("config file %s does not exist", input.ConfigPath)
 	}
 
+	// A UI that round-trips the mask GetConfig hands it back is asking to keep
+	// the stored key, not to set the mask as the new one. UpdateOrCreateConfig
+	// and DirectUpdateOrCreateConfig already collapse it; this one did not, so
+	// the same round-trip through SetConfig replaced the key with asterisks.
+	if isPreSharedKeyHidden(input.PreSharedKey) {
+		input.PreSharedKey = nil
+	}
+
 	return update(input)
 }
 
@@ -951,7 +1199,7 @@ func UpdateOrCreateConfig(input ConfigInput) (*Config, error) {
 	}
 	if !configExists {
 		log.Infof("generating new config %s", input.ConfigPath)
-		cfg, err := createNewConfig(input)
+		cfg, err := createProvisionedConfig(input)
 		if err != nil {
 			return nil, err
 		}
@@ -976,12 +1224,20 @@ func update(input ConfigInput) (*Config, error) {
 		return nil, err
 	}
 
+	// A write path is a provisioning point: a stored profile can legitimately
+	// carry no identity (a mobile logout clears the keys in place), and the
+	// next config write is what has to mint a new one. Reads leave that alone.
+	identityGenerated, err := config.EnsureIdentity()
+	if err != nil {
+		return nil, err
+	}
+
 	updated, err := config.apply(input)
 	if err != nil {
 		return nil, err
 	}
 
-	if updated {
+	if updated || identityGenerated {
 		if err := util.WriteJson(context.Background(), input.ConfigPath, config); err != nil {
 			return nil, err
 		}
@@ -990,8 +1246,8 @@ func update(input ConfigInput) (*Config, error) {
 	return config, nil
 }
 
-// GetConfig read config file and return with Config and if it was created. Errors out if it does not exist
-func GetConfig(configPath string) (*Config, error) {
+// GetExistingConfig reads and returns the config if it exists on disk. Fails otherwise.
+func GetExistingConfig(configPath string) (*Config, error) {
 	return readConfig(configPath, false)
 }
 
@@ -1074,17 +1330,27 @@ func UpdateOldManagementURL(ctx context.Context, config *Config, configPath stri
 	return newConfig, nil
 }
 
-// CreateInMemoryConfig generate a new config but do not write out it to the store
+// CreateInMemoryConfig generate a new config but do not write out it to the store.
+// It carries an identity: callers connect with what they get back.
 func CreateInMemoryConfig(input ConfigInput) (*Config, error) {
-	return createNewConfig(input)
+	return createProvisionedConfig(input)
 }
 
-// ReadConfig read config file and return with Config. If it is not exists create a new with default values
-func ReadConfig(configPath string) (*Config, error) {
+// ReadConfigOrDefault reads the profile config at configPath, or resolves the
+// default config in memory when the file does not exist. It never writes, and
+// never mints an identity — EnsureIdentity is where that happens, so the
+// caller that provisions is also the one that persists.
+func ReadConfigOrDefault(configPath string) (*Config, error) {
 	return readConfig(configPath, true)
 }
 
-// ReadConfig read config file and return with Config. If it is not exists create a new with default values
+// readConfig reads the profile config at configPath. createIfMissing resolves a
+// default config in memory when the file is absent, rather than erroring.
+//
+// Reads are pure. This used to write the config back whenever apply() had to
+// fill in a default the file was missing, which quietly made every reader a
+// writer: a gate deciding whether to refuse a request, a UI listing profiles,
+// a mobile getter reading a single preference.
 func readConfig(configPath string, createIfMissing bool) (*Config, error) {
 	configExists, err := fileExists(configPath)
 	if err != nil {
@@ -1102,12 +1368,8 @@ func readConfig(configPath string, createIfMissing bool) (*Config, error) {
 			return nil, err
 		}
 		// initialize through apply() without changes
-		if changed, err := config.apply(ConfigInput{}); err != nil {
+		if _, err := config.apply(ConfigInput{}); err != nil {
 			return nil, err
-		} else if changed {
-			if err = WriteOutConfig(configPath, config); err != nil {
-				return nil, err
-			}
 		}
 
 		return config, nil
@@ -1115,13 +1377,7 @@ func readConfig(configPath string, createIfMissing bool) (*Config, error) {
 		return nil, fmt.Errorf("config file %s does not exist", configPath)
 	}
 
-	cfg, err := createNewConfig(ConfigInput{ConfigPath: configPath})
-	if err != nil {
-		return nil, err
-	}
-
-	err = WriteOutConfig(configPath, cfg)
-	return cfg, err
+	return createNewConfig(ConfigInput{ConfigPath: configPath})
 }
 
 // WriteOutConfig write put the prepared config to the given path
@@ -1144,7 +1400,7 @@ func DirectUpdateOrCreateConfig(input ConfigInput) (*Config, error) {
 	}
 	if !configExists {
 		log.Infof("generating new config %s", input.ConfigPath)
-		cfg, err := createNewConfig(input)
+		cfg, err := createProvisionedConfig(input)
 		if err != nil {
 			return nil, err
 		}
@@ -1171,12 +1427,18 @@ func directUpdate(input ConfigInput) (*Config, error) {
 		return nil, err
 	}
 
+	// Same provisioning point as update(); see the note there.
+	identityGenerated, err := config.EnsureIdentity()
+	if err != nil {
+		return nil, err
+	}
+
 	updated, err := config.apply(input)
 	if err != nil {
 		return nil, err
 	}
 
-	if updated {
+	if updated || identityGenerated {
 		if err := util.DirectWriteJson(context.Background(), input.ConfigPath, config); err != nil {
 			return nil, err
 		}
@@ -1198,7 +1460,16 @@ func ConfigToJSON(config *Config) (string, error) {
 
 // ConfigFromJSON deserializes a JSON string to a Config struct.
 // This is useful for restoring config from alternative storage mechanisms.
-// After unmarshaling, defaults are applied to ensure the config is fully initialized.
+// After unmarshaling, defaults are applied to ensure the config is fully
+// initialized.
+//
+// The peer identity is deliberately none of its business, in either direction.
+// It does not generate one: a read cannot hand back keys that nothing will
+// write down (see ReadConfigOrDefault). Nor does it refuse a document that
+// carries none, because a config legitimately has no identity between a logout
+// and the next login — mobile logout clears both keys in place — and this is
+// also the deserializer the iOS SDK copies a config through. Whoever goes on
+// to connect is where an absent identity has to be answered.
 func ConfigFromJSON(jsonStr string) (*Config, error) {
 	config := &Config{}
 	err := json.Unmarshal([]byte(jsonStr), config)
diff --git a/client/internal/profilemanager/config_json_test.go b/client/internal/profilemanager/config_json_test.go
new file mode 100644
index 000000000..9a6d820c4
--- /dev/null
+++ b/client/internal/profilemanager/config_json_test.go
@@ -0,0 +1,44 @@
+package profilemanager
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// The serialized form is how the tvOS SDK stores a profile and how the iOS SDK
+// copies one in memory, so it must round-trip whatever a profile legitimately
+// holds — including no identity at all, which is the state mobile logout leaves
+// behind when it clears both keys in place. Refusing that document here broke
+// logout, profile switching and the login that follows them.
+func TestConfigFromJSONRoundTripsALoggedOutProfile(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "exported.json")
+	stored, err := UpdateOrCreateConfig(ConfigInput{ConfigPath: path, ManagementURL: DefaultManagementURL})
+	require.NoError(t, err)
+	require.NotEmpty(t, stored.PrivateKey, "a provisioned config is the fixture this test starts from")
+	require.NotEmpty(t, stored.SSHKey)
+
+	exported, err := ConfigToJSON(stored)
+	require.NoError(t, err)
+
+	restored, err := ConfigFromJSON(exported)
+	require.NoError(t, err, "a config exported after a login must load")
+	require.Equal(t, stored.PrivateKey, restored.PrivateKey, "the restored peer is not the stored one")
+	require.Equal(t, stored.SSHKey, restored.SSHKey)
+
+	// What mobile logout leaves on disk.
+	loggedOut := stored.clone()
+	loggedOut.PrivateKey = ""
+	loggedOut.SSHKey = ""
+
+	document, err := ConfigToJSON(loggedOut)
+	require.NoError(t, err)
+
+	reloaded, err := ConfigFromJSON(document)
+	require.NoError(t, err, "a logged-out profile must still load")
+	require.Empty(t, reloaded.PrivateKey, "loading must not mint a key nothing will write down")
+	require.Empty(t, reloaded.SSHKey)
+	require.Equal(t, stored.ManagementURL.String(), reloaded.ManagementURL.String(),
+		"the rest of the profile survives the logout")
+}
diff --git a/client/internal/profilemanager/config_optional_fields_test.go b/client/internal/profilemanager/config_optional_fields_test.go
new file mode 100644
index 000000000..9b74e2217
--- /dev/null
+++ b/client/internal/profilemanager/config_optional_fields_test.go
@@ -0,0 +1,131 @@
+package profilemanager
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// optionalBoolFields lists the *bool fields of Config by name, derived from the
+// type so a field added later is covered without touching these tests.
+func optionalBoolFields() []string {
+	pointerToBool := reflect.TypeOf((*bool)(nil))
+
+	var fields []string
+	configType := reflect.TypeOf(Config{})
+	for i := range configType.NumField() {
+		field := configType.Field(i)
+		if field.Type == pointerToBool && field.Tag.Get("json") != "-" {
+			fields = append(fields, field.Name)
+		}
+	}
+	return fields
+}
+
+func requireNoUnsetOptionalBool(t *testing.T, config *Config, context string) {
+	t.Helper()
+
+	value := reflect.ValueOf(*config)
+	for _, name := range optionalBoolFields() {
+		require.False(t, value.FieldByName(name).IsNil(),
+			"%s left %s unset, so its readers have to invent a default and a diff of it compares presence instead of value", context, name)
+	}
+}
+
+// An optional bool must not be tristate. While one can be nil, true or false,
+// every reader has to invent the meaning of nil, and — the reason this test
+// exists — a diff of the config ends up comparing presence rather than value:
+// that is what made the update-settings gate refuse `netbird up` for a client
+// restating its own defaults. apply() is where a config becomes complete, so
+// the invariant belongs to it: no *bool may come out of apply() unset.
+func TestApplyLeavesNoOptionalBoolUnset(t *testing.T) {
+	require.NotEmpty(t, optionalBoolFields(), "the invariant is only meaningful while Config has optional bools")
+
+	t.Run("a config built from scratch", func(t *testing.T) {
+		config := newConfigSkeleton()
+		_, err := config.apply(ConfigInput{})
+		require.NoError(t, err)
+
+		requireNoUnsetOptionalBool(t, config, "apply on a new config")
+	})
+
+	t.Run("a config file that predates every optional field", func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), "legacy.json")
+		require.NoError(t, os.WriteFile(path, []byte(`{"WgIface":"wt0"}`), 0o600))
+
+		config, err := GetExistingConfig(path)
+		require.NoError(t, err)
+
+		requireNoUnsetOptionalBool(t, config, "a read of a legacy config")
+	})
+
+	t.Run("a config file that stores them as null", func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), "null.json")
+		_, err := UpdateOrCreateConfig(ConfigInput{ConfigPath: path})
+		require.NoError(t, err)
+		unsetOnDisk(t, path, optionalBoolFields()...)
+
+		config, err := GetExistingConfig(path)
+		require.NoError(t, err)
+
+		requireNoUnsetOptionalBool(t, config, "a read of a config storing nulls")
+	})
+}
+
+// The same invariant on disk: what a write leaves in the file is what the next
+// client to read it starts from, so no write may store a null.
+func TestNoWriteStoresAnUnsetOptionalBool(t *testing.T) {
+	requireNoNullOnDisk := func(t *testing.T, path string, context string) {
+		t.Helper()
+
+		raw, err := os.ReadFile(path)
+		require.NoError(t, err)
+
+		var stored map[string]json.RawMessage
+		require.NoError(t, json.Unmarshal(raw, &stored))
+
+		for _, name := range optionalBoolFields() {
+			value, present := stored[name]
+			require.True(t, present, "%s did not store %s at all", context, name)
+			require.NotEqual(t, "null", string(value), "%s stored %s as null", context, name)
+		}
+	}
+
+	t.Run("UpdateOrCreateConfig", func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), "created.json")
+		_, err := UpdateOrCreateConfig(ConfigInput{ConfigPath: path, ManagementURL: DefaultManagementURL})
+		require.NoError(t, err)
+
+		requireNoNullOnDisk(t, path, "UpdateOrCreateConfig")
+	})
+
+	t.Run("UpdateConfig over a config storing nulls", func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), "stored.json")
+		_, err := UpdateOrCreateConfig(ConfigInput{ConfigPath: path})
+		require.NoError(t, err)
+		unsetOnDisk(t, path, optionalBoolFields()...)
+
+		_, err = UpdateConfig(ConfigInput{ConfigPath: path, ManagementURL: "https://mgmt.example.com"})
+		require.NoError(t, err)
+
+		requireNoNullOnDisk(t, path, "UpdateConfig")
+	})
+
+	// Renaming used to copy the file back through a bare Unmarshal, which
+	// preserved the nulls a pre-fix client had written.
+	t.Run("RenameProfile", func(t *testing.T) {
+		withTestSM(t, func(sm *ServiceManager, username string) {
+			created, err := sm.AddProfile("work", username)
+			require.NoError(t, err)
+			unsetOnDisk(t, created.Path, optionalBoolFields()...)
+
+			require.NoError(t, sm.RenameProfile(created.ID, username, "office"))
+
+			requireNoNullOnDisk(t, created.Path, "RenameProfile")
+		})
+	})
+}
diff --git a/client/internal/profilemanager/config_probe_test.go b/client/internal/profilemanager/config_probe_test.go
new file mode 100644
index 000000000..35a179a84
--- /dev/null
+++ b/client/internal/profilemanager/config_probe_test.go
@@ -0,0 +1,96 @@
+package profilemanager
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+// writeCertPair writes a throwaway certificate and key, so apply() has
+// something real to load rather than a missing file it would only log about.
+func writeCertPair(t *testing.T) (certPath, keyPath string) {
+	t.Helper()
+
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+
+	template := x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		Subject:      pkix.Name{CommonName: "probe-test"},
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     time.Now().Add(time.Hour),
+	}
+	der, err := x509.CreateCertificate(rand.Reader, &template, &template, &key.PublicKey, key)
+	require.NoError(t, err)
+
+	keyDER, err := x509.MarshalECPrivateKey(key)
+	require.NoError(t, err)
+
+	dir := t.TempDir()
+	certPath = filepath.Join(dir, "client.crt")
+	keyPath = filepath.Join(dir, "client.key")
+	require.NoError(t, os.WriteFile(certPath, pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der}), 0o600))
+	require.NoError(t, os.WriteFile(keyPath, pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: keyDER}), 0o600))
+	return certPath, keyPath
+}
+
+// The dry run behind the update-settings gate must not read the mTLS pair off
+// disk. The loaded pair feeds the connection, never the comparison, and the
+// gate runs it on every SetConfig and Login — twice per request — including the
+// ones it refuses.
+func TestProbeDoesNotLoadTheCertificatePair(t *testing.T) {
+	certPath, keyPath := writeCertPair(t)
+
+	t.Run("a real apply loads it", func(t *testing.T) {
+		config := newConfigSkeleton()
+		config.ClientCertPath, config.ClientCertKeyPath = certPath, keyPath
+
+		_, err := config.apply(ConfigInput{})
+		require.NoError(t, err)
+		require.NotNil(t, config.ClientCertKeyPair, "the connection would have no client certificate")
+	})
+
+	t.Run("a probe does not", func(t *testing.T) {
+		config := newConfigSkeleton()
+		config.ClientCertPath, config.ClientCertKeyPath = certPath, keyPath
+		config.probing = true
+
+		_, err := config.apply(ConfigInput{})
+		require.NoError(t, err)
+		require.Nil(t, config.ClientCertKeyPair, "the dry run read the certificate off disk")
+	})
+
+	// And the verdict is the same either way, which is the only thing the gate
+	// asks of the probe.
+	t.Run("the verdict is unaffected", func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), "mtls.json")
+		_, err := UpdateOrCreateConfig(ConfigInput{
+			ConfigPath:        path,
+			ManagementURL:     DefaultManagementURL,
+			ClientCertPath:    certPath,
+			ClientCertKeyPath: keyPath,
+		})
+		require.NoError(t, err)
+
+		stored, err := GetExistingConfig(path)
+		require.NoError(t, err)
+
+		changed, err := stored.WouldChange(ConfigInput{ClientCertPath: certPath, ClientCertKeyPath: keyPath})
+		require.NoError(t, err)
+		require.False(t, changed, "restating the stored certificate paths is not a change")
+
+		changed, err = stored.WouldChange(ConfigInput{ClientCertPath: filepath.Join(t.TempDir(), "other.crt")})
+		require.NoError(t, err)
+		require.True(t, changed, "a different certificate path is a change")
+	})
+}
diff --git a/client/internal/profilemanager/config_test.go b/client/internal/profilemanager/config_test.go
index 248920b5e..a461aa71f 100644
--- a/client/internal/profilemanager/config_test.go
+++ b/client/internal/profilemanager/config_test.go
@@ -196,7 +196,7 @@ func TestWireguardPortZeroExplicit(t *testing.T) {
 	assert.Equal(t, 0, config.WgPort, "WgPort should be 0 when explicitly set by user")
 
 	// Verify it persists
-	readConfig, err := GetConfig(configPath)
+	readConfig, err := GetExistingConfig(configPath)
 	require.NoError(t, err)
 	assert.Equal(t, 0, readConfig.WgPort, "WgPort should remain 0 after reading from file")
 }
diff --git a/client/internal/profilemanager/config_would_change_test.go b/client/internal/profilemanager/config_would_change_test.go
new file mode 100644
index 000000000..6b140030f
--- /dev/null
+++ b/client/internal/profilemanager/config_would_change_test.go
@@ -0,0 +1,529 @@
+package profilemanager
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/iface"
+	"github.com/netbirdio/netbird/shared/management/domain"
+)
+
+func seededConfig(t *testing.T) *Config {
+	t.Helper()
+
+	path := filepath.Join(t.TempDir(), "seeded.json")
+	cfg, err := UpdateOrCreateConfig(ConfigInput{
+		ConfigPath:    path,
+		ManagementURL: "https://api.netbird.io:443",
+		PreSharedKey:  strPointer("stored-key"),
+	})
+	require.NoError(t, err)
+	return cfg
+}
+
+func strPointer(s string) *string { return &s }
+
+func intPtr(i int) *int { return &i }
+
+func TestWouldChange(t *testing.T) {
+	tests := []struct {
+		name  string
+		input ConfigInput
+		want  bool
+	}{
+		{name: "empty input", input: ConfigInput{}, want: false},
+		{name: "same management URL", input: ConfigInput{ManagementURL: "https://api.netbird.io:443"}, want: false},
+		{name: "management URL without its default port", input: ConfigInput{ManagementURL: "https://api.netbird.io"}, want: false},
+		{name: "different management URL", input: ConfigInput{ManagementURL: "https://other.example:443"}, want: true},
+		{name: "same pre-shared key", input: ConfigInput{PreSharedKey: strPointer("stored-key")}, want: false},
+		{name: "redacted pre-shared key", input: ConfigInput{PreSharedKey: strPointer("**********")}, want: false},
+		{name: "different pre-shared key", input: ConfigInput{PreSharedKey: strPointer("other-key")}, want: true},
+		{name: "new interface blacklist entry", input: ConfigInput{ExtraIFaceBlackList: []string{"nb-probe0"}}, want: true},
+		{name: "blacklist entry already present", input: ConfigInput{ExtraIFaceBlackList: []string{"lo"}}, want: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfg := seededConfig(t)
+
+			changed, err := cfg.WouldChange(tt.input)
+			require.NoError(t, err)
+			require.Equal(t, tt.want, changed)
+		})
+	}
+}
+
+// The dry run must not be observable on the config it is run against: it
+// decides whether a write is allowed, it does not perform one.
+func TestWouldChangeLeavesTheConfigAlone(t *testing.T) {
+	cfg := seededConfig(t)
+	blacklist := len(cfg.IFaceBlackList)
+
+	changed, err := cfg.WouldChange(ConfigInput{
+		ManagementURL:       "https://other.example:443",
+		PreSharedKey:        strPointer("other-key"),
+		ExtraIFaceBlackList: []string{"nb-probe0"},
+		DNSLabels:           domain.FromPunycodeList([]string{"probe"}),
+		NATExternalIPs:      []string{"1.2.3.4"},
+	})
+	require.NoError(t, err)
+	require.True(t, changed)
+
+	require.Equal(t, "https://api.netbird.io:443", cfg.ManagementURL.String())
+	require.Equal(t, "stored-key", cfg.PreSharedKey)
+	require.Len(t, cfg.IFaceBlackList, blacklist)
+	require.Empty(t, cfg.DNSLabels)
+	require.Empty(t, cfg.NATExternalIPs)
+}
+
+// A nil config means the profile holds nothing yet, so the baseline is what
+// the daemon would create for it.
+func TestWouldChangeWithoutAStoredConfig(t *testing.T) {
+	var cfg *Config
+
+	changed, err := cfg.WouldChange(ConfigInput{})
+	require.NoError(t, err)
+	require.False(t, changed, "a request carrying nothing cannot change anything")
+
+	changed, err = cfg.WouldChange(ConfigInput{ManagementURL: DefaultManagementURL})
+	require.NoError(t, err)
+	require.False(t, changed, "the default management URL is what would be written anyway")
+
+	changed, err = cfg.WouldChange(ConfigInput{ManagementURL: "https://other.example:443"})
+	require.NoError(t, err)
+	require.True(t, changed)
+}
+
+func TestWouldChangeReportsAnInvalidInput(t *testing.T) {
+	cfg := seededConfig(t)
+
+	_, err := cfg.WouldChange(ConfigInput{ManagementURL: "not-a-url"})
+	require.Error(t, err)
+}
+
+// Reads must not write. A config file missing a field apply() fills in (MTU,
+// here) is what used to trigger the write-back.
+func TestReadsDoNotWriteTheConfigBack(t *testing.T) {
+	denormalized := []byte(`{"WgIface":"wt0"}`)
+
+	for name, read := range map[string]func(string) (*Config, error){
+		"GetExistingConfig":   GetExistingConfig,
+		"ReadConfigOrDefault": ReadConfigOrDefault,
+	} {
+		t.Run(name, func(t *testing.T) {
+			path := filepath.Join(t.TempDir(), "profile.json")
+			require.NoError(t, os.WriteFile(path, denormalized, 0o600))
+
+			cfg, err := read(path)
+			require.NoError(t, err)
+			require.Equal(t, uint16(iface.DefaultMTU), cfg.MTU, "the returned config is still normalized in memory")
+			require.Empty(t, cfg.PrivateKey, "a read must not mint an identity either")
+
+			after, err := os.ReadFile(path)
+			require.NoError(t, err)
+			require.Equal(t, string(denormalized), string(after), "%s rewrote the config file", name)
+		})
+	}
+}
+
+// ReadConfigOrDefault resolves a default config for a profile that has no file
+// yet, and that must not create the file either.
+func TestReadConfigDoesNotCreateTheFile(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "absent.json")
+
+	cfg, err := ReadConfigOrDefault(path)
+	require.NoError(t, err)
+	require.Equal(t, DefaultManagementURL, cfg.ManagementURL.String())
+
+	_, err = os.Stat(path)
+	require.True(t, os.IsNotExist(err), "ReadConfigOrDefault created the config file")
+}
+
+// The identity is the one thing a read cannot recompute, so it is provisioned
+// on request and its caller persists it.
+func TestEnsureIdentity(t *testing.T) {
+	cfg := newConfigSkeleton()
+
+	generated, err := cfg.EnsureIdentity()
+	require.NoError(t, err)
+	require.True(t, generated)
+	require.NotEmpty(t, cfg.PrivateKey)
+	require.NotEmpty(t, cfg.SSHKey)
+
+	key := cfg.PrivateKey
+	generated, err = cfg.EnsureIdentity()
+	require.NoError(t, err)
+	require.False(t, generated, "a config that already has an identity keeps it")
+	require.Equal(t, key, cfg.PrivateKey)
+}
+
+// One endpoint written several ways is one endpoint. A gate that compared
+// spellings refused a client restating its own management URL with a trailing
+// slash, which is a normal way to write it.
+func TestSameServiceURL(t *testing.T) {
+	tests := []struct {
+		a, b string
+		want bool
+	}{
+		{a: "https://mgmt.example.com", b: "https://mgmt.example.com:443", want: true},
+		{a: "https://mgmt.example.com", b: "https://mgmt.example.com/", want: true},
+		{a: "https://mgmt.example.com/", b: "https://mgmt.example.com:443/", want: true},
+		{a: "https://MGMT.example.com", b: "https://mgmt.example.com", want: true},
+		{a: "http://mgmt.example.com", b: "http://mgmt.example.com:80", want: true},
+		{a: "https://mgmt.example.com", b: "http://mgmt.example.com", want: false},
+		{a: "https://mgmt.example.com", b: "https://mgmt.example.com:8443", want: false},
+		{a: "https://mgmt.example.com", b: "https://other.example.com", want: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.a+" vs "+tt.b, func(t *testing.T) {
+			a, err := ParseServiceURL("a", tt.a)
+			require.NoError(t, err)
+			b, err := ParseServiceURL("b", tt.b)
+			require.NoError(t, err)
+
+			require.Equal(t, tt.want, SameServiceURL(a, b))
+			require.Equal(t, tt.want, SameServiceURL(b, a), "the comparison must be symmetric")
+		})
+	}
+}
+
+// The same spellings, through the dry run the update-settings gate uses.
+func TestWouldChangeIgnoresURLSpelling(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "seeded.json")
+	_, err := UpdateOrCreateConfig(ConfigInput{
+		ConfigPath:    path,
+		ManagementURL: "https://mgmt.example.com",
+	})
+	require.NoError(t, err)
+
+	cfg, err := GetExistingConfig(path)
+	require.NoError(t, err)
+
+	for _, spelling := range []string{
+		"https://mgmt.example.com",
+		"https://mgmt.example.com/",
+		"https://mgmt.example.com:443",
+		"https://mgmt.example.com:443/",
+		"https://MGMT.example.com",
+	} {
+		changed, err := cfg.WouldChange(ConfigInput{ManagementURL: spelling})
+		require.NoError(t, err)
+		require.False(t, changed, "%q is the stored endpoint written differently", spelling)
+	}
+
+	changed, err := cfg.WouldChange(ConfigInput{ManagementURL: "https://mgmt.example.com:8443"})
+	require.NoError(t, err)
+	require.True(t, changed, "a different port is a different endpoint")
+}
+
+// The dry-run baseline exists to be compared against and discarded, so it must
+// not mint keys — the CLI's login backoff loop would otherwise log a fresh
+// "generated new Wireguard key" on every attempt.
+func TestDryRunBaselineDoesNotGenerateKeys(t *testing.T) {
+	baseline, err := newDryRunBaseline(filepath.Join(t.TempDir(), "absent.json"))
+	require.NoError(t, err)
+
+	require.Empty(t, baseline.PrivateKey, "generated a WireGuard key for a throwaway config")
+	require.Empty(t, baseline.SSHKey, "generated an SSH key for a throwaway config")
+
+	// Everything the comparison actually looks at is still the default config.
+	require.Equal(t, DefaultManagementURL, baseline.ManagementURL.String())
+	require.Equal(t, uint16(iface.DefaultMTU), baseline.MTU)
+	require.Equal(t, iface.DefaultWgPort, baseline.WgPort)
+}
+
+// A stored profile can carry no identity — a mobile logout clears the keys in
+// place — so the next config write has to mint one, which is what keeps the
+// following login from dialing management with an empty key.
+func TestUpdateConfigProvisionsAMissingIdentity(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "logged-out.json")
+	_, err := UpdateOrCreateConfig(ConfigInput{
+		ConfigPath:    path,
+		ManagementURL: "https://api.netbird.io:443",
+	})
+	require.NoError(t, err)
+
+	// Stand in for the logout, which zeroes the keys and writes the config out.
+	loggedOut, err := GetExistingConfig(path)
+	require.NoError(t, err)
+	loggedOut.PrivateKey = ""
+	loggedOut.SSHKey = ""
+	require.NoError(t, WriteOutConfig(path, loggedOut))
+
+	cfg, err := UpdateOrCreateConfig(ConfigInput{ConfigPath: path})
+	require.NoError(t, err)
+	require.NotEmpty(t, cfg.PrivateKey, "the write path did not provision an identity")
+	require.NotEmpty(t, cfg.SSHKey)
+
+	persisted, err := GetExistingConfig(path)
+	require.NoError(t, err)
+	require.Equal(t, cfg.PrivateKey, persisted.PrivateKey, "the provisioned identity was not persisted")
+}
+
+// A config that carries no sync message version must not make the dry run
+// panic: the gate runs inside a request handler, where failing closed is the
+// worst acceptable outcome.
+func TestWouldChangeWithoutAStoredSyncMessageVersion(t *testing.T) {
+	cfg := seededConfig(t)
+	require.Nil(t, cfg.SyncMessageVersion, "the fixture is only useful while the field starts out unset")
+
+	version := 2
+	changed, err := cfg.WouldChange(ConfigInput{SyncMessageVersion: &version})
+	require.NoError(t, err)
+	require.True(t, changed)
+	require.Nil(t, cfg.SyncMessageVersion, "the dry run set the version on the stored config")
+}
+
+// Restating the certificate paths a config already holds is not a change, for
+// the same reason restating any other value is not.
+func TestWouldChangeIgnoresRestatedCertificatePaths(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "mtls.json")
+	_, err := UpdateOrCreateConfig(ConfigInput{
+		ConfigPath:        path,
+		ManagementURL:     "https://api.netbird.io:443",
+		ClientCertPath:    "/etc/netbird/client.crt",
+		ClientCertKeyPath: "/etc/netbird/client.key",
+	})
+	require.NoError(t, err)
+
+	cfg, err := GetExistingConfig(path)
+	require.NoError(t, err)
+
+	changed, err := cfg.WouldChange(ConfigInput{
+		ClientCertPath:    "/etc/netbird/client.crt",
+		ClientCertKeyPath: "/etc/netbird/client.key",
+	})
+	require.NoError(t, err)
+	require.False(t, changed, "the stored certificate paths were restated")
+
+	changed, err = cfg.WouldChange(ConfigInput{ClientCertPath: "/etc/netbird/other.crt"})
+	require.NoError(t, err)
+	require.True(t, changed, "a different certificate path is a change")
+}
+
+// A read that lands on a missing file must not hand back keys: nothing would
+// write them down, so the caller would connect with an identity that changes on
+// the next run and registers a second peer.
+func TestReadConfigOrDefaultCarriesNoIdentity(t *testing.T) {
+	cfg, err := ReadConfigOrDefault(filepath.Join(t.TempDir(), "absent.json"))
+	require.NoError(t, err)
+
+	require.Empty(t, cfg.PrivateKey, "a read minted a WireGuard key")
+	require.Empty(t, cfg.SSHKey, "a read minted an SSH key")
+
+	// So the caller's own EnsureIdentity is the one that reports the work, and
+	// therefore the one that triggers the write.
+	generated, err := cfg.EnsureIdentity()
+	require.NoError(t, err)
+	require.True(t, generated, "the provisioning caller could not tell it had to persist the identity")
+}
+
+// CreateInMemoryConfig is the opposite contract: its callers connect with what
+// they get back, so it does carry an identity.
+func TestCreateInMemoryConfigCarriesAnIdentity(t *testing.T) {
+	cfg, err := CreateInMemoryConfig(ConfigInput{ManagementURL: "https://api.netbird.io:443"})
+	require.NoError(t, err)
+
+	require.NotEmpty(t, cfg.PrivateKey)
+	require.NotEmpty(t, cfg.SSHKey)
+}
+
+// The admin panel is opened, not dialed, so its path identifies it. Comparing
+// it as a bare endpoint left a custom panel URL unable to change.
+func TestAdminURLPathIsPartOfTheIdentity(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "panel.json")
+	_, err := UpdateOrCreateConfig(ConfigInput{
+		ConfigPath: path,
+		AdminURL:   "https://app.example.com/netbird",
+	})
+	require.NoError(t, err)
+
+	cfg, err := GetExistingConfig(path)
+	require.NoError(t, err)
+	require.Equal(t, "https://app.example.com:443/netbird", cfg.AdminURL.String())
+
+	// Equivalent spellings of the same panel are still not a change.
+	for _, same := range []string{
+		"https://app.example.com/netbird",
+		"https://app.example.com:443/netbird",
+		"https://app.example.com/netbird/",
+		"https://APP.example.com/netbird",
+	} {
+		changed, err := cfg.WouldChange(ConfigInput{AdminURL: same})
+		require.NoError(t, err)
+		require.False(t, changed, "%q is the stored panel written differently", same)
+	}
+
+	// A different path is a different panel, and it must be persisted.
+	changed, err := cfg.WouldChange(ConfigInput{AdminURL: "https://app.example.com/other"})
+	require.NoError(t, err)
+	require.True(t, changed, "a different panel path is a change")
+
+	updated, err := UpdateConfig(ConfigInput{ConfigPath: path, AdminURL: "https://app.example.com/other"})
+	require.NoError(t, err)
+	require.Equal(t, "https://app.example.com:443/other", updated.AdminURL.String(), "the new panel path was not persisted")
+}
+
+// unsetOnDisk rewrites the stored config so the named fields carry a JSON null,
+// which is how a profile written before apply() resolved them looks on disk.
+// It synthesizes that state: no write produces it any more.
+func unsetOnDisk(t *testing.T, path string, fields ...string) {
+	t.Helper()
+
+	raw, err := os.ReadFile(path)
+	require.NoError(t, err)
+
+	var stored map[string]json.RawMessage
+	require.NoError(t, json.Unmarshal(raw, &stored))
+
+	for _, field := range fields {
+		_, present := stored[field]
+		require.True(t, present, "%s is not a field of the stored config", field)
+		stored[field] = json.RawMessage("null")
+	}
+
+	rewritten, err := json.Marshal(stored)
+	require.NoError(t, err)
+	require.NoError(t, os.WriteFile(path, rewritten, 0600))
+}
+
+// Seven fields mean "the effective default" when they hold no value, and every
+// profile written before apply() resolved them holds them as null. Restating
+// that default is asking for no change — and the CLI restates it on every
+// `netbird up`, because a flag set through an environment variable is a flag
+// pflag reports as Changed. Judging those restatements as changes made the
+// update-settings gate refuse `netbird up` outright for a client configured
+// through the environment, which is the shape of a Kubernetes deployment.
+//
+// A login now writes those fields set, so the fixture puts the null state back
+// on disk with unsetOnDisk instead of getting it from a login.
+func TestWouldChangeIgnoresRestatedDefaultsOfUnsetFields(t *testing.T) {
+	networkMonitorDefault := runtime.GOOS == "windows" || runtime.GOOS == "darwin"
+
+	tests := []struct {
+		field       string
+		theDefault  ConfigInput
+		theOtherWay ConfigInput
+	}{
+		{"EnableSSHRoot",
+			ConfigInput{EnableSSHRoot: boolPtr(false)}, ConfigInput{EnableSSHRoot: boolPtr(true)}},
+		{"EnableSSHSFTP",
+			ConfigInput{EnableSSHSFTP: boolPtr(false)}, ConfigInput{EnableSSHSFTP: boolPtr(true)}},
+		{"EnableSSHLocalPortForwarding",
+			ConfigInput{EnableSSHLocalPortForwarding: boolPtr(false)}, ConfigInput{EnableSSHLocalPortForwarding: boolPtr(true)}},
+		{"EnableSSHRemotePortForwarding",
+			ConfigInput{EnableSSHRemotePortForwarding: boolPtr(false)}, ConfigInput{EnableSSHRemotePortForwarding: boolPtr(true)}},
+		{"DisableSSHAuth",
+			ConfigInput{DisableSSHAuth: boolPtr(false)}, ConfigInput{DisableSSHAuth: boolPtr(true)}},
+		{"SSHJWTCacheTTL",
+			ConfigInput{SSHJWTCacheTTL: intPtr(0)}, ConfigInput{SSHJWTCacheTTL: intPtr(300)}},
+		{"NetworkMonitor",
+			ConfigInput{NetworkMonitor: boolPtr(networkMonitorDefault)}, ConfigInput{NetworkMonitor: boolPtr(!networkMonitorDefault)}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.field, func(t *testing.T) {
+			path := filepath.Join(t.TempDir(), "unset.json")
+			_, err := UpdateOrCreateConfig(ConfigInput{
+				ConfigPath:    path,
+				ManagementURL: "https://api.netbird.io:443",
+			})
+			require.NoError(t, err)
+			unsetOnDisk(t, path, tt.field)
+
+			cfg, err := GetExistingConfig(path)
+			require.NoError(t, err)
+
+			changed, err := cfg.WouldChange(tt.theDefault)
+			require.NoError(t, err)
+			require.False(t, changed, "restating the default of an unset %s was judged a change", tt.field)
+
+			// The gate still has to refuse a request that does ask for something.
+			changed, err = cfg.WouldChange(tt.theOtherWay)
+			require.NoError(t, err)
+			require.True(t, changed, "asking for a non-default %s is a change", tt.field)
+		})
+	}
+}
+
+// The verdict must not depend on where the caller got the config from. Readers
+// normalize what they hand out, but apply() signals "I filled in a default"
+// through the same bool as "the input changed something", so a config that
+// never passed through a read would otherwise report a change for an input
+// that asks for nothing.
+func TestWouldChangeNormalizesBeforeMeasuring(t *testing.T) {
+	rawConfig := func(t *testing.T) *Config {
+		t.Helper()
+
+		cfg := &Config{WgIface: iface.WgInterfaceDefault}
+		require.Nil(t, cfg.ServerSSHAllowed, "the fixture is only useful while the config is not normalized")
+		require.Nil(t, cfg.EnableSSHRoot)
+		require.Empty(t, cfg.IFaceBlackList)
+		return cfg
+	}
+
+	changed, err := rawConfig(t).WouldChange(ConfigInput{})
+	require.NoError(t, err)
+	require.False(t, changed, "an input carrying nothing cannot change anything")
+
+	changed, err = rawConfig(t).WouldChange(ConfigInput{EnableSSHRoot: boolPtr(false)})
+	require.NoError(t, err)
+	require.False(t, changed, "the default of a field the config never held is not a change")
+
+	changed, err = rawConfig(t).WouldChange(ConfigInput{EnableSSHRoot: boolPtr(true)})
+	require.NoError(t, err)
+	require.True(t, changed, "a non-default value is still a change")
+}
+
+// A zero-padded port addresses the same port. The normalization itself belongs
+// to util.ServiceURLPort and is tested there; this asserts that the comparison
+// this package hands its callers inherits it.
+func TestServiceURLPortIsNormalizedNumerically(t *testing.T) {
+	padded, err := ParseServiceURL("padded", "https://mgmt.example.com:0443")
+	require.NoError(t, err)
+	plain, err := ParseServiceURL("plain", "https://mgmt.example.com:443")
+	require.NoError(t, err)
+
+	require.True(t, SameServiceURL(padded, plain))
+}
+
+// A list the profile does not have and a list the request empties are the same
+// thing: no NAT mappings, no DNS labels. The profile stores an absent list as
+// JSON null and reads it back as a nil slice, while `netbird up` sends the
+// emptied list — CleanNATExternalIPs / CleanDNSLabels — whenever the matching
+// environment variable is set to nothing, which a deployment template does by
+// default. Judging nil and empty as different made the gate refuse that start,
+// which is the very deadlock this branch exists to remove, on another field.
+func TestWouldChangeIgnoresAnEmptiedListThatWasAlreadyAbsent(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "lists.json")
+	_, err := UpdateOrCreateConfig(ConfigInput{ConfigPath: path, ManagementURL: DefaultManagementURL})
+	require.NoError(t, err)
+
+	stored, err := GetExistingConfig(path)
+	require.NoError(t, err)
+	require.Nil(t, stored.NATExternalIPs, "the fixture is only useful while the stored list is absent")
+	require.Nil(t, stored.DNSLabels)
+
+	changed, err := stored.WouldChange(ConfigInput{NATExternalIPs: make([]string, 0)})
+	require.NoError(t, err)
+	require.False(t, changed, "emptying a NAT list the profile never had is not a change")
+
+	changed, err = stored.WouldChange(ConfigInput{DNSLabels: domain.List{}})
+	require.NoError(t, err)
+	require.False(t, changed, "emptying a DNS label list the profile never had is not a change")
+
+	// A list that does hold something still moves when the request empties it.
+	withEntries, err := UpdateConfig(ConfigInput{ConfigPath: path, NATExternalIPs: []string{"1.2.3.4"}})
+	require.NoError(t, err)
+	require.Equal(t, []string{"1.2.3.4"}, withEntries.NATExternalIPs)
+
+	changed, err = withEntries.WouldChange(ConfigInput{NATExternalIPs: make([]string, 0)})
+	require.NoError(t, err)
+	require.True(t, changed, "clearing a NAT list that had an entry is a change")
+}
diff --git a/client/internal/profilemanager/service.go b/client/internal/profilemanager/service.go
index ec287f01a..e58f421fd 100644
--- a/client/internal/profilemanager/service.go
+++ b/client/internal/profilemanager/service.go
@@ -313,7 +313,11 @@ func (s *ServiceManager) AddProfile(displayName, username string) (*Profile, err
 	}
 
 	profPath := filepath.Join(configDir, id.String()+".json")
-	cfg, err := createNewConfig(ConfigInput{ConfigPath: profPath})
+	// Provisioned, not bare: this config goes straight to disk, and a profile
+	// file with no identity is one whose first reader has to mint the keys and
+	// remember to write them back. Before identity generation moved out of
+	// apply() into EnsureIdentity, createNewConfig produced them here too.
+	cfg, err := createProvisionedConfig(ConfigInput{ConfigPath: profPath})
 	if err != nil {
 		return nil, fmt.Errorf("failed to create new config: %w", err)
 	}
@@ -330,6 +334,19 @@ func (s *ServiceManager) AddProfile(displayName, username string) (*Profile, err
 	}, nil
 }
 
+// RenameProfile changes a profile's display name. It rewrites the whole
+// profile file, not just the name: the config is read through the normalizing
+// reader, so apply()'s resolved values — the optional booleans, the interface
+// blacklist, the DNS route interval — are persisted along with the new name.
+//
+// That is deliberate. A write that skipped apply() is what left profiles on
+// disk carrying null where a value was meant, and made a diff of the config
+// compare presence instead of value. Two consequences worth knowing: the
+// platform-dependent defaults resolved here are the renaming host's
+// (ServerSSHAllowed and the network monitor differ per OS), and a profile
+// whose stored name does not survive sanitizeDisplayName now fails to rename
+// rather than being rewritten — though apply() rejects such a profile on every
+// other read too, so it was already unusable.
 func (s *ServiceManager) RenameProfile(id ID, username string, newName string) error {
 	displayName, err := sanitizeDisplayName(newName)
 	if err != nil {
@@ -356,17 +373,17 @@ func (s *ServiceManager) RenameProfile(id ID, username string, newName string) e
 		return ErrProfileNotFound
 	}
 
-	data, err := os.ReadFile(target.Path)
+	// Through the reader, not a bare Unmarshal: this was the one write that
+	// skipped apply(), so it copied back whatever the file held — including an
+	// optional field left unset, which every other write resolves to its
+	// default. Renaming a profile is a poor place to leave that behind.
+	cfg, err := GetExistingConfig(target.Path)
 	if err != nil {
-		return err
-	}
-	var cfg Config
-	if err := json.Unmarshal(data, &cfg); err != nil {
-		return err
+		return fmt.Errorf("read profile config: %w", err)
 	}
 	cfg.Name = displayName
 
-	if err := util.WriteJson(context.Background(), target.Path, cfg); err != nil {
+	if err := WriteOutConfig(target.Path, cfg); err != nil {
 		return fmt.Errorf("failed to write profile name: %w", err)
 	}
 	return nil
diff --git a/client/internal/profilemanager/service_test.go b/client/internal/profilemanager/service_test.go
index 5e051b15d..d26ce746a 100644
--- a/client/internal/profilemanager/service_test.go
+++ b/client/internal/profilemanager/service_test.go
@@ -228,3 +228,27 @@ func TestRemoveProfile_DeletesStateFile(t *testing.T) {
 		assert.True(t, errors.Is(err, os.ErrNotExist), "state file should be removed")
 	})
 }
+
+// A profile file is written here and read back by whoever connects with it, so
+// it has to carry the peer's identity. While AddProfile used the bare
+// constructor, it wrote a config with no keys: the first reader had to mint
+// them, and the paths that read without writing — a gate deciding whether to
+// refuse a request, the mobile SDKs loading a stored profile — got a config
+// that cannot connect.
+func TestAddProfileWritesAnIdentity(t *testing.T) {
+	withTestSM(t, func(sm *ServiceManager, username string) {
+		created, err := sm.AddProfile("work", username)
+		require.NoError(t, err)
+
+		stored, err := GetExistingConfig(created.Path)
+		require.NoError(t, err)
+
+		require.NotEmpty(t, stored.PrivateKey, "the profile was written without a WireGuard key")
+		require.NotEmpty(t, stored.SSHKey, "the profile was written without an SSH key")
+
+		// And the identity is the one on disk, not one minted per read.
+		reread, err := GetExistingConfig(created.Path)
+		require.NoError(t, err)
+		require.Equal(t, stored.PrivateKey, reread.PrivateKey)
+	})
+}
diff --git a/client/ios/NetBirdSDK/client.go b/client/ios/NetBirdSDK/client.go
index 96c747ae4..a6315a4ab 100644
--- a/client/ios/NetBirdSDK/client.go
+++ b/client/ios/NetBirdSDK/client.go
@@ -130,6 +130,10 @@ func NewClient(cfgFile, stateFile, cacheDir, logFilePath, deviceName string, osV
 
 // SetConfigFromJSON stores the JSON config that later loads resolve instead of the config file (tvOS).
 func (c *Client) SetConfigFromJSON(jsonStr string) error {
+	// Parsed only to reject an unreadable document early; the JSON itself is
+	// what is stored, and every load re-parses it. A document carrying no peer
+	// identity is readable and accepted: that is a logged-out profile, and the
+	// login that follows provisions the keys.
 	if _, err := profilemanager.ConfigFromJSON(jsonStr); err != nil {
 		log.Errorf("SetConfigFromJSON: failed to parse config JSON: %v", err)
 		return err
diff --git a/client/ios/NetBirdSDK/login.go b/client/ios/NetBirdSDK/login.go
index 0dfff620e..6a9a6d3d0 100644
--- a/client/ios/NetBirdSDK/login.go
+++ b/client/ios/NetBirdSDK/login.go
@@ -379,6 +379,35 @@ func (a *Auth) SetConfigFromJSON(jsonStr string) error {
 }
 
 func (a *Auth) setBaseConfig(base *profilemanager.Config) error {
+	// A logged-out profile carries no keys: the mobile logout clears them in
+	// place so the next login registers a new peer instead of resurrecting the
+	// old one. This is that login, and auth.NewAuth parses the WireGuard key
+	// before the SSO flow even starts, so an absent identity fails the login on
+	// key size rather than asking the user to sign in.
+	//
+	// Minted on the base config, which is the one GetConfigJSON hands back for
+	// the caller to store — the overlaid copy below is runtime-only.
+	generated, err := base.EnsureIdentity()
+	if err != nil {
+		return fmt.Errorf("ensure profile identity: %w", err)
+	}
+	if generated {
+		if a.cfgPath != "" {
+			// Non-atomic, like NewAuth's own write: the tvOS App Group sandbox
+			// blocks the temp-file-and-rename an atomic write needs.
+			if err := profilemanager.DirectWriteOutConfig(a.cfgPath, base); err != nil {
+				return fmt.Errorf("write out profile config: %w", err)
+			}
+		} else {
+			// No file to write to — this is the tvOS path, where the profile
+			// lives in the caller's own store. It persists the new identity by
+			// calling GetConfigJSON once the login completes; until then the
+			// keys exist only here, and a login that never completes leaves
+			// nothing behind.
+			log.Infof("provisioned a peer identity for a config with no file on disk")
+		}
+	}
+
 	overlaid, err := copyConfig(base)
 	if err != nil {
 		return err
diff --git a/client/ios/NetBirdSDK/preferences.go b/client/ios/NetBirdSDK/preferences.go
index 5297920a3..642f9e160 100644
--- a/client/ios/NetBirdSDK/preferences.go
+++ b/client/ios/NetBirdSDK/preferences.go
@@ -49,7 +49,7 @@ func (p *Preferences) GetManagementURL() (string, error) {
 		return p.configInput.ManagementURL, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return "", err
 	}
@@ -67,7 +67,7 @@ func (p *Preferences) GetAdminURL() (string, error) {
 		return p.configInput.AdminURL, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return "", err
 	}
@@ -89,7 +89,7 @@ func (p *Preferences) HasPreSharedKey() (bool, error) {
 		return *p.configInput.PreSharedKey != "", nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -115,7 +115,7 @@ func (p *Preferences) GetRosenpassEnabled() (bool, error) {
 		return *p.configInput.RosenpassEnabled, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -136,7 +136,7 @@ func (p *Preferences) GetRosenpassPermissive() (bool, error) {
 		return *p.configInput.RosenpassPermissive, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -149,7 +149,7 @@ func (p *Preferences) GetDisableIPv6() (bool, error) {
 		return *p.configInput.DisableIPv6, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
@@ -168,7 +168,7 @@ func (p *Preferences) GetRemoteJobsAllowed() (bool, error) {
 		return *p.configInput.RemoteJobsAllowed, nil
 	}
 
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
+	cfg, err := profilemanager.ReadConfigOrDefault(p.configInput.ConfigPath)
 	if err != nil {
 		return false, err
 	}
diff --git a/client/mobile/profile_lifecycle_test.go b/client/mobile/profile_lifecycle_test.go
new file mode 100644
index 000000000..9612f550d
--- /dev/null
+++ b/client/mobile/profile_lifecycle_test.go
@@ -0,0 +1,97 @@
+package mobile
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+)
+
+// loadAsTheMobileSDKsDo replays what the iOS SDK does with a stored profile:
+// read the config, serialize it, and load it back. Client.SetConfigFromJSON
+// stores that document for tvOS, Auth.SetConfigFromJSON authenticates with it,
+// and copyConfig round-trips a Config through the same pair to take an
+// in-memory copy before applying the MDM overlay.
+func loadAsTheMobileSDKsDo(t *testing.T, configPath string) *profilemanager.Config {
+	t.Helper()
+
+	stored, err := profilemanager.GetExistingConfig(configPath)
+	require.NoError(t, err, "read the stored profile")
+
+	document, err := profilemanager.ConfigToJSON(stored)
+	require.NoError(t, err, "serialize the stored profile")
+
+	reloaded, err := profilemanager.ConfigFromJSON(document)
+	require.NoError(t, err, "load the profile back")
+	return reloaded
+}
+
+// A profile survives the whole round its user puts it through: created, logged
+// out, loaded again, and switched away from and back.
+//
+// Logout is the step that makes this worth asserting. It clears the peer's
+// keys in place so the next login registers a new peer rather than bringing
+// the old one back, which leaves a profile that legitimately carries no
+// identity — and both mobile SDKs go on loading that profile through the
+// serialized form. A load that refused it, or a creation that never wrote an
+// identity in the first place, breaks logout and profile switching on iOS and
+// Android without any of it being visible from the desktop client.
+func TestProfileSurvivesLogoutAndReload(t *testing.T) {
+	pm := newTestProfileManager(t)
+
+	created, err := pm.AddProfile("work")
+	require.NoError(t, err)
+	require.NoError(t, pm.SwitchProfile(profilemanager.DefaultProfileName))
+
+	// Created: the profile carries the identity it will connect with.
+	require.NotEmpty(t, privateKeyOf(t, pm, created.ID), "a new profile was written with no identity")
+
+	configPath, err := pm.GetConfigPath(created.ID)
+	require.NoError(t, err)
+
+	before := loadAsTheMobileSDKsDo(t, configPath)
+	require.NotEmpty(t, before.PrivateKey)
+	managementURL := before.ManagementURL.String()
+
+	// Logged out: the identity is gone, on purpose.
+	require.NoError(t, pm.LogoutProfile(created.ID))
+	require.Empty(t, privateKeyOf(t, pm, created.ID), "logout left the peer's key behind")
+
+	// Loaded again: the profile is still readable, and loading it neither
+	// fails nor mints a key that nothing would write down.
+	after := loadAsTheMobileSDKsDo(t, configPath)
+	assert.Empty(t, after.PrivateKey, "loading a logged-out profile minted a key nothing will persist")
+	assert.Empty(t, after.SSHKey, "loading a logged-out profile minted an SSH key")
+	assert.Equal(t, managementURL, after.ManagementURL.String(), "the rest of the profile did not survive the logout")
+
+	// Switched away from and back: still the same profile, still loadable.
+	require.NoError(t, pm.SwitchProfile(created.ID))
+	require.NoError(t, pm.SwitchProfile(profilemanager.DefaultProfileName))
+	require.NoError(t, pm.SwitchProfile(created.ID))
+
+	active, err := pm.GetActiveProfile()
+	require.NoError(t, err)
+	assert.Equal(t, created.ID, active.ID, "the profile switched to is not the active one")
+
+	assert.Equal(t, managementURL, loadAsTheMobileSDKsDo(t, configPath).ManagementURL.String(),
+		"the profile did not survive the round of switches")
+}
+
+// The profile the SDKs fall back to gets the same treatment, since it is the
+// one a mobile client without an explicit profile runs on.
+func TestDefaultProfileSurvivesLogoutAndReload(t *testing.T) {
+	pm := newTestProfileManager(t)
+	require.NoError(t, pm.SwitchProfile(profilemanager.DefaultProfileName))
+
+	configPath, err := pm.GetConfigPath(profilemanager.DefaultProfileName)
+	require.NoError(t, err)
+	require.NotEmpty(t, loadAsTheMobileSDKsDo(t, configPath).PrivateKey)
+
+	require.NoError(t, pm.LogoutProfile(profilemanager.DefaultProfileName))
+
+	reloaded := loadAsTheMobileSDKsDo(t, configPath)
+	assert.Empty(t, reloaded.PrivateKey, "loading the logged-out default profile minted a key")
+	assert.NotNil(t, reloaded.ManagementURL, "the profile lost its management URL")
+}
diff --git a/client/mobile/profile_manager.go b/client/mobile/profile_manager.go
index 348b7253b..ad79d80c0 100644
--- a/client/mobile/profile_manager.go
+++ b/client/mobile/profile_manager.go
@@ -192,7 +192,10 @@ func (pm *ProfileManager) LogoutProfile(id string) error {
 		return fmt.Errorf("profile %q does not exist", id)
 	}
 
-	config, err := profilemanager.ReadConfig(configPath)
+	// The existing-file reader, not the generating one: the check above is not
+	// atomic with this read, so a profile removed in between would otherwise be
+	// resolved from the defaults here and recreated by the write below.
+	config, err := profilemanager.GetExistingConfig(configPath)
 	if err != nil {
 		return fmt.Errorf("read profile config: %w", err)
 	}
diff --git a/client/server/login_gate_test.go b/client/server/login_gate_test.go
index de62a8180..17ae3ecad 100644
--- a/client/server/login_gate_test.go
+++ b/client/server/login_gate_test.go
@@ -93,7 +93,7 @@ func TestLogin_ChangeThatBecomesPrivilegedMidRequestHasNoSideEffects(t *testing.
 	require.NoError(t, err)
 	require.Equal(t, profilemanager.ID(activeProfile), active.ID, "the refused login switched the active profile anyway")
 
-	stored, err := profilemanager.ReadConfig(targetPath)
+	stored, err := profilemanager.GetExistingConfig(targetPath)
 	require.NoError(t, err)
 	require.Equal(t, "https://api.netbird.io:443", stored.ManagementURL.String(), "the refused login moved the management URL")
 }
diff --git a/client/server/login_overrides_test.go b/client/server/login_overrides_test.go
index 5a2298764..f858c6059 100644
--- a/client/server/login_overrides_test.go
+++ b/client/server/login_overrides_test.go
@@ -7,6 +7,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/proto"
 )
 
 func TestPersistLoginOverrides(t *testing.T) {
@@ -80,10 +81,13 @@ func TestPersistLoginOverrides(t *testing.T) {
 			require.NoError(t, err, "seed config")
 
 			activeProf := &profilemanager.ActiveProfileState{ID: "default"}
-			err = persistLoginOverrides(activeProf, tt.newMgmtURL, tt.newPSK)
+			err = persistLoginOverrides(activeProf, &proto.LoginRequest{
+				ManagementUrl:        tt.newMgmtURL,
+				OptionalPreSharedKey: tt.newPSK,
+			})
 			require.NoError(t, err, "persistLoginOverrides")
 
-			cfg, err := profilemanager.ReadConfig(profilemanager.DefaultConfigPath)
+			cfg, err := profilemanager.ReadConfigOrDefault(profilemanager.DefaultConfigPath)
 			require.NoError(t, err, "read back config")
 
 			require.Equal(t, tt.wantMgmtURL, cfg.ManagementURL.String(), "management URL")
diff --git a/client/server/logout_gate_test.go b/client/server/logout_gate_test.go
index 2d84d1b6a..d88801959 100644
--- a/client/server/logout_gate_test.go
+++ b/client/server/logout_gate_test.go
@@ -129,7 +129,7 @@ func TestLogout_ForeignUserProfileDoesNotUseTheRunningConfig(t *testing.T) {
 	// refused with PermissionDenied. The namesake profile does not, so the
 	// correct path gets as far as dialing its own unreachable management URL.
 	enableSSHOnProfile(t, cfgPath)
-	running, err := profilemanager.GetConfig(cfgPath)
+	running, err := profilemanager.GetExistingConfig(cfgPath)
 	require.NoError(t, err)
 	s.config = running
 	s.connectClient = newDummyConnectClient(context.Background())
diff --git a/client/server/mdm.go b/client/server/mdm.go
index 7a47b2a57..b22c3b0a3 100644
--- a/client/server/mdm.go
+++ b/client/server/mdm.go
@@ -180,92 +180,6 @@ func mdmManagedFieldConflicts(msg *proto.SetConfigRequest, policy *mdm.Policy) [
 	})
 }
 
-// setConfigRequestHasConfigOverrides reports whether the SetConfigRequest
-// carries ANY field that would actually mutate the persisted config.
-// The CLI builds a SetConfigRequest unconditionally on every
-// `netbird up` (see setupSetConfigReq in cmd/up.go) — a plain
-// `netbird up` produces a request with every field at its zero value;
-// the gate must skip such no-op invocations or it would always fire
-// even when the user did not pass any --flag. Returns false on a nil
-// msg; true when any management/admin URL, PSK, DNS/NAT list+clean
-// flag, interface/port/MTU, or any optional bool/duration field is set.
-func setConfigRequestHasConfigOverrides(msg *proto.SetConfigRequest) bool {
-	if msg == nil {
-		return false
-	}
-	return msg.ManagementUrl != "" ||
-		msg.AdminURL != "" ||
-		msg.OptionalPreSharedKey != nil ||
-		len(msg.CustomDNSAddress) > 0 ||
-		len(msg.NatExternalIPs) > 0 || msg.CleanNATExternalIPs ||
-		len(msg.ExtraIFaceBlacklist) > 0 ||
-		len(msg.DnsLabels) > 0 || msg.CleanDNSLabels ||
-		msg.DnsRouteInterval != nil ||
-		msg.RosenpassEnabled != nil ||
-		msg.RosenpassPermissive != nil ||
-		msg.InterfaceName != nil ||
-		msg.WireguardPort != nil ||
-		msg.Mtu != nil ||
-		msg.DisableAutoConnect != nil ||
-		msg.ServerSSHAllowed != nil ||
-		msg.RemoteJobsAllowed != nil ||
-		msg.NetworkMonitor != nil ||
-		msg.DisableClientRoutes != nil ||
-		msg.DisableServerRoutes != nil ||
-		msg.DisableDns != nil ||
-		msg.DisableFirewall != nil ||
-		msg.BlockLanAccess != nil ||
-		msg.DisableNotifications != nil ||
-		msg.BlockInbound != nil ||
-		msg.DisableIpv6 != nil ||
-		msg.EnableSSHRoot != nil ||
-		msg.EnableSSHSFTP != nil ||
-		msg.EnableSSHLocalPortForwarding != nil ||
-		msg.EnableSSHRemotePortForwarding != nil ||
-		msg.DisableSSHAuth != nil ||
-		msg.SshJWTCacheTTL != nil ||
-		msg.EnableLocalMetrics != nil ||
-		msg.LocalMetricsAddress != nil
-}
-
-// loginRequestHasConfigOverrides reports whether the LoginRequest
-// carries ANY field that would mutate persisted daemon configuration
-// (as opposed to pure-auth fields like setupKey, hostname, hint,
-// profileName, username). Used by the Login handler to decide whether
-// the `--disable-update-settings` / MDM gates must run: a re-auth that
-// changes nothing about the configuration is always allowed.
-func loginRequestHasConfigOverrides(msg *proto.LoginRequest) bool {
-	if msg == nil {
-		return false
-	}
-	return msg.ManagementUrl != "" ||
-		msg.AdminURL != "" ||
-		msg.PreSharedKey != "" || //nolint:staticcheck // SA1019: legacy proto field still accepted by Login
-		msg.OptionalPreSharedKey != nil ||
-		len(msg.CustomDNSAddress) > 0 ||
-		len(msg.NatExternalIPs) > 0 || msg.CleanNATExternalIPs ||
-		msg.RosenpassEnabled != nil ||
-		msg.InterfaceName != nil ||
-		msg.WireguardPort != nil ||
-		msg.DisableAutoConnect != nil ||
-		msg.ServerSSHAllowed != nil ||
-		msg.RemoteJobsAllowed != nil ||
-		msg.RosenpassPermissive != nil ||
-		len(msg.ExtraIFaceBlacklist) > 0 ||
-		msg.NetworkMonitor != nil ||
-		msg.DnsRouteInterval != nil ||
-		msg.DisableClientRoutes != nil ||
-		msg.DisableServerRoutes != nil ||
-		msg.DisableDns != nil ||
-		msg.DisableFirewall != nil ||
-		msg.BlockLanAccess != nil ||
-		msg.DisableNotifications != nil ||
-		len(msg.DnsLabels) > 0 || msg.CleanDNSLabels ||
-		msg.BlockInbound != nil ||
-		msg.EnableLocalMetrics != nil ||
-		msg.LocalMetricsAddress != nil
-}
-
 // loginRequestMDMConflicts mirrors mdmManagedFieldConflicts but for the
 // LoginRequest surface. Same value-aware semantics: a field set to the
 // MDM-enforced value is a no-op echo, not a conflict; only a divergent
diff --git a/client/server/provision_identity_test.go b/client/server/provision_identity_test.go
new file mode 100644
index 000000000..c944cdb1a
--- /dev/null
+++ b/client/server/provision_identity_test.go
@@ -0,0 +1,59 @@
+package server
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+)
+
+// The daemon provisions the peer's identity and persists it, because a key that
+// stayed in memory would come back different on the next start and register a
+// second peer. Provisioning is idempotent: a profile that already has an
+// identity keeps the one on disk.
+func TestProvisionProfileIdentity(t *testing.T) {
+	origDir := profilemanager.DefaultConfigPathDir
+	origPath := profilemanager.DefaultConfigPath
+	t.Cleanup(func() {
+		profilemanager.DefaultConfigPathDir = origDir
+		profilemanager.DefaultConfigPath = origPath
+	})
+
+	dir := t.TempDir()
+	profilemanager.DefaultConfigPathDir = dir
+	profilemanager.DefaultConfigPath = filepath.Join(dir, "default.json")
+
+	activeProf := &profilemanager.ActiveProfileState{ID: "default"}
+
+	t.Run("a profile with no file is provisioned and written", func(t *testing.T) {
+		_, err := os.Stat(profilemanager.DefaultConfigPath)
+		require.True(t, os.IsNotExist(err), "the fixture starts without a config file")
+
+		config, existed, err := provisionProfileIdentity(activeProf)
+		require.NoError(t, err)
+		require.False(t, existed, "the file was reported as pre-existing")
+		require.NotEmpty(t, config.PrivateKey)
+
+		stored, err := profilemanager.GetExistingConfig(profilemanager.DefaultConfigPath)
+		require.NoError(t, err, "provisioning did not write the config out")
+		require.Equal(t, config.PrivateKey, stored.PrivateKey, "the persisted identity is not the one returned")
+		require.NotEmpty(t, stored.SSHKey)
+	})
+
+	t.Run("a second call keeps the identity on disk", func(t *testing.T) {
+		before, err := profilemanager.GetExistingConfig(profilemanager.DefaultConfigPath)
+		require.NoError(t, err)
+
+		config, existed, err := provisionProfileIdentity(activeProf)
+		require.NoError(t, err)
+		require.True(t, existed)
+		require.Equal(t, before.PrivateKey, config.PrivateKey, "provisioning minted a second identity")
+
+		after, err := profilemanager.GetExistingConfig(profilemanager.DefaultConfigPath)
+		require.NoError(t, err)
+		require.Equal(t, before.PrivateKey, after.PrivateKey, "provisioning rewrote the stored identity")
+	})
+}
diff --git a/client/server/server.go b/client/server/server.go
index 108aa8a41..f7f81b688 100644
--- a/client/server/server.go
+++ b/client/server/server.go
@@ -58,8 +58,13 @@ const (
 	// JWT token cache TTL for the client daemon (disabled by default)
 	defaultJWTCacheTTL = 0
 
-	errRestoreResidualState   = "failed to restore residual state: %v"
-	errProfilesDisabled       = "profiles are disabled, you cannot use this feature without profiles enabled"
+	errRestoreResidualState = "failed to restore residual state: %v"
+	errProfilesDisabled     = "profiles are disabled, you cannot use this feature without profiles enabled"
+	// errUpdateSettingsDisabled is returned with codes.FailedPrecondition, not
+	// codes.Unavailable: the daemon answered, and it refused. Unavailable means
+	// "the daemon cannot serve this", which is why the CLI downgrades it to a
+	// warning and the GUI reads it as an unreachable daemon — both wrong for a
+	// refusal the caller has to act on.
 	errUpdateSettingsDisabled = "update settings are disabled, you cannot use this feature without update settings enabled"
 	errNetworksDisabled       = "network selection is disabled by the administrator"
 )
@@ -492,16 +497,27 @@ func (s *Server) SetConfig(callerCtx context.Context, msg *proto.SetConfigReques
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
 
-	// Skip the update-settings gate when the request carries no actual
-	// overrides: the CLI builds a SetConfigRequest unconditionally on
-	// every `netbird up` (setupSetConfigReq in cmd/up.go), so a plain
-	// `netbird up` would otherwise always trip the gate and surface a
-	// misleading "setConfig method is not available" warning, even when
-	// the user did not pass any config flag.
-	if setConfigRequestHasConfigOverrides(msg) {
-		if s.checkUpdateSettingsDisabled() {
-			return nil, gstatus.Errorf(codes.Unavailable, errUpdateSettingsDisabled)
-		}
+	stored, err := s.storedProfileConfig(msg.ProfileName, msg.Username)
+	if err != nil {
+		return nil, err
+	}
+
+	config, err := s.setConfigInputFromRequest(msg)
+	if err != nil {
+		return nil, err
+	}
+
+	// Update-settings gate: refuse the request only when it would actually
+	// change a persisted setting. The CLI builds a SetConfigRequest
+	// unconditionally on every `netbird up` (setupSetConfigReq in
+	// cmd/up.go) and fills it from its flags and environment, so a service
+	// or container that restates the configuration it already runs with
+	// must pass the gate. Deciding this on field presence alone refused
+	// those callers, and — through the identical gate in Login — refused
+	// their login too, which left a client configured by environment
+	// (NB_MANAGEMENT_URL and friends) unable to come up at all.
+	if s.checkUpdateSettingsDisabled() && configChangeRequested(stored, config) {
+		return nil, gstatus.Errorf(codes.FailedPrecondition, errUpdateSettingsDisabled)
 	}
 
 	// MDM gate: refuse the whole request if any of its fields is enforced
@@ -513,19 +529,10 @@ func (s *Server) SetConfig(callerCtx context.Context, msg *proto.SetConfigReques
 		return nil, err
 	}
 
-	stored, err := s.storedProfileConfig(msg.ProfileName, msg.Username)
-	if err != nil {
-		return nil, err
-	}
 	if err := requirePrivilegeForConfigChange(callerCtx, stored, privilegedChangeFromSetConfig(msg)); err != nil {
 		return nil, err
 	}
 
-	config, err := s.setConfigInputFromRequest(msg)
-	if err != nil {
-		return nil, err
-	}
-
 	updatedConf, err := profilemanager.UpdateConfig(config)
 	if err != nil {
 		log.Errorf("failed to update profile config: %v", err)
@@ -641,37 +648,45 @@ func (s *Server) setConfigInputFromRequest(msg *proto.SetConfigRequest) (profile
 
 // Login uses setup key to prepare configuration for the daemon.
 func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*proto.LoginResponse, error) {
+	activeProf, err := s.profileManager.GetActiveProfileState()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get active profile state: %w", err)
+	}
+
+	// The stored config of the profile this request targets backs all three
+	// gates below. It is read before anything changes daemon state, so a
+	// refused login neither switches the profile nor cancels a login already
+	// in progress, and it is the profile the switch further down would
+	// activate.
+	stored, err := s.storedLoginConfig(activeProf, msg)
+	if err != nil {
+		return nil, err
+	}
+
 	// Config-override gates. LoginRequest carries the same surface as
 	// SetConfigRequest (managementUrl, PSK, ssh/rosenpass/port toggles,
 	// ...), so the same protections must apply. Without these the CLI
 	// command `netbird up --management-url=X` (which falls through to
 	// Login when SetConfig is rejected — see cmd/up.go) would silently
 	// bypass `--disable-update-settings` and any MDM policy.
-	if loginRequestHasConfigOverrides(msg) {
-		if s.checkUpdateSettingsDisabled() {
-			return nil, gstatus.Errorf(codes.Unavailable, errUpdateSettingsDisabled)
-		}
-		policy := s.mdmLoader.Load()
-		if err := rejectMDMManagedFieldConflicts(loginRequestMDMConflicts(msg, policy)); err != nil {
-			return nil, err
-		}
+	//
+	// The update-settings gate is value-aware, as in SetConfig: it looks at
+	// what a login would actually persist (loginOverridesInput) and refuses
+	// only a real divergence from the stored config. A login that restates
+	// the values already on disk changes nothing, so it must go through —
+	// that is what keeps a re-login, or a container restart carrying
+	// NB_MANAGEMENT_URL, working with the kill switch on.
+	if s.checkUpdateSettingsDisabled() && configChangeRequested(stored, loginOverridesInput(msg)) {
+		return nil, gstatus.Errorf(codes.FailedPrecondition, errUpdateSettingsDisabled)
 	}
 
-	activeProf, err := s.profileManager.GetActiveProfileState()
-	if err != nil {
-		log.Errorf("failed to get active profile state: %v", err)
-		return nil, fmt.Errorf("failed to get active profile state: %w", err)
+	policy := s.mdmLoader.Load()
+	if err := rejectMDMManagedFieldConflicts(loginRequestMDMConflicts(msg, policy)); err != nil {
+		return nil, err
 	}
 
 	// Privilege gate: same restrictions as SetConfig, since LoginRequest can carry
-	// the same fields. It runs before anything here changes daemon state, so a
-	// refused login neither switches the profile nor cancels a login already in
-	// progress, and it reads the profile the request targets, which is the one the
-	// switch below would activate.
-	stored, err := s.storedLoginConfig(activeProf, msg)
-	if err != nil {
-		return nil, err
-	}
+	// the same fields.
 	if err := requirePrivilegeForConfigChange(callerCtx, stored, privilegedChangeFromLogin(msg)); err != nil {
 		return nil, err
 	}
@@ -1174,6 +1189,10 @@ func (s *Server) storedLoginConfig(activeProf *profilemanager.ActiveProfileState
 
 // storedConfigAtPath reads a profile config file, yielding nil when it does not
 // exist yet.
+//
+// Reading it has no side effect: profilemanager.GetExistingConfig does not
+// write, so a request that the gates go on to refuse leaves the profile file as
+// it found it.
 func (s *Server) storedConfigAtPath(path string) (*profilemanager.Config, error) {
 	if _, err := os.Stat(path); err != nil {
 		if os.IsNotExist(err) {
@@ -1182,7 +1201,7 @@ func (s *Server) storedConfigAtPath(path string) (*profilemanager.Config, error)
 		return nil, fmt.Errorf("stat profile config: %w", err)
 	}
 
-	cfg, err := profilemanager.GetConfig(path)
+	cfg, err := profilemanager.GetExistingConfig(path)
 	if err != nil {
 		return nil, fmt.Errorf("read profile config: %w", err)
 	}
@@ -1485,8 +1504,16 @@ func (s *Server) handleActiveProfileLogout(ctx context.Context) (*proto.LogoutRe
 	return &proto.LogoutResponse{}, nil
 }
 
-// getConfig reads config file and returns Config and whether the config file already existed. Errors out if it does not exist
-func (s *Server) getConfig(activeProf *profilemanager.ActiveProfileState) (*profilemanager.Config, bool, error) {
+// provisionProfileIdentity resolves the active profile's config and puts the
+// keys that identify the peer on disk, reporting whether the config file
+// already existed.
+//
+// This is the daemon's provisioning point: the config resolved here is the one
+// the peer runs with, so it needs its identity, and that has to reach disk — a
+// key that stays in memory would come back different on the next start and
+// re-register the peer. Reads themselves are pure, so the write is here, in
+// the open, instead of hiding inside the reader.
+func provisionProfileIdentity(activeProf *profilemanager.ActiveProfileState) (*profilemanager.Config, bool, error) {
 	cfgPath, err := activeProf.FilePath()
 	if err != nil {
 		return nil, false, fmt.Errorf("failed to get active profile file path: %w", err)
@@ -1497,15 +1524,38 @@ func (s *Server) getConfig(activeProf *profilemanager.ActiveProfileState) (*prof
 
 	log.Infof("active profile config existed: %t, err %v", configExisted, err)
 
-	config, err := profilemanager.ReadConfig(cfgPath)
+	config, err := profilemanager.ReadConfigOrDefault(cfgPath)
 	if err != nil {
 		return nil, false, fmt.Errorf("failed to get config: %w", err)
 	}
 
-	// Apply the daemon-owned MDM policy on top of the just-resolved
-	// Config. profilemanager's apply() initialises the policy to
-	// empty — the Loader lives outside Config, so this overlay step
-	// is driven externally here.
+	generated, err := config.EnsureIdentity()
+	if err != nil {
+		return nil, false, fmt.Errorf("ensure profile identity: %w", err)
+	}
+
+	if generated || !configExisted {
+		if err := profilemanager.WriteOutConfig(cfgPath, config); err != nil {
+			return nil, false, fmt.Errorf("write out profile config: %w", err)
+		}
+	}
+
+	return config, configExisted, nil
+}
+
+// getConfig resolves the active profile's config, provisions its identity and
+// reports whether the config file already existed.
+func (s *Server) getConfig(activeProf *profilemanager.ActiveProfileState) (*profilemanager.Config, bool, error) {
+	config, configExisted, err := provisionProfileIdentity(activeProf)
+	if err != nil {
+		return nil, false, err
+	}
+
+	// Apply the daemon-owned MDM policy on top of the just-resolved Config.
+	// profilemanager's apply() initialises the policy to empty — the Loader
+	// lives outside Config, so this overlay step is driven externally here.
+	// After the write above, on purpose: the overlay is runtime-only and
+	// re-derived on every load, so the file keeps the profile's own values.
 	config.ApplyMDMPolicy(s.mdmLoader.Load())
 
 	return config, configExisted, nil
@@ -1560,7 +1610,7 @@ func (s *Server) logoutFromProfile(ctx context.Context, profile *profilemanager.
 		cfgPath = profilemanager.DefaultConfigPath
 	}
 
-	config, err := profilemanager.GetConfig(cfgPath)
+	config, err := profilemanager.GetExistingConfig(cfgPath)
 	if err != nil {
 		return fmt.Errorf("profile '%s' not found", profile.ID)
 	}
@@ -1579,6 +1629,19 @@ func (s *Server) sendLogoutRequestWithConfig(ctx context.Context, config *profil
 	// Privilege gate: deregistering frees this machine's key to be registered
 	// against another management server, which is only restricted while the SSH
 	// server makes that a privilege handover.
+	// Ahead of the privilege gate on purpose. A profile with no identity was
+	// never registered — a logout clears the keys in place, so logging the same
+	// profile out twice lands here — so there is nothing to deregister and
+	// nothing for the gate to protect: what it guards against is handing this
+	// machine's registered key to another management server. Behind the gate,
+	// an unprivileged caller would be refused instead, and for a profile whose
+	// ServerSSHAllowed is unset that is every caller, since an absent value
+	// counts as SSH enabled.
+	if config.PrivateKey == "" {
+		log.Infof("profile carries no identity, nothing to deregister")
+		return nil
+	}
+
 	if err := requirePrivilegeForDeregistration(ctx, config); err != nil {
 		return err
 	}
@@ -2196,7 +2259,7 @@ func (s *Server) GetConfig(ctx context.Context, req *proto.GetConfigRequest) (*p
 		cfgPath = profilemanager.DefaultConfigPath
 	}
 
-	cfg, err := profilemanager.GetConfig(cfgPath)
+	cfg, err := profilemanager.GetExistingConfig(cfgPath)
 	if err != nil {
 		log.Errorf("failed to get active profile config: %v", err)
 		return nil, fmt.Errorf("failed to get active profile config: %w", err)
@@ -2659,8 +2722,6 @@ func sendTerminalNotification() error {
 	return wallCmd.Wait()
 }
 
-// persistLoginOverrides writes management URL and pre-shared key from a LoginRequest to the
-// active profile config so that subsequent reads pick them up. Empty/nil values are ignored.
 // afterLoginPreCheck is a seam for tests to run a concurrent config change
 // between Login's first privilege check and the authoritative one.
 var afterLoginPreCheck func()
@@ -2691,6 +2752,15 @@ func (s *Server) authorizeAndPrepareLogin(callerCtx context.Context, msg *proto.
 		return nil, nil, err
 	}
 
+	// The update-settings decision is re-taken here for the same reason as the
+	// privilege one: Login's earlier check ran outside this lock, so the stored
+	// config it compared against could have moved since. This one is the
+	// authoritative check, and it is the last read before persistLoginOverrides
+	// writes.
+	if s.checkUpdateSettingsDisabled() && configChangeRequested(stored, loginOverridesInput(msg)) {
+		return nil, nil, gstatus.Errorf(codes.FailedPrecondition, errUpdateSettingsDisabled)
+	}
+
 	s.mutex.Lock()
 	if s.actCancel != nil {
 		s.actCancel()
@@ -2717,18 +2787,28 @@ func (s *Server) authorizeAndPrepareLogin(callerCtx context.Context, msg *proto.
 		return nil, nil, fmt.Errorf("active profile state: %w", err)
 	}
 
-	if err := persistLoginOverrides(activeProf, msg.ManagementUrl, msg.OptionalPreSharedKey); err != nil {
+	if err := persistLoginOverrides(activeProf, msg); err != nil {
 		return nil, nil, fmt.Errorf("persist login overrides: %w", err)
 	}
 
+	// Provisioning under the same lock as the decision above, and next to the
+	// write it guards. getConfig would otherwise mint the identity and persist
+	// it once this returns: between its read and its write, a SetConfig that
+	// had already answered its caller would be overwritten by the config this
+	// login read before it landed.
+	if _, _, err := provisionProfileIdentity(activeProf); err != nil {
+		return nil, nil, err
+	}
+
 	return ctx, activeProf, nil
 }
 
-func persistLoginOverrides(activeProf *profilemanager.ActiveProfileState, managementURL string, preSharedKey *string) error {
-	if preSharedKey != nil && *preSharedKey == "" {
-		preSharedKey = nil
-	}
-	if managementURL == "" && preSharedKey == nil {
+// persistLoginOverrides writes the config fields a login request is allowed to
+// carry into the active profile. It shares its input builder with the
+// update-settings gate, so the gate judges exactly the fields this writes.
+func persistLoginOverrides(activeProf *profilemanager.ActiveProfileState, msg *proto.LoginRequest) error {
+	input := loginOverridesInput(msg)
+	if input.ManagementURL == "" && input.PreSharedKey == nil {
 		return nil
 	}
 
@@ -2737,11 +2817,7 @@ func persistLoginOverrides(activeProf *profilemanager.ActiveProfileState, manage
 		return fmt.Errorf("active profile file path: %w", err)
 	}
 
-	input := profilemanager.ConfigInput{
-		ConfigPath:    cfgPath,
-		ManagementURL: managementURL,
-		PreSharedKey:  preSharedKey,
-	}
+	input.ConfigPath = cfgPath
 	if _, err := profilemanager.UpdateOrCreateConfig(input); err != nil {
 		return fmt.Errorf("update config: %w", err)
 	}
diff --git a/client/server/setconfig_mdm_test.go b/client/server/setconfig_mdm_test.go
index a392af6d3..d174dc47b 100644
--- a/client/server/setconfig_mdm_test.go
+++ b/client/server/setconfig_mdm_test.go
@@ -290,7 +290,7 @@ func TestSetConfig_MDMReject_AllOrNothing(t *testing.T) {
 
 	// Confirm RosenpassEnabled was NOT applied even though it was not
 	// in the conflict list: the request was rejected as a whole.
-	reloaded, err := profilemanager.GetConfig(cfgPath)
+	reloaded, err := profilemanager.GetExistingConfig(cfgPath)
 	require.NoError(t, err)
 	assert.False(t, reloaded.RosenpassEnabled, "non-conflicting field must not be applied when request is rejected")
 }
diff --git a/client/server/setconfig_test.go b/client/server/setconfig_test.go
index 7442b718e..d7f7b2bd5 100644
--- a/client/server/setconfig_test.go
+++ b/client/server/setconfig_test.go
@@ -125,7 +125,7 @@ func TestSetConfig_AllFieldsSaved(t *testing.T) {
 	cfgPath, err := profState.FilePath()
 	require.NoError(t, err)
 
-	cfg, err := profilemanager.GetConfig(cfgPath)
+	cfg, err := profilemanager.GetExistingConfig(cfgPath)
 	require.NoError(t, err)
 
 	require.Equal(t, "https://new-api.netbird.io:443", cfg.ManagementURL.String())
diff --git a/client/server/ssh_gate.go b/client/server/ssh_gate.go
index 01d24687e..40d66b7a5 100644
--- a/client/server/ssh_gate.go
+++ b/client/server/ssh_gate.go
@@ -331,21 +331,5 @@ func sameManagementURL(stored *url.URL, requested string) bool {
 		return false
 	}
 
-	return stored.Scheme == parsed.Scheme &&
-		stored.Hostname() == parsed.Hostname() &&
-		effectivePort(stored) == effectivePort(parsed)
-}
-
-func effectivePort(u *url.URL) string {
-	if port := u.Port(); port != "" {
-		return port
-	}
-	switch u.Scheme {
-	case "https":
-		return "443"
-	case "http":
-		return "80"
-	default:
-		return ""
-	}
+	return profilemanager.SameServiceURL(stored, parsed)
 }
diff --git a/client/server/update_settings_gate.go b/client/server/update_settings_gate.go
new file mode 100644
index 000000000..b4d32754f
--- /dev/null
+++ b/client/server/update_settings_gate.go
@@ -0,0 +1,55 @@
+package server
+
+import (
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// configChangeRequested reports whether applying input would move the target
+// profile away from the configuration it already persists. It is the decision
+// procedure of the update-settings kill switch (--disable-update-settings /
+// NB_DISABLE_UPDATE_SETTINGS / the MDM DisableUpdateSettings key): that switch
+// forbids *changing* settings, so a request that restates the stored values is
+// not a change and must not be refused.
+//
+// This has to be judged on values, not on field presence. `netbird up` rebuilds
+// the whole config surface of SetConfigRequest and LoginRequest from its flags
+// and environment on every invocation, so a service or container configured by
+// environment restates its own configuration on every start. A presence-based
+// gate refused those requests, and because Login carries the same fields it
+// refused the login too — leaving such a client unable to come up at all.
+//
+// A dry run that cannot be evaluated fails closed: the request counts as a
+// change, so a malformed field can never open the gate. The error itself is
+// reported to the caller by the real update path.
+func configChangeRequested(stored *profilemanager.Config, input profilemanager.ConfigInput) bool {
+	changed, err := stored.WouldChange(input)
+	if err != nil {
+		log.Warnf("cannot evaluate the requested config change, treating it as a change: %v", err)
+		return true
+	}
+	return changed
+}
+
+// loginOverridesInput builds the ConfigInput a login request persists. The
+// management URL and the pre-shared key are the only config fields the daemon
+// applies from a LoginRequest; everything else on that message is either pure
+// auth or ignored. An empty pre-shared key is dropped rather than written, so
+// a login cannot clear the stored key by omission.
+//
+// Both the write (persistLoginOverrides) and the update-settings gate go
+// through this builder, so the gate can neither refuse a field the write
+// ignores nor miss one it applies.
+func loginOverridesInput(msg *proto.LoginRequest) profilemanager.ConfigInput {
+	preSharedKey := msg.OptionalPreSharedKey
+	if preSharedKey != nil && *preSharedKey == "" {
+		preSharedKey = nil
+	}
+
+	return profilemanager.ConfigInput{
+		ManagementURL: msg.ManagementUrl,
+		PreSharedKey:  preSharedKey,
+	}
+}
diff --git a/client/server/update_settings_gate_test.go b/client/server/update_settings_gate_test.go
new file mode 100644
index 000000000..0d2cd8810
--- /dev/null
+++ b/client/server/update_settings_gate_test.go
@@ -0,0 +1,390 @@
+package server
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/internal"
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// The seeded profile of setupServerWithProfile is created with this management
+// URL, so a request carrying it restates what the profile already holds.
+const storedManagementURL = "https://api.netbird.io:443"
+
+// A client configured by environment re-sends its whole configuration on every
+// `netbird up`: the CLI fills the request from its flags and env regardless of
+// what changed. With the update-settings kill switch on, such a request must
+// pass — nothing about the configuration moves.
+func TestSetConfig_RestatingTheStoredConfigPassesTheGate(t *testing.T) {
+	s, ctx, profName, username, _ := setupServerWithProfile(t)
+	s.updateSettingsDisabled = true
+
+	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
+		ProfileName:   profName,
+		Username:      username,
+		ManagementUrl: storedManagementURL,
+	})
+	require.NoError(t, err, "restating the stored management URL is not a settings change")
+}
+
+// The same endpoint written without its default port is the same endpoint. A
+// gate that compared raw strings refused NB_MANAGEMENT_URL=https://host, which
+// is how the URL is normally spelled.
+func TestSetConfig_EquivalentManagementURLPassesTheGate(t *testing.T) {
+	s, ctx, profName, username, _ := setupServerWithProfile(t)
+	s.updateSettingsDisabled = true
+
+	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
+		ProfileName:   profName,
+		Username:      username,
+		ManagementUrl: "https://api.netbird.io",
+	})
+	require.NoError(t, err, "an implicit :443 is the same management URL")
+}
+
+// The kill switch still has to do its job: a request that moves a setting is
+// refused, and the profile keeps the value it had.
+func TestSetConfig_ChangingASettingIsRefused(t *testing.T) {
+	s, ctx, profName, username, cfgPath := setupServerWithProfile(t)
+	s.updateSettingsDisabled = true
+
+	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
+		ProfileName:   profName,
+		Username:      username,
+		ManagementUrl: "https://mgmt.elsewhere.example:443",
+	})
+	require.Error(t, err, "moving the management URL is a settings change")
+	require.Equal(t, codes.FailedPrecondition, gstatus.Code(err), "want the update-settings refusal, got %v", err)
+
+	cfg, err := profilemanager.GetExistingConfig(cfgPath)
+	require.NoError(t, err)
+	require.Equal(t, storedManagementURL, cfg.ManagementURL.String(), "the refused request changed the config anyway")
+}
+
+// A field whose requested value differs from the stored one is a change even
+// when the rest of the request restates the configuration.
+func TestSetConfig_SingleDivergingFieldIsRefused(t *testing.T) {
+	s, ctx, profName, username, _ := setupServerWithProfile(t)
+	s.updateSettingsDisabled = true
+
+	rosenpass := true
+	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
+		ProfileName:      profName,
+		Username:         username,
+		ManagementUrl:    storedManagementURL,
+		RosenpassEnabled: &rosenpass,
+	})
+	require.Error(t, err, "enabling Rosenpass is a settings change")
+	require.Equal(t, codes.FailedPrecondition, gstatus.Code(err), "want the update-settings refusal, got %v", err)
+}
+
+// With the switch off, the same diverging request goes through: the gate must
+// not leak into a daemon that never enabled it.
+func TestSetConfig_ChangeAllowedWhenTheSwitchIsOff(t *testing.T) {
+	s, ctx, profName, username, cfgPath := setupServerWithProfile(t)
+
+	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
+		ProfileName:   profName,
+		Username:      username,
+		ManagementUrl: "https://mgmt.elsewhere.example:443",
+	})
+	require.NoError(t, err)
+
+	cfg, err := profilemanager.GetExistingConfig(cfgPath)
+	require.NoError(t, err)
+	require.Equal(t, "https://mgmt.elsewhere.example:443", cfg.ManagementURL.String())
+}
+
+// Login carries the same config surface as SetConfig, so it is gated the same
+// way: a login that would move a protected setting is refused before it can
+// touch daemon state.
+func TestLogin_ChangingTheManagementURLIsRefused(t *testing.T) {
+	s, _, profName, username, cfgPath := setupServerWithProfile(t)
+	s.updateSettingsDisabled = true
+	s.rootCtx = internal.CtxInitState(context.Background())
+
+	cancelled := false
+	s.actCancel = func() { cancelled = true }
+
+	_, err := s.Login(userCtx(), &proto.LoginRequest{
+		Username:      &username,
+		ManagementUrl: "https://mgmt.elsewhere.example:443",
+	})
+	require.Error(t, err, "moving the management URL through Login is a settings change")
+	require.Equal(t, codes.FailedPrecondition, gstatus.Code(err), "want the update-settings refusal, got %v", err)
+
+	// "Refused before it can touch daemon state" is the contract, so check the
+	// state as well as the error.
+	cfg, err := profilemanager.GetExistingConfig(cfgPath)
+	require.NoError(t, err)
+	require.Equal(t, storedManagementURL, cfg.ManagementURL.String(), "the refused login moved the management URL")
+	require.False(t, cancelled, "the refused login cancelled the login already in progress")
+
+	active, err := s.profileManager.GetActiveProfileState()
+	require.NoError(t, err)
+	require.Equal(t, profilemanager.ID(profName), active.ID, "the refused login switched the active profile")
+}
+
+// seedProfileConfig writes a profile config carrying the given management URL
+// and pre-shared key into a temp dir, and returns its path.
+func seedProfileConfig(t *testing.T, managementURL, preSharedKey string) string {
+	t.Helper()
+
+	path := filepath.Join(t.TempDir(), "seeded.json")
+	_, err := profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
+		ConfigPath:    path,
+		ManagementURL: managementURL,
+		PreSharedKey:  &preSharedKey,
+	})
+	require.NoError(t, err, "seed profile config")
+	return path
+}
+
+// The decision procedure itself, over the fields a login actually persists.
+// A login that restates the stored values must not be refused: that is what
+// keeps a re-login, or a container restart carrying NB_MANAGEMENT_URL, working
+// with the kill switch on.
+func TestLoginGateDecision(t *testing.T) {
+	stored, err := profilemanager.GetExistingConfig(seedProfileConfig(t, storedManagementURL, "stored-key"))
+	require.NoError(t, err)
+
+	redacted := mdm.PreSharedKeyRedactedSentinel
+	empty := ""
+	sameKey := "stored-key"
+	otherKey := "other-key"
+
+	tests := []struct {
+		name        string
+		msg         *proto.LoginRequest
+		wantChanged bool
+	}{
+		{
+			name:        "pure auth carries no config",
+			msg:         &proto.LoginRequest{SetupKey: "ABC"},
+			wantChanged: false,
+		},
+		{
+			name:        "stored management URL restated",
+			msg:         &proto.LoginRequest{ManagementUrl: storedManagementURL},
+			wantChanged: false,
+		},
+		{
+			name:        "stored management URL without its default port",
+			msg:         &proto.LoginRequest{ManagementUrl: "https://api.netbird.io"},
+			wantChanged: false,
+		},
+		{
+			name:        "different management URL",
+			msg:         &proto.LoginRequest{ManagementUrl: "https://mgmt.elsewhere.example:443"},
+			wantChanged: true,
+		},
+		{
+			name:        "stored pre-shared key restated",
+			msg:         &proto.LoginRequest{OptionalPreSharedKey: &sameKey},
+			wantChanged: false,
+		},
+		{
+			name:        "redacted pre-shared key echoed back",
+			msg:         &proto.LoginRequest{OptionalPreSharedKey: &redacted},
+			wantChanged: false,
+		},
+		{
+			name:        "empty pre-shared key is not a request to clear it",
+			msg:         &proto.LoginRequest{OptionalPreSharedKey: &empty},
+			wantChanged: false,
+		},
+		{
+			name:        "different pre-shared key",
+			msg:         &proto.LoginRequest{OptionalPreSharedKey: &otherKey},
+			wantChanged: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			require.Equal(t, tt.wantChanged, configChangeRequested(stored, loginOverridesInput(tt.msg)))
+		})
+	}
+}
+
+// A profile with no config on disk yet is judged against the config the daemon
+// would create for it, so a first login that asks for the defaults is not a
+// change while one that asks for a different management URL is.
+func TestGateDecisionWithoutStoredConfig(t *testing.T) {
+	require.False(t, configChangeRequested(nil, profilemanager.ConfigInput{}),
+		"a request carrying nothing cannot change anything")
+	require.False(t, configChangeRequested(nil, profilemanager.ConfigInput{ManagementURL: profilemanager.DefaultManagementURL}),
+		"asking for the default management URL is what the daemon would write anyway")
+	require.True(t, configChangeRequested(nil, profilemanager.ConfigInput{ManagementURL: "https://mgmt.elsewhere.example:443"}),
+		"asking for a non-default management URL is a change")
+}
+
+// A dry run that cannot be evaluated must fail closed, or a malformed field
+// would open the gate.
+func TestGateDecisionFailsClosedOnAnInvalidRequest(t *testing.T) {
+	require.True(t, configChangeRequested(nil, profilemanager.ConfigInput{ManagementURL: "not-a-url"}),
+		"an unevaluable request must count as a change")
+}
+
+// The gate reads the stored config to decide, and reading it must not write it:
+// a refused request has to leave the profile file byte-for-byte as it was.
+// A config file missing a field the config layer fills in (MTU, here) is what
+// makes the normalization write fire.
+func TestSetConfig_RefusedRequestLeavesTheConfigFileUntouched(t *testing.T) {
+	s, ctx, profName, username, cfgPath := setupServerWithProfile(t)
+	s.updateSettingsDisabled = true
+
+	require.NoError(t, os.WriteFile(cfgPath, []byte(`{"WgIface":"wt0"}`), 0o600))
+	before, err := os.ReadFile(cfgPath)
+	require.NoError(t, err)
+
+	_, err = s.SetConfig(ctx, &proto.SetConfigRequest{
+		ProfileName:   profName,
+		Username:      username,
+		ManagementUrl: "https://mgmt.elsewhere.example:443",
+	})
+	require.Error(t, err)
+	require.Equal(t, codes.FailedPrecondition, gstatus.Code(err), "want the update-settings refusal, got %v", err)
+
+	after, err := os.ReadFile(cfgPath)
+	require.NoError(t, err)
+	require.Equal(t, string(before), string(after), "the refused request rewrote the profile config")
+}
+
+// The container case that the string comparison still broke: the management URL
+// supplied through the environment is the stored one, written with a trailing
+// slash.
+func TestSetConfig_ManagementURLSpellingsPassTheGate(t *testing.T) {
+	for _, spelling := range []string{
+		"https://api.netbird.io",
+		"https://api.netbird.io/",
+		"https://api.netbird.io:443/",
+		"https://API.netbird.io:443",
+	} {
+		t.Run(spelling, func(t *testing.T) {
+			s, ctx, profName, username, _ := setupServerWithProfile(t)
+			s.updateSettingsDisabled = true
+
+			_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
+				ProfileName:   profName,
+				Username:      username,
+				ManagementUrl: spelling,
+			})
+			require.NoError(t, err, "%q is the stored management URL written differently", spelling)
+		})
+	}
+}
+
+// The RPC the whole fix hangs on. Login is retried by the CLI in a backoff
+// loop, so a login that restates the stored configuration — which is what a
+// container configured by environment sends on every start — must get past the
+// gate, or the client never comes up at all.
+//
+// Past the gate the handler goes on to do real work this test does not stand
+// up, so the assertion is only that the refusal did not happen.
+func TestLogin_RestatingTheStoredConfigPassesTheGate(t *testing.T) {
+	s, _, _, username, _ := setupServerWithProfile(t)
+	s.updateSettingsDisabled = true
+	s.rootCtx = internal.CtxInitState(context.Background())
+
+	// Stand in for the management round trip the handler makes once the gate
+	// lets it through, so this test exercises the gate and not the network:
+	// without it the profile's management URL is dialed for real.
+	s.isLoginRequiredFn = func(context.Context) (bool, error) { return false, nil }
+
+	_, err := s.Login(userCtx(), &proto.LoginRequest{
+		Username:      &username,
+		ManagementUrl: storedManagementURL,
+	})
+	if err != nil {
+		require.NotEqual(t, codes.FailedPrecondition, gstatus.Code(err),
+			"the gate refused a login that changes nothing: %v", err)
+		require.NotContains(t, err.Error(), "update settings are disabled",
+			"the gate refused a login that changes nothing: %v", err)
+	}
+}
+
+// The value-aware decision has the same synchronization problem as the
+// privileged-change one: Login's first check runs outside guardedConfigMu, so
+// the stored config it compared against can move before the write. A login that
+// was a no-op when it was checked must not be written once it has become a
+// change.
+func TestLogin_ChangeThatAppearsMidRequestIsRefused(t *testing.T) {
+	s, _, _, username, _ := setupServerWithProfile(t)
+	s.updateSettingsDisabled = true
+	s.rootCtx = internal.CtxInitState(context.Background())
+
+	target := "moved-under-us"
+	targetPath := filepath.Join(profilemanager.DefaultConfigPathDir, target+".json")
+	_, err := profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
+		ConfigPath:    targetPath,
+		ManagementURL: storedManagementURL,
+	})
+	require.NoError(t, err)
+
+	cancelled := false
+	s.actCancel = func() { cancelled = true }
+
+	// Stand in for a concurrent writer that repoints the profile between the two
+	// checks, which is the interleaving the lock has to make safe. The login
+	// restates the URL the profile held when it was checked, so the first check
+	// sees a no-op and lets it through.
+	afterLoginPreCheck = func() {
+		_, err := profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
+			ConfigPath:    targetPath,
+			ManagementURL: "https://mgmt.elsewhere.example:443",
+		})
+		require.NoError(t, err)
+	}
+	t.Cleanup(func() { afterLoginPreCheck = nil })
+
+	_, err = s.Login(userCtx(), &proto.LoginRequest{
+		ProfileName:   &target,
+		Username:      &username,
+		ManagementUrl: storedManagementURL,
+	})
+	require.Error(t, err, "the login became a settings change before it was written")
+	require.Equal(t, codes.FailedPrecondition, gstatus.Code(err), "want the update-settings refusal, got %v", err)
+	require.False(t, cancelled, "the refused login cancelled the login already in progress")
+
+	stored, err := profilemanager.GetExistingConfig(targetPath)
+	require.NoError(t, err)
+	require.Equal(t, "https://mgmt.elsewhere.example:443", stored.ManagementURL.String(),
+		"the refused login wrote the management URL it was asked for")
+}
+
+// Logging out a profile that was already logged out must not fail: the logout
+// clears the keys in place, so the second attempt finds a profile with no
+// identity, which was never registered and has nothing to deregister.
+func TestLogout_ProfileWithoutAnIdentityIsANoOp(t *testing.T) {
+	s, _, _, _, cfgPath := setupServerWithProfile(t)
+
+	loggedOut, err := profilemanager.GetExistingConfig(cfgPath)
+	require.NoError(t, err)
+	loggedOut.PrivateKey = ""
+	loggedOut.SSHKey = ""
+	require.NoError(t, profilemanager.WriteOutConfig(cfgPath, loggedOut))
+
+	stored, err := profilemanager.GetExistingConfig(cfgPath)
+	require.NoError(t, err)
+	require.NoError(t, s.sendLogoutRequestWithConfig(privilegedTestCtx(), stored),
+		"logging out an identity-less profile must not fail")
+
+	// And for an unprivileged caller too: the deregistration privilege gate
+	// guards the handover of a registered key, so with no key there is nothing
+	// to guard. An unset SSH setting is what arms that gate — sshServerEnabled
+	// reads an absent value as enabled — so this stands in for every legacy
+	// profile, where behind the gate the caller would be refused.
+	stored.ServerSSHAllowed = nil
+	require.NoError(t, s.sendLogoutRequestWithConfig(userCtx(), stored),
+		"an unprivileged caller could not log out a profile with nothing to deregister")
+}
diff --git a/client/ui/i18n/locales/de/common.json b/client/ui/i18n/locales/de/common.json
index c39584992..dcce2f908 100644
--- a/client/ui/i18n/locales/de/common.json
+++ b/client/ui/i18n/locales/de/common.json
@@ -1363,6 +1363,12 @@
     "error.daemon_unreachable": {
         "message": "Der NetBird-Dienst antwortet nicht. Bitte prüfen Sie, ob der Dienst läuft."
     },
+    "error.settings_locked": {
+        "message": "Die Einstellungen können auf diesem Gerät nicht geändert werden: Ein Administrator hat sie gesperrt."
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "Diese Einstellung wird von Ihrer Organisation verwaltet und kann nicht geändert werden."
+    },
     "error.unknown": {
         "message": "Vorgang fehlgeschlagen."
     },
diff --git a/client/ui/i18n/locales/en/common.json b/client/ui/i18n/locales/en/common.json
index e9ee26de4..94d741b3e 100644
--- a/client/ui/i18n/locales/en/common.json
+++ b/client/ui/i18n/locales/en/common.json
@@ -1815,6 +1815,14 @@
         "message": "The NetBird daemon is not responding. Please check that the service is running.",
         "description": "Error: the NetBird background service isn't responding. 'daemon' = the background service."
     },
+    "error.settings_locked": {
+        "message": "Settings cannot be changed on this device: an administrator has locked them.",
+        "description": "Error: the local daemon was started with update-settings disabled, so it refuses configuration changes."
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "This setting is managed by your organization and cannot be changed.",
+        "description": "Error: the setting is enforced by an MDM policy. 'MDM' = mobile device management, the organization's device-management system."
+    },
     "error.unknown": {
         "message": "Operation failed.",
         "description": "Generic fallback error message used when no specific error applies."
diff --git a/client/ui/i18n/locales/es/common.json b/client/ui/i18n/locales/es/common.json
index 245b5aa5f..979879680 100644
--- a/client/ui/i18n/locales/es/common.json
+++ b/client/ui/i18n/locales/es/common.json
@@ -1363,6 +1363,12 @@
     "error.daemon_unreachable": {
         "message": "El daemon de NetBird no responde. Compruebe que el servicio esté en ejecución."
     },
+    "error.settings_locked": {
+        "message": "La configuración no se puede cambiar en este dispositivo: un administrador la ha bloqueado."
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "Esta configuración está gestionada por su organización y no se puede cambiar."
+    },
     "error.unknown": {
         "message": "La operación falló."
     },
diff --git a/client/ui/i18n/locales/fr/common.json b/client/ui/i18n/locales/fr/common.json
index 6da66a643..f9961d864 100644
--- a/client/ui/i18n/locales/fr/common.json
+++ b/client/ui/i18n/locales/fr/common.json
@@ -1363,6 +1363,12 @@
     "error.daemon_unreachable": {
         "message": "Le daemon NetBird ne répond pas. Veuillez vérifier que le service est en cours d’exécution."
     },
+    "error.settings_locked": {
+        "message": "Les paramètres ne peuvent pas être modifiés sur cet appareil : un administrateur les a verrouillés."
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "Ce paramètre est géré par votre organisation et ne peut pas être modifié."
+    },
     "error.unknown": {
         "message": "L’opération a échoué."
     },
diff --git a/client/ui/i18n/locales/hu/common.json b/client/ui/i18n/locales/hu/common.json
index 1b4d2fb9d..94dcb578c 100644
--- a/client/ui/i18n/locales/hu/common.json
+++ b/client/ui/i18n/locales/hu/common.json
@@ -1363,6 +1363,12 @@
     "error.daemon_unreachable": {
         "message": "A NetBird szolgáltatás nem válaszol. Kérjük, ellenőrizze, hogy fut-e a szolgáltatás."
     },
+    "error.settings_locked": {
+        "message": "A beállítások ezen az eszközön nem módosíthatók: egy rendszergazda zárolta őket."
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "Ezt a beállítást a szervezete kezeli, ezért nem módosítható."
+    },
     "error.unknown": {
         "message": "A művelet meghiúsult."
     },
diff --git a/client/ui/i18n/locales/it/common.json b/client/ui/i18n/locales/it/common.json
index 4cee0f842..8c1312535 100644
--- a/client/ui/i18n/locales/it/common.json
+++ b/client/ui/i18n/locales/it/common.json
@@ -1363,6 +1363,12 @@
     "error.daemon_unreachable": {
         "message": "Il daemon NetBird non risponde. Verifichi che il servizio sia in esecuzione."
     },
+    "error.settings_locked": {
+        "message": "Le impostazioni non possono essere modificate su questo dispositivo: un amministratore le ha bloccate."
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "Questa impostazione è gestita dalla sua organizzazione e non può essere modificata."
+    },
     "error.unknown": {
         "message": "Operazione non riuscita."
     },
diff --git a/client/ui/i18n/locales/ja/common.json b/client/ui/i18n/locales/ja/common.json
index 4fc81d283..a3138de6c 100644
--- a/client/ui/i18n/locales/ja/common.json
+++ b/client/ui/i18n/locales/ja/common.json
@@ -1363,6 +1363,12 @@
     "error.daemon_unreachable": {
         "message": "NetBird デーモンが応答していません。サービスが実行されているか確認してください。"
     },
+    "error.settings_locked": {
+        "message": "この端末では設定を変更できません。管理者によってロックされています。"
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "この設定は組織によって管理されているため、変更できません。"
+    },
     "error.unknown": {
         "message": "操作に失敗しました。"
     },
diff --git a/client/ui/i18n/locales/pt/common.json b/client/ui/i18n/locales/pt/common.json
index cb4a542d0..a75ae3dfc 100644
--- a/client/ui/i18n/locales/pt/common.json
+++ b/client/ui/i18n/locales/pt/common.json
@@ -1363,6 +1363,12 @@
     "error.daemon_unreachable": {
         "message": "O daemon do NetBird não está respondendo. Verifique se o serviço está em execução."
     },
+    "error.settings_locked": {
+        "message": "As configurações não podem ser alteradas neste dispositivo: um administrador bloqueou-as."
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "Esta configuração é gerida pela sua organização e não pode ser alterada."
+    },
     "error.unknown": {
         "message": "A operação falhou."
     },
diff --git a/client/ui/i18n/locales/ru/common.json b/client/ui/i18n/locales/ru/common.json
index 61ece03b8..e11ed26a4 100644
--- a/client/ui/i18n/locales/ru/common.json
+++ b/client/ui/i18n/locales/ru/common.json
@@ -1363,6 +1363,12 @@
     "error.daemon_unreachable": {
         "message": "Демон NetBird не отвечает. Проверьте, запущена ли служба."
     },
+    "error.settings_locked": {
+        "message": "Настройки на этом устройстве изменить нельзя: администратор заблокировал их."
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "Эта настройка управляется вашей организацией и не может быть изменена."
+    },
     "error.unknown": {
         "message": "Не удалось выполнить операцию."
     },
diff --git a/client/ui/i18n/locales/uk/common.json b/client/ui/i18n/locales/uk/common.json
index f8fe71562..01d2f4452 100644
--- a/client/ui/i18n/locales/uk/common.json
+++ b/client/ui/i18n/locales/uk/common.json
@@ -1361,6 +1361,12 @@
     "error.daemon_unreachable": {
         "message": "Служба NetBird не відповідає. Будь ласка, перевірте, чи запущена служба."
     },
+    "error.settings_locked": {
+        "message": "Налаштування на цьому пристрої змінити неможливо: адміністратор їх заблокував."
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "Це налаштування керується вашою організацією і не може бути змінене."
+    },
     "error.unknown": {
         "message": "Помилка операції."
     },
diff --git a/client/ui/i18n/locales/zh-CN/common.json b/client/ui/i18n/locales/zh-CN/common.json
index 126b11851..64725a69f 100644
--- a/client/ui/i18n/locales/zh-CN/common.json
+++ b/client/ui/i18n/locales/zh-CN/common.json
@@ -1363,6 +1363,12 @@
     "error.daemon_unreachable": {
         "message": "NetBird 守护进程无响应。请检查服务是否正在运行。"
     },
+    "error.settings_locked": {
+        "message": "此设备上的设置无法更改：管理员已将其锁定。"
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "此设置由您的组织管理，无法更改。"
+    },
     "error.unknown": {
         "message": "操作失败。"
     },
diff --git a/client/ui/services/errors.go b/client/ui/services/errors.go
index 0c6f2f20f..d193e9f02 100644
--- a/client/ui/services/errors.go
+++ b/client/ui/services/errors.go
@@ -134,8 +134,19 @@ func (c errorClassifier) classify(err error) *ClientError {
 		strings.Contains(lower, "connection refused"),
 		strings.Contains(lower, "context deadline exceeded"):
 		code = "daemon_unreachable"
+	case strings.Contains(lower, "update settings are disabled"):
+		code = "settings_locked"
+	case strings.Contains(lower, "managed by mdm"):
+		code = "settings_managed_by_mdm"
 	}
 
+	// Deliberately no blanket mapping for FailedPrecondition below: the daemon
+	// returns it for two dozen states that are not settings refusals at all —
+	// "not logged in", "client is not running", "session can no longer be
+	// extended" — and this classifier is shared with the session and connection
+	// services. Only the two refusals the daemon composes are named, by their
+	// message.
+
 	// Fall back to the gRPC status code when the message didn't match a known
 	// substring — the daemon now forwards the innermost code with a clean desc
 	// that no longer contains the English marker text.
diff --git a/client/ui/services/errors_test.go b/client/ui/services/errors_test.go
index 2f8f3d039..c2a10442f 100644
--- a/client/ui/services/errors_test.go
+++ b/client/ui/services/errors_test.go
@@ -34,6 +34,29 @@ func TestErrorClassifier_Classify(t *testing.T) {
 		require.Equal(t, "session_expired", ce.Code)
 	})
 
+	t.Run("the update-settings kill switch is a refusal, not a failure", func(t *testing.T) {
+		err := gstatus.Error(gcodes.FailedPrecondition,
+			"update settings are disabled, you cannot use this feature without update settings enabled")
+
+		ce := c.classify(err)
+		require.NotNil(t, ce)
+		require.Equal(t, "settings_locked", ce.Code)
+	})
+
+	t.Run("an MDM-managed field is named as such", func(t *testing.T) {
+		err := gstatus.Error(gcodes.FailedPrecondition,
+			"fields managed by MDM cannot be modified: [managementURL]")
+
+		require.Equal(t, "settings_managed_by_mdm", c.classify(err).Code)
+	})
+
+	t.Run("an unrelated FailedPrecondition is not called a refusal", func(t *testing.T) {
+		// The daemon uses this code for states that are not settings refusals,
+		// and this classifier is shared with the session and connection
+		// services, so only the two refusals it composes are named.
+		require.Equal(t, "unknown", c.classify(gstatus.Error(gcodes.FailedPrecondition, "not logged in")).Code)
+	})
+
 	t.Run("unavailable code maps to daemon_unreachable", func(t *testing.T) {
 		ce := c.classify(gstatus.Error(gcodes.Unavailable, "transport closing"))
 		require.Equal(t, "daemon_unreachable", ce.Code)

From f5707c348532a4b15ea39fb53264339f6045932c Mon Sep 17 00:00:00 2001
From: Eduard Gert <kontakt@eduardgert.de>
Date: Tue, 6 Oct 2026 12:08:11 +0200
Subject: [PATCH 09/18] [client] Add RTL layout support to the desktop UI
 (#8076)

* [client] Add RTL layout support to the desktop UI

<html dir> follows the active language, Radix primitives get the
matching dir, physical spacing/positioning uses logical utilities, and
directional icons, animations, arrow-key navigation and tooltip sides
flip in RTL.

* [client] Address RTL review feedback

Force LTR with isolation for monospace values, let truncated names
take their direction from their content, and keep the profile name
field in the UI direction.

* [client] Keep translated monospace labels in their own direction

The forced-LTR rule for monospace values now skips elements with an
explicit dir, translated development labels use dir=auto, and
monospace values rendered through TruncatedText opt into LTR.

---------

Co-authored-by: Edward <43848523+thomashacker@users.noreply.github.com>
---
 .../src/components/CopyToClipboard.tsx        |  6 ++--
 .../frontend/src/components/DropdownMenu.tsx  | 26 +++++++++-------
 .../src/components/LanguagePicker.tsx         | 10 +++++--
 client/ui/frontend/src/components/Tooltip.tsx | 11 ++++++-
 .../frontend/src/components/TruncatedText.tsx | 11 +++++--
 .../frontend/src/components/VerticalTabs.tsx  | 11 ++++---
 .../src/components/dialog/ConfirmModal.tsx    |  6 ++--
 .../frontend/src/components/dialog/Dialog.tsx |  2 +-
 .../components/dialog/DialogDescription.tsx   |  6 ++--
 .../src/components/dialog/DialogHeading.tsx   |  6 ++--
 .../empty-state/DaemonOutdatedOverlay.tsx     |  4 +--
 .../frontend/src/components/inputs/Input.tsx  | 19 ++++++------
 .../frontend/src/components/inputs/Select.tsx |  2 +-
 .../components/switches/FancyToggleSwitch.tsx |  8 ++---
 .../components/switches/SwitchItemGroup.tsx   |  3 ++
 .../src/components/switches/ToggleSwitch.tsx  |  6 ++--
 client/ui/frontend/src/globals.css            |  5 ++++
 client/ui/frontend/src/hooks/useDirection.ts  |  6 ++++
 .../ui/frontend/src/layouts/AppRightPanel.tsx |  7 +++--
 client/ui/frontend/src/lib/i18n.ts            |  1 +
 .../src/modules/error/ErrorDialog.tsx         |  2 +-
 .../main/MainConnectionStatusSwitch.tsx       |  9 +++---
 .../src/modules/main/MainExitNodeSwitcher.tsx | 14 ++++++---
 .../frontend/src/modules/main/MainHeader.tsx  | 20 +++++++++----
 .../ui/frontend/src/modules/main/MainPage.tsx |  4 +--
 .../src/modules/main/advanced/Navigation.tsx  | 13 +++++---
 .../main/advanced/networks/NetworkFilters.tsx |  2 +-
 .../main/advanced/networks/Networks.tsx       | 19 ++++++++----
 .../main/advanced/peers/PeerDetailPanel.tsx   | 30 +++++++++++++------
 .../main/advanced/peers/PeerFilters.tsx       |  2 +-
 .../src/modules/main/advanced/peers/Peers.tsx | 17 +++++++----
 .../modules/profiles/ProfileCreationModal.tsx |  5 ++--
 .../src/modules/profiles/ProfileDropdown.tsx  |  5 +++-
 .../src/modules/profiles/ProfilesTab.tsx      |  2 +-
 .../src/modules/settings/SettingsAbout.tsx    |  4 +--
 .../src/modules/settings/SettingsAdvanced.tsx |  2 ++
 .../src/modules/settings/SettingsGeneral.tsx  |  1 +
 .../src/modules/settings/SettingsPage.tsx     |  3 ++
 .../src/modules/settings/SettingsSection.tsx  |  2 +-
 .../settings/SettingsTroubleshooting.tsx      |  3 +-
 .../modules/welcome/WelcomeStepManagement.tsx |  7 +++--
 .../src/modules/welcome/WelcomeStepTray.tsx   |  4 +--
 42 files changed, 218 insertions(+), 108 deletions(-)
 create mode 100644 client/ui/frontend/src/hooks/useDirection.ts

diff --git a/client/ui/frontend/src/components/CopyToClipboard.tsx b/client/ui/frontend/src/components/CopyToClipboard.tsx
index 4af4ecc8f..b3d5a8715 100644
--- a/client/ui/frontend/src/components/CopyToClipboard.tsx
+++ b/client/ui/frontend/src/components/CopyToClipboard.tsx
@@ -80,7 +80,7 @@ export const CopyToClipboard = ({
             aria-label={resolvedLabel}
             aria-live={"polite"}
             className={cn(
-                "group/copy wails-no-draggable pointer-events-auto inline-flex cursor-default items-center gap-2 rounded-sm text-left outline-none",
+                "group/copy wails-no-draggable pointer-events-auto inline-flex cursor-default items-center gap-2 rounded-sm text-start outline-none",
                 "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
                 className,
             )}
@@ -97,14 +97,14 @@ export const CopyToClipboard = ({
                 <span
                     aria-hidden={"true"}
                     className={
-                        "pointer-events-none absolute bottom-0 left-0 right-0 border-b border-dashed border-transparent group-hover/copy:border-nb-gray-500"
+                        "pointer-events-none absolute inset-x-0 bottom-0 border-b border-dashed border-transparent group-hover/copy:border-nb-gray-500"
                     }
                 />
             </span>
             <span
                 aria-hidden={"true"}
                 className={cn(
-                    "relative right-[1px] top-[2px] inline-flex shrink-0",
+                    "relative end-[1px] top-[2px] inline-flex shrink-0",
                     iconAlignment === "left" ? "order-first" : "order-last",
                     iconClassName,
                 )}
diff --git a/client/ui/frontend/src/components/DropdownMenu.tsx b/client/ui/frontend/src/components/DropdownMenu.tsx
index aa3ced05f..4bedc7c8a 100644
--- a/client/ui/frontend/src/components/DropdownMenu.tsx
+++ b/client/ui/frontend/src/components/DropdownMenu.tsx
@@ -3,8 +3,12 @@ import { cva } from "class-variance-authority";
 import { Check, ChevronRight } from "lucide-react";
 import * as React from "react";
 import { cn } from "@/lib/cn";
+import { useDirection } from "@/hooks/useDirection";
 
-const DropdownMenu = DropdownMenuPrimitive.Root;
+const DropdownMenu = (props: React.ComponentProps<typeof DropdownMenuPrimitive.Root>) => {
+    const dir = useDirection();
+    return <DropdownMenuPrimitive.Root dir={dir} {...props} />;
+};
 const DropdownMenuTrigger = DropdownMenuPrimitive.Trigger;
 const DropdownMenuGroup = DropdownMenuPrimitive.Group;
 const DropdownMenuPortal = DropdownMenuPrimitive.Portal;
@@ -32,16 +36,16 @@ const DropdownMenuSubTrigger = React.forwardRef<
     <DropdownMenuPrimitive.SubTrigger
         ref={ref}
         className={cn(
-            "relative flex cursor-default select-none items-center rounded-md py-1.5 pl-3 pr-2 text-sm outline-none",
+            "relative flex cursor-default select-none items-center rounded-md py-1.5 pe-2 ps-3 text-sm outline-none",
             "transition-colors data-[disabled]:pointer-events-none data-[disabled]:opacity-50",
-            inset && "pl-8",
+            inset && "ps-8",
             menuItemVariants({ variant }),
             className,
         )}
         {...props}
     >
         {children}
-        <ChevronRight className={"ml-auto h-4 w-4"} aria-hidden={"true"} />
+        <ChevronRight className={"ms-auto h-4 w-4 rtl:-scale-x-100"} aria-hidden={"true"} />
     </DropdownMenuPrimitive.SubTrigger>
 ));
 DropdownMenuSubTrigger.displayName = DropdownMenuPrimitive.SubTrigger.displayName;
@@ -102,9 +106,9 @@ const DropdownMenuItem = React.forwardRef<
     <DropdownMenuPrimitive.Item
         ref={ref}
         className={cn(
-            "relative flex cursor-default select-none items-center rounded-md py-1.5 pl-2 pr-2 text-sm outline-none",
+            "relative flex cursor-default select-none items-center rounded-md px-2 py-1.5 text-sm outline-none",
             "transition-colors data-[disabled]:pointer-events-none data-[disabled]:opacity-50",
-            inset && "pl-8",
+            inset && "ps-8",
             menuItemVariants({ variant }),
             className,
         )}
@@ -134,7 +138,7 @@ const DropdownMenuCheckboxItem = React.forwardRef<
     <DropdownMenuPrimitive.CheckboxItem
         ref={ref}
         className={cn(
-            "relative flex cursor-default select-none items-center rounded-sm py-1.5 pl-8 pr-2 text-sm outline-none",
+            "relative flex cursor-default select-none items-center rounded-sm py-1.5 pe-2 ps-8 text-sm outline-none",
             "text-nb-gray-200 transition-colors hover:bg-nb-gray-900 hover:text-nb-gray-50 focus-visible:bg-nb-gray-900 focus-visible:text-nb-gray-50",
             "data-[disabled]:pointer-events-none data-[disabled]:opacity-50",
             className,
@@ -142,7 +146,7 @@ const DropdownMenuCheckboxItem = React.forwardRef<
         checked={checked}
         {...props}
     >
-        <span className={"absolute left-2 flex h-3.5 w-3.5 items-center justify-center"}>
+        <span className={"absolute start-2 flex h-3.5 w-3.5 items-center justify-center"}>
             <DropdownMenuPrimitive.ItemIndicator>
                 <Check className={"h-4 w-4"} />
             </DropdownMenuPrimitive.ItemIndicator>
@@ -170,7 +174,7 @@ const DropdownMenuRadioItem = React.forwardRef<
         {children}
         <span
             aria-hidden={"true"}
-            className={"ml-auto flex w-4 shrink-0 items-center justify-center"}
+            className={"ms-auto flex w-4 shrink-0 items-center justify-center"}
         >
             <DropdownMenuPrimitive.ItemIndicator>
                 <Check size={14} className={"text-netbird"} />
@@ -190,7 +194,7 @@ const DropdownMenuLabel = React.forwardRef<
         ref={ref}
         className={cn(
             "px-2 py-1.5 text-sm font-semibold text-nb-gray-200",
-            inset && "pl-8",
+            inset && "ps-8",
             className,
         )}
         {...props}
@@ -212,7 +216,7 @@ DropdownMenuSeparator.displayName = DropdownMenuPrimitive.Separator.displayName;
 
 const DropdownMenuShortcut = ({ className, ...props }: React.HTMLAttributes<HTMLSpanElement>) => (
     <span
-        className={cn("ml-auto text-xs tracking-widest text-nb-gray-100 opacity-60", className)}
+        className={cn("ms-auto text-xs tracking-widest text-nb-gray-100 opacity-60", className)}
         {...props}
     />
 );
diff --git a/client/ui/frontend/src/components/LanguagePicker.tsx b/client/ui/frontend/src/components/LanguagePicker.tsx
index d0a95906f..1e1fdb17b 100644
--- a/client/ui/frontend/src/components/LanguagePicker.tsx
+++ b/client/ui/frontend/src/components/LanguagePicker.tsx
@@ -12,6 +12,7 @@ import { useFocusVisible } from "@/hooks/useFocusVisible";
 import { loadLanguages } from "@/lib/i18n";
 import { cn } from "@/lib/cn";
 import { errorDialog, formatErrorMessage } from "@/lib/errors";
+import { useDirection } from "@/hooks/useDirection";
 
 // No flag icons: flags represent countries, not languages. https://www.flagsarenotlanguages.com/blog/
 
@@ -21,6 +22,7 @@ const labelFor = (lang: Language): string =>
         : lang.displayName;
 
 export function LanguagePicker() {
+    const dir = useDirection();
     const { t, i18n } = useTranslation();
     const [languages, setLanguages] = useState<Language[]>([]);
     const [open, setOpen] = useState(false);
@@ -112,7 +114,7 @@ export function LanguagePicker() {
                                 aria-hidden={"true"}
                                 className={"shrink-0 text-nb-gray-200"}
                             />
-                            <span className={"flex-1 truncate text-left"}>
+                            <span className={"flex-1 truncate text-start"}>
                                 {current ? labelFor(current) : "—"}
                             </span>
                             <ChevronDown
@@ -168,7 +170,11 @@ export function LanguagePicker() {
                                     </div>
                                 </div>
 
-                                <ScrollArea.Root type={"auto"} className={"-mx-1 overflow-hidden"}>
+                                <ScrollArea.Root
+                                    dir={dir}
+                                    type={"auto"}
+                                    className={"-mx-1 overflow-hidden"}
+                                >
                                     <ScrollArea.Viewport className={"max-h-64 px-1"}>
                                         <Command.List>
                                             <Command.Empty>
diff --git a/client/ui/frontend/src/components/Tooltip.tsx b/client/ui/frontend/src/components/Tooltip.tsx
index d7a85277a..86589e47f 100644
--- a/client/ui/frontend/src/components/Tooltip.tsx
+++ b/client/ui/frontend/src/components/Tooltip.tsx
@@ -1,6 +1,7 @@
 import { type ReactNode, useEffect, useRef, useState } from "react";
 import * as RTooltip from "@radix-ui/react-tooltip";
 import { cn } from "@/lib/cn";
+import { useDirection } from "@/hooks/useDirection";
 
 type Props = {
     content: ReactNode;
@@ -29,6 +30,8 @@ export const Tooltip = ({
     contentClassName,
     closeDelay = 0,
 }: Props) => {
+    const dir = useDirection();
+    const physicalSide = dir === "rtl" ? mirrorSide(side) : side;
     const [open, setOpen] = useState(false);
     const hoveringRef = useRef(false);
     const closeTimer = useRef<ReturnType<typeof setTimeout> | null>(null);
@@ -73,7 +76,7 @@ export const Tooltip = ({
                 </RTooltip.Trigger>
                 <RTooltip.Portal>
                     <RTooltip.Content
-                        side={side}
+                        side={physicalSide}
                         align={align}
                         sideOffset={sideOffset}
                         alignOffset={alignOffset}
@@ -96,3 +99,9 @@ export const Tooltip = ({
         </RTooltip.Provider>
     );
 };
+
+function mirrorSide(side: Props["side"]): Props["side"] {
+    if (side === "left") return "right";
+    if (side === "right") return "left";
+    return side;
+}
diff --git a/client/ui/frontend/src/components/TruncatedText.tsx b/client/ui/frontend/src/components/TruncatedText.tsx
index 5b2d2160c..1174a8b42 100644
--- a/client/ui/frontend/src/components/TruncatedText.tsx
+++ b/client/ui/frontend/src/components/TruncatedText.tsx
@@ -6,9 +6,16 @@ type Props = {
     className?: string;
     tooltipContent?: ReactNode;
     delayDuration?: number;
+    dir?: "ltr" | "rtl" | "auto";
 };
 
-export const TruncatedText = ({ text, className, tooltipContent, delayDuration = 600 }: Props) => {
+export const TruncatedText = ({
+    text,
+    className,
+    tooltipContent,
+    delayDuration = 600,
+    dir = "auto",
+}: Props) => {
     const ref = useRef<HTMLSpanElement>(null);
     const [overflowing, setOverflowing] = useState(false);
 
@@ -19,7 +26,7 @@ export const TruncatedText = ({ text, className, tooltipContent, delayDuration =
     }, [text]);
 
     const span = (
-        <span ref={ref} className={className}>
+        <span ref={ref} dir={dir} className={className}>
             {text}
         </span>
     );
diff --git a/client/ui/frontend/src/components/VerticalTabs.tsx b/client/ui/frontend/src/components/VerticalTabs.tsx
index 306850ee2..bd1912662 100644
--- a/client/ui/frontend/src/components/VerticalTabs.tsx
+++ b/client/ui/frontend/src/components/VerticalTabs.tsx
@@ -3,12 +3,15 @@ import * as Tabs from "@radix-ui/react-tabs";
 import { type LucideProps } from "lucide-react";
 import { cn } from "@/lib/cn";
 import { useFocusVisible } from "@/hooks/useFocusVisible";
+import { useDirection } from "@/hooks/useDirection";
 
 const Root = forwardRef<HTMLDivElement, Omit<Tabs.TabsProps, "orientation">>(
     function VerticalTabsRoot({ className, ...props }, ref) {
+        const dir = useDirection();
         return (
             <Tabs.Root
                 ref={ref}
+                dir={dir}
                 orientation={"vertical"}
                 className={cn("flex min-h-0 flex-1", className)}
                 {...props}
@@ -24,7 +27,7 @@ const List = forwardRef<HTMLDivElement, Tabs.TabsListProps>(function VerticalTab
     return (
         <Tabs.List
             ref={ref}
-            className={cn("flex w-full flex-col gap-1 p-5 pr-0", className)}
+            className={cn("flex w-full flex-col gap-1 p-5 pe-0", className)}
             {...props}
         />
     );
@@ -46,7 +49,7 @@ const Trigger = forwardRef<HTMLButtonElement, TriggerProps>(function VerticalTab
         <Tabs.Trigger
             ref={ref}
             className={cn(
-                "group flex w-full cursor-default items-center gap-3 rounded-md border border-transparent px-2 py-2.5 text-left outline-none dark:border-0",
+                "group flex w-full cursor-default items-center gap-3 rounded-md border border-transparent px-2 py-2.5 text-start outline-none dark:border-0",
                 "transition-colors duration-150",
                 "data-[state=active]:border-nb-gray-800 data-[state=active]:bg-white dark:data-[state=active]:bg-nb-gray-930",
                 "data-[state=inactive]:hover:bg-nb-gray-850 dark:data-[state=inactive]:hover:bg-nb-gray-935",
@@ -60,7 +63,7 @@ const Trigger = forwardRef<HTMLButtonElement, TriggerProps>(function VerticalTab
                 size={iconSize}
                 aria-hidden={"true"}
                 className={cn(
-                    "ml-2 shrink-0 transition-colors duration-150",
+                    "ms-2 shrink-0 transition-colors duration-150",
                     "text-nb-gray-350 dark:text-nb-gray-400",
                     "group-data-[state=active]:text-nb-gray-100",
                 )}
@@ -75,7 +78,7 @@ const Trigger = forwardRef<HTMLButtonElement, TriggerProps>(function VerticalTab
                 {title}
             </span>
             {adornment && (
-                <div aria-hidden={"true"} className={"ml-auto mr-2 shrink-0"}>
+                <div aria-hidden={"true"} className={"me-2 ms-auto shrink-0"}>
                     {adornment}
                 </div>
             )}
diff --git a/client/ui/frontend/src/components/dialog/ConfirmModal.tsx b/client/ui/frontend/src/components/dialog/ConfirmModal.tsx
index 7a8a1c906..e9c33e677 100644
--- a/client/ui/frontend/src/components/dialog/ConfirmModal.tsx
+++ b/client/ui/frontend/src/components/dialog/ConfirmModal.tsx
@@ -54,9 +54,9 @@ export const ConfirmModal = ({
                 onOpenAutoFocus={(e) => e.preventDefault()}
             >
                 <div className={"flex flex-col gap-5 px-5"}>
-                    <div className={"flex flex-col gap-1 pl-1"}>
-                        <DialogHeading align={"left"}>{title}</DialogHeading>
-                        <DialogDescription align={"left"} className={"whitespace-pre-line"}>
+                    <div className={"flex flex-col gap-1 ps-1"}>
+                        <DialogHeading align={"start"}>{title}</DialogHeading>
+                        <DialogDescription align={"start"} className={"whitespace-pre-line"}>
                             {description}
                         </DialogDescription>
                     </div>
diff --git a/client/ui/frontend/src/components/dialog/Dialog.tsx b/client/ui/frontend/src/components/dialog/Dialog.tsx
index c43c04b0b..3d0d47fc2 100644
--- a/client/ui/frontend/src/components/dialog/Dialog.tsx
+++ b/client/ui/frontend/src/components/dialog/Dialog.tsx
@@ -95,7 +95,7 @@ export const Content = forwardRef<ElementRef<typeof DialogPrimitive.Content>, Co
                         {showClose && (
                             <DialogPrimitive.Close
                                 className={cn(
-                                    "absolute right-3 top-3 z-10 rounded-md p-3 transition-colors",
+                                    "absolute end-3 top-3 z-10 rounded-md p-3 transition-colors",
                                     "text-nb-gray-300 hover:text-nb-gray-100",
                                     "focus:outline-none disabled:pointer-events-none",
                                 )}
diff --git a/client/ui/frontend/src/components/dialog/DialogDescription.tsx b/client/ui/frontend/src/components/dialog/DialogDescription.tsx
index 12c358043..3d6ecbba7 100644
--- a/client/ui/frontend/src/components/dialog/DialogDescription.tsx
+++ b/client/ui/frontend/src/components/dialog/DialogDescription.tsx
@@ -1,12 +1,12 @@
 import { type ReactNode } from "react";
 import { cn } from "@/lib/cn";
 
-type DialogAlign = "left" | "center" | "right";
+type DialogAlign = "start" | "center" | "end";
 
 const alignClass: Record<DialogAlign, string> = {
-    left: "text-left",
+    start: "text-start",
     center: "text-center",
-    right: "text-right",
+    end: "text-end",
 };
 
 type DialogDescriptionProps = {
diff --git a/client/ui/frontend/src/components/dialog/DialogHeading.tsx b/client/ui/frontend/src/components/dialog/DialogHeading.tsx
index b9dda72a9..52eb0c369 100644
--- a/client/ui/frontend/src/components/dialog/DialogHeading.tsx
+++ b/client/ui/frontend/src/components/dialog/DialogHeading.tsx
@@ -1,12 +1,12 @@
 import { type ReactNode } from "react";
 import { cn } from "@/lib/cn";
 
-type DialogAlign = "left" | "center" | "right";
+type DialogAlign = "start" | "center" | "end";
 
 const alignClass: Record<DialogAlign, string> = {
-    left: "text-left",
+    start: "text-start",
     center: "text-center",
-    right: "text-right",
+    end: "text-end",
 };
 
 type DialogHeadingProps = {
diff --git a/client/ui/frontend/src/components/empty-state/DaemonOutdatedOverlay.tsx b/client/ui/frontend/src/components/empty-state/DaemonOutdatedOverlay.tsx
index e8e7108eb..da04bb4d7 100644
--- a/client/ui/frontend/src/components/empty-state/DaemonOutdatedOverlay.tsx
+++ b/client/ui/frontend/src/components/empty-state/DaemonOutdatedOverlay.tsx
@@ -65,7 +65,7 @@ export const DaemonOutdatedOverlay = () => {
                         {clientVersion === "development" ? (
                             <span>
                                 {t("settings.about.clientName")}{" "}
-                                <span className={"font-mono text-yellow-400"}>
+                                <span dir={"auto"} className={"font-mono text-yellow-400"}>
                                     {t("settings.about.development")}
                                 </span>
                             </span>
@@ -77,7 +77,7 @@ export const DaemonOutdatedOverlay = () => {
                         {guiVersion === "development" ? (
                             <span>
                                 {t("settings.about.guiName")}{" "}
-                                <span className={"font-mono text-yellow-400"}>
+                                <span dir={"auto"} className={"font-mono text-yellow-400"}>
                                     {t("settings.about.development")}
                                 </span>
                             </span>
diff --git a/client/ui/frontend/src/components/inputs/Input.tsx b/client/ui/frontend/src/components/inputs/Input.tsx
index eada79a1f..9d82f4dad 100644
--- a/client/ui/frontend/src/components/inputs/Input.tsx
+++ b/client/ui/frontend/src/components/inputs/Input.tsx
@@ -86,13 +86,13 @@ function buildInputClassName(
         "file:border-0 file:bg-transparent file:text-sm file:font-medium",
         "focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-offset-2",
         "disabled:cursor-not-allowed disabled:opacity-40",
-        opts.hasCustomPrefix && "!rounded-l-none !border-l-0",
-        opts.hasSuffix && "!pr-9",
-        opts.hasIcon && "!pl-10",
+        opts.hasCustomPrefix && "!rounded-s-none !border-s-0",
+        opts.hasSuffix && "!pe-9",
+        opts.hasIcon && "!ps-10",
         "border",
         opts.readOnly && "!border-nb-gray-800 !bg-nb-gray-910 text-nb-gray-350",
         opts.showStepper &&
-            "!rounded-r-none [-moz-appearance:textfield] [&::-webkit-inner-spin-button]:appearance-none [&::-webkit-outer-spin-button]:appearance-none",
+            "!rounded-e-none [-moz-appearance:textfield] [&::-webkit-inner-spin-button]:appearance-none [&::-webkit-outer-spin-button]:appearance-none",
         opts.className,
     );
 }
@@ -107,7 +107,7 @@ function InputAffix({
         <div
             className={cn(
                 inputVariants({ prefixSuffixVariant: error ? "error" : "default" }),
-                "flex h-[40px] w-auto rounded-l-md bg-white px-3 py-2 text-sm",
+                "flex h-[40px] w-auto rounded-s-md bg-white px-3 py-2 text-sm",
                 "items-center whitespace-nowrap border",
                 disabled && "opacity-40",
                 className,
@@ -122,7 +122,7 @@ function InputIconSlot({ icon, disabled }: Readonly<{ icon: ReactNode; disabled?
     return (
         <div
             className={cn(
-                "absolute left-0 top-0 flex h-full items-center pl-3 text-xs leading-[0] dark:text-nb-gray-300",
+                "absolute start-0 top-0 flex h-full items-center ps-3 text-xs leading-[0] dark:text-nb-gray-300",
                 disabled && "opacity-40",
             )}
         >
@@ -138,7 +138,7 @@ function InputSuffixSlot({
     return (
         <div
             className={cn(
-                "pointer-events-none absolute right-0 top-0 flex h-full select-none items-center pr-3 text-xs leading-[0] dark:text-nb-gray-300",
+                "pointer-events-none absolute end-0 top-0 flex h-full select-none items-center pe-3 text-xs leading-[0] dark:text-nb-gray-300",
                 disabled && "opacity-30",
             )}
         >
@@ -157,7 +157,7 @@ function NumberStepper({
         <div
             className={cn(
                 "flex h-[40px] shrink-0 flex-col overflow-hidden",
-                "rounded-r-md border border-l-0",
+                "rounded-e-md border border-s-0",
                 "border-neutral-200 bg-white dark:border-nb-gray-700 dark:bg-nb-gray-900",
                 error && "dark:border-red-500",
                 disabled && "pointer-events-none opacity-40",
@@ -226,6 +226,7 @@ export const Input = forwardRef<HTMLInputElement, InputProps>(function Input(
         showPasswordToggle = false,
         copy = false,
         id,
+        dir,
         ...props
     },
     ref,
@@ -336,7 +337,7 @@ export const Input = forwardRef<HTMLInputElement, InputProps>(function Input(
     return (
         <div className={"flex w-full min-w-0 flex-col"}>
             {label && <Label htmlFor={inputId}>{label}</Label>}
-            <div className={cn("relative flex h-[40px] w-full", maxWidthClass)}>
+            <div dir={dir} className={cn("relative flex h-[40px] w-full", maxWidthClass)}>
                 {customPrefix && (
                     <InputAffix
                         content={customPrefix}
diff --git a/client/ui/frontend/src/components/inputs/Select.tsx b/client/ui/frontend/src/components/inputs/Select.tsx
index 953008455..d9c7512d2 100644
--- a/client/ui/frontend/src/components/inputs/Select.tsx
+++ b/client/ui/frontend/src/components/inputs/Select.tsx
@@ -64,7 +64,7 @@ export function Select<T extends string>({
                             className={"shrink-0 text-nb-gray-200"}
                         />
                     )}
-                    <span className={"flex-1 truncate text-left"}>{current?.label ?? "—"}</span>
+                    <span className={"flex-1 truncate text-start"}>{current?.label ?? "—"}</span>
                     <ChevronDown
                         size={12}
                         aria-hidden={"true"}
diff --git a/client/ui/frontend/src/components/switches/FancyToggleSwitch.tsx b/client/ui/frontend/src/components/switches/FancyToggleSwitch.tsx
index a63e56e69..b6331ee2d 100644
--- a/client/ui/frontend/src/components/switches/FancyToggleSwitch.tsx
+++ b/client/ui/frontend/src/components/switches/FancyToggleSwitch.tsx
@@ -42,7 +42,7 @@ export default function FancyToggleSwitch({
                 role={"status"}
                 aria-busy={"true"}
                 aria-live={"polite"}
-                className={cn("inline-block w-full text-left", className)}
+                className={cn("inline-block w-full text-start", className)}
             >
                 <div className={"flex justify-between gap-10"}>
                     <div className={cn(textWrapperClassName)}>
@@ -55,7 +55,7 @@ export default function FancyToggleSwitch({
                             </span>
                         </HelpText>
                     </div>
-                    <div className={"mt-2 pr-1"}>
+                    <div className={"mt-2 pe-1"}>
                         <div
                             aria-hidden={"true"}
                             className={
@@ -73,7 +73,7 @@ export default function FancyToggleSwitch({
             {...(disabled ? { inert: "" } : {})}
             className={cn(
                 "relative z-[1] cursor-default transition-all duration-300",
-                "inline-block w-full text-left",
+                "inline-block w-full text-start",
                 disabled && "pointer-events-none opacity-30",
                 className,
             )}
@@ -87,7 +87,7 @@ export default function FancyToggleSwitch({
                         <span id={descriptionId}>{helpText}</span>
                     </HelpText>
                 </div>
-                <div className={"mt-2 pr-1"}>
+                <div className={"mt-2 pe-1"}>
                     <ToggleSwitch
                         id={switchId}
                         checked={value}
diff --git a/client/ui/frontend/src/components/switches/SwitchItemGroup.tsx b/client/ui/frontend/src/components/switches/SwitchItemGroup.tsx
index e63d245b9..df4bac3df 100644
--- a/client/ui/frontend/src/components/switches/SwitchItemGroup.tsx
+++ b/client/ui/frontend/src/components/switches/SwitchItemGroup.tsx
@@ -1,6 +1,7 @@
 import * as RadioGroup from "@radix-ui/react-radio-group";
 import { createContext, type ReactNode, useContext, useId, useMemo } from "react";
 import { cn } from "@/lib/cn";
+import { useDirection } from "@/hooks/useDirection";
 
 type SwitchItemGroupContextValue = {
     value: string;
@@ -37,11 +38,13 @@ export const SwitchItemGroup = ({
     "aria-labelledby": ariaLabelledBy,
 }: Props) => {
     const layoutId = useId();
+    const dir = useDirection();
     const contextValue = useMemo(() => ({ value, layoutId }), [value, layoutId]);
 
     return (
         <SwitchItemGroupContext.Provider value={contextValue}>
             <RadioGroup.Root
+                dir={dir}
                 value={value}
                 onValueChange={onChange}
                 disabled={disabled}
diff --git a/client/ui/frontend/src/components/switches/ToggleSwitch.tsx b/client/ui/frontend/src/components/switches/ToggleSwitch.tsx
index f4fcfcf4b..6862f85d8 100644
--- a/client/ui/frontend/src/components/switches/ToggleSwitch.tsx
+++ b/client/ui/frontend/src/components/switches/ToggleSwitch.tsx
@@ -36,9 +36,9 @@ const switchVariants = cva("", {
         },
         "thumb-size": {
             default:
-                "h-5 w-5 data-[state=checked]:translate-x-5 data-[state=unchecked]:translate-x-0",
-            small: "h-[14px] w-[14px] data-[state=checked]:translate-x-[17px] data-[state=unchecked]:translate-x-0",
-            large: "h-[30px] w-[30px] data-[state=checked]:translate-x-[31px] data-[state=unchecked]:translate-x-[1px]",
+                "h-5 w-5 data-[state=checked]:translate-x-5 data-[state=unchecked]:translate-x-0 rtl:data-[state=checked]:-translate-x-5",
+            small: "h-[14px] w-[14px] data-[state=checked]:translate-x-[17px] data-[state=unchecked]:translate-x-0 rtl:data-[state=checked]:-translate-x-[17px]",
+            large: "h-[30px] w-[30px] data-[state=checked]:translate-x-[31px] data-[state=unchecked]:translate-x-[1px] rtl:data-[state=checked]:-translate-x-[31px] rtl:data-[state=unchecked]:-translate-x-[1px]",
         },
     },
 });
diff --git a/client/ui/frontend/src/globals.css b/client/ui/frontend/src/globals.css
index 5cf2fc25d..bfdabeb31 100644
--- a/client/ui/frontend/src/globals.css
+++ b/client/ui/frontend/src/globals.css
@@ -96,6 +96,11 @@ body {
     @apply bg-nb-gray font-sans text-nb-gray-200 antialiased;
 }
 
+[dir="rtl"] :is(.font-mono, code, kbd):not([dir]) {
+    direction: ltr;
+    unicode-bidi: isolate;
+}
+
 .wails-draggable {
     --wails-draggable: drag;
     cursor: default;
diff --git a/client/ui/frontend/src/hooks/useDirection.ts b/client/ui/frontend/src/hooks/useDirection.ts
new file mode 100644
index 000000000..4609a2ae2
--- /dev/null
+++ b/client/ui/frontend/src/hooks/useDirection.ts
@@ -0,0 +1,6 @@
+import { useTranslation } from "react-i18next";
+
+export function useDirection(): "ltr" | "rtl" {
+    const { i18n } = useTranslation();
+    return i18n.dir(i18n.language);
+}
diff --git a/client/ui/frontend/src/layouts/AppRightPanel.tsx b/client/ui/frontend/src/layouts/AppRightPanel.tsx
index 9656187e2..4e7bcb0f4 100644
--- a/client/ui/frontend/src/layouts/AppRightPanel.tsx
+++ b/client/ui/frontend/src/layouts/AppRightPanel.tsx
@@ -1,6 +1,7 @@
 import { type ReactNode } from "react";
 import { motion } from "framer-motion";
 import { cn } from "@/lib/cn.ts";
+import { useDirection } from "@/hooks/useDirection";
 
 type Props = {
     children: ReactNode;
@@ -15,17 +16,19 @@ const PANEL_TRANSITION = {
 };
 
 export const AppRightPanel = ({ children, overlay, overlayOpen = false, className }: Props) => {
+    const dir = useDirection();
+    const parallaxX = dir === "rtl" ? 48 : -48;
     return (
         <div
             className={cn(
                 "wails-no-draggable relative m-5",
                 "border border-nb-gray-800 bg-nb-gray-940 dark:border-nb-gray-920",
-                "flex min-h-0 min-w-0 flex-1 flex-col overflow-hidden rounded-xl rounded-br-2xl",
+                "flex min-h-0 min-w-0 flex-1 flex-col overflow-hidden rounded-xl rounded-ee-2xl",
                 className,
             )}
         >
             <motion.div
-                animate={{ x: overlayOpen ? -48 : 0 }}
+                animate={{ x: overlayOpen ? parallaxX : 0 }}
                 transition={PANEL_TRANSITION}
                 className={"flex min-h-0 min-w-0 flex-1 flex-col"}
                 style={{ pointerEvents: overlayOpen ? "none" : "auto" }}
diff --git a/client/ui/frontend/src/lib/i18n.ts b/client/ui/frontend/src/lib/i18n.ts
index dc7fc7902..87cc996dd 100644
--- a/client/ui/frontend/src/lib/i18n.ts
+++ b/client/ui/frontend/src/lib/i18n.ts
@@ -93,6 +93,7 @@ export async function initI18n(): Promise<void> {
 function syncDocumentLang() {
     if (typeof document !== "undefined") {
         document.documentElement.lang = i18next.language;
+        document.documentElement.dir = i18next.dir(i18next.language);
     }
 }
 
diff --git a/client/ui/frontend/src/modules/error/ErrorDialog.tsx b/client/ui/frontend/src/modules/error/ErrorDialog.tsx
index 4fbb78052..0be13b86e 100644
--- a/client/ui/frontend/src/modules/error/ErrorDialog.tsx
+++ b/client/ui/frontend/src/modules/error/ErrorDialog.tsx
@@ -66,7 +66,7 @@ export default function ErrorDialog() {
                         wrap
                         variant={"bright"}
                         className={
-                            "mt-2 w-full items-start gap-2 rounded-md bg-nb-gray-930 px-3 py-2 text-left"
+                            "mt-2 w-full items-start gap-2 rounded-md bg-nb-gray-930 px-3 py-2 text-start"
                         }
                         aria-label={t("common.copy")}
                     >
diff --git a/client/ui/frontend/src/modules/main/MainConnectionStatusSwitch.tsx b/client/ui/frontend/src/modules/main/MainConnectionStatusSwitch.tsx
index 2f4014741..df48524c1 100644
--- a/client/ui/frontend/src/modules/main/MainConnectionStatusSwitch.tsx
+++ b/client/ui/frontend/src/modules/main/MainConnectionStatusSwitch.tsx
@@ -267,12 +267,13 @@ export const MainConnectionStatusSwitch = () => {
                     tabIndex={show && fqdn ? 0 : -1}
                     className={cn(
                         "mt-1 max-h-[1em] min-h-[1em] max-w-full transition-opacity duration-300",
-                        "relative left-[0.55rem]",
+                        "relative start-[0.55rem]",
                         show && fqdn ? "opacity-100" : "pointer-events-none opacity-0",
                     )}
                 >
                     <TruncatedText
                         text={shortenDns(fqdn) || " "}
+                        dir={"ltr"}
                         className={
                             "block h-[18px] max-w-[310px] truncate font-mono text-[0.8rem] leading-tight text-nb-gray-300"
                         }
@@ -298,7 +299,7 @@ const LocalIpLine = ({ ip, ipv6, show }: { ip: string; ipv6: string; show: boole
                 tabIndex={show && ip ? 0 : -1}
                 className={cn(
                     "mt-1 max-h-[1em] min-h-[1em] transition-opacity duration-300",
-                    "relative left-[0.55rem]",
+                    "relative start-[0.55rem]",
                     show && ip ? "opacity-100" : "pointer-events-none opacity-0",
                 )}
             >
@@ -345,7 +346,7 @@ const LocalIpLine = ({ ip, ipv6, show }: { ip: string; ipv6: string; show: boole
                             size={14}
                             aria-hidden={"true"}
                             className={cn(
-                                "absolute -right-5 top-1/2 -translate-y-1/2",
+                                "absolute -end-5 top-1/2 -translate-y-1/2",
                                 "shrink-0 text-nb-gray-300 transition-colors",
                                 "group-hover:text-nb-gray-200",
                                 "group-data-[state=open]:text-nb-gray-200",
@@ -398,7 +399,7 @@ const IpRow = ({ value }: { value: string }) => {
             aria-label={`${t("common.copy")} ${value}`}
             className={cn(
                 "group/iprow relative flex items-center justify-between gap-3",
-                "rounded-md px-2 py-1.5 text-left",
+                "rounded-md px-2 py-1.5 text-start",
                 "text-nb-gray-200 hover:bg-nb-gray-900 hover:text-nb-gray-50",
                 "cursor-default outline-none transition-colors",
                 isFocusVisible &&
diff --git a/client/ui/frontend/src/modules/main/MainExitNodeSwitcher.tsx b/client/ui/frontend/src/modules/main/MainExitNodeSwitcher.tsx
index 0d6579dd7..3e6281352 100644
--- a/client/ui/frontend/src/modules/main/MainExitNodeSwitcher.tsx
+++ b/client/ui/frontend/src/modules/main/MainExitNodeSwitcher.tsx
@@ -9,10 +9,12 @@ import { TruncatedText } from "@/components/TruncatedText";
 import { useNetworks } from "@/contexts/NetworksContext";
 import { useStatus } from "@/contexts/StatusContext";
 import { useFocusVisible } from "@/hooks/useFocusVisible";
+import { useDirection } from "@/hooks/useDirection";
 
 const NONE_VALUE = "__none__";
 
 export const MainExitNodeSwitcher = () => {
+    const dir = useDirection();
     const { t } = useTranslation();
     const { status } = useStatus();
     const { exitNodes, toggleExitNode } = useNetworks();
@@ -101,7 +103,11 @@ export const MainExitNodeSwitcher = () => {
                             <NoneRow isActive={!active} onSelect={() => handleSelect(NONE_VALUE)} />
                             {hasAny && <div className={"-mx-1 my-1 h-px bg-nb-gray-910"} />}
                             {hasAny && (
-                                <ScrollArea.Root type={"auto"} className={"-mx-1 overflow-hidden"}>
+                                <ScrollArea.Root
+                                    dir={dir}
+                                    type={"auto"}
+                                    className={"-mx-1 overflow-hidden"}
+                                >
                                     <ScrollArea.Viewport className={"max-h-72 px-1"}>
                                         {exitNodes.map((n) => (
                                             <ExitNodeRow
@@ -155,7 +161,7 @@ const ExitNodeTriggerCard = forwardRef<HTMLButtonElement, TriggerProps>(
                 tabIndex={0}
                 disabled={disabled}
                 className={cn(
-                    "flex w-full items-center gap-3 rounded-xl p-2.5 pr-5 text-left outline-none",
+                    "flex w-full items-center gap-3 rounded-xl p-2.5 pe-5 text-start outline-none",
                     "border border-nb-gray-800 bg-nb-gray-940 dark:border-nb-gray-920",
                     "transition-colors duration-150",
                     "wails-no-draggable",
@@ -212,7 +218,7 @@ const NoneRow = ({ isActive, onSelect }: NoneRowProps) => {
             value={NONE_VALUE}
             onSelect={onSelect}
             className={cn(
-                "flex items-center gap-2 px-2 py-2 pr-3",
+                "flex items-center gap-2 px-2 py-2 pe-3",
                 "cursor-default rounded-md text-sm outline-none",
                 "data-[selected=true]:bg-nb-gray-900",
             )}
@@ -237,7 +243,7 @@ const ExitNodeRow = ({ id, label, isActive, onSelect }: ExitNodeRowProps) => (
         value={id}
         onSelect={onSelect}
         className={cn(
-            "flex items-center gap-2 px-2 py-2 pr-3",
+            "flex items-center gap-2 px-2 py-2 pe-3",
             "cursor-default rounded-md text-sm outline-none",
             "data-[selected=true]:bg-nb-gray-900",
         )}
diff --git a/client/ui/frontend/src/modules/main/MainHeader.tsx b/client/ui/frontend/src/modules/main/MainHeader.tsx
index d79e76cd1..6aa5b7993 100644
--- a/client/ui/frontend/src/modules/main/MainHeader.tsx
+++ b/client/ui/frontend/src/modules/main/MainHeader.tsx
@@ -25,7 +25,8 @@ import { cn } from "@/lib/cn";
 import { formatShortcut, useKeyboardShortcut } from "@/hooks/useKeyboardShortcut";
 import { useViewMode, type ViewMode } from "@/contexts/ViewModeContext";
 import { useRestrictions } from "@/contexts/RestrictionsContext";
-import { isWindows } from "@/lib/platform.ts";
+import { isMacOS, isWindows } from "@/lib/platform.ts";
+import { useDirection } from "@/hooks/useDirection";
 
 const SETTINGS_SHORTCUT = { key: ",", cmd: true } as const;
 
@@ -35,6 +36,8 @@ export const MainHeader = () => {
     const { viewMode, setViewMode } = useViewMode();
     const { updateAvailable } = useClientVersion();
     const { mdm, features } = useRestrictions();
+    const dir = useDirection();
+    const pinSettingsRight = isMacOS();
 
     const openSettings = useCallback(() => {
         setMenuOpen(false);
@@ -83,7 +86,7 @@ export const MainHeader = () => {
                     />
                 </DropdownMenuTrigger>
                 <DropdownMenuContent
-                    align={"end"}
+                    align={pinSettingsRight && dir === "rtl" ? "start" : "end"}
                     sideOffset={8}
                     className={
                         "min-w-52 select-none data-[state=closed]:!animate-none data-[state=closed]:!duration-0"
@@ -138,7 +141,7 @@ export const MainHeader = () => {
                 <span
                     aria-hidden={"true"}
                     className={
-                        "pointer-events-none absolute right-1.5 top-1.5 flex h-2.5 w-2.5 items-center justify-center"
+                        "pointer-events-none absolute end-1.5 top-1.5 flex h-2.5 w-2.5 items-center justify-center"
                     }
                 >
                     <span
@@ -168,10 +171,17 @@ export const MainHeader = () => {
                 )}
             >
                 <div />
-                <div className={"ml-4 flex justify-center"}>{profileSlot}</div>
+                <div className={"ml-4 flex justify-center rtl:ml-1"}>{profileSlot}</div>
                 <div />
             </div>
-            <div className={"absolute right-[1.3rem] top-1/2 -translate-y-1/2"}>{settingsSlot}</div>
+            <div
+                className={cn(
+                    "absolute top-1/2 -translate-y-1/2",
+                    pinSettingsRight ? "right-[1.3rem]" : "end-[1.3rem]",
+                )}
+            >
+                {settingsSlot}
+            </div>
         </header>
     );
 };
diff --git a/client/ui/frontend/src/modules/main/MainPage.tsx b/client/ui/frontend/src/modules/main/MainPage.tsx
index c05b3a025..1d8f8d1f6 100644
--- a/client/ui/frontend/src/modules/main/MainPage.tsx
+++ b/client/ui/frontend/src/modules/main/MainPage.tsx
@@ -55,7 +55,7 @@ const MainBody = () => {
             >
                 <MainConnectionStatusSwitch />
                 {!features.disableNetworks && (
-                    <div className={"wails-no-draggable absolute bottom-5 left-5 right-5"}>
+                    <div className={"wails-no-draggable absolute inset-x-5 bottom-5"}>
                         <MainExitNodeSwitcher />
                     </div>
                 )}
@@ -79,7 +79,7 @@ const AdvancedAppRightPanel = () => {
         <AppRightPanel
             overlay={<PeerDetailPanel />}
             overlayOpen={selected !== null}
-            className={"m-5 ml-0"}
+            className={"m-5 ms-0"}
         >
             <div
                 ref={(el) => {
diff --git a/client/ui/frontend/src/modules/main/advanced/Navigation.tsx b/client/ui/frontend/src/modules/main/advanced/Navigation.tsx
index dc8d7505b..1f0f527d1 100644
--- a/client/ui/frontend/src/modules/main/advanced/Navigation.tsx
+++ b/client/ui/frontend/src/modules/main/advanced/Navigation.tsx
@@ -5,6 +5,7 @@ import { cn } from "@/lib/cn";
 import { useNavSection, type NavSection } from "@/contexts/NavSectionContext";
 import { useStatus } from "@/contexts/StatusContext";
 import { useRestrictions } from "@/contexts/RestrictionsContext";
+import { useDirection } from "@/hooks/useDirection";
 
 type TabEntry = {
     value: NavSection;
@@ -48,6 +49,10 @@ export const Navigation = () => {
         requestAnimationFrame(() => tabRefs.current[value]?.focus());
     };
 
+    const dir = useDirection();
+    const forwardKey = dir === "rtl" ? "ArrowLeft" : "ArrowRight";
+    const backwardKey = dir === "rtl" ? "ArrowRight" : "ArrowLeft";
+
     const handleKeyDown = (e: KeyboardEvent<HTMLButtonElement>) => {
         const enabled = tabs.filter((t) => isConnected || t.value === section);
         if (enabled.length < 2) return;
@@ -55,10 +60,10 @@ export const Navigation = () => {
         if (currentIndex === -1) return;
         let nextIndex: number;
         switch (e.key) {
-            case "ArrowRight":
+            case forwardKey:
                 nextIndex = (currentIndex + 1) % enabled.length;
                 break;
-            case "ArrowLeft":
+            case backwardKey:
                 nextIndex = (currentIndex - 1 + enabled.length) % enabled.length;
                 break;
             case "Home":
@@ -106,8 +111,8 @@ export const Navigation = () => {
                             "group relative flex flex-1 items-center justify-center",
                             "gap-2.5 px-5 py-3.5",
                             "outline-none transition-all",
-                            isFirst && "rounded-tl-xl",
-                            isLast && "rounded-tr-xl",
+                            isFirst && "rounded-ss-xl",
+                            isLast && "rounded-se-xl",
                             "focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-nb-gray-50/60",
                             isActive ? "text-netbird" : "text-nb-gray-400 hover:text-nb-gray-300",
                             isDisabled ? "cursor-not-allowed opacity-50" : "cursor-default",
diff --git a/client/ui/frontend/src/modules/main/advanced/networks/NetworkFilters.tsx b/client/ui/frontend/src/modules/main/advanced/networks/NetworkFilters.tsx
index 0d8c9f4db..3686275f0 100644
--- a/client/ui/frontend/src/modules/main/advanced/networks/NetworkFilters.tsx
+++ b/client/ui/frontend/src/modules/main/advanced/networks/NetworkFilters.tsx
@@ -52,7 +52,7 @@ export const NetworkFilters = ({ value, onChange, counts, disabled }: Props) =>
                 <span>
                     {active.label} <span className={"tabular-nums"}>({counts[active.value]})</span>
                 </span>
-                <ChevronDown size={14} aria-hidden={"true"} className={"ml-0.5 shrink-0"} />
+                <ChevronDown size={14} aria-hidden={"true"} className={"ms-0.5 shrink-0"} />
             </DropdownMenuTrigger>
             <DropdownMenuContent align={"end"} className={"min-w-[10rem]"}>
                 {filters.map((f) => {
diff --git a/client/ui/frontend/src/modules/main/advanced/networks/Networks.tsx b/client/ui/frontend/src/modules/main/advanced/networks/Networks.tsx
index a13993aa9..da8028155 100644
--- a/client/ui/frontend/src/modules/main/advanced/networks/Networks.tsx
+++ b/client/ui/frontend/src/modules/main/advanced/networks/Networks.tsx
@@ -23,6 +23,7 @@ import { NoResults } from "@/components/empty-state/NoResults";
 import { useStatus } from "@/contexts/StatusContext";
 import { useNetworks } from "@/contexts/NetworksContext";
 import { type NetworkFilter, NetworkFilters } from "./NetworkFilters";
+import { useDirection } from "@/hooks/useDirection";
 
 // Daemon renders DNS-route prefixes (zero netip.Prefix) as "invalid Prefix".
 const INVALID_PREFIX = "invalid Prefix";
@@ -70,6 +71,7 @@ const buildOverlapMap = (
 };
 
 export const Networks = () => {
+    const dir = useDirection();
     const { t } = useTranslation();
     const { status } = useStatus();
     const isConnected = status?.status === "Connected";
@@ -175,7 +177,11 @@ export const Networks = () => {
             {filtered.length === 0 ? (
                 <NoResults />
             ) : (
-                <ScrollArea.Root type={"auto"} className={"min-h-0 flex-1 overflow-hidden"}>
+                <ScrollArea.Root
+                    dir={dir}
+                    type={"auto"}
+                    className={"min-h-0 flex-1 overflow-hidden"}
+                >
                     <ScrollArea.Viewport ref={setScrollParent} className={"h-full w-full"}>
                         {scrollParent && (
                             <NetworksList
@@ -343,7 +349,7 @@ const NetworkRow = ({ network: n, index, onKeyDown, onToggle, setRowRef }: Netwo
     return (
         <div
             className={cn(
-                "group relative flex min-w-0 items-start gap-2.5 py-3 pl-6 pr-9",
+                "group relative flex min-w-0 items-start gap-2.5 py-3 pe-9 ps-6",
                 "transition-colors hover:bg-nb-gray-900/40",
                 "wails-no-draggable",
             )}
@@ -423,6 +429,7 @@ const Subtitle = ({ network, onKeyDown }: SubtitleProps) => {
                 <CopyToClipboard message={network.range} onKeyDown={onKeyDown}>
                     <TruncatedText
                         text={network.range}
+                        dir={"ltr"}
                         className={
                             "block max-w-[300px] truncate font-mono text-xs text-nb-gray-400"
                         }
@@ -463,7 +470,7 @@ const DomainSubtitle = ({ domain, ips, onKeyDown }: DomainSubtitleProps) => {
                         contentClassName={cn(
                             "max-h-72 max-w-[18rem] overflow-auto",
                             "rounded-lg border border-nb-gray-800 bg-white dark:border-nb-gray-900 dark:bg-nb-gray-935",
-                            "p-2 pr-4",
+                            "p-2 pe-4",
                         )}
                     >
                         {span}
@@ -508,7 +515,9 @@ type ToggleProps = {
 };
 
 const NetworkToggle = ({ checked, mixed }: ToggleProps) => {
-    const checkedTranslate = checked ? "translate-x-[1.125rem]" : "translate-x-0.5";
+    const checkedTranslate = checked
+        ? "translate-x-[1.125rem] rtl:-translate-x-[1.125rem]"
+        : "translate-x-0.5 rtl:-translate-x-0.5";
     return (
         <span
             className={cn(
@@ -521,7 +530,7 @@ const NetworkToggle = ({ checked, mixed }: ToggleProps) => {
             <span
                 className={cn(
                     "inline-block h-4 w-4 rounded-full bg-white transition-transform",
-                    mixed ? "translate-x-2.5" : checkedTranslate,
+                    mixed ? "translate-x-2.5 rtl:-translate-x-2.5" : checkedTranslate,
                 )}
             />
         </span>
diff --git a/client/ui/frontend/src/modules/main/advanced/peers/PeerDetailPanel.tsx b/client/ui/frontend/src/modules/main/advanced/peers/PeerDetailPanel.tsx
index ee3de6643..e22054c68 100644
--- a/client/ui/frontend/src/modules/main/advanced/peers/PeerDetailPanel.tsx
+++ b/client/ui/frontend/src/modules/main/advanced/peers/PeerDetailPanel.tsx
@@ -43,6 +43,7 @@ import { useStatus } from "@/contexts/StatusContext";
 import { usePeerDetail } from "@/contexts/PeerDetailContext";
 import { useFocusVisible } from "@/hooks/useFocusVisible";
 import { peerStatusLabelKey } from "./Peers";
+import { useDirection } from "@/hooks/useDirection";
 
 const DEFAULT_TRANSITION: Transition = {
     duration: 0.32,
@@ -70,6 +71,8 @@ export const PeerDetailPanel = ({ transition = DEFAULT_TRANSITION }: Props) => {
     const { t } = useTranslation();
     const { selected, setSelected } = usePeerDetail();
     const { status, refresh } = useStatus();
+    const dir = useDirection();
+    const offscreenX = dir === "rtl" ? "-100%" : "100%";
 
     useEffect(() => {
         if (!selected) return;
@@ -111,7 +114,7 @@ export const PeerDetailPanel = ({ transition = DEFAULT_TRANSITION }: Props) => {
                 setSelected(null);
                 return;
             }
-            if (e.key === "ArrowLeft") {
+            if (e.key === (dir === "rtl" ? "ArrowRight" : "ArrowLeft")) {
                 const target = e.target as HTMLElement | null;
                 const tag = target?.tagName;
                 if (tag === "INPUT" || tag === "TEXTAREA" || target?.isContentEditable) return;
@@ -120,7 +123,7 @@ export const PeerDetailPanel = ({ transition = DEFAULT_TRANSITION }: Props) => {
         };
         globalThis.addEventListener("keydown", onKey);
         return () => globalThis.removeEventListener("keydown", onKey);
-    }, [selected, setSelected]);
+    }, [selected, setSelected, dir]);
 
     const dialogRef = useRef<HTMLDivElement>(null);
     const backButtonRef = useRef<HTMLButtonElement>(null);
@@ -172,9 +175,9 @@ export const PeerDetailPanel = ({ transition = DEFAULT_TRANSITION }: Props) => {
                     aria-modal={"true"}
                     aria-labelledby={"nb-peer-detail-title"}
                     onKeyDown={onDialogKeyDown}
-                    initial={{ x: "100%" }}
+                    initial={{ x: offscreenX }}
                     animate={{ x: 0 }}
-                    exit={{ x: "100%" }}
+                    exit={{ x: offscreenX }}
                     transition={transition}
                     style={{ willChange: "transform" }}
                     className={cn("absolute inset-0 z-20 flex flex-col", "bg-nb-gray-940")}
@@ -199,7 +202,11 @@ export const PeerDetailPanel = ({ transition = DEFAULT_TRANSITION }: Props) => {
                                 "wails-no-draggable",
                             )}
                         >
-                            <ArrowLeftIcon size={16} aria-hidden={"true"} />
+                            <ArrowLeftIcon
+                                size={16}
+                                aria-hidden={"true"}
+                                className={"rtl:-scale-x-100"}
+                            />
                         </button>
                         <Tooltip content={t(peerStatusLabelKey(selected.connStatus))} side={"top"}>
                             <span
@@ -248,7 +255,11 @@ export const PeerDetailPanel = ({ transition = DEFAULT_TRANSITION }: Props) => {
                             </button>
                         </Tooltip>
                     </div>
-                    <ScrollArea.Root type={"auto"} className={"min-h-0 flex-1 overflow-hidden"}>
+                    <ScrollArea.Root
+                        dir={dir}
+                        type={"auto"}
+                        className={"min-h-0 flex-1 overflow-hidden"}
+                    >
                         <ScrollArea.Viewport className={"h-full w-full"}>
                             <PeerDetails peer={selected} now={now} />
                         </ScrollArea.Viewport>
@@ -466,7 +477,7 @@ const ResourcesPopover = ({ networks }: { networks: string[] }) => {
                         "inline-flex shrink-0 items-center gap-1 rounded",
                         "bg-nb-gray-930 hover:bg-nb-gray-910/80 data-[state=open]:bg-nb-gray-910",
                         "border border-nb-gray-900",
-                        "py-1 pl-2.5 pr-2 text-xs font-medium text-nb-gray-300",
+                        "py-1 pe-2 ps-2.5 text-xs font-medium text-nb-gray-300",
                         "wails-no-draggable cursor-default outline-none transition-all",
                         "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
                     )}
@@ -526,7 +537,7 @@ const ResourceRow = ({ value }: { value: string }) => {
             aria-label={`${t("common.copy")} ${value}`}
             className={cn(
                 "group/resourcerow relative flex items-center justify-between gap-3",
-                "rounded-md px-2 py-1.5 text-left",
+                "rounded-md px-2 py-1.5 text-start",
                 "text-nb-gray-200 hover:bg-nb-gray-900 hover:text-nb-gray-50",
                 "cursor-default outline-none transition-colors",
                 isFocusVisible &&
@@ -547,6 +558,7 @@ const ResourceRow = ({ value }: { value: string }) => {
 const TruncatedRowValue = ({ value, mono }: { value: string; mono?: boolean }) => (
     <TruncatedText
         text={value}
+        dir={mono ? "ltr" : "auto"}
         className={cn(
             "inline-block min-w-0 max-w-[260px] truncate align-middle",
             mono && "font-mono",
@@ -564,7 +576,7 @@ const Row = ({ icon: Icon, iconClassName, label, children }: RowProps) => (
         <span className={"shrink-0 font-semibold text-nb-gray-200"}>{label}</span>
         <span
             className={cn(
-                "min-w-0 flex-1 pl-8 text-right",
+                "min-w-0 flex-1 ps-8 text-end",
                 "font-medium text-nb-gray-350",
                 "flex items-center justify-end",
             )}
diff --git a/client/ui/frontend/src/modules/main/advanced/peers/PeerFilters.tsx b/client/ui/frontend/src/modules/main/advanced/peers/PeerFilters.tsx
index 51dd5b04e..524bae5d4 100644
--- a/client/ui/frontend/src/modules/main/advanced/peers/PeerFilters.tsx
+++ b/client/ui/frontend/src/modules/main/advanced/peers/PeerFilters.tsx
@@ -52,7 +52,7 @@ export const PeerFilters = ({ value, onChange, counts, disabled }: Props) => {
                 <span>
                     {active.label} <span className={"tabular-nums"}>({counts[active.value]})</span>
                 </span>
-                <ChevronDown size={14} aria-hidden={"true"} className={"ml-0.5 shrink-0"} />
+                <ChevronDown size={14} aria-hidden={"true"} className={"ms-0.5 shrink-0"} />
             </DropdownMenuTrigger>
             <DropdownMenuContent align={"end"} className={"min-w-[10rem]"}>
                 {filters.map((f) => {
diff --git a/client/ui/frontend/src/modules/main/advanced/peers/Peers.tsx b/client/ui/frontend/src/modules/main/advanced/peers/Peers.tsx
index f3cb0f139..79a02a471 100644
--- a/client/ui/frontend/src/modules/main/advanced/peers/Peers.tsx
+++ b/client/ui/frontend/src/modules/main/advanced/peers/Peers.tsx
@@ -15,6 +15,7 @@ import { useStatus } from "@/contexts/StatusContext";
 import { usePeerDetail } from "@/contexts/PeerDetailContext";
 import { Tooltip } from "@/components/Tooltip";
 import { TruncatedText } from "@/components/TruncatedText";
+import { useDirection } from "@/hooks/useDirection";
 import { PeerFilters, type StatusFilter } from "./PeerFilters";
 
 const isOnline = (connStatus: string) => connStatus === "Connected";
@@ -42,6 +43,7 @@ export const peerStatusLabelKey = (connStatus: string): string => {
 };
 
 export const Peers = () => {
+    const dir = useDirection();
     const { t } = useTranslation();
     const { status } = useStatus();
     const [search, setSearch] = useState("");
@@ -135,7 +137,11 @@ export const Peers = () => {
             {filtered.length === 0 ? (
                 <NoResults />
             ) : (
-                <ScrollArea.Root type={"auto"} className={"min-h-0 flex-1 overflow-hidden"}>
+                <ScrollArea.Root
+                    dir={dir}
+                    type={"auto"}
+                    className={"min-h-0 flex-1 overflow-hidden"}
+                >
                     <ScrollArea.Viewport ref={setScrollParent} className={"h-full w-full"}>
                         {scrollParent && <PeersList data={filtered} scrollParent={scrollParent} />}
                     </ScrollArea.Viewport>
@@ -167,6 +173,7 @@ type PeersListProps = {
 
 const PeersList = ({ data, scrollParent }: PeersListProps) => {
     const { setSelected } = usePeerDetail();
+    const dir = useDirection();
     const virtuosoRef = useRef<VirtuosoHandle>(null);
     const rowRefs = useRef<Map<string, HTMLButtonElement>>(new Map());
 
@@ -200,7 +207,7 @@ const PeersList = ({ data, scrollParent }: PeersListProps) => {
                 e.preventDefault();
                 focusRow(Math.max(index - 1, 0));
                 break;
-            case "ArrowRight":
+            case dir === "rtl" ? "ArrowLeft" : "ArrowRight":
                 e.preventDefault();
                 setSelected(data[index]);
                 break;
@@ -223,7 +230,7 @@ const PeersList = ({ data, scrollParent }: PeersListProps) => {
     const ctx = useMemo<PeerRowContext>(
         () => ({ onKeyDown: handleRowKeyDown, onSelect: setSelected, setRowRef }),
         // eslint-disable-next-line react-hooks/exhaustive-deps
-        [data, setSelected],
+        [data, setSelected, dir],
     );
 
     return (
@@ -273,7 +280,7 @@ const PeerRow = ({ peer, index, onKeyDown, onSelect, setRowRef }: PeerRowProps)
     return (
         <div
             className={cn(
-                "group relative flex min-w-0 items-start gap-2.5 py-3 pl-6 pr-4",
+                "group relative flex min-w-0 items-start gap-2.5 py-3 pe-4 ps-6",
                 "transition-colors hover:bg-nb-gray-900/40",
                 "wails-no-draggable",
             )}
@@ -344,7 +351,7 @@ const PeerRow = ({ peer, index, onKeyDown, onSelect, setRowRef }: PeerRowProps)
                 size={16}
                 aria-hidden={"true"}
                 className={cn(
-                    "pointer-events-none relative shrink-0 self-center text-nb-gray-300",
+                    "pointer-events-none relative shrink-0 self-center text-nb-gray-300 rtl:-scale-x-100",
                     "opacity-0 transition-opacity group-hover:opacity-100",
                 )}
             />
diff --git a/client/ui/frontend/src/modules/profiles/ProfileCreationModal.tsx b/client/ui/frontend/src/modules/profiles/ProfileCreationModal.tsx
index 19313ccb3..487080f3d 100644
--- a/client/ui/frontend/src/modules/profiles/ProfileCreationModal.tsx
+++ b/client/ui/frontend/src/modules/profiles/ProfileCreationModal.tsx
@@ -175,7 +175,7 @@ export const ProfileCreationModal = ({ open, onOpenChange, onSubmit, initial }:
                 <form onSubmit={handleSubmit}>
                     <div className={"flex flex-col gap-6 px-7"}>
                         <div className={"flex flex-col gap-2"}>
-                            <div className={"pl-1"}>
+                            <div className={"ps-1"}>
                                 <Label htmlFor={nameId} className={"mb-0.5"}>
                                     {t("profile.dialog.nameLabel")}
                                 </Label>
@@ -200,7 +200,7 @@ export const ProfileCreationModal = ({ open, onOpenChange, onSubmit, initial }:
 
                         {!managedManagementUrl && (
                             <div className={"flex flex-col gap-2"}>
-                                <div className={"pl-1"}>
+                                <div className={"ps-1"}>
                                     <Label as={"div"} className={"mb-0.5"}>
                                         {t("settings.general.management.label")}
                                     </Label>
@@ -217,6 +217,7 @@ export const ProfileCreationModal = ({ open, onOpenChange, onSubmit, initial }:
                                     {mode === ManagementMode.SelfHosted && (
                                         <Input
                                             id={urlId}
+                                            dir={"ltr"}
                                             ref={urlRef}
                                             aria-label={t("settings.general.management.label")}
                                             placeholder={t(
diff --git a/client/ui/frontend/src/modules/profiles/ProfileDropdown.tsx b/client/ui/frontend/src/modules/profiles/ProfileDropdown.tsx
index 81da3aa29..ec70fb923 100644
--- a/client/ui/frontend/src/modules/profiles/ProfileDropdown.tsx
+++ b/client/ui/frontend/src/modules/profiles/ProfileDropdown.tsx
@@ -11,6 +11,7 @@ import { useProfile } from "@/contexts/ProfileContext";
 import { useFocusVisible } from "@/hooks/useFocusVisible";
 import { cn } from "@/lib/cn";
 import { errorDialog, formatErrorMessage } from "@/lib/errors";
+import { useDirection } from "@/hooks/useDirection";
 
 type ProfileDropdownProps = {
     onManageProfiles?: () => void;
@@ -19,6 +20,7 @@ type ProfileDropdownProps = {
 const MANAGE_VALUE = "__manage_profiles__";
 
 export const ProfileDropdown = ({ onManageProfiles }: ProfileDropdownProps) => {
+    const dir = useDirection();
     const { t } = useTranslation();
     const { activeProfile, activeProfileId, profiles, switchProfile, loaded } = useProfile();
     const [open, setOpen] = useState(false);
@@ -116,6 +118,7 @@ export const ProfileDropdown = ({ onManageProfiles }: ProfileDropdownProps) => {
                             {sortedProfiles.length > 0 && (
                                 <>
                                     <ScrollArea.Root
+                                        dir={dir}
                                         type={"auto"}
                                         className={"-mx-1 overflow-hidden"}
                                     >
@@ -252,7 +255,7 @@ const ProfileRow = ({ profile, isActive, onSelect }: ProfileRowProps) => {
             value={profile.id}
             onSelect={() => onSelect(profile.id)}
             className={cn(
-                "flex w-auto gap-2 px-2 py-2 pr-3 last:mb-1",
+                "flex w-auto gap-2 px-2 py-2 pe-3 last:mb-1",
                 "cursor-default rounded-md text-sm outline-none",
                 "data-[selected=true]:bg-nb-gray-900",
                 showEmail ? "items-start" : "items-center",
diff --git a/client/ui/frontend/src/modules/profiles/ProfilesTab.tsx b/client/ui/frontend/src/modules/profiles/ProfilesTab.tsx
index f2110fda0..509f48061 100644
--- a/client/ui/frontend/src/modules/profiles/ProfilesTab.tsx
+++ b/client/ui/frontend/src/modules/profiles/ProfilesTab.tsx
@@ -440,7 +440,7 @@ const ProfileRow = ({
                     {showEmail && <TruncatedEmail email={profile.email} />}
                 </div>
             </td>
-            <td className={"shrink-0 text-right"}>
+            <td className={"shrink-0 text-end"}>
                 <RowActions
                     canSwitch={!isActive}
                     canDeregister={!!profile.email}
diff --git a/client/ui/frontend/src/modules/settings/SettingsAbout.tsx b/client/ui/frontend/src/modules/settings/SettingsAbout.tsx
index c103d1d74..7228e2a6c 100644
--- a/client/ui/frontend/src/modules/settings/SettingsAbout.tsx
+++ b/client/ui/frontend/src/modules/settings/SettingsAbout.tsx
@@ -112,7 +112,7 @@ export function SettingsAbout() {
                     {daemonVersion === "development" ? (
                         <span>
                             {t("settings.about.clientName")}{" "}
-                            <span className={"font-mono text-yellow-400"}>
+                            <span dir={"auto"} className={"font-mono text-yellow-400"}>
                                 {t("settings.about.development")}
                             </span>
                         </span>
@@ -124,7 +124,7 @@ export function SettingsAbout() {
                     {guiVersion === "development" ? (
                         <span>
                             {t("settings.about.guiName")}{" "}
-                            <span className={"font-mono text-yellow-400"}>
+                            <span dir={"auto"} className={"font-mono text-yellow-400"}>
                                 {t("settings.about.development")}
                             </span>
                         </span>
diff --git a/client/ui/frontend/src/modules/settings/SettingsAdvanced.tsx b/client/ui/frontend/src/modules/settings/SettingsAdvanced.tsx
index 37b1932d9..6cb54d124 100644
--- a/client/ui/frontend/src/modules/settings/SettingsAdvanced.tsx
+++ b/client/ui/frontend/src/modules/settings/SettingsAdvanced.tsx
@@ -102,6 +102,7 @@ export function SettingsAdvanced() {
             <SectionGroup title={t("settings.advanced.section.interface")}>
                 <Input
                     label={t("settings.advanced.interfaceName.label")}
+                    dir={"ltr"}
                     value={values.interfaceName}
                     error={errors.interfaceName}
                     onChange={(e) => setValues((v) => ({ ...v, interfaceName: e.target.value }))}
@@ -151,6 +152,7 @@ export function SettingsAdvanced() {
                         <HelpText>{t("settings.advanced.psk.help")}</HelpText>
                         <Input
                             type={"password"}
+                            dir={"ltr"}
                             showPasswordToggle={pskInputValue !== PSK_MASK}
                             placeholder={"kQv0qF3oQpJYdgD5mC9hL7sB2xZ8nT4eU6wY1aR3jK0="}
                             value={pskInputValue}
diff --git a/client/ui/frontend/src/modules/settings/SettingsGeneral.tsx b/client/ui/frontend/src/modules/settings/SettingsGeneral.tsx
index 5e0327648..06620614e 100644
--- a/client/ui/frontend/src/modules/settings/SettingsGeneral.tsx
+++ b/client/ui/frontend/src/modules/settings/SettingsGeneral.tsx
@@ -88,6 +88,7 @@ export function SettingsGeneral() {
                             <div className={"mt-2 flex items-start gap-3"}>
                                 <Input
                                     id={managementUrlId}
+                                    dir={"ltr"}
                                     ref={inputRef}
                                     value={displayUrl}
                                     onChange={(e) => setUrl(e.target.value)}
diff --git a/client/ui/frontend/src/modules/settings/SettingsPage.tsx b/client/ui/frontend/src/modules/settings/SettingsPage.tsx
index bf0db3bec..9fb6e2129 100644
--- a/client/ui/frontend/src/modules/settings/SettingsPage.tsx
+++ b/client/ui/frontend/src/modules/settings/SettingsPage.tsx
@@ -17,6 +17,7 @@ import { SettingsAdvanced } from "@/modules/settings/SettingsAdvanced.tsx";
 import { SettingsTroubleshooting } from "@/modules/settings/SettingsTroubleshooting.tsx";
 import { SettingsAbout } from "@/modules/settings/SettingsAbout.tsx";
 import { useRestrictions } from "@/contexts/RestrictionsContext.tsx";
+import { useDirection } from "@/hooks/useDirection";
 
 const EVENT_SETTINGS_OPEN = "netbird:settings:open";
 
@@ -43,6 +44,7 @@ const TAB_CONTENT: Record<Tab, ReactNode> = {
 };
 
 export const SettingsPage = () => {
+    const dir = useDirection();
     const location = useLocation();
     const navState = location.state as { tab?: string } | null;
     const { mdm, features } = useRestrictions();
@@ -94,6 +96,7 @@ export const SettingsPage = () => {
                         <AutostartSettingsProvider>
                             <SettingsProvider>
                                 <ScrollArea.Root
+                                    dir={dir}
                                     key={active}
                                     type={"auto"}
                                     className={"min-h-0 flex-1 overflow-hidden"}
diff --git a/client/ui/frontend/src/modules/settings/SettingsSection.tsx b/client/ui/frontend/src/modules/settings/SettingsSection.tsx
index 4b67fe7eb..3a39d661f 100644
--- a/client/ui/frontend/src/modules/settings/SettingsSection.tsx
+++ b/client/ui/frontend/src/modules/settings/SettingsSection.tsx
@@ -30,7 +30,7 @@ export const SectionGroup = ({
 export const SettingsBottomBar = ({ children }: { children: ReactNode }) => (
     <>
         <div className={"h-[3.2rem] shrink-0"} aria-hidden={"true"} />
-        <div className={"absolute bottom-0 left-0 w-full"}>
+        <div className={"absolute bottom-0 start-0 w-full"}>
             <div
                 className={
                     "flex w-full justify-end gap-3 border-t border-nb-gray-800 bg-nb-gray-940 px-8 py-5 dark:border-nb-gray-920"
diff --git a/client/ui/frontend/src/modules/settings/SettingsTroubleshooting.tsx b/client/ui/frontend/src/modules/settings/SettingsTroubleshooting.tsx
index 63f5e8e3d..de7b2cba2 100644
--- a/client/ui/frontend/src/modules/settings/SettingsTroubleshooting.tsx
+++ b/client/ui/frontend/src/modules/settings/SettingsTroubleshooting.tsx
@@ -298,10 +298,11 @@ function DoneResult({
             </div>
 
             <div className={"flex w-full max-w-sm flex-col gap-3"}>
-                {showKey && <Input value={result.uploadedKey} readOnly copy />}
+                {showKey && <Input dir={"ltr"} value={result.uploadedKey} readOnly copy />}
 
                 {result.path && !showKey && (
                     <Input
+                        dir={"ltr"}
                         value={result.path}
                         readOnly
                         aria-label={t("settings.troubleshooting.done.savedTitle")}
diff --git a/client/ui/frontend/src/modules/welcome/WelcomeStepManagement.tsx b/client/ui/frontend/src/modules/welcome/WelcomeStepManagement.tsx
index 5cb04d484..0fb973122 100644
--- a/client/ui/frontend/src/modules/welcome/WelcomeStepManagement.tsx
+++ b/client/ui/frontend/src/modules/welcome/WelcomeStepManagement.tsx
@@ -90,10 +90,10 @@ export function WelcomeStepManagement({
     return (
         <>
             <div className={cn("flex flex-col items-center gap-1", isMacOS() && "mt-4")}>
-                <DialogHeading id={"nb-welcome-management-title"} align={"left"}>
+                <DialogHeading id={"nb-welcome-management-title"} align={"start"}>
                     {t("welcome.management.title")}
                 </DialogHeading>
-                <DialogDescription align={"left"}>
+                <DialogDescription align={"start"}>
                     {t("welcome.management.description")}
                 </DialogDescription>
             </div>
@@ -103,9 +103,10 @@ export function WelcomeStepManagement({
             </div>
 
             {mode === ManagementMode.SelfHosted && (
-                <div className={"wails-no-draggable w-full text-left"}>
+                <div className={"wails-no-draggable w-full text-start"}>
                     <Input
                         ref={inputRef}
+                        dir={"ltr"}
                         placeholder={t("welcome.management.urlPlaceholder")}
                         value={url}
                         onChange={(e) => setUrl(e.target.value)}
diff --git a/client/ui/frontend/src/modules/welcome/WelcomeStepTray.tsx b/client/ui/frontend/src/modules/welcome/WelcomeStepTray.tsx
index 5a8b0d015..8838e5c92 100644
--- a/client/ui/frontend/src/modules/welcome/WelcomeStepTray.tsx
+++ b/client/ui/frontend/src/modules/welcome/WelcomeStepTray.tsx
@@ -38,10 +38,10 @@ export function WelcomeStepTray({ onContinue }: Readonly<WelcomeStepTrayProps>)
             </div>
 
             <div className={"flex w-full flex-col gap-1"}>
-                <DialogHeading id={"nb-welcome-title"} align={"left"}>
+                <DialogHeading id={"nb-welcome-title"} align={"start"}>
                     {t(titleKey)}
                 </DialogHeading>
-                <DialogDescription align={"left"}>{t(descriptionKey)}</DialogDescription>
+                <DialogDescription align={"start"}>{t(descriptionKey)}</DialogDescription>
             </div>
 
             <DialogActions>

From a816acd97c416ff2f6b263a2a1a7bd47b2affc11 Mon Sep 17 00:00:00 2001
From: Pascal Fischer <32096965+pascal-fischer@users.noreply.github.com>
Date: Tue, 6 Oct 2026 14:53:16 +0200
Subject: [PATCH 10/18] [management] fix the concurrency handling within the
 update message tests (#8000)

---
 management/server/account_test.go             |   87 +-
 management/server/affected_peers_jwt_test.go  |  154 +-
 .../server/affected_peers_oldstate_test.go    |  198 +--
 .../affected_peers_router_paths_test.go       |  264 ++--
 .../server/affected_peers_router_test.go      |  508 +++----
 management/server/affected_peers_test.go      | 1320 +++++++++--------
 management/server/affected_peers_user_test.go |  238 ++-
 management/server/cache/idp.go                |   12 +-
 management/server/dns_test.go                 |  284 ++--
 management/server/group_test.go               |  635 ++++----
 management/server/nameserver_test.go          |  260 ++--
 management/server/peer_test.go                |  696 +++++----
 management/server/policy_test.go              |  552 +++----
 management/server/posture_checks_test.go      |  586 ++++----
 management/server/route_test.go               |  496 ++++---
 management/server/setupkey_test.go            |  128 +-
 management/server/user_test.go                |  266 ++--
 17 files changed, 3417 insertions(+), 3267 deletions(-)

diff --git a/management/server/account_test.go b/management/server/account_test.go
index 881ad19d7..6067b6023 100644
--- a/management/server/account_test.go
+++ b/management/server/account_test.go
@@ -13,6 +13,7 @@ import (
 	"strings"
 	"sync"
 	"testing"
+	"testing/synctest"
 	"time"
 
 	"github.com/prometheus/client_golang/prometheus/push"
@@ -40,6 +41,7 @@ import (
 	"github.com/netbirdio/netbird/management/internals/modules/zones"
 	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
 	networkmapdbfactory "github.com/netbirdio/netbird/management/internals/network_map_db/factory"
+	networkmap_sqlite "github.com/netbirdio/netbird/management/internals/network_map_db/sqlite"
 	"github.com/netbirdio/netbird/management/internals/server/config"
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
 	nbAccount "github.com/netbirdio/netbird/management/server/account"
@@ -1297,7 +1299,9 @@ func TestAccountManager_AddPeerWithUserID(t *testing.T) {
 }
 
 func TestAccountManager_NetworkUpdates_SaveGroup(t *testing.T) {
-	testAccountManager_NetworkUpdates_SaveGroup(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		testAccountManager_NetworkUpdates_SaveGroup(t)
+	})
 }
 
 func testAccountManager_NetworkUpdates_SaveGroup(t *testing.T) {
@@ -1330,6 +1334,8 @@ func testAccountManager_NetworkUpdates_SaveGroup(t *testing.T) {
 	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
 	defer updateManager.CloseChannel(context.Background(), peer1.ID)
 
+	settleAffectedUpdates(updMsg)
+
 	wg := sync.WaitGroup{}
 	wg.Add(1)
 	go func() {
@@ -1352,7 +1358,9 @@ func testAccountManager_NetworkUpdates_SaveGroup(t *testing.T) {
 }
 
 func TestAccountManager_NetworkUpdates_DeletePolicy(t *testing.T) {
-	testAccountManager_NetworkUpdates_DeletePolicy(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		testAccountManager_NetworkUpdates_DeletePolicy(t)
+	})
 }
 
 func testAccountManager_NetworkUpdates_DeletePolicy(t *testing.T) {
@@ -1361,13 +1369,7 @@ func testAccountManager_NetworkUpdates_DeletePolicy(t *testing.T) {
 	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
 	defer updateManager.CloseChannel(context.Background(), peer1.ID)
 
-	// Ensure that we do not receive an update message before the policy is deleted
-	time.Sleep(time.Second)
-	select {
-	case <-updMsg:
-		t.Logf("received addPeer update message before policy deletion")
-	default:
-	}
+	settleAffectedUpdates(updMsg)
 
 	wg := sync.WaitGroup{}
 	wg.Add(1)
@@ -1390,7 +1392,9 @@ func testAccountManager_NetworkUpdates_DeletePolicy(t *testing.T) {
 }
 
 func TestAccountManager_NetworkUpdates_SavePolicy(t *testing.T) {
-	testAccountManager_NetworkUpdates_SavePolicy(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		testAccountManager_NetworkUpdates_SavePolicy(t)
+	})
 }
 
 func testAccountManager_NetworkUpdates_SavePolicy(t *testing.T) {
@@ -1410,6 +1414,8 @@ func testAccountManager_NetworkUpdates_SavePolicy(t *testing.T) {
 	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
 	defer updateManager.CloseChannel(context.Background(), peer1.ID)
 
+	settleAffectedUpdates(updMsg)
+
 	wg := sync.WaitGroup{}
 	wg.Add(1)
 	go func() {
@@ -1443,7 +1449,9 @@ func testAccountManager_NetworkUpdates_SavePolicy(t *testing.T) {
 }
 
 func TestAccountManager_NetworkUpdates_DeletePeer(t *testing.T) {
-	testAccountManager_NetworkUpdates_DeletePeer(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		testAccountManager_NetworkUpdates_DeletePeer(t)
+	})
 }
 
 func testAccountManager_NetworkUpdates_DeletePeer(t *testing.T) {
@@ -1482,6 +1490,8 @@ func testAccountManager_NetworkUpdates_DeletePeer(t *testing.T) {
 	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
 	defer updateManager.CloseChannel(context.Background(), peer1.ID)
 
+	settleAffectedUpdates(updMsg)
+
 	wg := sync.WaitGroup{}
 	wg.Add(1)
 	go func() {
@@ -1503,7 +1513,9 @@ func testAccountManager_NetworkUpdates_DeletePeer(t *testing.T) {
 }
 
 func TestAccountManager_NetworkUpdates_DeleteGroup(t *testing.T) {
-	testAccountManager_NetworkUpdates_DeleteGroup(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		testAccountManager_NetworkUpdates_DeleteGroup(t)
+	})
 }
 
 func testAccountManager_NetworkUpdates_DeleteGroup(t *testing.T) {
@@ -1550,6 +1562,8 @@ func testAccountManager_NetworkUpdates_DeleteGroup(t *testing.T) {
 		}
 	}
 
+	settleAffectedUpdates(updMsg)
+
 	wg := sync.WaitGroup{}
 	wg.Add(1)
 	go func() {
@@ -3582,6 +3596,9 @@ func createManagerWithNetworkMapStore(t testing.TB) (*DefaultAccountManager, *up
 
 	nmdataStore, err := networkmapdbfactory.NewNetworkMapDBStore(context.Background(), types.SqliteStoreEngine, dataDir, MockIntegratedValidator{}, newSettingsMockManager(t))
 	require.NoError(t, err)
+	sqliteStore, ok := nmdataStore.Store.(*networkmap_sqlite.SqliteStore)
+	require.True(t, ok, "network map store is %T, want *networkmap_sqlite.SqliteStore", nmdataStore.Store)
+	t.Cleanup(func() { assert.NoError(t, sqliteStore.Db.Close()) })
 
 	manager, updateManager, err := buildTestManager(t, store, nmdataStore)
 	require.NoError(t, err)
@@ -3636,7 +3653,8 @@ func buildTestManager(t testing.TB, store store.Store, nmdataStore *networkmapdb
 		Return(nil).
 		AnyTimes()
 
-	cacheStore, err := cache.NewStore(ctx, 100*time.Millisecond, 300*time.Millisecond, 100)
+	// The go-cache janitor only stops via a GC finalizer and would outlive synctest bubbles.
+	cacheStore, err := cache.NewStore(ctx, 100*time.Millisecond, 0, 100)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -3648,8 +3666,11 @@ func buildTestManager(t testing.TB, store store.Store, nmdataStore *networkmapdb
 	if err != nil {
 		return nil, nil, err
 	}
+	cacheManager := manager.cacheManager
+	t.Cleanup(func() { assert.NoError(t, cacheManager.Close()) })
 
 	proxyGrpcServer := nbgrpc.NewProxyServiceServer(nil, nil, nil, nbgrpc.ProxyOIDCConfig{}, peersManager, nil, nil, proxyManager, nil)
+	t.Cleanup(proxyGrpcServer.Close)
 	proxyController, err := proxymanager.NewGRPCController(proxyGrpcServer, noop.Meter{})
 	if err != nil {
 		return nil, nil, err
@@ -3743,6 +3764,33 @@ func setupNetworkMapTest(t *testing.T) (*DefaultAccountManager, *update_channel.
 // when the channel delivers.
 const peerUpdateTimeout = 5 * time.Second
 
+// peerUpdateSettleTime bounds how far settleAffectedUpdates advances the fake clock. It must exceed
+// the account request and peer update buffer intervals.
+const peerUpdateSettleTime = time.Second
+
+// runPeerUpdateTest runs f inside synctest.Test, so the peer update helpers observe every background
+// goroutine of the test, and lets the updates still in flight when f returns finish before the bubble
+// ends, since the bubble's clock stops with it.
+func runPeerUpdateTest(t *testing.T, f func(t *testing.T)) {
+	synctest.Test(t, func(t *testing.T) {
+		defer settleAffectedUpdates()
+		f(t)
+	})
+}
+
+// settleAffectedUpdates runs the synctest bubble's fake clock past every update buffer interval until
+// all goroutines are blocked, then discards the updates already delivered to chans, so the next
+// assertion only observes updates from the action under test. It must be called inside synctest.Test.
+func settleAffectedUpdates(chans ...<-chan *network_map.UpdateMessage) {
+	time.Sleep(peerUpdateSettleTime)
+	synctest.Wait()
+	for _, ch := range chans {
+		for len(ch) > 0 {
+			<-ch
+		}
+	}
+}
+
 func drainPeerUpdates(ch <-chan *network_map.UpdateMessage) {
 	for {
 		select {
@@ -3756,6 +3804,19 @@ func drainPeerUpdates(ch <-chan *network_map.UpdateMessage) {
 	}
 }
 
+// step runs f as one named stage of a test inside synctest.Test, which forbids t.Run, and names the
+// stage when it fails the test. Stages share t, so a fatal failure ends the remaining stages as well.
+func step(t *testing.T, name string, f func(t *testing.T)) {
+	t.Helper()
+	failedBefore := t.Failed()
+	defer func() {
+		if !failedBefore && t.Failed() {
+			t.Logf("step %q failed", name)
+		}
+	}()
+	f(t)
+}
+
 func peerShouldNotReceiveUpdate(t *testing.T, updateMessage <-chan *network_map.UpdateMessage) {
 	t.Helper()
 	select {
diff --git a/management/server/affected_peers_jwt_test.go b/management/server/affected_peers_jwt_test.go
index 766745cd7..0b0eba1c4 100644
--- a/management/server/affected_peers_jwt_test.go
+++ b/management/server/affected_peers_jwt_test.go
@@ -87,93 +87,93 @@ func TestAffectedPeers_AllowedUsersChange_RefreshesSSHDestinations(t *testing.T)
 // auto-group change updates only the user's peers and the peers linked to the changed
 // group through policies, instead of fanning out to the whole account.
 func TestAffectedPeers_SyncUserJWTGroups_OnlyAffectedPeersUpdated(t *testing.T) {
-	manager, updateManager, account, _, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, _, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	key, err := wgtypes.GeneratePrivateKey()
-	require.NoError(t, err)
-	userPeer, _, _, _, err := manager.AddPeer(ctx, accountID, "", userID, &nbpeer.Peer{
-		Key:  key.PublicKey().String(),
-		Meta: nbpeer.PeerSystemMeta{Hostname: "user-peer"},
-	}, false)
-	require.NoError(t, err)
+		key, err := wgtypes.GeneratePrivateKey()
+		require.NoError(t, err)
+		userPeer, _, _, _, err := manager.AddPeer(ctx, accountID, "", userID, &nbpeer.Peer{
+			Key:  key.PublicKey().String(),
+			Meta: nbpeer.PeerSystemMeta{Hostname: "user-peer"},
+		}, false)
+		require.NoError(t, err)
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID))
-	}
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
+		require.NoError(t, err)
+		for _, p := range policies {
+			require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID))
+		}
 
-	account, err = manager.Store.GetAccount(ctx, accountID)
-	require.NoError(t, err)
-	account.Settings.JWTGroupsEnabled = true
-	account.Settings.JWTGroupsClaimName = "groups"
-	account.Settings.GroupsPropagationEnabled = true
-	require.NoError(t, manager.Store.SaveAccount(ctx, account))
+		account, err = manager.Store.GetAccount(ctx, accountID)
+		require.NoError(t, err)
+		account.Settings.JWTGroupsEnabled = true
+		account.Settings.JWTGroupsClaimName = "groups"
+		account.Settings.GroupsPropagationEnabled = true
+		require.NoError(t, manager.Store.SaveAccount(ctx, account))
 
-	require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "jwt-grp", Name: "jwt-linked", Issued: types.GroupIssuedJWT, Peers: []string{}}))
-	require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "jwt-dest", Name: "jwt-dest", Peers: []string{peer2.ID}}))
+		require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "jwt-grp", Name: "jwt-linked", Issued: types.GroupIssuedJWT, Peers: []string{}}))
+		require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "jwt-dest", Name: "jwt-dest", Peers: []string{peer2.ID}}))
 
-	_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
-			{
-				Enabled:       true,
-				Sources:       []string{"jwt-grp"},
-				Destinations:  []string{"jwt-dest"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
+		_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+			Enabled: true,
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"jwt-grp"},
+					Destinations:  []string{"jwt-dest"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
 			},
-		},
-	}, true)
-	require.NoError(t, err)
-
-	updUser := updateManager.CreateChannel(ctx, userPeer.ID)
-	upd2 := updateManager.CreateChannel(ctx, peer2.ID)
-	upd3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, userPeer.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	userAuth := auth.UserAuth{
-		AccountId: accountID,
-		UserId:    userID,
-		Groups:    []string{"jwt-linked"},
-	}
-
-	t.Run("adding JWT group updates only linked peers", func(t *testing.T) {
-		drainPeerUpdates(updUser)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
-
-		require.NoError(t, manager.SyncUserJWTGroups(ctx, userAuth))
-
-		peerShouldReceiveUpdate(t, updUser)
-		peerShouldReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
-
-		user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, userID)
+		}, true)
 		require.NoError(t, err)
-		assert.Contains(t, user.AutoGroups, "jwt-grp")
-	})
 
-	t.Run("removing JWT group updates only linked peers", func(t *testing.T) {
-		drainPeerUpdates(updUser)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
+		updUser := updateManager.CreateChannel(ctx, userPeer.ID)
+		upd2 := updateManager.CreateChannel(ctx, peer2.ID)
+		upd3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, userPeer.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
 
-		userAuth.Groups = nil
-		require.NoError(t, manager.SyncUserJWTGroups(ctx, userAuth))
+		userAuth := auth.UserAuth{
+			AccountId: accountID,
+			UserId:    userID,
+			Groups:    []string{"jwt-linked"},
+		}
 
-		peerShouldReceiveUpdate(t, updUser)
-		peerShouldReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
+		step(t, "adding JWT group updates only linked peers", func(t *testing.T) {
+			settleAffectedUpdates(updUser, upd2, upd3)
 
-		user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, userID)
-		require.NoError(t, err)
-		assert.NotContains(t, user.AutoGroups, "jwt-grp")
+			require.NoError(t, manager.SyncUserJWTGroups(ctx, userAuth))
+
+			peerShouldReceiveUpdate(t, updUser)
+			peerShouldReceiveUpdate(t, upd2)
+			peerShouldNotReceiveUpdate(t, upd3)
+
+			user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, userID)
+			require.NoError(t, err)
+			assert.Contains(t, user.AutoGroups, "jwt-grp")
+		})
+
+		step(t, "removing JWT group updates only linked peers", func(t *testing.T) {
+			drainPeerUpdates(updUser)
+			drainPeerUpdates(upd2)
+			drainPeerUpdates(upd3)
+
+			userAuth.Groups = nil
+			require.NoError(t, manager.SyncUserJWTGroups(ctx, userAuth))
+
+			peerShouldReceiveUpdate(t, updUser)
+			peerShouldReceiveUpdate(t, upd2)
+			peerShouldNotReceiveUpdate(t, upd3)
+
+			user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, userID)
+			require.NoError(t, err)
+			assert.NotContains(t, user.AutoGroups, "jwt-grp")
+		})
 	})
 }
diff --git a/management/server/affected_peers_oldstate_test.go b/management/server/affected_peers_oldstate_test.go
index bcb78a660..bfc0a51b9 100644
--- a/management/server/affected_peers_oldstate_test.go
+++ b/management/server/affected_peers_oldstate_test.go
@@ -24,120 +24,124 @@ import (
 // detaching one of them must still refresh that group's policy source peers, even
 // though the post-update resource no longer maps to it.
 func TestAffectedPeers_E2E_UpdateResource_DetachGroup_RefreshesOldGroupSources(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	// A second resource group + a second source group/peer that reaches the
-	// resource only through that second group.
-	const detachGroupID = "rs-detach-grp"
-	require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{ID: detachGroupID, Name: "rs-detach"}))
+		// A second resource group + a second source group/peer that reaches the
+		// resource only through that second group.
+		const detachGroupID = "rs-detach-grp"
+		require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{ID: detachGroupID, Name: "rs-detach"}))
 
-	const secondSourceGroupID = "rs-source-grp-2"
-	setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-detach-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
-	require.NoError(t, err)
-	secondSourcePeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
-	require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{
-		ID: secondSourceGroupID, Name: "rs-source-2", Peers: []string{secondSourcePeer.ID},
-	}))
+		const secondSourceGroupID = "rs-source-grp-2"
+		setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-detach-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
+		require.NoError(t, err)
+		secondSourcePeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
+		require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{
+			ID: secondSourceGroupID, Name: "rs-source-2", Peers: []string{secondSourcePeer.ID},
+		}))
 
-	resourcesManager, _, _ := s.managers()
+		resourcesManager, _, _ := s.managers()
 
-	// Attach the resource to the detach group as well: now in [resourceGroup, detachGroup].
-	_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
-		ID:        s.resourceID,
-		AccountID: s.accountID,
-		NetworkID: s.networkID,
-		Name:      "rs-resource-host",
-		Address:   "10.20.30.0/24",
-		GroupIDs:  []string{s.resourceGroupID, detachGroupID},
-		Enabled:   true,
+		// Attach the resource to the detach group as well: now in [resourceGroup, detachGroup].
+		_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
+			ID:        s.resourceID,
+			AccountID: s.accountID,
+			NetworkID: s.networkID,
+			Name:      "rs-resource-host",
+			Address:   "10.20.30.0/24",
+			GroupIDs:  []string{s.resourceGroupID, detachGroupID},
+			Enabled:   true,
+		})
+		require.NoError(t, err)
+
+		// Policy granting the second source group access via the detach group.
+		_, err = s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(secondSourceGroupID, detachGroupID), true)
+		require.NoError(t, err)
+
+		secondSrcCh := s.updateManager.CreateChannel(ctx, secondSourcePeer.ID)
+		t.Cleanup(func() { s.updateManager.CloseChannel(ctx, secondSourcePeer.ID) })
+		settleAffectedUpdates(secondSrcCh)
+
+		done := make(chan struct{})
+		go func() {
+			// Detaching the resource from detachGroup removes the second source's
+			// access; that source peer must be refreshed even though the post-update
+			// resource no longer maps to detachGroup.
+			peerShouldReceiveUpdate(t, secondSrcCh)
+			close(done)
+		}()
+
+		_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
+			ID:        s.resourceID,
+			AccountID: s.accountID,
+			NetworkID: s.networkID,
+			Name:      "rs-resource-host",
+			Address:   "10.20.30.0/24",
+			GroupIDs:  []string{s.resourceGroupID}, // detached detachGroup
+			Enabled:   true,
+		})
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: detaching a resource group did not refresh the old group's policy source peer")
+		}
 	})
-	require.NoError(t, err)
-
-	// Policy granting the second source group access via the detach group.
-	_, err = s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(secondSourceGroupID, detachGroupID), true)
-	require.NoError(t, err)
-
-	secondSrcCh := s.updateManager.CreateChannel(ctx, secondSourcePeer.ID)
-	t.Cleanup(func() { s.updateManager.CloseChannel(ctx, secondSourcePeer.ID) })
-	settleAffectedUpdates(secondSrcCh)
-
-	done := make(chan struct{})
-	go func() {
-		// Detaching the resource from detachGroup removes the second source's
-		// access; that source peer must be refreshed even though the post-update
-		// resource no longer maps to detachGroup.
-		peerShouldReceiveUpdate(t, secondSrcCh)
-		close(done)
-	}()
-
-	_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
-		ID:        s.resourceID,
-		AccountID: s.accountID,
-		NetworkID: s.networkID,
-		Name:      "rs-resource-host",
-		Address:   "10.20.30.0/24",
-		GroupIDs:  []string{s.resourceGroupID}, // detached detachGroup
-		Enabled:   true,
-	})
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: detaching a resource group did not refresh the old group's policy source peer")
-	}
 }
 
 // TestAffectedPeers_E2E_UpdateRouter_RepointPeer_RefreshesOldRoutingPeer:
 // changing router.Peer within the same network must still refresh the OLD routing
 // peer, which loses its routing role.
 func TestAffectedPeers_E2E_UpdateRouter_RepointPeer_RefreshesOldRoutingPeer(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
 
-	_, routersManager, _ := s.managers()
+		_, routersManager, _ := s.managers()
 
-	routers, err := s.manager.Store.GetNetworkRoutersByNetID(ctx, store.LockingStrengthNone, s.accountID, s.networkID)
-	require.NoError(t, err)
-	require.Len(t, routers, 1)
-	router := routers[0]
-	oldRoutingPeer := router.Peer
-	require.NotEmpty(t, oldRoutingPeer)
+		routers, err := s.manager.Store.GetNetworkRoutersByNetID(ctx, store.LockingStrengthNone, s.accountID, s.networkID)
+		require.NoError(t, err)
+		require.Len(t, routers, 1)
+		router := routers[0]
+		oldRoutingPeer := router.Peer
+		require.NotEmpty(t, oldRoutingPeer)
 
-	// A new peer to become the routing peer in place of the old one.
-	setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-newrouter-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
-	require.NoError(t, err)
-	newRoutingPeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
+		// A new peer to become the routing peer in place of the old one.
+		setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-newrouter-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
+		require.NoError(t, err)
+		newRoutingPeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
 
-	oldCh := s.updateManager.CreateChannel(ctx, oldRoutingPeer)
-	t.Cleanup(func() { s.updateManager.CloseChannel(ctx, oldRoutingPeer) })
-	settleAffectedUpdates(oldCh)
+		oldCh := s.updateManager.CreateChannel(ctx, oldRoutingPeer)
+		t.Cleanup(func() { s.updateManager.CloseChannel(ctx, oldRoutingPeer) })
+		settleAffectedUpdates(oldCh)
 
-	done := make(chan struct{})
-	go func() {
-		// The old routing peer stops serving the resource and must be refreshed.
-		peerShouldReceiveUpdate(t, oldCh)
-		close(done)
-	}()
+		done := make(chan struct{})
+		go func() {
+			// The old routing peer stops serving the resource and must be refreshed.
+			peerShouldReceiveUpdate(t, oldCh)
+			close(done)
+		}()
 
-	_, err = routersManager.UpdateRouter(ctx, userID, &routerTypes.NetworkRouter{
-		ID:         router.ID,
-		NetworkID:  s.networkID,
-		AccountID:  s.accountID,
-		Peer:       newRoutingPeer.ID, // repoint within the same network
-		Masquerade: true,
-		Metric:     9999,
-		Enabled:    true,
+		_, err = routersManager.UpdateRouter(ctx, userID, &routerTypes.NetworkRouter{
+			ID:         router.ID,
+			NetworkID:  s.networkID,
+			AccountID:  s.accountID,
+			Peer:       newRoutingPeer.ID, // repoint within the same network
+			Masquerade: true,
+			Metric:     9999,
+			Enabled:    true,
+		})
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: re-pointing the router peer did not refresh the old routing peer")
+		}
 	})
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: re-pointing the router peer did not refresh the old routing peer")
-	}
 }
diff --git a/management/server/affected_peers_router_paths_test.go b/management/server/affected_peers_router_paths_test.go
index d5868a5c1..185c03ddb 100644
--- a/management/server/affected_peers_router_paths_test.go
+++ b/management/server/affected_peers_router_paths_test.go
@@ -165,148 +165,154 @@ func (s *routerScenario) createPostureCheckGatedPolicy(t *testing.T, ctx context
 }
 
 func TestAffectedPeers_E2E_SavePostureCheck_RefreshesRoutingPeer(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	checkID := s.createPostureCheckGatedPolicy(t, ctx, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID))
+		checkID := s.createPostureCheckGatedPolicy(t, ctx, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID))
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
-		s.updateManager.CloseChannel(ctx, s.unrelatedPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+			s.updateManager.CloseChannel(ctx, s.unrelatedPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh, unrelatedCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			peerShouldNotReceiveUpdate(t, unrelatedCh)
+			close(done)
+		}()
+
+		_, err := s.manager.SavePostureChecks(ctx, s.accountID, userID, &posture.Checks{
+			ID:   checkID,
+			Name: "rs-min-version",
+			Checks: posture.ChecksDefinition{
+				NBVersionCheck: &posture.NBVersionCheck{MinVersion: "0.31.0"},
+			},
+		}, false)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: editing a posture check did not refresh source + routing peers")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh, unrelatedCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		peerShouldNotReceiveUpdate(t, unrelatedCh)
-		close(done)
-	}()
-
-	_, err := s.manager.SavePostureChecks(ctx, s.accountID, userID, &posture.Checks{
-		ID:   checkID,
-		Name: "rs-min-version",
-		Checks: posture.ChecksDefinition{
-			NBVersionCheck: &posture.NBVersionCheck{MinVersion: "0.31.0"},
-		},
-	}, false)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: editing a posture check did not refresh source + routing peers")
-	}
 }
 
 func TestAffectedPeers_E2E_UpdateResource_DestinationResourcePolicy_RefreshesSourcePeer(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true)
-	require.NoError(t, err)
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true)
+		require.NoError(t, err)
 
-	resourcesManager, _, _ := s.managers()
+		resourcesManager, _, _ := s.managers()
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
-		s.updateManager.CloseChannel(ctx, s.unrelatedPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+			s.updateManager.CloseChannel(ctx, s.unrelatedPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh, unrelatedCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			peerShouldNotReceiveUpdate(t, unrelatedCh)
+			close(done)
+		}()
+
+		_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
+			ID:        s.resourceID,
+			AccountID: s.accountID,
+			NetworkID: s.networkID,
+			Name:      "rs-resource-host",
+			Address:   "10.20.30.0/25",
+			GroupIDs:  []string{s.resourceGroupID},
+			Enabled:   true,
+		})
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: updating a DestinationResource-targeted resource did not refresh its policy source peer")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh, unrelatedCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		peerShouldNotReceiveUpdate(t, unrelatedCh)
-		close(done)
-	}()
-
-	_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
-		ID:        s.resourceID,
-		AccountID: s.accountID,
-		NetworkID: s.networkID,
-		Name:      "rs-resource-host",
-		Address:   "10.20.30.0/25",
-		GroupIDs:  []string{s.resourceGroupID},
-		Enabled:   true,
-	})
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: updating a DestinationResource-targeted resource did not refresh its policy source peer")
-	}
 }
 
 // A disabled sibling router routes to nobody, so updating a resource on its network
 // must NOT refresh its peer (the enabled router carries the bridge instead).
 func TestAffectedPeers_E2E_UpdateResource_DisabledSiblingRouterNotBridged(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
 
-	resourcesManager, routersManager, _ := s.managers()
+		resourcesManager, routersManager, _ := s.managers()
 
-	setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-key-disabled", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
-	require.NoError(t, err)
-	disabledRouterPeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
-	_, err = routersManager.CreateRouter(ctx, userID, &routerTypes.NetworkRouter{
-		NetworkID:  s.networkID,
-		AccountID:  s.accountID,
-		Peer:       disabledRouterPeer.ID,
-		Masquerade: true,
-		Metric:     9000,
-		Enabled:    false,
+		setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-key-disabled", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
+		require.NoError(t, err)
+		disabledRouterPeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
+		_, err = routersManager.CreateRouter(ctx, userID, &routerTypes.NetworkRouter{
+			NetworkID:  s.networkID,
+			AccountID:  s.accountID,
+			Peer:       disabledRouterPeer.ID,
+			Masquerade: true,
+			Metric:     9000,
+			Enabled:    false,
+		})
+		require.NoError(t, err)
+
+		disabledCh := s.updateManager.CreateChannel(ctx, disabledRouterPeer.ID)
+		enabledCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, disabledRouterPeer.ID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		})
+
+		settleAffectedUpdates(disabledCh, enabledCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, enabledCh)
+			peerShouldNotReceiveUpdate(t, disabledCh)
+			close(done)
+		}()
+
+		_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
+			ID:        s.resourceID,
+			AccountID: s.accountID,
+			NetworkID: s.networkID,
+			Name:      "rs-resource-host",
+			Address:   "10.20.30.0/25",
+			GroupIDs:  []string{s.resourceGroupID},
+			Enabled:   true,
+		})
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout")
+		}
 	})
-	require.NoError(t, err)
-
-	disabledCh := s.updateManager.CreateChannel(ctx, disabledRouterPeer.ID)
-	enabledCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, disabledRouterPeer.ID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
-	})
-
-	settleAffectedUpdates(disabledCh, enabledCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, enabledCh)
-		peerShouldNotReceiveUpdate(t, disabledCh)
-		close(done)
-	}()
-
-	_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
-		ID:        s.resourceID,
-		AccountID: s.accountID,
-		NetworkID: s.networkID,
-		Name:      "rs-resource-host",
-		Address:   "10.20.30.0/25",
-		GroupIDs:  []string{s.resourceGroupID},
-		Enabled:   true,
-	})
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout")
-	}
 }
 
 func TestAffectedPeers_GroupChange_RouterInOtherNetworkNotAffected(t *testing.T) {
@@ -346,8 +352,10 @@ func TestAffectedPeers_PeerChange_RouterInOtherNetworkNotAffected(t *testing.T)
 // shortcut (the denied peer's map holds no router) and the allow direction
 // depends on which meta field moved, leaving the routers with a stale map.
 func TestAffectedPeers_E2E_PostureFlip_RefreshesRoutingPeer(t *testing.T) {
-	runPostureFlipRefreshesRoutingPeer(t, func(s *routerScenario) *types.Policy {
-		return peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		runPostureFlipRefreshesRoutingPeer(t, func(s *routerScenario) *types.Policy {
+			return peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID)
+		})
 	})
 }
 
@@ -355,8 +363,10 @@ func TestAffectedPeers_E2E_PostureFlip_RefreshesRoutingPeer(t *testing.T) {
 // scenario with the source peer named directly in the rule: it must receive its posture
 // checks and have its flips detected exactly like a group member.
 func TestAffectedPeers_E2E_PostureFlip_DirectSourcePeer_RefreshesRoutingPeer(t *testing.T) {
-	runPostureFlipRefreshesRoutingPeer(t, func(s *routerScenario) *types.Policy {
-		return peerToResourcePolicyByPeer(s.sourcePeerID, s.resourceGroupID)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		runPostureFlipRefreshesRoutingPeer(t, func(s *routerScenario) *types.Policy {
+			return peerToResourcePolicyByPeer(s.sourcePeerID, s.resourceGroupID)
+		})
 	})
 }
 
diff --git a/management/server/affected_peers_router_test.go b/management/server/affected_peers_router_test.go
index 7e3f02b27..e2bdff4ad 100644
--- a/management/server/affected_peers_router_test.go
+++ b/management/server/affected_peers_router_test.go
@@ -8,7 +8,6 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/update_channel"
 	"github.com/netbirdio/netbird/management/server/affectedpeers"
 	"github.com/netbirdio/netbird/management/server/groups"
@@ -320,190 +319,189 @@ func TestAffectedPeers_PolicyToResource_UnrelatedPeerNotAffected(t *testing.T) {
 }
 
 func TestAffectedPeers_ResourceSideBridgesToRoutingPeer_DirectRouter(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	// A pre-existing policy grants the source group access to the resource.
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
+		// A pre-existing policy grants the source group access to the resource.
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
 
-	// Drive an update through the resource manager and assert the routing peer
-	// is among the affected set by observing the channel. This path walks
-	// policies whose destinations reference the resource's groups, folds in the
-	// source groups, and loads the network's routers, so it reaches both the
-	// source peer and the routing peer.
-	permissionsManager := permissions.NewManager(s.manager.Store)
-	groupsManager := groups.NewManager(s.manager.Store, permissionsManager, s.manager)
-	rm := resources.NewManager(s.manager.Store, permissionsManager, groupsManager, s.manager, s.manager.serviceManager)
+		// Drive an update through the resource manager and assert the routing peer
+		// is among the affected set by observing the channel. This path walks
+		// policies whose destinations reference the resource's groups, folds in the
+		// source groups, and loads the network's routers, so it reaches both the
+		// source peer and the routing peer.
+		permissionsManager := permissions.NewManager(s.manager.Store)
+		groupsManager := groups.NewManager(s.manager.Store, permissionsManager, s.manager)
+		rm := resources.NewManager(s.manager.Store, permissionsManager, groupsManager, s.manager, s.manager.serviceManager)
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			close(done)
+		}()
+
+		_, err = rm.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
+			ID:        s.resourceID,
+			AccountID: s.accountID,
+			NetworkID: s.networkID,
+			Name:      "rs-resource-host",
+			Address:   "10.20.30.0/24",
+			GroupIDs:  []string{s.resourceGroupID},
+			Enabled:   true,
+		})
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: resource update did not refresh source peer + routing peer")
+		}
 	})
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		close(done)
-	}()
-
-	_, err = rm.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
-		ID:        s.resourceID,
-		AccountID: s.accountID,
-		NetworkID: s.networkID,
-		Name:      "rs-resource-host",
-		Address:   "10.20.30.0/24",
-		GroupIDs:  []string{s.resourceGroupID},
-		Enabled:   true,
-	})
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: resource update did not refresh source peer + routing peer")
-	}
-}
-
-// settleAffectedUpdates waits for in-flight async updates to arrive, then drains
-// every given channel so subsequent assertions start from a clean slate.
-//
-// Setup (CreateNetwork/CreateResource/CreateRouter) fires async UpdateAffectedPeers
-// goroutines; draining first means the assertion only observes updates from the
-// action under test, not setup stragglers.
-func settleAffectedUpdates(chans ...<-chan *network_map.UpdateMessage) {
-	time.Sleep(300 * time.Millisecond)
-	for _, ch := range chans {
-		drainPeerUpdates(ch)
-	}
 }
 
 func TestAffectedPeers_E2E_CreatePolicy_RoutingPeer_DirectRouter(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
-		s.updateManager.CloseChannel(ctx, s.unrelatedPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+			s.updateManager.CloseChannel(ctx, s.unrelatedPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh, unrelatedCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			peerShouldNotReceiveUpdate(t, unrelatedCh)
+			close(done)
+		}()
+
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: creating peer->resource policy did not refresh the routing peer")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh, unrelatedCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		peerShouldNotReceiveUpdate(t, unrelatedCh)
-		close(done)
-	}()
-
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: creating peer->resource policy did not refresh the routing peer")
-	}
 }
 
 func TestAffectedPeers_E2E_CreatePolicy_RoutingPeer_RouterPeerGroups(t *testing.T) {
-	s := setupRouterScenario(t, false)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, false)
+		ctx := context.Background()
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerGroupPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerGroupPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerGroupPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerGroupPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			close(done)
+		}()
+
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: routing peer (PeerGroups) not refreshed on policy create")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		close(done)
-	}()
-
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: routing peer (PeerGroups) not refreshed on policy create")
-	}
 }
 
 func TestAffectedPeers_E2E_DestResource_RoutingPeer(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			close(done)
+		}()
+
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: routing peer not refreshed when policy targets DestinationResource")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		close(done)
-	}()
-
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: routing peer not refreshed when policy targets DestinationResource")
-	}
 }
 
 func TestAffectedPeers_E2E_DeletePolicy_RoutingPeer(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
+		policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			close(done)
+		}()
+
+		require.NoError(t, s.manager.DeletePolicy(ctx, s.accountID, policy.ID, userID))
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: deleting peer->resource policy did not refresh the routing peer")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		close(done)
-	}()
-
-	require.NoError(t, s.manager.DeletePolicy(ctx, s.accountID, policy.ID, userID))
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: deleting peer->resource policy did not refresh the routing peer")
-	}
 }
 
 func (s *routerScenario) managers() (resources.Manager, routers.Manager, networks.Manager) {
@@ -572,113 +570,119 @@ func (s *routerScenario) addSecondTopology(t *testing.T, suffix string) secondTo
 }
 
 func TestAffectedPeers_E2E_UpdatePolicy_BothRoutingPeers(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	second := s.addSecondTopology(t, "b")
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		second := s.addSecondTopology(t, "b")
+		ctx := context.Background()
 
-	policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
+		policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerACh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	routerBCh := s.updateManager.CreateChannel(ctx, second.routerPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
-		s.updateManager.CloseChannel(ctx, second.routerPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerACh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		routerBCh := s.updateManager.CreateChannel(ctx, second.routerPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+			s.updateManager.CloseChannel(ctx, second.routerPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerACh, routerBCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerACh)
+			peerShouldReceiveUpdate(t, routerBCh)
+			close(done)
+		}()
+
+		policy.Rules[0].Destinations = []string{second.resourceGroupID}
+		_, err = s.manager.SavePolicy(ctx, s.accountID, userID, policy, false)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: re-pointing the policy destination did not refresh both routing peers")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerACh, routerBCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerACh)
-		peerShouldReceiveUpdate(t, routerBCh)
-		close(done)
-	}()
-
-	policy.Rules[0].Destinations = []string{second.resourceGroupID}
-	_, err = s.manager.SavePolicy(ctx, s.accountID, userID, policy, false)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: re-pointing the policy destination did not refresh both routing peers")
-	}
 }
 
 func TestAffectedPeers_E2E_UpdatePolicy_AddSource(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	const secondSourceGroupID = "rs-source-grp-2"
-	setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-key-2", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
-	require.NoError(t, err)
-	secondSourcePeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
-	require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{
-		ID: secondSourceGroupID, Name: "rs-source-2", Peers: []string{secondSourcePeer.ID},
-	}))
+		const secondSourceGroupID = "rs-source-grp-2"
+		setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-key-2", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
+		require.NoError(t, err)
+		secondSourcePeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
+		require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{
+			ID: secondSourceGroupID, Name: "rs-source-2", Peers: []string{secondSourcePeer.ID},
+		}))
 
-	policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
+		policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
 
-	newSrcCh := s.updateManager.CreateChannel(ctx, secondSourcePeer.ID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, secondSourcePeer.ID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		newSrcCh := s.updateManager.CreateChannel(ctx, secondSourcePeer.ID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, secondSourcePeer.ID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		})
+
+		settleAffectedUpdates(newSrcCh, routerCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, newSrcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			close(done)
+		}()
+
+		policy.Rules[0].Sources = []string{s.sourceGroupID, secondSourceGroupID}
+		_, err = s.manager.SavePolicy(ctx, s.accountID, userID, policy, false)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: adding a source group did not refresh the new source peer + routing peer")
+		}
 	})
-
-	settleAffectedUpdates(newSrcCh, routerCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, newSrcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		close(done)
-	}()
-
-	policy.Rules[0].Sources = []string{s.sourceGroupID, secondSourceGroupID}
-	_, err = s.manager.SavePolicy(ctx, s.accountID, userID, policy, false)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: adding a source group did not refresh the new source peer + routing peer")
-	}
 }
 
 func TestAffectedPeers_E2E_DestResource_RouterPeerGroups(t *testing.T) {
-	s := setupRouterScenario(t, false)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, false)
+		ctx := context.Background()
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerGroupPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerGroupPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerGroupPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerGroupPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			close(done)
+		}()
+
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: DestinationResource policy with PeerGroups router did not refresh the routing peer")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		close(done)
-	}()
-
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: DestinationResource policy with PeerGroups router did not refresh the routing peer")
-	}
 }
 
 func TestAffectedPeers_AllRoutingPeers_Network(t *testing.T) {
diff --git a/management/server/affected_peers_test.go b/management/server/affected_peers_test.go
index 235128693..90408f70a 100644
--- a/management/server/affected_peers_test.go
+++ b/management/server/affected_peers_test.go
@@ -955,73 +955,77 @@ func TestAffectedPeers_IsolatedRouteAndPolicy(t *testing.T) {
 }
 
 func TestAffectedPeers_GroupUpdateOnlyAffectsLinkedPeers(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
-	}
-
-	for _, g := range []*types.Group{
-		{ID: "ap-grpA", Name: "AP-A", Peers: []string{peer1.ID}},
-		{ID: "ap-grpB", Name: "AP-B", Peers: []string{peer2.ID}},
-		{ID: "ap-grpC", Name: "AP-C", Peers: []string{peer3.ID}},
-	} {
-		err := manager.CreateGroup(ctx, accountID, userID, g)
-		require.NoError(t, err)
-	}
-
-	_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
-			{
-				Enabled:       true,
-				Sources:       []string{"ap-grpA"},
-				Destinations:  []string{"ap-grpB"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
-			},
-		},
-	}, true)
-	require.NoError(t, err)
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	result := manager.resolveAffectedPeersForPeerChanges(ctx, manager.Store, accountID, []string{peer1.ID})
-	assert.ElementsMatch(t, []string{peer1.ID, peer2.ID}, result)
-
-	t.Run("group change updates all peers in policy groups", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			peerShouldReceiveUpdate(t, updMsg2)
-			peerShouldReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		err := manager.UpdateGroup(ctx, accountID, userID, &types.Group{
-			ID:    "ap-grpA",
-			Name:  "AP-A",
-			Peers: []string{peer1.ID, peer3.ID},
-		})
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
 		}
+
+		for _, g := range []*types.Group{
+			{ID: "ap-grpA", Name: "AP-A", Peers: []string{peer1.ID}},
+			{ID: "ap-grpB", Name: "AP-B", Peers: []string{peer2.ID}},
+			{ID: "ap-grpC", Name: "AP-C", Peers: []string{peer3.ID}},
+		} {
+			err := manager.CreateGroup(ctx, accountID, userID, g)
+			require.NoError(t, err)
+		}
+
+		_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+			Enabled: true,
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"ap-grpA"},
+					Destinations:  []string{"ap-grpB"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
+			},
+		}, true)
+		require.NoError(t, err)
+
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		result := manager.resolveAffectedPeersForPeerChanges(ctx, manager.Store, accountID, []string{peer1.ID})
+		assert.ElementsMatch(t, []string{peer1.ID, peer2.ID}, result)
+
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "group change updates all peers in policy groups", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				peerShouldReceiveUpdate(t, updMsg2)
+				peerShouldReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			err := manager.UpdateGroup(ctx, accountID, userID, &types.Group{
+				ID:    "ap-grpA",
+				Name:  "AP-A",
+				Peers: []string{peer1.ID, peer3.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
@@ -1037,243 +1041,259 @@ func TestAffectedPeers_UnlinkedPeerChange_RefreshesSelfOnly(t *testing.T) {
 // TestAffectedPeers_PolicyChange_UnrelatedPeerNoUpdate verifies that creating/deleting a
 // policy only sends updates to peers in the policy's groups, not to unrelated peers.
 func TestAffectedPeers_PolicyChange_UnrelatedPeerNoUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
-	}
-
-	for _, g := range []*types.Group{
-		{ID: "pol-grpA", Name: "Pol-A", Peers: []string{peer1.ID}},
-		{ID: "pol-grpB", Name: "Pol-B", Peers: []string{peer2.ID}},
-		{ID: "pol-grpC", Name: "Pol-C", Peers: []string{peer3.ID}},
-	} {
-		err := manager.CreateGroup(ctx, accountID, userID, g)
-		require.NoError(t, err)
-	}
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("create policy only affects linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			peerShouldReceiveUpdate(t, updMsg2)
-			peerShouldNotReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		_, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-			Enabled: true,
-			Rules: []*types.PolicyRule{
-				{
-					Enabled:       true,
-					Sources:       []string{"pol-grpA"},
-					Destinations:  []string{"pol-grpB"},
-					Bidirectional: true,
-					Action:        types.PolicyTrafficActionAccept,
-				},
-			},
-		}, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
 		}
+
+		for _, g := range []*types.Group{
+			{ID: "pol-grpA", Name: "Pol-A", Peers: []string{peer1.ID}},
+			{ID: "pol-grpB", Name: "Pol-B", Peers: []string{peer2.ID}},
+			{ID: "pol-grpC", Name: "Pol-C", Peers: []string{peer3.ID}},
+		} {
+			err := manager.CreateGroup(ctx, accountID, userID, g)
+			require.NoError(t, err)
+		}
+
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "create policy only affects linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				peerShouldReceiveUpdate(t, updMsg2)
+				peerShouldNotReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			_, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+				Enabled: true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"pol-grpA"},
+						Destinations:  []string{"pol-grpB"},
+						Bidirectional: true,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+			}, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
 // TestAffectedPeers_RouteChange_UnrelatedPeerNoUpdate verifies that creating a route
 // only sends updates to peers in the route's groups, not to unrelated peers.
 func TestAffectedPeers_RouteChange_UnrelatedPeerNoUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
-	}
-
-	for _, g := range []*types.Group{
-		{ID: "rt-grpA", Name: "Rt-A", Peers: []string{peer1.ID}},
-		{ID: "rt-grpB", Name: "Rt-B", Peers: []string{peer2.ID}},
-		{ID: "rt-grpC", Name: "Rt-C", Peers: []string{peer3.ID}},
-	} {
-		err := manager.CreateGroup(ctx, accountID, userID, g)
-		require.NoError(t, err)
-	}
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("create route only affects linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			peerShouldReceiveUpdate(t, updMsg2)
-			peerShouldNotReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		_, err := manager.CreateRoute(ctx, accountID,
-			netip.MustParsePrefix("10.10.0.0/24"),
-			route.IPv4Network,
-			nil,
-			"",
-			[]string{"rt-grpA"},
-			"test route",
-			"routenoaffect",
-			false,
-			9999,
-			[]string{"rt-grpB"},
-			nil,
-			true,
-			userID,
-			false,
-			false,
-		)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
 		}
+
+		for _, g := range []*types.Group{
+			{ID: "rt-grpA", Name: "Rt-A", Peers: []string{peer1.ID}},
+			{ID: "rt-grpB", Name: "Rt-B", Peers: []string{peer2.ID}},
+			{ID: "rt-grpC", Name: "Rt-C", Peers: []string{peer3.ID}},
+		} {
+			err := manager.CreateGroup(ctx, accountID, userID, g)
+			require.NoError(t, err)
+		}
+
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "create route only affects linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				peerShouldReceiveUpdate(t, updMsg2)
+				peerShouldNotReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			_, err := manager.CreateRoute(ctx, accountID,
+				netip.MustParsePrefix("10.10.0.0/24"),
+				route.IPv4Network,
+				nil,
+				"",
+				[]string{"rt-grpA"},
+				"test route",
+				"routenoaffect",
+				false,
+				9999,
+				[]string{"rt-grpB"},
+				nil,
+				true,
+				userID,
+				false,
+				false,
+			)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
 // TestAffectedPeers_NameServerChange_UnrelatedPeerNoUpdate verifies that creating a
 // nameserver group only sends updates to peers in its groups, not to unrelated peers.
 func TestAffectedPeers_NameServerChange_UnrelatedPeerNoUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
-	}
-
-	for _, g := range []*types.Group{
-		{ID: "ns-grpA", Name: "NS-A", Peers: []string{peer1.ID}},
-		{ID: "ns-grpB", Name: "NS-B", Peers: []string{peer2.ID}},
-	} {
-		err := manager.CreateGroup(ctx, accountID, userID, g)
-		require.NoError(t, err)
-	}
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("create nameserver group only affects linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			peerShouldNotReceiveUpdate(t, updMsg2)
-			peerShouldNotReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		_, err := manager.CreateNameServerGroup(ctx, accountID, "ns-unrelated", "NS Unrelated",
-			[]nbdns.NameServer{{
-				IP:     netip.MustParseAddr("1.1.1.1"),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			}},
-			[]string{"ns-grpA"},
-			true, nil, true, userID, false,
-		)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
 		}
+
+		for _, g := range []*types.Group{
+			{ID: "ns-grpA", Name: "NS-A", Peers: []string{peer1.ID}},
+			{ID: "ns-grpB", Name: "NS-B", Peers: []string{peer2.ID}},
+		} {
+			err := manager.CreateGroup(ctx, accountID, userID, g)
+			require.NoError(t, err)
+		}
+
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "create nameserver group only affects linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				peerShouldNotReceiveUpdate(t, updMsg2)
+				peerShouldNotReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			_, err := manager.CreateNameServerGroup(ctx, accountID, "ns-unrelated", "NS Unrelated",
+				[]nbdns.NameServer{{
+					IP:     netip.MustParseAddr("1.1.1.1"),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				}},
+				[]string{"ns-grpA"},
+				true, nil, true, userID, false,
+			)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
 // TestAffectedPeers_DNSSettingsChange_UnrelatedPeerNoUpdate verifies that changing DNS
 // settings only sends updates to peers in the affected groups, not to unrelated peers.
 func TestAffectedPeers_DNSSettingsChange_UnrelatedPeerNoUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
-	}
-
-	for _, g := range []*types.Group{
-		{ID: "dns-grpA", Name: "DNS-A", Peers: []string{peer1.ID}},
-		{ID: "dns-grpB", Name: "DNS-B", Peers: []string{peer2.ID}},
-	} {
-		err := manager.CreateGroup(ctx, accountID, userID, g)
-		require.NoError(t, err)
-	}
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("dns settings change only affects linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			peerShouldNotReceiveUpdate(t, updMsg2)
-			peerShouldNotReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		err := manager.SaveDNSSettings(ctx, accountID, userID, &types.DNSSettings{
-			DisabledManagementGroups: []string{"dns-grpA"},
-		})
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
 		}
+
+		for _, g := range []*types.Group{
+			{ID: "dns-grpA", Name: "DNS-A", Peers: []string{peer1.ID}},
+			{ID: "dns-grpB", Name: "DNS-B", Peers: []string{peer2.ID}},
+		} {
+			err := manager.CreateGroup(ctx, accountID, userID, g)
+			require.NoError(t, err)
+		}
+
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "dns settings change only affects linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				peerShouldNotReceiveUpdate(t, updMsg2)
+				peerShouldNotReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			err := manager.SaveDNSSettings(ctx, accountID, userID, &types.DNSSettings{
+				DisabledManagementGroups: []string{"dns-grpA"},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
@@ -1281,429 +1301,451 @@ func TestAffectedPeers_DNSSettingsChange_UnrelatedPeerNoUpdate(t *testing.T) {
 // updating a group that is NOT referenced by any policy/route/ns/dns should not send
 // updates to any peer.
 func TestAffectedPeers_UnlinkedGroupChange_NoUpdateIntegration(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
-	}
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
+		}
 
-	err = manager.CreateGroup(ctx, accountID, userID, &types.Group{
-		ID:    "unlinked-grp",
-		Name:  "Unlinked",
-		Peers: []string{peer1.ID},
-	})
-	require.NoError(t, err)
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("updating unlinked group sends no peer updates", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg1)
-			peerShouldNotReceiveUpdate(t, updMsg2)
-			peerShouldNotReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		err := manager.UpdateGroup(ctx, accountID, userID, &types.Group{
+		err = manager.CreateGroup(ctx, accountID, userID, &types.Group{
 			ID:    "unlinked-grp",
 			Name:  "Unlinked",
-			Peers: []string{peer1.ID, peer2.ID},
+			Peers: []string{peer1.ID},
 		})
-		assert.NoError(t, err)
+		require.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
-		}
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "updating unlinked group sends no peer updates", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg1)
+				peerShouldNotReceiveUpdate(t, updMsg2)
+				peerShouldNotReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			err := manager.UpdateGroup(ctx, accountID, userID, &types.Group{
+				ID:    "unlinked-grp",
+				Name:  "Unlinked",
+				Peers: []string{peer1.ID, peer2.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
 // TestAffectedPeers_NetworkRouterUnlinkedPeerNoUpdate: a network router with peer
 // groups updates only those groups' peers (and resource policy sources), not others.
 func TestAffectedPeers_NetworkRouterUnlinkedPeerNoUpdate(t *testing.T) {
-	// Delete the default policy before adding peers so AddPeer schedules no async
-	// update that races with the test.
-	manager, updateManager, err := createManager(t)
-	require.NoError(t, err)
-
-	ctx := context.Background()
-
-	account, err := createAccount(manager, "nr_test_account", userID, "")
-	require.NoError(t, err)
-	accountID := account.Id
-
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		// Delete the default policy before adding peers so AddPeer schedules no async
+		// update that races with the test.
+		manager, updateManager, err := createManager(t)
 		require.NoError(t, err)
-	}
 
-	setupKey, err := manager.CreateSetupKey(ctx, accountID, "test-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
-	require.NoError(t, err)
+		ctx := context.Background()
 
-	peer1 := addPeerToAccount(t, manager, accountID, setupKey.Key)
-	peer2 := addPeerToAccount(t, manager, accountID, setupKey.Key)
-	peer3 := addPeerToAccount(t, manager, accountID, setupKey.Key)
-
-	for _, g := range []*types.Group{
-		{ID: "nr-grpA", Name: "NR-A", Peers: []string{peer1.ID}},
-		{ID: "nr-grpB", Name: "NR-B", Peers: []string{peer2.ID}},
-	} {
-		err := manager.CreateGroup(ctx, accountID, userID, g)
+		account, err := createAccount(manager, "nr_test_account", userID, "")
 		require.NoError(t, err)
-	}
+		accountID := account.Id
 
-	net1 := &networkTypes.Network{
-		ID:        "nr-net-test",
-		AccountID: accountID,
-		Name:      "nr-test-network",
-	}
-	err = manager.Store.SaveNetwork(ctx, net1)
-	require.NoError(t, err)
-
-	err = manager.Store.CreateNetworkRouter(ctx, &routerTypes.NetworkRouter{
-		ID:         "nr-router-test",
-		NetworkID:  net1.ID,
-		AccountID:  accountID,
-		PeerGroups: []string{"nr-grpA"},
-		Enabled:    true,
-	})
-	require.NoError(t, err)
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("network router group change only affects linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			peerShouldNotReceiveUpdate(t, updMsg2)
-			peerShouldReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		err = manager.UpdateGroup(ctx, accountID, userID, &types.Group{
-			ID:    "nr-grpA",
-			Name:  "NR-A",
-			Peers: []string{peer1.ID, peer3.ID},
-		})
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
+		require.NoError(t, err)
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
 		}
+
+		setupKey, err := manager.CreateSetupKey(ctx, accountID, "test-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
+		require.NoError(t, err)
+
+		peer1 := addPeerToAccount(t, manager, accountID, setupKey.Key)
+		peer2 := addPeerToAccount(t, manager, accountID, setupKey.Key)
+		peer3 := addPeerToAccount(t, manager, accountID, setupKey.Key)
+
+		for _, g := range []*types.Group{
+			{ID: "nr-grpA", Name: "NR-A", Peers: []string{peer1.ID}},
+			{ID: "nr-grpB", Name: "NR-B", Peers: []string{peer2.ID}},
+		} {
+			err := manager.CreateGroup(ctx, accountID, userID, g)
+			require.NoError(t, err)
+		}
+
+		net1 := &networkTypes.Network{
+			ID:        "nr-net-test",
+			AccountID: accountID,
+			Name:      "nr-test-network",
+		}
+		err = manager.Store.SaveNetwork(ctx, net1)
+		require.NoError(t, err)
+
+		err = manager.Store.CreateNetworkRouter(ctx, &routerTypes.NetworkRouter{
+			ID:         "nr-router-test",
+			NetworkID:  net1.ID,
+			AccountID:  accountID,
+			PeerGroups: []string{"nr-grpA"},
+			Enabled:    true,
+		})
+		require.NoError(t, err)
+
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "network router group change only affects linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				peerShouldNotReceiveUpdate(t, updMsg2)
+				peerShouldReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			err = manager.UpdateGroup(ctx, accountID, userID, &types.Group{
+				ID:    "nr-grpA",
+				Name:  "NR-A",
+				Peers: []string{peer1.ID, peer3.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
 // TestAffectedPeers_IsolatedEntitiesOnlyAffectTheirPeers: with a policy (peer1<->peer2)
 // and a separate route (peer3), changing one entity's groups affects only its peers.
 func TestAffectedPeers_IsolatedEntitiesOnlyAffectTheirPeers(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
-	}
-
-	for _, g := range []*types.Group{
-		{ID: "iso-grpA", Name: "ISO-A", Peers: []string{peer1.ID}},
-		{ID: "iso-grpB", Name: "ISO-B", Peers: []string{peer2.ID}},
-		{ID: "iso-grpC", Name: "ISO-C", Peers: []string{peer3.ID}},
-	} {
-		err := manager.CreateGroup(ctx, accountID, userID, g)
-		require.NoError(t, err)
-	}
-
-	_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
-			{
-				Enabled:       true,
-				Sources:       []string{"iso-grpA"},
-				Destinations:  []string{"iso-grpB"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
-			},
-		},
-	}, true)
-	require.NoError(t, err)
-
-	_, err = manager.CreateRoute(ctx, accountID,
-		netip.MustParsePrefix("10.20.0.0/24"),
-		route.IPv4Network,
-		nil,
-		"",
-		[]string{"iso-grpC"},
-		"isolated route",
-		"isonet2",
-		false,
-		9999,
-		[]string{"iso-grpC"},
-		nil,
-		true,
-		userID,
-		false,
-		false,
-	)
-	require.NoError(t, err)
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	// The setup policy/route above dispatch affected-peer updates asynchronously;
-	// drain any in-flight ones so the assertions only observe the UpdateGroup below.
-	settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
-
-	t.Run("policy group change does not affect route-only peer", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			peerShouldReceiveUpdate(t, updMsg2)
-			peerShouldNotReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		err := manager.UpdateGroup(ctx, accountID, userID, &types.Group{
-			ID:    "iso-grpA",
-			Name:  "ISO-A-updated",
-			Peers: []string{peer1.ID},
-		})
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
 		}
+
+		for _, g := range []*types.Group{
+			{ID: "iso-grpA", Name: "ISO-A", Peers: []string{peer1.ID}},
+			{ID: "iso-grpB", Name: "ISO-B", Peers: []string{peer2.ID}},
+			{ID: "iso-grpC", Name: "ISO-C", Peers: []string{peer3.ID}},
+		} {
+			err := manager.CreateGroup(ctx, accountID, userID, g)
+			require.NoError(t, err)
+		}
+
+		_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+			Enabled: true,
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"iso-grpA"},
+					Destinations:  []string{"iso-grpB"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
+			},
+		}, true)
+		require.NoError(t, err)
+
+		_, err = manager.CreateRoute(ctx, accountID,
+			netip.MustParsePrefix("10.20.0.0/24"),
+			route.IPv4Network,
+			nil,
+			"",
+			[]string{"iso-grpC"},
+			"isolated route",
+			"isonet2",
+			false,
+			9999,
+			[]string{"iso-grpC"},
+			nil,
+			true,
+			userID,
+			false,
+			false,
+		)
+		require.NoError(t, err)
+
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		// The setup policy/route above dispatch affected-peer updates asynchronously;
+		// drain any in-flight ones so the assertions only observe the UpdateGroup below.
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "policy group change does not affect route-only peer", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				peerShouldReceiveUpdate(t, updMsg2)
+				peerShouldNotReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			err := manager.UpdateGroup(ctx, accountID, userID, &types.Group{
+				ID:    "iso-grpA",
+				Name:  "ISO-A-updated",
+				Peers: []string{peer1.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
 // TestAffectedPeers_DeleteRoute_UnrelatedPeerNoUpdate verifies that deleting a route
 // only sends updates to peers in the route's groups.
 func TestAffectedPeers_DeleteRoute_UnrelatedPeerNoUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
-	}
-
-	for _, g := range []*types.Group{
-		{ID: "del-rt-grpA", Name: "Del-Rt-A", Peers: []string{peer1.ID}},
-		{ID: "del-rt-grpB", Name: "Del-Rt-B", Peers: []string{peer2.ID}},
-	} {
-		err := manager.CreateGroup(ctx, accountID, userID, g)
-		require.NoError(t, err)
-	}
-
-	newRoute, err := manager.CreateRoute(ctx, accountID,
-		netip.MustParsePrefix("10.30.0.0/24"),
-		route.IPv4Network,
-		nil,
-		"",
-		[]string{"del-rt-grpA"},
-		"deletable route",
-		"delnet",
-		false,
-		9999,
-		[]string{"del-rt-grpB"},
-		nil,
-		true,
-		userID,
-		false,
-		false,
-	)
-	require.NoError(t, err)
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("delete route only affects linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			peerShouldReceiveUpdate(t, updMsg2)
-			peerShouldNotReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		err := manager.DeleteRoute(ctx, accountID, newRoute.ID, userID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
 		}
+
+		for _, g := range []*types.Group{
+			{ID: "del-rt-grpA", Name: "Del-Rt-A", Peers: []string{peer1.ID}},
+			{ID: "del-rt-grpB", Name: "Del-Rt-B", Peers: []string{peer2.ID}},
+		} {
+			err := manager.CreateGroup(ctx, accountID, userID, g)
+			require.NoError(t, err)
+		}
+
+		newRoute, err := manager.CreateRoute(ctx, accountID,
+			netip.MustParsePrefix("10.30.0.0/24"),
+			route.IPv4Network,
+			nil,
+			"",
+			[]string{"del-rt-grpA"},
+			"deletable route",
+			"delnet",
+			false,
+			9999,
+			[]string{"del-rt-grpB"},
+			nil,
+			true,
+			userID,
+			false,
+			false,
+		)
+		require.NoError(t, err)
+
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "delete route only affects linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				peerShouldReceiveUpdate(t, updMsg2)
+				peerShouldNotReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			err := manager.DeleteRoute(ctx, accountID, newRoute.ID, userID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
 // TestAffectedPeers_DeletePolicy_UnrelatedPeerNoUpdate verifies that deleting a policy
 // only sends updates to peers in the policy's groups.
 func TestAffectedPeers_DeletePolicy_UnrelatedPeerNoUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
-	}
-
-	for _, g := range []*types.Group{
-		{ID: "del-pol-grpA", Name: "Del-Pol-A", Peers: []string{peer1.ID}},
-		{ID: "del-pol-grpB", Name: "Del-Pol-B", Peers: []string{peer2.ID}},
-	} {
-		err := manager.CreateGroup(ctx, accountID, userID, g)
-		require.NoError(t, err)
-	}
-
-	policy, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
-			{
-				Enabled:       true,
-				Sources:       []string{"del-pol-grpA"},
-				Destinations:  []string{"del-pol-grpB"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
-			},
-		},
-	}, true)
-	require.NoError(t, err)
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("delete policy only affects linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			peerShouldReceiveUpdate(t, updMsg2)
-			peerShouldNotReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		err := manager.DeletePolicy(ctx, accountID, policy.ID, userID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
 		}
+
+		for _, g := range []*types.Group{
+			{ID: "del-pol-grpA", Name: "Del-Pol-A", Peers: []string{peer1.ID}},
+			{ID: "del-pol-grpB", Name: "Del-Pol-B", Peers: []string{peer2.ID}},
+		} {
+			err := manager.CreateGroup(ctx, accountID, userID, g)
+			require.NoError(t, err)
+		}
+
+		policy, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+			Enabled: true,
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"del-pol-grpA"},
+					Destinations:  []string{"del-pol-grpB"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
+			},
+		}, true)
+		require.NoError(t, err)
+
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "delete policy only affects linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				peerShouldReceiveUpdate(t, updMsg2)
+				peerShouldNotReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			err := manager.DeletePolicy(ctx, accountID, policy.ID, userID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
 // TestAffectedPeers_DeleteNameServer_UnrelatedPeerNoUpdate verifies that deleting a
 // nameserver group only sends updates to peers in its groups.
 func TestAffectedPeers_DeleteNameServer_UnrelatedPeerNoUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
-	}
-
-	err = manager.CreateGroup(ctx, accountID, userID, &types.Group{
-		ID:    "del-ns-grpA",
-		Name:  "Del-NS-A",
-		Peers: []string{peer1.ID},
-	})
-	require.NoError(t, err)
-
-	nsGroup, err := manager.CreateNameServerGroup(ctx, accountID, "del-ns", "Del NS",
-		[]nbdns.NameServer{{
-			IP:     netip.MustParseAddr("8.8.4.4"),
-			NSType: nbdns.UDPNameServerType,
-			Port:   nbdns.DefaultDNSPort,
-		}},
-		[]string{"del-ns-grpA"},
-		true, nil, true, userID, false,
-	)
-	require.NoError(t, err)
-
-	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
-	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
-	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, peer1.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("delete nameserver group only affects linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			peerShouldNotReceiveUpdate(t, updMsg2)
-			peerShouldNotReceiveUpdate(t, updMsg3)
-			close(done)
-		}()
-
-		err := manager.DeleteNameServerGroup(ctx, accountID, nsGroup.ID, userID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout")
+		for _, p := range policies {
+			err := manager.Store.DeletePolicy(ctx, accountID, p.ID)
+			require.NoError(t, err)
 		}
+
+		err = manager.CreateGroup(ctx, accountID, userID, &types.Group{
+			ID:    "del-ns-grpA",
+			Name:  "Del-NS-A",
+			Peers: []string{peer1.ID},
+		})
+		require.NoError(t, err)
+
+		nsGroup, err := manager.CreateNameServerGroup(ctx, accountID, "del-ns", "Del NS",
+			[]nbdns.NameServer{{
+				IP:     netip.MustParseAddr("8.8.4.4"),
+				NSType: nbdns.UDPNameServerType,
+				Port:   nbdns.DefaultDNSPort,
+			}},
+			[]string{"del-ns-grpA"},
+			true, nil, true, userID, false,
+		)
+		require.NoError(t, err)
+
+		updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+		updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+		updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, peer1.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
+
+		settleAffectedUpdates(updMsg1, updMsg2, updMsg3)
+
+		step(t, "delete nameserver group only affects linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				peerShouldNotReceiveUpdate(t, updMsg2)
+				peerShouldNotReceiveUpdate(t, updMsg3)
+				close(done)
+			}()
+
+			err := manager.DeleteNameServerGroup(ctx, accountID, nsGroup.ID, userID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout")
+			}
+		})
 	})
 }
 
diff --git a/management/server/affected_peers_user_test.go b/management/server/affected_peers_user_test.go
index 3d73bbed0..3f4658de4 100644
--- a/management/server/affected_peers_user_test.go
+++ b/management/server/affected_peers_user_test.go
@@ -17,156 +17,152 @@ import (
 // A user update refreshes only the peers its auto-group change reaches, and a user
 // update that changes no group membership refreshes nobody.
 func TestAffectedPeers_SaveUser_OnlyAffectedPeersUpdated(t *testing.T) {
-	manager, updateManager, account, _, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, _, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	const targetUserID = "target-user"
-	require.NoError(t, manager.Store.SaveUser(ctx, &types.User{
-		Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
-	}))
+		const targetUserID = "target-user"
+		require.NoError(t, manager.Store.SaveUser(ctx, &types.User{
+			Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
+		}))
 
-	key, err := wgtypes.GeneratePrivateKey()
-	require.NoError(t, err)
-	targetPeer, _, _, _, err := manager.AddPeer(ctx, accountID, "", targetUserID, &nbpeer.Peer{
-		Key:  key.PublicKey().String(),
-		Meta: nbpeer.PeerSystemMeta{Hostname: "target-peer"},
-	}, false)
-	require.NoError(t, err)
+		key, err := wgtypes.GeneratePrivateKey()
+		require.NoError(t, err)
+		targetPeer, _, _, _, err := manager.AddPeer(ctx, accountID, "", targetUserID, &nbpeer.Peer{
+			Key:  key.PublicKey().String(),
+			Meta: nbpeer.PeerSystemMeta{Hostname: "target-peer"},
+		}, false)
+		require.NoError(t, err)
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID))
-	}
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
+		require.NoError(t, err)
+		for _, p := range policies {
+			require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID))
+		}
 
-	account, err = manager.Store.GetAccount(ctx, accountID)
-	require.NoError(t, err)
-	account.Settings.GroupsPropagationEnabled = true
-	require.NoError(t, manager.Store.SaveAccount(ctx, account))
+		account, err = manager.Store.GetAccount(ctx, accountID)
+		require.NoError(t, err)
+		account.Settings.GroupsPropagationEnabled = true
+		require.NoError(t, manager.Store.SaveAccount(ctx, account))
 
-	require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-linked", Name: "ug-linked"}))
-	require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-dest", Name: "ug-dest", Peers: []string{peer2.ID}}))
+		require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-linked", Name: "ug-linked"}))
+		require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-dest", Name: "ug-dest", Peers: []string{peer2.ID}}))
 
-	_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
-			{
-				Enabled:       true,
-				Sources:       []string{"ug-linked"},
-				Destinations:  []string{"ug-dest"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
+		_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+			Enabled: true,
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"ug-linked"},
+					Destinations:  []string{"ug-dest"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
 			},
-		},
-	}, true)
-	require.NoError(t, err)
+		}, true)
+		require.NoError(t, err)
 
-	updTarget := updateManager.CreateChannel(ctx, targetPeer.ID)
-	upd2 := updateManager.CreateChannel(ctx, peer2.ID)
-	upd3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, targetPeer.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("auto group change updates only linked peers", func(t *testing.T) {
-		drainPeerUpdates(updTarget)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
-
-		_, err := manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
-			Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
-			AutoGroups: []string{"ug-linked"},
+		updTarget := updateManager.CreateChannel(ctx, targetPeer.ID)
+		upd2 := updateManager.CreateChannel(ctx, peer2.ID)
+		upd3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, targetPeer.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
 		})
-		require.NoError(t, err)
 
-		peerShouldReceiveUpdate(t, updTarget)
-		peerShouldReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
-	})
+		step(t, "auto group change updates only linked peers", func(t *testing.T) {
+			settleAffectedUpdates(updTarget, upd2, upd3)
 
-	t.Run("update without group changes refreshes nobody", func(t *testing.T) {
-		drainPeerUpdates(updTarget)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
+			_, err := manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
+				Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
+				AutoGroups: []string{"ug-linked"},
+			})
+			require.NoError(t, err)
 
-		_, err := manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
-			Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
-			AutoGroups: []string{"ug-linked"}, Name: "renamed",
+			peerShouldReceiveUpdate(t, updTarget)
+			peerShouldReceiveUpdate(t, upd2)
+			peerShouldNotReceiveUpdate(t, upd3)
 		})
-		require.NoError(t, err)
 
-		peerShouldNotReceiveUpdate(t, updTarget)
-		peerShouldNotReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
+		step(t, "update without group changes refreshes nobody", func(t *testing.T) {
+			drainPeerUpdates(updTarget)
+			drainPeerUpdates(upd2)
+			drainPeerUpdates(upd3)
 
-		user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, targetUserID)
-		require.NoError(t, err)
-		assert.Equal(t, "renamed", user.Name)
-	})
+			_, err := manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
+				Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
+				AutoGroups: []string{"ug-linked"}, Name: "renamed",
+			})
+			require.NoError(t, err)
 
-	t.Run("auto group change reassigning IPv6 refreshes the changed peers and their observers", func(t *testing.T) {
-		require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-v6", Name: "ug-v6"}))
-		// Apply through the settings API so the reconciliation that strips the other
+			peerShouldNotReceiveUpdate(t, updTarget)
+			peerShouldNotReceiveUpdate(t, upd2)
+			peerShouldNotReceiveUpdate(t, upd3)
+
+			user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, targetUserID)
+			require.NoError(t, err)
+			assert.Equal(t, "renamed", user.Name)
+		})
+
+		step(t, "auto group change reassigning IPv6 refreshes the changed peers and their observers", func(t *testing.T) {
+
+			require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-v6", Name: "ug-v6"}))// Apply through the settings API so the reconciliation that strips the other
 		// peers' addresses happens here, leaving the target as the only peer the
 		// user update reassigns.
 		updateIPv6TestSettings(t, manager, accountID, func(s *types.Settings) {
 			s.IPv6EnabledGroups = []string{"ug-v6"}
 		})
 
-		drainPeerUpdates(updTarget)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
+			settleAffectedUpdates(updTarget, upd2, upd3)
 
-		_, err = manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
-			Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
-			AutoGroups: []string{"ug-linked", "ug-v6"}, Name: "renamed",
+			_, err = manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
+				Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
+				AutoGroups: []string{"ug-linked", "ug-v6"}, Name: "renamed",
+			})
+			require.NoError(t, err)
+
+			// The reassigned peer refreshes with everyone it can reach: peer2 via the
+			// policy, but not peer3, which shares no group or policy with it.
+			peerShouldReceiveUpdate(t, updTarget)
+			peerShouldReceiveUpdate(t, upd2)
+			peerShouldNotReceiveUpdate(t, upd3)
 		})
-		require.NoError(t, err)
 
-		// The reassigned peer refreshes with everyone it can reach: peer2 via the
-		// policy, but not peer3, which shares no group or policy with it.
-		peerShouldReceiveUpdate(t, updTarget)
-		peerShouldReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
-	})
+		step(t, "unblocking a user refreshes only the SSH rule destinations", func(t *testing.T) {
+			// An SSH rule that authorizes no group of its own ships the account's
+			// allowed-user set to its destinations, so those are the peers an unblock
+			// reaches — not the whole account.
+			_, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+				Enabled: true,
+				Rules: []*types.PolicyRule{{
+					Enabled:      true,
+					Sources:      []string{"ug-linked"},
+					Destinations: []string{"ug-dest"},
+					Protocol:     types.PolicyRuleProtocolNetbirdSSH,
+					Action:       types.PolicyTrafficActionAccept,
+				}},
+			}, true)
+			require.NoError(t, err)
 
-	t.Run("unblocking a user refreshes only the SSH rule destinations", func(t *testing.T) {
-		// An SSH rule that authorizes no group of its own ships the account's
-		// allowed-user set to its destinations, so those are the peers an unblock
-		// reaches — not the whole account.
-		_, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-			Enabled: true,
-			Rules: []*types.PolicyRule{{
-				Enabled:      true,
-				Sources:      []string{"ug-linked"},
-				Destinations: []string{"ug-dest"},
-				Protocol:     types.PolicyRuleProtocolNetbirdSSH,
-				Action:       types.PolicyTrafficActionAccept,
-			}},
-		}, true)
-		require.NoError(t, err)
+			blocked, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, targetUserID)
+			require.NoError(t, err)
+			blocked.Blocked = true
+			require.NoError(t, manager.Store.SaveUser(ctx, blocked))
 
-		blocked, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, targetUserID)
-		require.NoError(t, err)
-		blocked.Blocked = true
-		require.NoError(t, manager.Store.SaveUser(ctx, blocked))
+			settleAffectedUpdates(updTarget, upd2, upd3)
 
-		drainPeerUpdates(updTarget)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
+			// Same auto-groups as the previous subtest left them, so no group change and
+			// no IPv6 reconciliation interferes: the unblock alone drives the refresh.
+			_, err = manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
+				Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
+				AutoGroups: []string{"ug-linked", "ug-v6"}, Name: "renamed",
+			})
+			require.NoError(t, err)
 
-		// Same auto-groups as the previous subtest left them, so no group change and
-		// no IPv6 reconciliation interferes: the unblock alone drives the refresh.
-		_, err = manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
-			Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
-			AutoGroups: []string{"ug-linked", "ug-v6"}, Name: "renamed",
+			peerShouldReceiveUpdate(t, upd2)
+			peerShouldNotReceiveUpdate(t, upd3)
 		})
-		require.NoError(t, err)
-
-		peerShouldReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
 	})
 }
diff --git a/management/server/cache/idp.go b/management/server/cache/idp.go
index 6ec42e217..ec2684d6f 100644
--- a/management/server/cache/idp.go
+++ b/management/server/cache/idp.go
@@ -88,7 +88,8 @@ func NewUserDataCache(store store.StoreInterface) *UserDataCacheImpl {
 
 // AccountUserDataCache wraps the basic Get, Set and Delete methods for []*idp.UserData objects.
 type AccountUserDataCache struct {
-	cache Marshaler
+	cache    Marshaler
+	loadable *cache.LoadableCache[any]
 }
 
 func (a *AccountUserDataCache) Get(ctx context.Context, key string) ([]*idp.UserData, error) {
@@ -127,13 +128,18 @@ func (a *AccountUserDataCache) Delete(ctx context.Context, key string) error {
 	return a.cache.Delete(ctx, key)
 }
 
+// Close stops the goroutine that stores loaded values. The cache must not be used afterwards.
+func (a *AccountUserDataCache) Close() error {
+	return a.loadable.Close()
+}
+
 // NewAccountUserDataCache creates a new AccountUserDataCache object.
 func NewAccountUserDataCache(loadableFunc cache.LoadFunction[any], store store.StoreInterface) *AccountUserDataCache {
 	simpleCache := cache.New[any](store)
 	loadable := cache.NewLoadable[any](loadableFunc, simpleCache)
 	if store.GetType() == redis.RedisType {
 		m := marshaler.New(loadable)
-		return &AccountUserDataCache{cache: m}
+		return &AccountUserDataCache{cache: m, loadable: loadable}
 	}
-	return &AccountUserDataCache{cache: &marshalerWraper{loadable}}
+	return &AccountUserDataCache{cache: &marshalerWraper{loadable}, loadable: loadable}
 }
diff --git a/management/server/dns_test.go b/management/server/dns_test.go
index 25bef664c..d21864cbb 100644
--- a/management/server/dns_test.go
+++ b/management/server/dns_test.go
@@ -6,8 +6,8 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
 	"github.com/stretchr/testify/assert"
+	"go.uber.org/mock/gomock"
 
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller"
@@ -363,163 +363,167 @@ func initTestDNSAccount(t *testing.T, am *DefaultAccountManager) (*types.Account
 }
 
 func TestDNSAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	err := manager.CreateGroups(context.Background(), account.Id, userID, []*types.Group{
-		{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{},
-		},
-	})
-	assert.NoError(t, err)
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	// Saving DNS settings with groups that have no peers should not trigger updates to account peers or send peer updates
-	t.Run("saving dns setting with unused groups", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
-			DisabledManagementGroups: []string{"groupA"},
+		err := manager.CreateGroups(context.Background(), account.Id, userID, []*types.Group{
+			{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{},
+			},
+			{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{},
+			},
 		})
 		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Creating DNS settings with groups that have no peers should not update account peers or send peer update
-	t.Run("creating dns setting with unused groups", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err = manager.CreateNameServerGroup(
-			context.Background(), account.Id, "ns-group", "ns-group", []nbdns.NameServer{{
-				IP:     netip.MustParseAddr(peer1.IP.String()),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			}},
-			[]string{"groupB"},
-			true, []string{}, true, userID, false,
-		)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Creating DNS settings with groups that have peers should update account peers and send peer update
-	t.Run("creating dns setting with used groups", func(t *testing.T) {
-		err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
 		})
-		assert.NoError(t, err)
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		// Saving DNS settings with groups that have no peers should not trigger updates to account peers or send peer updates
+		step(t, "saving dns setting with unused groups", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
 
-		_, err = manager.CreateNameServerGroup(
-			context.Background(), account.Id, "ns-group-1", "ns-group-1", []nbdns.NameServer{{
-				IP:     netip.MustParseAddr(peer1.IP.String()),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			}},
-			[]string{"groupA"},
-			true, []string{}, true, userID, false,
-		)
-		assert.NoError(t, err)
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+			err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
+				DisabledManagementGroups: []string{"groupA"},
+			})
+			assert.NoError(t, err)
 
-	// Saving DNS settings with groups that have peers should update account peers and send peer update
-	t.Run("saving dns setting with used groups", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
-			DisabledManagementGroups: []string{"groupA", "groupB"},
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// Creating DNS settings with groups that have no peers should not update account peers or send peer update
+		step(t, "creating dns setting with unused groups", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	// Removing group with no peers from DNS settings  should not trigger updates to account peers or send peer updates
-	t.Run("removing group with no peers from dns settings", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			_, err = manager.CreateNameServerGroup(
+				context.Background(), account.Id, "ns-group", "ns-group", []nbdns.NameServer{{
+					IP:     netip.MustParseAddr(peer1.IP.String()),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				}},
+				[]string{"groupB"},
+				true, []string{}, true, userID, false,
+			)
+			assert.NoError(t, err)
 
-		err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
-			DisabledManagementGroups: []string{"groupA"},
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+		// Creating DNS settings with groups that have peers should update account peers and send peer update
+		step(t, "creating dns setting with used groups", func(t *testing.T) {
+			err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+			})
+			assert.NoError(t, err)
 
-	// Removing group with peers from DNS settings should trigger updates to account peers and send peer updates
-	t.Run("removing group with peers from dns settings", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
-			DisabledManagementGroups: []string{},
+			_, err = manager.CreateNameServerGroup(
+				context.Background(), account.Id, "ns-group-1", "ns-group-1", []nbdns.NameServer{{
+					IP:     netip.MustParseAddr(peer1.IP.String()),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				}},
+				[]string{"groupA"},
+				true, []string{}, true, userID, false,
+			)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
+		// Saving DNS settings with groups that have peers should update account peers and send peer update
+		step(t, "saving dns setting with used groups", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
+				DisabledManagementGroups: []string{"groupA", "groupB"},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Removing group with no peers from DNS settings  should not trigger updates to account peers or send peer updates
+		step(t, "removing group with no peers from dns settings", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
+				DisabledManagementGroups: []string{"groupA"},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Removing group with peers from DNS settings should trigger updates to account peers and send peer updates
+		step(t, "removing group with peers from dns settings", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
+				DisabledManagementGroups: []string{},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 	})
 }
diff --git a/management/server/group_test.go b/management/server/group_test.go
index fa351a43e..f0ccd385c 100644
--- a/management/server/group_test.go
+++ b/management/server/group_test.go
@@ -23,6 +23,7 @@ import (
 	"github.com/netbirdio/netbird/management/server/groups"
 	"github.com/netbirdio/netbird/management/server/networks"
 	"github.com/netbirdio/netbird/management/server/networks/resources"
+	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	"github.com/netbirdio/netbird/management/server/networks/routers"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
 	networkTypes "github.com/netbirdio/netbird/management/server/networks/types"
@@ -685,342 +686,368 @@ func initTestGroupAccount(am *DefaultAccountManager) (*DefaultAccountManager, *t
 }
 
 func TestGroupAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	g := []*types.Group{
-		{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer2.ID},
-		},
-		{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupC",
-			Name:  "GroupC",
-			Peers: []string{peer1.ID, peer3.ID},
-		},
-		{
-			ID:    "groupD",
-			Name:  "GroupD",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupE",
-			Name:  "GroupE",
-			Peers: []string{peer2.ID},
-		},
-	}
-	for _, group := range g {
-		err := manager.CreateGroup(context.Background(), account.Id, userID, group)
-		assert.NoError(t, err)
-	}
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	// Saving a group that is not linked to any resource should not update account peers
-	t.Run("saving unlinked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{peer1.ID, peer2.ID},
-		})
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Adding a peer to a group that is not linked to any resource should not update account peers
-	// and not send peer update
-	t.Run("adding peer to unlinked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.GroupAddPeer(context.Background(), account.Id, "groupB", peer3.ID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Removing a peer from a group that is not linked to any resource should not update account peers
-	// and not send peer update
-	t.Run("removing peer from unliked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.GroupDeletePeer(context.Background(), account.Id, "groupB", peer3.ID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Deleting group should not update account peers and not send peer update
-	t.Run("deleting group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.DeleteGroup(context.Background(), account.Id, userID, "groupB")
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// adding a group to policy
-	_, err := manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
+		g := []*types.Group{
 			{
-				Enabled:       true,
-				Sources:       []string{"groupA"},
-				Destinations:  []string{"groupA"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer2.ID},
+			},
+			{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{},
+			},
+			{
+				ID:    "groupC",
+				Name:  "GroupC",
+				Peers: []string{peer1.ID, peer3.ID},
+			},
+			{
+				ID:    "groupD",
+				Name:  "GroupD",
+				Peers: []string{},
+			},
+			{
+				ID:    "groupE",
+				Name:  "GroupE",
+				Peers: []string{peer2.ID},
 			},
-		},
-	}, true)
-	assert.NoError(t, err)
-
-	// Saving a group linked to policy should update account peers and send peer update
-	t.Run("saving linked group to policy", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer2.ID},
-		})
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
 		}
-	})
-
-	// adding peer to a used group should update account peers and send peer update
-	t.Run("adding peer to linked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.GroupAddPeer(context.Background(), account.Id, "groupA", peer3.ID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
+		for _, group := range g {
+			err := manager.CreateGroup(context.Background(), account.Id, userID, group)
+			assert.NoError(t, err)
 		}
-	})
 
-	// removing peer from a linked group should update account peers and send peer update
-	t.Run("removing peer from linked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
+		})
 
-		err := manager.GroupDeletePeer(context.Background(), account.Id, "groupA", peer3.ID)
+		// Saving a group that is not linked to any resource should not update account peers
+		step(t, "saving unlinked group", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{peer1.ID, peer2.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Adding a peer to a group that is not linked to any resource should not update account peers
+		// and not send peer update
+		step(t, "adding peer to unlinked group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.GroupAddPeer(context.Background(), account.Id, "groupB", peer3.ID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Removing a peer from a group that is not linked to any resource should not update account peers
+		// and not send peer update
+		step(t, "removing peer from unliked group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.GroupDeletePeer(context.Background(), account.Id, "groupB", peer3.ID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Deleting group should not update account peers and not send peer update
+		step(t, "deleting group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.DeleteGroup(context.Background(), account.Id, userID, "groupB")
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// adding a group to policy
+		_, err := manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+			Enabled: true,
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"groupA"},
+					Destinations:  []string{"groupA"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
+			},
+		}, true)
 		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// Saving a group linked to policy should update account peers and send peer update
+		step(t, "saving linked group to policy", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
 
-	// Saving a group linked to name server group should update account peers and send peer update
-	t.Run("saving group linked to name server group", func(t *testing.T) {
-		_, err = manager.CreateNameServerGroup(
-			context.Background(), account.Id, "nsGroup", "nsGroup", []nbdns.NameServer{{
-				IP:     netip.MustParseAddr("1.1.1.1"),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			}},
-			[]string{"groupC"},
-			true, nil, true, userID, false,
-		)
-		assert.NoError(t, err)
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer2.ID},
+			})
+			assert.NoError(t, err)
 
-		err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupC",
-			Name:  "GroupC",
-			Peers: []string{peer1.ID, peer3.ID},
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// adding peer to a used group should update account peers and send peer update
+		step(t, "adding peer to linked group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	// Saving a group linked to route should update account peers and send peer update
-	t.Run("saving group linked to route", func(t *testing.T) {
-		newRoute := route.Route{
-			ID:          "route",
-			Network:     netip.MustParsePrefix("192.168.0.0/16"),
-			NetID:       "superNet",
-			NetworkType: route.IPv4Network,
-			PeerGroups:  []string{"groupA"},
-			Description: "super",
-			Masquerade:  false,
-			Metric:      9999,
-			Enabled:     true,
-			Groups:      []string{"groupC"},
-		}
-		_, err := manager.CreateRoute(
-			context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer,
-			newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric,
-			newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, newRoute.SkipAutoApply,
-		)
-		require.NoError(t, err)
+			err := manager.GroupAddPeer(context.Background(), account.Id, "groupA", peer3.ID)
+			assert.NoError(t, err)
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// removing peer from a linked group should update account peers and send peer update
+		step(t, "removing peer from linked group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	// Saving a group linked to dns settings should update account peers and send peer update
-	t.Run("saving group linked to dns settings", func(t *testing.T) {
-		err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
-			DisabledManagementGroups: []string{"groupD"},
+			err := manager.GroupDeletePeer(context.Background(), account.Id, "groupA", peer3.ID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		// Saving a group linked to name server group should update account peers and send peer update
+		step(t, "saving group linked to name server group", func(t *testing.T) {
+			_, err = manager.CreateNameServerGroup(
+				context.Background(), account.Id, "nsGroup", "nsGroup", []nbdns.NameServer{{
+					IP:     netip.MustParseAddr("1.1.1.1"),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				}},
+				[]string{"groupC"},
+				true, nil, true, userID, false,
+			)
+			assert.NoError(t, err)
 
-		err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupD",
-			Name:  "GroupD",
-			Peers: []string{peer1.ID},
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupC",
+				Name:  "GroupC",
+				Peers: []string{peer1.ID, peer3.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// Saving a group linked to route should update account peers and send peer update
+		step(t, "saving group linked to route", func(t *testing.T) {
+			newRoute := route.Route{
+				ID:          "route",
+				Network:     netip.MustParsePrefix("192.168.0.0/16"),
+				NetID:       "superNet",
+				NetworkType: route.IPv4Network,
+				PeerGroups:  []string{"groupA"},
+				Description: "super",
+				Masquerade:  false,
+				Metric:      9999,
+				Enabled:     true,
+				Groups:      []string{"groupC"},
+			}
+			_, err := manager.CreateRoute(
+				context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer,
+				newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric,
+				newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, newRoute.SkipAutoApply,
+			)
+			require.NoError(t, err)
 
-	// Saving a group linked to network router should update account peers and send peer update
-	t.Run("saving group linked to network router", func(t *testing.T) {
-		permissionsManager := permissions.NewManager(manager.Store)
-		groupsManager := groups.NewManager(manager.Store, permissionsManager, manager)
-		resourcesManager := resources.NewManager(manager.Store, permissionsManager, groupsManager, manager, manager.serviceManager)
-		routersManager := routers.NewManager(manager.Store, permissionsManager, manager)
-		networksManager := networks.NewManager(manager.Store, permissionsManager, resourcesManager, routersManager, manager)
+			settleAffectedUpdates(updMsg)
 
-		network, err := networksManager.CreateNetwork(context.Background(), userID, &networkTypes.Network{
-			ID:          "network_test",
-			AccountID:   account.Id,
-			Name:        "network_test",
-			Description: "",
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		require.NoError(t, err)
 
-		_, err = routersManager.CreateRouter(context.Background(), userID, &routerTypes.NetworkRouter{
-			ID:         "router_test",
-			NetworkID:  network.ID,
-			AccountID:  account.Id,
-			PeerGroups: []string{"groupE"},
-			Masquerade: true,
-			Metric:     9999,
-			Enabled:    true,
+		// Saving a group linked to dns settings should update account peers and send peer update
+		step(t, "saving group linked to dns settings", func(t *testing.T) {
+			err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
+				DisabledManagementGroups: []string{"groupD"},
+			})
+			assert.NoError(t, err)
+
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupD",
+				Name:  "GroupD",
+				Peers: []string{peer1.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		require.NoError(t, err)
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		// Saving a group linked to network router should update account peers and send peer update
+		step(t, "saving group linked to network router", func(t *testing.T) {
+			permissionsManager := permissions.NewManager(manager.Store)
+			groupsManager := groups.NewManager(manager.Store, permissionsManager, manager)
+			resourcesManager := resources.NewManager(manager.Store, permissionsManager, groupsManager, manager, manager.serviceManager)
+			routersManager := routers.NewManager(manager.Store, permissionsManager, manager)
+			networksManager := networks.NewManager(manager.Store, permissionsManager, resourcesManager, routersManager, manager)
 
-		err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupE",
-			Name:  "GroupE",
-			Peers: []string{peer2.ID, peer3.ID},
+			network, err := networksManager.CreateNetwork(context.Background(), userID, &networkTypes.Network{
+				ID:          "network_test",
+				AccountID:   account.Id,
+				Name:        "network_test",
+				Description: "",
+			})
+			require.NoError(t, err)
+
+			_, err = routersManager.CreateRouter(context.Background(), userID, &routerTypes.NetworkRouter{
+				ID:         "router_test",
+				NetworkID:  network.ID,
+				AccountID:  account.Id,
+				PeerGroups: []string{"groupE"},
+				Masquerade: true,
+				Metric:     9999,
+				Enabled:    true,
+			})
+			require.NoError(t, err)
+
+			resource, err := resourcesManager.CreateResource(context.Background(), userID, &resourceTypes.NetworkResource{
+				AccountID: account.Id,
+				NetworkID: network.ID,
+				Name:      "resource_test",
+				Address:   "10.20.30.0/24",
+				Enabled:   true,
+			})
+			require.NoError(t, err)
+
+			_, err = manager.SavePolicy(context.Background(), account.Id, userID, peerToResourcePolicyByResource("groupA", resource.ID), true)
+			require.NoError(t, err)
+
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupE",
+				Name:  "GroupE",
+				Peers: []string{peer2.ID, peer3.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
 	})
 }
 
diff --git a/management/server/nameserver_test.go b/management/server/nameserver_test.go
index deed9c34f..1460893cf 100644
--- a/management/server/nameserver_test.go
+++ b/management/server/nameserver_test.go
@@ -6,9 +6,9 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller"
@@ -966,147 +966,151 @@ func TestValidateDomain(t *testing.T) {
 }
 
 func TestNameServerAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	var newNameServerGroupA *nbdns.NameServerGroup
-	var newNameServerGroupB *nbdns.NameServerGroup
+		var newNameServerGroupA *nbdns.NameServerGroup
+		var newNameServerGroupB *nbdns.NameServerGroup
 
-	err := manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
-		ID:    "groupA",
-		Name:  "GroupA",
-		Peers: []string{},
-	})
-	assert.NoError(t, err)
-
-	err = manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
-		ID:    "groupB",
-		Name:  "GroupB",
-		Peers: []string{peer1.ID, peer2.ID, peer3.ID},
-	})
-	assert.NoError(t, err)
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	// Creating a nameserver group with a distribution group no peers should not update account peers
-	// and not send peer update
-	t.Run("creating nameserver group with distribution group no peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		newNameServerGroupA, err = manager.CreateNameServerGroup(
-			context.Background(), account.Id, "nsGroupA", "nsGroupA", []nbdns.NameServer{{
-				IP:     netip.MustParseAddr("1.1.1.1"),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			}},
-			[]string{"groupA"},
-			true, []string{}, true, userID, false,
-		)
+		err := manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
+			ID:    "groupA",
+			Name:  "GroupA",
+			Peers: []string{},
+		})
 		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// saving a nameserver group with a distribution group with no peers should not update account peers
-	// and not send peer update
-	t.Run("saving nameserver group with distribution group no peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err = manager.SaveNameServerGroup(context.Background(), account.Id, userID, newNameServerGroupA)
+		err = manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
+			ID:    "groupB",
+			Name:  "GroupB",
+			Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+		})
 		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
+		})
 
-	// Creating a nameserver group with a distribution group no peers should update account peers and send peer update
-	t.Run("creating nameserver group with distribution group has peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		// Creating a nameserver group with a distribution group no peers should not update account peers
+		// and not send peer update
+		step(t, "creating nameserver group with distribution group no peers", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
 
-		newNameServerGroupB, err = manager.CreateNameServerGroup(
-			context.Background(), account.Id, "nsGroupB", "nsGroupB", []nbdns.NameServer{{
-				IP:     netip.MustParseAddr("1.1.1.1"),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			}},
-			[]string{"groupB"},
-			true, []string{}, true, userID, false,
-		)
-		assert.NoError(t, err)
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+			newNameServerGroupA, err = manager.CreateNameServerGroup(
+				context.Background(), account.Id, "nsGroupA", "nsGroupA", []nbdns.NameServer{{
+					IP:     netip.MustParseAddr("1.1.1.1"),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				}},
+				[]string{"groupA"},
+				true, []string{}, true, userID, false,
+			)
+			assert.NoError(t, err)
 
-	// saving a nameserver group with a distribution group with peers should update account peers and send peer update
-	t.Run("saving nameserver group with distribution group has peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
 
-		newNameServerGroupB.NameServers = []nbdns.NameServer{
-			{
-				IP:     netip.MustParseAddr("1.1.1.2"),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			},
-			{
-				IP:     netip.MustParseAddr("8.8.8.8"),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			},
-		}
-		err = manager.SaveNameServerGroup(context.Background(), account.Id, userID, newNameServerGroupB)
-		assert.NoError(t, err)
+		// saving a nameserver group with a distribution group with no peers should not update account peers
+		// and not send peer update
+		step(t, "saving nameserver group with distribution group no peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+			err = manager.SaveNameServerGroup(context.Background(), account.Id, userID, newNameServerGroupA)
+			assert.NoError(t, err)
 
-	// Deleting a nameserver group should update account peers and send peer update
-	t.Run("deleting nameserver group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
 
-		err = manager.DeleteNameServerGroup(context.Background(), account.Id, newNameServerGroupB.ID, userID)
-		assert.NoError(t, err)
+		// Creating a nameserver group with a distribution group no peers should update account peers and send peer update
+		step(t, "creating nameserver group with distribution group has peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
+			newNameServerGroupB, err = manager.CreateNameServerGroup(
+				context.Background(), account.Id, "nsGroupB", "nsGroupB", []nbdns.NameServer{{
+					IP:     netip.MustParseAddr("1.1.1.1"),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				}},
+				[]string{"groupB"},
+				true, []string{}, true, userID, false,
+			)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// saving a nameserver group with a distribution group with peers should update account peers and send peer update
+		step(t, "saving nameserver group with distribution group has peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			newNameServerGroupB.NameServers = []nbdns.NameServer{
+				{
+					IP:     netip.MustParseAddr("1.1.1.2"),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				},
+				{
+					IP:     netip.MustParseAddr("8.8.8.8"),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				},
+			}
+			err = manager.SaveNameServerGroup(context.Background(), account.Id, userID, newNameServerGroupB)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Deleting a nameserver group should update account peers and send peer update
+		step(t, "deleting nameserver group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.DeleteNameServerGroup(context.Background(), account.Id, newNameServerGroupB.ID, userID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 	})
 }
diff --git a/management/server/peer_test.go b/management/server/peer_test.go
index 5c3e02af5..5307300d6 100644
--- a/management/server/peer_test.go
+++ b/management/server/peer_test.go
@@ -1844,374 +1844,336 @@ func Test_LoginPeer(t *testing.T) {
 }
 
 func TestPeerAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	err := manager.DeletePolicy(context.Background(), account.Id, account.Policies[0].ID, userID)
-	require.NoError(t, err)
-
-	g := []*types.Group{
-		{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer2.ID, peer3.ID},
-		},
-		{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupC",
-			Name:  "GroupC",
-			Peers: []string{},
-		},
-	}
-	for _, group := range g {
-		err = manager.CreateGroup(context.Background(), account.Id, userID, group)
-		require.NoError(t, err)
-	}
-
-	// create a user with auto groups
-	_, err = manager.SaveOrAddUsers(context.Background(), account.Id, userID, []*types.User{
-		{
-			Id:         "regularUser1",
-			AccountID:  account.Id,
-			Role:       types.UserRoleAdmin,
-			Issued:     types.UserIssuedAPI,
-			AutoGroups: []string{"groupA"},
-		},
-		{
-			Id:         "regularUser2",
-			AccountID:  account.Id,
-			Role:       types.UserRoleAdmin,
-			Issued:     types.UserIssuedAPI,
-			AutoGroups: []string{"groupB"},
-		},
-		{
-			Id:         "regularUser3",
-			AccountID:  account.Id,
-			Role:       types.UserRoleAdmin,
-			Issued:     types.UserIssuedAPI,
-			AutoGroups: []string{"groupC"},
-		},
-	}, true)
-	require.NoError(t, err)
-
-	var peer4 *nbpeer.Peer
-	var peer5 *nbpeer.Peer
-	var peer6 *nbpeer.Peer
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	// Updating not expired peer and peer expiration is enabled should not update account peers and not send peer update
-	t.Run("updating not expired peer and peer expiration is enabled", func(t *testing.T) {
-		t.Skip("Currently all updates will trigger a network map")
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err := manager.UpdatePeer(context.Background(), account.Id, userID, peer2)
+		err := manager.DeletePolicy(context.Background(), account.Id, account.Policies[0].ID, userID)
 		require.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+		g := []*types.Group{
+			{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+			},
+			{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{},
+			},
+			{
+				ID:    "groupC",
+				Name:  "GroupC",
+				Peers: []string{},
+			},
 		}
-	})
-
-	// Adding peer to unlinked group should not update account peers and not send peer update
-	t.Run("adding peer to unlinked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		key, err := wgtypes.GeneratePrivateKey()
-		require.NoError(t, err)
-
-		expectedPeerKey := key.PublicKey().String()
-		peer4, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser1", &nbpeer.Peer{
-			Key:  expectedPeerKey,
-			Meta: nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
-		}, false)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Deleting peer with unlinked group should not update account peers and not send peer update
-	t.Run("deleting peer with unlinked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err = manager.DeletePeer(context.Background(), account.Id, peer4.ID, userID)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Updating peer label should update account peers and send peer update
-	t.Run("updating peer label", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		peer1.Name = "peer-1"
-		_, err = manager.UpdatePeer(context.Background(), account.Id, userID, peer1)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	t.Run("validator requires update", func(t *testing.T) {
-		requireUpdateFunc := func(_ context.Context, update *nbpeer.Peer, peer *nbpeer.Peer, userID string, accountID string, dnsDomain string, peersGroup []string, extraSettings *types.ExtraSettings) (*nbpeer.Peer, bool, error) {
-			return update, true, nil
+		for _, group := range g {
+			err = manager.CreateGroup(context.Background(), account.Id, userID, group)
+			require.NoError(t, err)
 		}
 
-		manager.integratedPeerValidator = MockIntegratedValidator{ValidatePeerFunc: requireUpdateFunc}
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err = manager.UpdatePeer(context.Background(), account.Id, userID, peer1)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	t.Run("validator requires no update", func(t *testing.T) {
-		t.Skip("Currently all updates will trigger a network map")
-
-		requireNoUpdateFunc := func(_ context.Context, update *nbpeer.Peer, peer *nbpeer.Peer, userID string, accountID string, dnsDomain string, peersGroup []string, extraSettings *types.ExtraSettings) (*nbpeer.Peer, bool, error) {
-			return update, false, nil
-		}
-
-		manager.integratedPeerValidator = MockIntegratedValidator{ValidatePeerFunc: requireNoUpdateFunc}
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err = manager.UpdatePeer(context.Background(), account.Id, userID, peer1)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Adding peer to group linked with policy should update account peers and send peer update
-	t.Run("adding peer to group linked with policy", func(t *testing.T) {
-		_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-			AccountID: account.Id,
-			Enabled:   true,
-			Rules: []*types.PolicyRule{
-				{
-					Enabled:       true,
-					Sources:       []string{"groupA"},
-					Destinations:  []string{"groupA"},
-					Bidirectional: true,
-					Action:        types.PolicyTrafficActionAccept,
-				},
+		// create a user with auto groups
+		_, err = manager.SaveOrAddUsers(context.Background(), account.Id, userID, []*types.User{
+			{
+				Id:         "regularUser1",
+				AccountID:  account.Id,
+				Role:       types.UserRoleAdmin,
+				Issued:     types.UserIssuedAPI,
+				AutoGroups: []string{"groupA"},
+			},
+			{
+				Id:         "regularUser2",
+				AccountID:  account.Id,
+				Role:       types.UserRoleAdmin,
+				Issued:     types.UserIssuedAPI,
+				AutoGroups: []string{"groupB"},
+			},
+			{
+				Id:         "regularUser3",
+				AccountID:  account.Id,
+				Role:       types.UserRoleAdmin,
+				Issued:     types.UserIssuedAPI,
+				AutoGroups: []string{"groupC"},
 			},
 		}, true)
 		require.NoError(t, err)
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		var peer4 *nbpeer.Peer
+		var peer5 *nbpeer.Peer
+		var peer6 *nbpeer.Peer
 
-		key, err := wgtypes.GeneratePrivateKey()
-		require.NoError(t, err)
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
+		})
 
-		expectedPeerKey := key.PublicKey().String()
-		peer4, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser1", &nbpeer.Peer{
-			Key:                    expectedPeerKey,
-			LoginExpirationEnabled: true,
-			Meta:                   nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
-		}, false)
-		require.NoError(t, err)
+		// Adding peer to unlinked group should not update account peers and not send peer update
+		step(t, "adding peer to unlinked group", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+			key, err := wgtypes.GeneratePrivateKey()
+			require.NoError(t, err)
 
-	// Deleting peer with linked group to policy should update account peers and send peer update
-	t.Run("deleting peer with linked group to policy", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			expectedPeerKey := key.PublicKey().String()
+			peer4, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser1", &nbpeer.Peer{
+				Key:  expectedPeerKey,
+				Meta: nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
+			}, false)
+			require.NoError(t, err)
 
-		err = manager.DeletePeer(context.Background(), account.Id, peer4.ID, userID)
-		require.NoError(t, err)
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// Deleting peer with unlinked group should not update account peers and not send peer update
+		step(t, "deleting peer with unlinked group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	// drain any buffered updates from previous subtests
-	drainPeerUpdates(updMsg)
+			err = manager.DeletePeer(context.Background(), account.Id, peer4.ID, userID)
+			require.NoError(t, err)
 
-	// Adding peer to group linked with route should update peers in that group, not unrelated peers
-	t.Run("adding peer to group linked with route", func(t *testing.T) {
-		route := nbroute.Route{
-			ID:          "testingRoute1",
-			Network:     netip.MustParsePrefix("100.65.250.202/32"),
-			NetID:       "superNet",
-			NetworkType: nbroute.IPv4Network,
-			PeerGroups:  []string{"groupB"},
-			Description: "super",
-			Masquerade:  false,
-			Metric:      9999,
-			Enabled:     true,
-			Groups:      []string{"groupB"},
-		}
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
 
-		_, err := manager.CreateRoute(
-			context.Background(), account.Id, route.Network, route.NetworkType, route.Domains, route.Peer,
-			route.PeerGroups, route.Description, route.NetID, route.Masquerade, route.Metric,
-			route.Groups, []string{}, true, userID, route.KeepRoute, route.SkipAutoApply,
-		)
-		require.NoError(t, err)
+		// Updating peer label should update account peers and send peer update
+		step(t, "updating peer label", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			peer1.Name = "peer-1"
+			_, err = manager.UpdatePeer(context.Background(), account.Id, userID, peer1)
+			require.NoError(t, err)
 
-		key, err := wgtypes.GeneratePrivateKey()
-		require.NoError(t, err)
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 
-		expectedPeerKey := key.PublicKey().String()
-		peer5, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser2", &nbpeer.Peer{
-			Key:                    expectedPeerKey,
-			LoginExpirationEnabled: true,
-			Meta:                   nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
-		}, false)
-		require.NoError(t, err)
+		step(t, "validator requires update", func(t *testing.T) {
+			requireUpdateFunc := func(_ context.Context, update *nbpeer.Peer, peer *nbpeer.Peer, userID string, accountID string, dnsDomain string, peersGroup []string, extraSettings *types.ExtraSettings) (*nbpeer.Peer, bool, error) {
+				return update, true, nil
+			}
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+			manager.integratedPeerValidator = MockIntegratedValidator{ValidatePeerFunc: requireUpdateFunc}
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	// Deleting peer with linked group to route should update peers in that group, not unrelated peers
-	t.Run("deleting peer with linked group to route", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			_, err = manager.UpdatePeer(context.Background(), account.Id, userID, peer1)
+			require.NoError(t, err)
 
-		err = manager.DeletePeer(context.Background(), account.Id, peer5.ID, userID)
-		require.NoError(t, err)
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+		// Adding peer to group linked with policy should update account peers and send peer update
+		step(t, "adding peer to group linked with policy", func(t *testing.T) {
+			_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				AccountID: account.Id,
+				Enabled:   true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupA"},
+						Destinations:  []string{"groupA"},
+						Bidirectional: true,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+			}, true)
+			require.NoError(t, err)
 
-	// Adding peer to group linked with name server group should update peers in that group, not unrelated peers
-	t.Run("adding peer to group linked with name server group", func(t *testing.T) {
-		_, err = manager.CreateNameServerGroup(
-			context.Background(), account.Id, "nsGroup", "nsGroup", []nbdns.NameServer{{
-				IP:     netip.MustParseAddr("1.1.1.1"),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			}},
-			[]string{"groupC"},
-			true, []string{}, true, userID, false,
-		)
-		require.NoError(t, err)
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			key, err := wgtypes.GeneratePrivateKey()
+			require.NoError(t, err)
 
-		key, err := wgtypes.GeneratePrivateKey()
-		require.NoError(t, err)
+			expectedPeerKey := key.PublicKey().String()
+			peer4, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser1", &nbpeer.Peer{
+				Key:                    expectedPeerKey,
+				LoginExpirationEnabled: true,
+				Meta:                   nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
+			}, false)
+			require.NoError(t, err)
 
-		expectedPeerKey := key.PublicKey().String()
-		peer6, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser3", &nbpeer.Peer{
-			Key:                    expectedPeerKey,
-			LoginExpirationEnabled: true,
-			Meta:                   nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
-		}, false)
-		require.NoError(t, err)
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+		// Deleting peer with linked group to policy should update account peers and send peer update
+		step(t, "deleting peer with linked group to policy", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	// Deleting peer with linked group to name server group should update peers in that group, not unrelated peers
-	t.Run("deleting peer with linked group to route", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			err = manager.DeletePeer(context.Background(), account.Id, peer4.ID, userID)
+			require.NoError(t, err)
 
-		err = manager.DeletePeer(context.Background(), account.Id, peer6.ID, userID)
-		require.NoError(t, err)
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
+		// drain any buffered updates from previous subtests
+		drainPeerUpdates(updMsg)
+
+		// Adding peer to group linked with route should update peers in that group, not unrelated peers
+		step(t, "adding peer to group linked with route", func(t *testing.T) {
+			route := nbroute.Route{
+				ID:          "testingRoute1",
+				Network:     netip.MustParsePrefix("100.65.250.202/32"),
+				NetID:       "superNet",
+				NetworkType: nbroute.IPv4Network,
+				PeerGroups:  []string{"groupB"},
+				Description: "super",
+				Masquerade:  false,
+				Metric:      9999,
+				Enabled:     true,
+				Groups:      []string{"groupB"},
+			}
+
+			_, err := manager.CreateRoute(
+				context.Background(), account.Id, route.Network, route.NetworkType, route.Domains, route.Peer,
+				route.PeerGroups, route.Description, route.NetID, route.Masquerade, route.Metric,
+				route.Groups, []string{}, true, userID, route.KeepRoute, route.SkipAutoApply,
+			)
+			require.NoError(t, err)
+
+			settleAffectedUpdates(updMsg)
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			key, err := wgtypes.GeneratePrivateKey()
+			require.NoError(t, err)
+
+			expectedPeerKey := key.PublicKey().String()
+			peer5, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser2", &nbpeer.Peer{
+				Key:                    expectedPeerKey,
+				LoginExpirationEnabled: true,
+				Meta:                   nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
+			}, false)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Deleting peer with linked group to route should update peers in that group, not unrelated peers
+		step(t, "deleting peer with linked group to route", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.DeletePeer(context.Background(), account.Id, peer5.ID, userID)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Adding peer to group linked with name server group should update peers in that group, not unrelated peers
+		step(t, "adding peer to group linked with name server group", func(t *testing.T) {
+			_, err = manager.CreateNameServerGroup(
+				context.Background(), account.Id, "nsGroup", "nsGroup", []nbdns.NameServer{{
+					IP:     netip.MustParseAddr("1.1.1.1"),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				}},
+				[]string{"groupC"},
+				true, []string{}, true, userID, false,
+			)
+			require.NoError(t, err)
+
+			settleAffectedUpdates(updMsg)
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			key, err := wgtypes.GeneratePrivateKey()
+			require.NoError(t, err)
+
+			expectedPeerKey := key.PublicKey().String()
+			peer6, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser3", &nbpeer.Peer{
+				Key:                    expectedPeerKey,
+				LoginExpirationEnabled: true,
+				Meta:                   nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
+			}, false)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Deleting peer with linked group to name server group should update peers in that group, not unrelated peers
+		step(t, "deleting peer with linked group to name server group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.DeletePeer(context.Background(), account.Id, peer6.ID, userID)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
 	})
 }
 
@@ -2859,45 +2821,47 @@ func TestPeerWillHaveIPv6(t *testing.T) {
 // flipping --disable-ipv6) without bumping its WtVersion, other account peers
 // receive a fresh network map so their AAAA records for it become unstale.
 func TestSyncPeer_IPv6CapabilityChangePropagates(t *testing.T) {
-	manager, updateManager, _, peer1, peer2, _ := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, _, peer1, peer2, _ := setupNetworkMapTest(t)
 
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
+		})
 
-	// Drain any initial updates from setup.
-	drain := func() {
-		for {
-			select {
-			case <-updMsg:
-			case <-time.After(200 * time.Millisecond):
-				return
+		// Drain any initial updates from setup.
+		drain := func() {
+			for {
+				select {
+				case <-updMsg:
+				case <-time.After(200 * time.Millisecond):
+					return
+				}
 			}
 		}
-	}
-	drain()
+		drain()
 
-	t.Run("no propagation when capabilities are unchanged", func(t *testing.T) {
-		_, _, _, _, err := manager.SyncPeer(context.Background(), types.PeerSync{
-			WireGuardPubKey: peer2.Key,
-			Meta:            peer2.Meta,
-		}, peer2.AccountID)
-		require.NoError(t, err)
-		peerShouldNotReceiveUpdate(t, updMsg)
-	})
+		step(t, "no propagation when capabilities are unchanged", func(t *testing.T) {
+			_, _, _, _, err := manager.SyncPeer(context.Background(), types.PeerSync{
+				WireGuardPubKey: peer2.Key,
+				Meta:            peer2.Meta,
+			}, peer2.AccountID)
+			require.NoError(t, err)
+			peerShouldNotReceiveUpdate(t, updMsg)
+		})
 
-	t.Run("propagation when IPv6 capability is added", func(t *testing.T) {
-		newMeta := peer2.Meta
-		newMeta.Capabilities = append([]int32{}, peer2.Meta.Capabilities...)
-		newMeta.Capabilities = append(newMeta.Capabilities, nbpeer.PeerCapabilityIPv6Overlay)
+		step(t, "propagation when IPv6 capability is added", func(t *testing.T) {
+			newMeta := peer2.Meta
+			newMeta.Capabilities = append([]int32{}, peer2.Meta.Capabilities...)
+			newMeta.Capabilities = append(newMeta.Capabilities, nbpeer.PeerCapabilityIPv6Overlay)
 
-		_, _, _, _, err := manager.SyncPeer(context.Background(), types.PeerSync{
-			WireGuardPubKey: peer2.Key,
-			Meta:            newMeta,
-		}, peer2.AccountID)
-		require.NoError(t, err)
-		peerShouldReceiveUpdate(t, updMsg)
+			_, _, _, _, err := manager.SyncPeer(context.Background(), types.PeerSync{
+				WireGuardPubKey: peer2.Key,
+				Meta:            newMeta,
+			}, peer2.AccountID)
+			require.NoError(t, err)
+			peerShouldReceiveUpdate(t, updMsg)
+		})
 	})
 }
 
diff --git a/management/server/policy_test.go b/management/server/policy_test.go
index 6fb573b9e..7607a7567 100644
--- a/management/server/policy_test.go
+++ b/management/server/policy_test.go
@@ -1135,287 +1135,291 @@ func sortFunc() func(a *types.FirewallRule, b *types.FirewallRule) int {
 }
 
 func TestPolicyAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	g := []*types.Group{
-		{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer3.ID},
-		},
-		{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupC",
-			Name:  "GroupC",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupD",
-			Name:  "GroupD",
-			Peers: []string{peer1.ID, peer2.ID},
-		},
-	}
-	for _, group := range g {
-		err := manager.CreateGroup(context.Background(), account.Id, userID, group)
-		assert.NoError(t, err)
-	}
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	var policyWithGroupRulesNoPeers *types.Policy
-	var policyWithDestinationPeersOnly *types.Policy
-	var policyWithSourceAndDestinationPeers *types.Policy
-	var err error
-
-	// Saving policy with rule groups with no peers should not update account's peers and not send peer update
-	t.Run("saving policy with rule groups with no peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policyWithGroupRulesNoPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-			AccountID: account.Id,
-			Enabled:   true,
-			Rules: []*types.PolicyRule{
-				{
-					Enabled:       true,
-					Sources:       []string{"groupB"},
-					Destinations:  []string{"groupC"},
-					Bidirectional: true,
-					Action:        types.PolicyTrafficActionAccept,
-				},
+		g := []*types.Group{
+			{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer3.ID},
 			},
-		}, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Saving policy with source group containing peers, but destination group without peers should
-	// update account's peers and send peer update
-	t.Run("saving policy where source has peers but destination does not", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-			AccountID: account.Id,
-			Enabled:   true,
-			Rules: []*types.PolicyRule{
-				{
-					Enabled:       true,
-					Sources:       []string{"groupA"},
-					Destinations:  []string{"groupB"},
-					Protocol:      types.PolicyRuleProtocolTCP,
-					Bidirectional: true,
-					Action:        types.PolicyTrafficActionAccept,
-				},
+			{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{},
 			},
-		}, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Saving policy with destination group containing peers, but source group without peers should
-	// update account's peers and send peer update
-	t.Run("saving policy where destination has peers but source does not", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policyWithDestinationPeersOnly, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-			AccountID: account.Id,
-			Enabled:   true,
-			Rules: []*types.PolicyRule{
-				{
-					Enabled:       true,
-					Sources:       []string{"groupC"},
-					Destinations:  []string{"groupD"},
-					Bidirectional: true,
-					Protocol:      types.PolicyRuleProtocolTCP,
-					Action:        types.PolicyTrafficActionAccept,
-				},
+			{
+				ID:    "groupC",
+				Name:  "GroupC",
+				Peers: []string{},
 			},
-		}, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Saving policy with destination and source groups containing peers should update account's peers
-	// and send peer update
-	t.Run("saving policy with source and destination groups with peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-			AccountID: account.Id,
-			Enabled:   true,
-			Rules: []*types.PolicyRule{
-				{
-					Enabled:       true,
-					Sources:       []string{"groupA"},
-					Destinations:  []string{"groupD"},
-					Bidirectional: true,
-					Action:        types.PolicyTrafficActionAccept,
-				},
+			{
+				ID:    "groupD",
+				Name:  "GroupD",
+				Peers: []string{peer1.ID, peer2.ID},
 			},
-		}, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
 		}
-	})
-
-	// Disabling policy with destination and source groups containing peers should update account's peers
-	// and send peer update
-	t.Run("disabling policy with source and destination groups with peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policyWithSourceAndDestinationPeers.Enabled = false
-		policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, policyWithSourceAndDestinationPeers, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Updating disabled policy with destination and source groups containing peers should still update account's peers
-	// because affected peer resolution does not filter by policy enabled state
-	t.Run("updating disabled policy with source and destination groups with peers", func(t *testing.T) {
-		drainPeerUpdates(updMsg)
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policyWithSourceAndDestinationPeers.Description = "updated description"
-		policyWithSourceAndDestinationPeers.Rules[0].Destinations = []string{"groupA"}
-		policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, policyWithSourceAndDestinationPeers, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Enabling policy with destination and source groups containing peers should update account's peers
-	// and send peer update
-	t.Run("enabling policy with source and destination groups with peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policyWithSourceAndDestinationPeers.Enabled = true
-		policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, policyWithSourceAndDestinationPeers, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Deleting policy should trigger account peers update and send peer update
-	t.Run("deleting policy with source and destination groups with peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.DeletePolicy(context.Background(), account.Id, policyWithSourceAndDestinationPeers.ID, userID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
+		for _, group := range g {
+			err := manager.CreateGroup(context.Background(), account.Id, userID, group)
+			assert.NoError(t, err)
 		}
 
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
+		})
+
+		var policyWithGroupRulesNoPeers *types.Policy
+		var policyWithDestinationPeersOnly *types.Policy
+		var policyWithSourceAndDestinationPeers *types.Policy
+		var err error
+
+		// Saving policy with rule groups with no peers should not update account's peers and not send peer update
+		step(t, "saving policy with rule groups with no peers", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			policyWithGroupRulesNoPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				AccountID: account.Id,
+				Enabled:   true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupB"},
+						Destinations:  []string{"groupC"},
+						Bidirectional: true,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+			}, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Saving policy with source group containing peers, but destination group without peers should
+		// update account's peers and send peer update
+		step(t, "saving policy where source has peers but destination does not", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				AccountID: account.Id,
+				Enabled:   true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupA"},
+						Destinations:  []string{"groupB"},
+						Protocol:      types.PolicyRuleProtocolTCP,
+						Bidirectional: true,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+			}, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Saving policy with destination group containing peers, but source group without peers should
+		// update account's peers and send peer update
+		step(t, "saving policy where destination has peers but source does not", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			policyWithDestinationPeersOnly, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				AccountID: account.Id,
+				Enabled:   true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupC"},
+						Destinations:  []string{"groupD"},
+						Bidirectional: true,
+						Protocol:      types.PolicyRuleProtocolTCP,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+			}, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Saving policy with destination and source groups containing peers should update account's peers
+		// and send peer update
+		step(t, "saving policy with source and destination groups with peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				AccountID: account.Id,
+				Enabled:   true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupA"},
+						Destinations:  []string{"groupD"},
+						Bidirectional: true,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+			}, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Disabling policy with destination and source groups containing peers should update account's peers
+		// and send peer update
+		step(t, "disabling policy with source and destination groups with peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			policyWithSourceAndDestinationPeers.Enabled = false
+			policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, policyWithSourceAndDestinationPeers, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Updating disabled policy with destination and source groups containing peers should still update account's peers
+		// because affected peer resolution does not filter by policy enabled state
+		step(t, "updating disabled policy with source and destination groups with peers", func(t *testing.T) {
+			drainPeerUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			policyWithSourceAndDestinationPeers.Description = "updated description"
+			policyWithSourceAndDestinationPeers.Rules[0].Destinations = []string{"groupA"}
+			policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, policyWithSourceAndDestinationPeers, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Enabling policy with destination and source groups containing peers should update account's peers
+		// and send peer update
+		step(t, "enabling policy with source and destination groups with peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			policyWithSourceAndDestinationPeers.Enabled = true
+			policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, policyWithSourceAndDestinationPeers, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Deleting policy should trigger account peers update and send peer update
+		step(t, "deleting policy with source and destination groups with peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.DeletePolicy(context.Background(), account.Id, policyWithSourceAndDestinationPeers.ID, userID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+
+		})
+
+		// Deleting policy with destination group containing peers, but source group without peers should
+		// update account's peers and send peer update
+		step(t, "deleting policy where destination has peers but source does not", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.DeletePolicy(context.Background(), account.Id, policyWithDestinationPeersOnly.ID, userID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Deleting policy with no peers in groups should not update account's peers and not send peer update
+		step(t, "deleting policy with no peers in groups", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.DeletePolicy(context.Background(), account.Id, policyWithGroupRulesNoPeers.ID, userID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
 	})
-
-	// Deleting policy with destination group containing peers, but source group without peers should
-	// update account's peers and send peer update
-	t.Run("deleting policy where destination has peers but source does not", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.DeletePolicy(context.Background(), account.Id, policyWithDestinationPeersOnly.ID, userID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Deleting policy with no peers in groups should not update account's peers and not send peer update
-	t.Run("deleting policy with no peers in groups", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.DeletePolicy(context.Background(), account.Id, policyWithGroupRulesNoPeers.ID, userID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
 }
diff --git a/management/server/posture_checks_test.go b/management/server/posture_checks_test.go
index 74738e72d..601294eda 100644
--- a/management/server/posture_checks_test.go
+++ b/management/server/posture_checks_test.go
@@ -123,324 +123,334 @@ func initTestPostureChecksAccount(am *DefaultAccountManager) (*types.Account, er
 }
 
 func TestPostureCheckAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	g := []*types.Group{
-		{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer2.ID, peer3.ID},
-		},
-		{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupC",
-			Name:  "GroupC",
-			Peers: []string{},
-		},
-	}
-	for _, group := range g {
-		err := manager.CreateGroup(context.Background(), account.Id, userID, group)
-		assert.NoError(t, err)
-	}
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	postureCheckA := &posture.Checks{
-		Name:      "postureCheckA",
-		AccountID: account.Id,
-		Checks: posture.ChecksDefinition{
-			ProcessCheck: &posture.ProcessCheck{
-				Processes: []posture.Process{
-					{LinuxPath: "/usr/bin/netbird", MacPath: "/usr/local/bin/netbird"},
-				},
-			},
-		},
-	}
-	postureCheckA, err := manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckA, true)
-	require.NoError(t, err)
-
-	postureCheckB := &posture.Checks{
-		Name:      "postureCheckB",
-		AccountID: account.Id,
-		Checks: posture.ChecksDefinition{
-			NBVersionCheck: &posture.NBVersionCheck{
-				MinVersion: "0.28.0",
-			},
-		},
-	}
-
-	// Saving unused posture check should not update account peers and not send peer update
-	t.Run("saving unused posture check", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		postureCheckB, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Updating unused posture check should not update account peers and not send peer update
-	t.Run("updating unused posture check", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		postureCheckB.Checks = posture.ChecksDefinition{
-			NBVersionCheck: &posture.NBVersionCheck{
-				MinVersion: "0.29.0",
-			},
-		}
-		_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	policy := &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
+		g := []*types.Group{
 			{
-				Enabled:       true,
-				Sources:       []string{"groupA"},
-				Destinations:  []string{"groupA"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer2.ID, peer3.ID},
 			},
-		},
-		SourcePostureChecks: []string{postureCheckB.ID},
-	}
-
-	// Linking posture check to policy should trigger update account peers and send peer update
-	t.Run("linking posture check to policy with peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policy, err = manager.SavePolicy(context.Background(), account.Id, userID, policy, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Updating linked posture checks should update account peers and send peer update
-	t.Run("updating linked to posture check with peers", func(t *testing.T) {
-		postureCheckB.Checks = posture.ChecksDefinition{
-			NBVersionCheck: &posture.NBVersionCheck{
-				MinVersion: "0.29.0",
+			{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{},
 			},
-			ProcessCheck: &posture.ProcessCheck{
-				Processes: []posture.Process{
-					{LinuxPath: "/usr/bin/netbird", MacPath: "/usr/local/bin/netbird"},
-				},
+			{
+				ID:    "groupC",
+				Name:  "GroupC",
+				Peers: []string{},
 			},
 		}
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
+		for _, group := range g {
+			err := manager.CreateGroup(context.Background(), account.Id, userID, group)
+			assert.NoError(t, err)
 		}
-	})
 
-	// Removing posture check from policy should trigger account peers update and send peer update
-	t.Run("removing posture check from policy", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policy.SourcePostureChecks = []string{}
-		_, err := manager.SavePolicy(context.Background(), account.Id, userID, policy, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Deleting unused posture check should not trigger account peers update and not send peer update
-	t.Run("deleting unused posture check", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.DeletePostureChecks(context.Background(), account.Id, postureCheckA.ID, userID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
-	assert.NoError(t, err)
-
-	// Updating linked posture check to policy with no peers should not trigger account peers update and not send peer update
-	t.Run("updating linked posture check to policy with no peers", func(t *testing.T) {
-		_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-			Enabled: true,
-			Rules: []*types.PolicyRule{
-				{
-					Enabled:       true,
-					Sources:       []string{"groupB"},
-					Destinations:  []string{"groupC"},
-					Bidirectional: true,
-					Action:        types.PolicyTrafficActionAccept,
-				},
-			},
-			SourcePostureChecks: []string{postureCheckB.ID},
-		}, true)
-		assert.NoError(t, err)
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		postureCheckB.Checks = posture.ChecksDefinition{
-			NBVersionCheck: &posture.NBVersionCheck{
-				MinVersion: "0.29.0",
-			},
-		}
-		_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Updating linked posture check to policy where destination has peers but source does not
-	// should trigger account peers update and send peer update
-	t.Run("updating linked posture check to policy where destination has peers but source does not", func(t *testing.T) {
-		updMsg1 := updateManager.CreateChannel(context.Background(), peer2.ID)
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
 		t.Cleanup(func() {
-			updateManager.CloseChannel(context.Background(), peer2.ID)
+			updateManager.CloseChannel(context.Background(), peer1.ID)
 		})
 
-		_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+		postureCheckA := &posture.Checks{
+			Name:      "postureCheckA",
+			AccountID: account.Id,
+			Checks: posture.ChecksDefinition{
+				ProcessCheck: &posture.ProcessCheck{
+					Processes: []posture.Process{
+						{LinuxPath: "/usr/bin/netbird", MacPath: "/usr/local/bin/netbird"},
+					},
+				},
+			},
+		}
+		postureCheckA, err := manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckA, true)
+		require.NoError(t, err)
+
+		postureCheckB := &posture.Checks{
+			Name:      "postureCheckB",
+			AccountID: account.Id,
+			Checks: posture.ChecksDefinition{
+				NBVersionCheck: &posture.NBVersionCheck{
+					MinVersion: "0.28.0",
+				},
+			},
+		}
+
+		// Saving unused posture check should not update account peers and not send peer update
+		step(t, "saving unused posture check", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			postureCheckB, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Updating unused posture check should not update account peers and not send peer update
+		step(t, "updating unused posture check", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			postureCheckB.Checks = posture.ChecksDefinition{
+				NBVersionCheck: &posture.NBVersionCheck{
+					MinVersion: "0.29.0",
+				},
+			}
+			_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		policy := &types.Policy{
 			Enabled: true,
 			Rules: []*types.PolicyRule{
 				{
 					Enabled:       true,
-					Sources:       []string{"groupB"},
+					Sources:       []string{"groupA"},
 					Destinations:  []string{"groupA"},
 					Bidirectional: true,
 					Action:        types.PolicyTrafficActionAccept,
 				},
 			},
 			SourcePostureChecks: []string{postureCheckB.ID},
-		}, true)
-		assert.NoError(t, err)
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			close(done)
-		}()
-
-		postureCheckB.Checks = posture.ChecksDefinition{
-			NBVersionCheck: &posture.NBVersionCheck{
-				MinVersion: "0.29.0",
-			},
 		}
-		_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// Linking posture check to policy should trigger update account peers and send peer update
+		step(t, "linking posture check to policy with peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	// Updating linked client posture check to policy where source has peers but destination does not,
-	// should trigger account peers update and send peer update
-	t.Run("updating linked posture check to policy where source has peers but destination does not", func(t *testing.T) {
-		_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-			Enabled: true,
-			Rules: []*types.PolicyRule{
-				{
-					Enabled:       true,
-					Sources:       []string{"groupA"},
-					Destinations:  []string{"groupB"},
-					Bidirectional: true,
-					Action:        types.PolicyTrafficActionAccept,
+			policy, err = manager.SavePolicy(context.Background(), account.Id, userID, policy, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Updating linked posture checks should update account peers and send peer update
+		step(t, "updating linked to posture check with peers", func(t *testing.T) {
+			postureCheckB.Checks = posture.ChecksDefinition{
+				NBVersionCheck: &posture.NBVersionCheck{
+					MinVersion: "0.29.0",
 				},
-			},
-			SourcePostureChecks: []string{postureCheckB.ID},
-		}, true)
-		assert.NoError(t, err)
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		postureCheckB.Checks = posture.ChecksDefinition{
-			ProcessCheck: &posture.ProcessCheck{
-				Processes: []posture.Process{
-					{
-						LinuxPath: "/usr/bin/netbird",
+				ProcessCheck: &posture.ProcessCheck{
+					Processes: []posture.Process{
+						{LinuxPath: "/usr/bin/netbird", MacPath: "/usr/local/bin/netbird"},
 					},
 				},
-			},
-		}
+			}
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Removing posture check from policy should trigger account peers update and send peer update
+		step(t, "removing posture check from policy", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			policy.SourcePostureChecks = []string{}
+			_, err := manager.SavePolicy(context.Background(), account.Id, userID, policy, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Deleting unused posture check should not trigger account peers update and not send peer update
+		step(t, "deleting unused posture check", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.DeletePostureChecks(context.Background(), account.Id, postureCheckA.ID, userID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
 		_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
 		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
+		// Updating linked posture check to policy with no peers should not trigger account peers update and not send peer update
+		step(t, "updating linked posture check to policy with no peers", func(t *testing.T) {
+			_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				Enabled: true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupB"},
+						Destinations:  []string{"groupC"},
+						Bidirectional: true,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+				SourcePostureChecks: []string{postureCheckB.ID},
+			}, true)
+			assert.NoError(t, err)
+
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			postureCheckB.Checks = posture.ChecksDefinition{
+				NBVersionCheck: &posture.NBVersionCheck{
+					MinVersion: "0.29.0",
+				},
+			}
+			_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Updating linked posture check to policy where destination has peers but source does not
+		// should trigger account peers update and send peer update
+		step(t, "updating linked posture check to policy where destination has peers but source does not", func(t *testing.T) {
+			updMsg1 := updateManager.CreateChannel(context.Background(), peer2.ID)
+			t.Cleanup(func() {
+				updateManager.CloseChannel(context.Background(), peer2.ID)
+			})
+
+			_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				Enabled: true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupB"},
+						Destinations:  []string{"groupA"},
+						Bidirectional: true,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+				SourcePostureChecks: []string{postureCheckB.ID},
+			}, true)
+			assert.NoError(t, err)
+
+			settleAffectedUpdates(updMsg, updMsg1)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				close(done)
+			}()
+
+			postureCheckB.Checks = posture.ChecksDefinition{
+				NBVersionCheck: &posture.NBVersionCheck{
+					MinVersion: "0.29.0",
+				},
+			}
+			_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Updating linked client posture check to policy where source has peers but destination does not,
+		// should trigger account peers update and send peer update
+		step(t, "updating linked posture check to policy where source has peers but destination does not", func(t *testing.T) {
+			_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				Enabled: true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupA"},
+						Destinations:  []string{"groupB"},
+						Bidirectional: true,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+				SourcePostureChecks: []string{postureCheckB.ID},
+			}, true)
+			assert.NoError(t, err)
+
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			postureCheckB.Checks = posture.ChecksDefinition{
+				ProcessCheck: &posture.ProcessCheck{
+					Processes: []posture.Process{
+						{
+							LinuxPath: "/usr/bin/netbird",
+						},
+					},
+				},
+			}
+			_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 	})
 }
 
diff --git a/management/server/route_test.go b/management/server/route_test.go
index 4ca9ee48f..69b9aec6c 100644
--- a/management/server/route_test.go
+++ b/management/server/route_test.go
@@ -6,10 +6,10 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
 	"github.com/rs/xid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/update_channel"
@@ -1262,7 +1262,10 @@ func createRouterManager(t *testing.T) (*DefaultAccountManager, *update_channel.
 	}
 	eventStore := &activity.InMemoryEventStore{}
 
-	metrics, err := telemetry.NewDefaultAppMetrics(context.Background())
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	metrics, err := telemetry.NewDefaultAppMetrics(ctx)
 	require.NoError(t, err)
 
 	ctrl := gomock.NewController(t)
@@ -1290,9 +1293,8 @@ func createRouterManager(t *testing.T) (*DefaultAccountManager, *update_channel.
 	permissionsManager := permissions.NewManager(store)
 	peersManager := peers.NewManager(store, permissionsManager)
 
-	ctx := context.Background()
-
-	cacheStore, err := cache.NewStore(ctx, 100*time.Millisecond, 300*time.Millisecond, 100)
+	// A go-cache janitor only stops through a GC finalizer, which would leave synctest bubbles with a goroutine that never exits.
+	cacheStore, err := cache.NewStore(ctx, 100*time.Millisecond, 0, 100)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -1301,10 +1303,12 @@ func createRouterManager(t *testing.T) (*DefaultAccountManager, *update_channel.
 	requestBuffer := NewAccountRequestBuffer(ctx, store)
 	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nil)
 
-	am, err := BuildManager(context.Background(), nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	am, err := BuildManager(ctx, nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
 	if err != nil {
 		return nil, nil, err
 	}
+	cacheManager := am.cacheManager
+	t.Cleanup(func() { _ = cacheManager.Close() })
 	return am, updateManager, nil
 }
 
@@ -1893,265 +1897,269 @@ func TestAccount_getPeersRoutesFirewall(t *testing.T) {
 }
 
 func TestRouteAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, err := createRouterManager(t)
-	require.NoError(t, err, "failed to create account manager")
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, err := createRouterManager(t)
+		require.NoError(t, err, "failed to create account manager")
 
-	account, err := initTestRouteAccount(t, manager)
-	require.NoError(t, err, "failed to init testing account")
+		account, err := initTestRouteAccount(t, manager)
+		require.NoError(t, err, "failed to init testing account")
 
-	g := []*types.Group{
-		{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupC",
-			Name:  "GroupC",
-			Peers: []string{},
-		},
-	}
-	for _, group := range g {
-		err = manager.CreateGroup(context.Background(), account.Id, userID, group)
-		require.NoError(t, err, "failed to create group %s", group.Name)
-	}
+		g := []*types.Group{
+			{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{},
+			},
+			{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{},
+			},
+			{
+				ID:    "groupC",
+				Name:  "GroupC",
+				Peers: []string{},
+			},
+		}
+		for _, group := range g {
+			err = manager.CreateGroup(context.Background(), account.Id, userID, group)
+			require.NoError(t, err, "failed to create group %s", group.Name)
+		}
 
-	updMsg := updateManager.CreateChannel(context.Background(), peer1ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1ID)
-	})
+		updMsg := updateManager.CreateChannel(context.Background(), peer1ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1ID)
+		})
 
-	// Creating a route with no routing peer and no peers in PeerGroups or Groups should not update account peers and not send peer update
-	t.Run("creating route no routing peer and no peers in groups", func(t *testing.T) {
-		route := route.Route{
-			ID:          "testingRoute1",
-			Network:     netip.MustParsePrefix("100.65.250.202/32"),
+		// Creating a route with no routing peer and no peers in PeerGroups or Groups should not update account peers and not send peer update
+		step(t, "creating route no routing peer and no peers in groups", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
+
+			route := route.Route{
+				ID:          "testingRoute1",
+				Network:     netip.MustParsePrefix("100.65.250.202/32"),
+				NetID:       "superNet",
+				NetworkType: route.IPv4Network,
+				PeerGroups:  []string{"groupA"},
+				Description: "super",
+				Masquerade:  false,
+				Metric:      9999,
+				Enabled:     true,
+				Groups:      []string{"groupA"},
+			}
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			_, err := manager.CreateRoute(
+				context.Background(), account.Id, route.Network, route.NetworkType, route.Domains, route.Peer,
+				route.PeerGroups, route.Description, route.NetID, route.Masquerade, route.Metric,
+				route.Groups, []string{}, true, userID, route.KeepRoute, route.SkipAutoApply,
+			)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+
+		})
+
+		// Creating a route with no routing peer and having peers in groups that don't include peer1 should not send peer1 an update
+		step(t, "creating a route with peers in  PeerGroups and Groups", func(t *testing.T) {
+			drainPeerUpdates(updMsg)
+
+			route := route.Route{
+				ID:          "testingRoute2",
+				Network:     netip.MustParsePrefix("192.0.2.0/32"),
+				NetID:       "superNet",
+				NetworkType: route.IPv4Network,
+				PeerGroups:  []string{routeGroup3},
+				Description: "super",
+				Masquerade:  false,
+				Metric:      9999,
+				Enabled:     true,
+				Groups:      []string{routeGroup3},
+			}
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			_, err := manager.CreateRoute(
+				context.Background(), account.Id, route.Network, route.NetworkType, route.Domains, route.Peer,
+				route.PeerGroups, route.Description, route.NetID, route.Masquerade, route.Metric,
+				route.Groups, []string{}, true, userID, route.KeepRoute, route.SkipAutoApply,
+			)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+
+		})
+
+		baseRoute := route.Route{
+			ID:          "testingRoute3",
+			Network:     netip.MustParsePrefix("192.168.0.0/16"),
 			NetID:       "superNet",
 			NetworkType: route.IPv4Network,
-			PeerGroups:  []string{"groupA"},
-			Description: "super",
-			Masquerade:  false,
-			Metric:      9999,
-			Enabled:     true,
-			Groups:      []string{"groupA"},
-		}
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err := manager.CreateRoute(
-			context.Background(), account.Id, route.Network, route.NetworkType, route.Domains, route.Peer,
-			route.PeerGroups, route.Description, route.NetID, route.Masquerade, route.Metric,
-			route.Groups, []string{}, true, userID, route.KeepRoute, route.SkipAutoApply,
-		)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-
-	})
-
-	// Creating a route with no routing peer and having peers in groups that don't include peer1 should not send peer1 an update
-	t.Run("creating a route with peers in  PeerGroups and Groups", func(t *testing.T) {
-		drainPeerUpdates(updMsg)
-
-		route := route.Route{
-			ID:          "testingRoute2",
-			Network:     netip.MustParsePrefix("192.0.2.0/32"),
-			NetID:       "superNet",
-			NetworkType: route.IPv4Network,
-			PeerGroups:  []string{routeGroup3},
-			Description: "super",
-			Masquerade:  false,
-			Metric:      9999,
-			Enabled:     true,
-			Groups:      []string{routeGroup3},
-		}
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err := manager.CreateRoute(
-			context.Background(), account.Id, route.Network, route.NetworkType, route.Domains, route.Peer,
-			route.PeerGroups, route.Description, route.NetID, route.Masquerade, route.Metric,
-			route.Groups, []string{}, true, userID, route.KeepRoute, route.SkipAutoApply,
-		)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-
-	})
-
-	baseRoute := route.Route{
-		ID:          "testingRoute3",
-		Network:     netip.MustParsePrefix("192.168.0.0/16"),
-		NetID:       "superNet",
-		NetworkType: route.IPv4Network,
-		Peer:        peer1ID,
-		Description: "super",
-		Masquerade:  false,
-		Metric:      9999,
-		Enabled:     true,
-		Groups:      []string{routeGroup1},
-	}
-
-	// Creating route should update account peers and send peer update
-	t.Run("creating route with a routing peer", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		newRoute, err := manager.CreateRoute(
-			context.Background(), account.Id, baseRoute.Network, baseRoute.NetworkType, baseRoute.Domains, baseRoute.Peer,
-			baseRoute.PeerGroups, baseRoute.Description, baseRoute.NetID, baseRoute.Masquerade, baseRoute.Metric,
-			baseRoute.Groups, []string{}, true, userID, baseRoute.KeepRoute, !baseRoute.SkipAutoApply,
-		)
-		require.NoError(t, err)
-		baseRoute = *newRoute
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Updating the route should update account peers and send peer update when there is peers in group
-	t.Run("updating route", func(t *testing.T) {
-		baseRoute.Groups = []string{routeGroup1, routeGroup2}
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.SaveRoute(context.Background(), account.Id, userID, &baseRoute)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Deleting the route should update account peers and send peer update
-	t.Run("deleting route", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.DeleteRoute(context.Background(), account.Id, baseRoute.ID, userID)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Adding peer to route peer groups that do not have any peers should update account peers and send peer update
-	t.Run("adding peer to route peer groups that do not have any peers", func(t *testing.T) {
-		newRoute := route.Route{
-			Network:     netip.MustParsePrefix("192.168.12.0/16"),
-			NetID:       "superNet",
-			NetworkType: route.IPv4Network,
-			PeerGroups:  []string{"groupB"},
+			Peer:        peer1ID,
 			Description: "super",
 			Masquerade:  false,
 			Metric:      9999,
 			Enabled:     true,
 			Groups:      []string{routeGroup1},
 		}
-		_, err := manager.CreateRoute(
-			context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer,
-			newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric,
-			newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, !newRoute.SkipAutoApply,
-		)
-		require.NoError(t, err)
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		// Creating route should update account peers and send peer update
+		step(t, "creating route with a routing peer", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{peer1ID},
+			newRoute, err := manager.CreateRoute(
+				context.Background(), account.Id, baseRoute.Network, baseRoute.NetworkType, baseRoute.Domains, baseRoute.Peer,
+				baseRoute.PeerGroups, baseRoute.Description, baseRoute.NetID, baseRoute.Masquerade, baseRoute.Metric,
+				baseRoute.Groups, []string{}, true, userID, baseRoute.KeepRoute, !baseRoute.SkipAutoApply,
+			)
+			require.NoError(t, err)
+			baseRoute = *newRoute
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// Updating the route should update account peers and send peer update when there is peers in group
+		step(t, "updating route", func(t *testing.T) {
+			baseRoute.Groups = []string{routeGroup1, routeGroup2}
 
-	// Adding peer to route groups that do not have any peers should update account peers and send peer update
-	t.Run("adding peer to route groups that do not have any peers", func(t *testing.T) {
-		newRoute := route.Route{
-			Network:     netip.MustParsePrefix("192.168.13.0/16"),
-			NetID:       "superNet",
-			NetworkType: route.IPv4Network,
-			PeerGroups:  []string{"groupB"},
-			Description: "super",
-			Masquerade:  false,
-			Metric:      9999,
-			Enabled:     true,
-			Groups:      []string{"groupC"},
-		}
-		_, err := manager.CreateRoute(
-			context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer,
-			newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric,
-			newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, !newRoute.SkipAutoApply,
-		)
-		require.NoError(t, err)
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			err := manager.SaveRoute(context.Background(), account.Id, userID, &baseRoute)
+			require.NoError(t, err)
 
-		err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupC",
-			Name:  "GroupC",
-			Peers: []string{peer1ID},
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
+		// Deleting the route should update account peers and send peer update
+		step(t, "deleting route", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.DeleteRoute(context.Background(), account.Id, baseRoute.ID, userID)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Adding peer to route peer groups that do not have any peers should update account peers and send peer update
+		step(t, "adding peer to route peer groups that do not have any peers", func(t *testing.T) {
+			newRoute := route.Route{
+				Network:     netip.MustParsePrefix("192.168.12.0/16"),
+				NetID:       "superNet",
+				NetworkType: route.IPv4Network,
+				PeerGroups:  []string{"groupB"},
+				Description: "super",
+				Masquerade:  false,
+				Metric:      9999,
+				Enabled:     true,
+				Groups:      []string{routeGroup1},
+			}
+			_, err := manager.CreateRoute(
+				context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer,
+				newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric,
+				newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, !newRoute.SkipAutoApply,
+			)
+			require.NoError(t, err)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{peer1ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Adding peer to route groups that do not have any peers should update account peers and send peer update
+		step(t, "adding peer to route groups that do not have any peers", func(t *testing.T) {
+			newRoute := route.Route{
+				Network:     netip.MustParsePrefix("192.168.13.0/16"),
+				NetID:       "superNet",
+				NetworkType: route.IPv4Network,
+				PeerGroups:  []string{"groupB"},
+				Description: "super",
+				Masquerade:  false,
+				Metric:      9999,
+				Enabled:     true,
+				Groups:      []string{"groupC"},
+			}
+			_, err := manager.CreateRoute(
+				context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer,
+				newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric,
+				newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, !newRoute.SkipAutoApply,
+			)
+			require.NoError(t, err)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupC",
+				Name:  "GroupC",
+				Peers: []string{peer1ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 	})
 }
 
diff --git a/management/server/setupkey_test.go b/management/server/setupkey_test.go
index 2d43ea28b..87959113d 100644
--- a/management/server/setupkey_test.go
+++ b/management/server/setupkey_test.go
@@ -397,75 +397,77 @@ func TestSetupKey_Copy(t *testing.T) {
 }
 
 func TestSetupKeyAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	err := manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
-		ID:    "groupA",
-		Name:  "GroupA",
-		Peers: []string{peer1.ID, peer2.ID, peer3.ID},
-	})
-	assert.NoError(t, err)
-
-	policy := &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
-			{
-				Enabled:       true,
-				Sources:       []string{"groupA"},
-				Destinations:  []string{"group"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
-			},
-		},
-	}
-	_, err = manager.SavePolicy(context.Background(), account.Id, userID, policy, true)
-	require.NoError(t, err)
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	// The setup policy above dispatches affected-peer updates asynchronously; drain
-	// any in-flight ones so the assertions only observe the setup-key operations.
-	settleAffectedUpdates(updMsg)
-
-	var setupKey *types.SetupKey
-
-	// Creating setup key should not update account peers and not send peer update
-	t.Run("creating setup key", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		setupKey, err = manager.CreateSetupKey(context.Background(), account.Id, "key1", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
+		err := manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
+			ID:    "groupA",
+			Name:  "GroupA",
+			Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+		})
 		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+		policy := &types.Policy{
+			Enabled: true,
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"groupA"},
+					Destinations:  []string{"group"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
+			},
 		}
-	})
-
-	// Saving setup key should not update account peers and not send peer update
-	t.Run("saving setup key", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err = manager.SaveSetupKey(context.Background(), account.Id, setupKey, userID)
+		_, err = manager.SavePolicy(context.Background(), account.Id, userID, policy, true)
 		require.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
+		})
+
+		// The setup policy above dispatches affected-peer updates asynchronously; drain
+		// any in-flight ones so the assertions only observe the setup-key operations.
+		settleAffectedUpdates(updMsg)
+
+		var setupKey *types.SetupKey
+
+		// Creating setup key should not update account peers and not send peer update
+		step(t, "creating setup key", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			setupKey, err = manager.CreateSetupKey(context.Background(), account.Id, "key1", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Saving setup key should not update account peers and not send peer update
+		step(t, "saving setup key", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			_, err = manager.SaveSetupKey(context.Background(), account.Id, setupKey, userID)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
 	})
 }
 
diff --git a/management/server/user_test.go b/management/server/user_test.go
index 2d1a5f1e9..fcfb7a1e7 100644
--- a/management/server/user_test.go
+++ b/management/server/user_test.go
@@ -1544,166 +1544,170 @@ func TestDefaultAccountManager_SaveUser(t *testing.T) {
 }
 
 func TestUserAccountPeersUpdate(t *testing.T) {
-	// account groups propagation is enabled
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		// account groups propagation is enabled
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	err := manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
-		ID:    "groupA",
-		Name:  "GroupA",
-		Peers: []string{peer1.ID, peer2.ID, peer3.ID},
-	})
-	require.NoError(t, err)
+		err := manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
+			ID:    "groupA",
+			Name:  "GroupA",
+			Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+		})
+		require.NoError(t, err)
 
-	policy := &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
-			{
-				Enabled:       true,
-				Sources:       []string{"groupA"},
-				Destinations:  []string{"groupA"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
+		policy := &types.Policy{
+			Enabled: true,
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"groupA"},
+					Destinations:  []string{"groupA"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
 			},
-		},
-	}
-	_, err = manager.SavePolicy(context.Background(), account.Id, userID, policy, true)
-	require.NoError(t, err)
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	// Creating a new regular user should send peer update (as users are not filtered yet)
-	t.Run("creating new regular user with no groups", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err = manager.SaveOrAddUser(context.Background(), account.Id, userID, &types.User{
-			Id:        "regularUser1",
-			AccountID: account.Id,
-			Role:      types.UserRoleUser,
-			Issued:    types.UserIssuedAPI,
-		}, true)
+		}
+		_, err = manager.SavePolicy(context.Background(), account.Id, userID, policy, true)
 		require.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
+		})
 
-	// updating user with no linked peers should update account peers and send peer update (as users are not filtered yet)
-	t.Run("updating user with no linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		// Creating a new regular user should send peer update (as users are not filtered yet)
+		step(t, "creating new regular user with no groups", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
 
-		_, err = manager.SaveOrAddUser(context.Background(), account.Id, userID, &types.User{
-			Id:        "regularUser1",
-			AccountID: account.Id,
-			Role:      types.UserRoleUser,
-			Issued:    types.UserIssuedAPI,
-		}, false)
-		require.NoError(t, err)
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+			_, err = manager.SaveOrAddUser(context.Background(), account.Id, userID, &types.User{
+				Id:        "regularUser1",
+				AccountID: account.Id,
+				Role:      types.UserRoleUser,
+				Issued:    types.UserIssuedAPI,
+			}, true)
+			require.NoError(t, err)
 
-	// drain any buffered updates from previous subtests
-	drainPeerUpdates(updMsg)
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 
-	// deleting user with no linked peers should not update account peers and not send peer update
-	t.Run("deleting user with no linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		// saving an unchanged user with no linked peers should not update account peers and not send peer update
+		step(t, "updating user with no linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		err = manager.DeleteUser(context.Background(), account.Id, userID, "regularUser1")
-		require.NoError(t, err)
+			_, err = manager.SaveOrAddUser(context.Background(), account.Id, userID, &types.User{
+				Id:        "regularUser1",
+				AccountID: account.Id,
+				Role:      types.UserRoleUser,
+				Issued:    types.UserIssuedAPI,
+			}, false)
+			require.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
 
-	// create a user and add new peer with the user
-	_, err = manager.SaveOrAddUser(context.Background(), account.Id, userID, &types.User{
-		Id:        "regularUser2",
-		AccountID: account.Id,
-		Role:      types.UserRoleAdmin,
-		Issued:    types.UserIssuedAPI,
-	}, true)
-	require.NoError(t, err)
+		// drain any buffered updates from previous subtests
+		drainPeerUpdates(updMsg)
 
-	key, err := wgtypes.GeneratePrivateKey()
-	require.NoError(t, err)
+		// deleting user with no linked peers should not update account peers and not send peer update
+		step(t, "deleting user with no linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	expectedPeerKey := key.PublicKey().String()
-	peer4, _, _, _, err := manager.AddPeer(context.Background(), "", "", "regularUser2", &nbpeer.Peer{
-		Key:  expectedPeerKey,
-		Meta: nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
-	}, false)
-	require.NoError(t, err)
+			err = manager.DeleteUser(context.Background(), account.Id, userID, "regularUser1")
+			require.NoError(t, err)
 
-	// updating user with linked peers should update account peers and send peer update
-	t.Run("updating user with linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
 
+		// create a user and add new peer with the user
 		_, err = manager.SaveOrAddUser(context.Background(), account.Id, userID, &types.User{
 			Id:        "regularUser2",
 			AccountID: account.Id,
 			Role:      types.UserRoleAdmin,
 			Issued:    types.UserIssuedAPI,
+		}, true)
+		require.NoError(t, err)
+
+		key, err := wgtypes.GeneratePrivateKey()
+		require.NoError(t, err)
+
+		expectedPeerKey := key.PublicKey().String()
+		peer4, _, _, _, err := manager.AddPeer(context.Background(), "", "", "regularUser2", &nbpeer.Peer{
+			Key:  expectedPeerKey,
+			Meta: nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
 		}, false)
 		require.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// updating user with linked peers should update account peers and send peer update
+		step(t, "updating user with linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	peer4UpdMsg := updateManager.CreateChannel(context.Background(), peer4.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer4.ID)
-	})
+			_, err = manager.SaveOrAddUser(context.Background(), account.Id, userID, &types.User{
+				Id:        "regularUser2",
+				AccountID: account.Id,
+				Role:      types.UserRoleAdmin,
+				Issued:    types.UserIssuedAPI,
+			}, false)
+			require.NoError(t, err)
 
-	// deleting user with linked peers should update account peers and send peer update
-	t.Run("deleting user with linked peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, peer4UpdMsg)
-			close(done)
-		}()
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 
-		err = manager.DeleteUser(context.Background(), account.Id, userID, "regularUser2")
-		require.NoError(t, err)
+		peer4UpdMsg := updateManager.CreateChannel(context.Background(), peer4.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer4.ID)
+		})
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
+		// deleting user with linked peers should update account peers and send peer update
+		step(t, "deleting user with linked peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, peer4UpdMsg)
+				close(done)
+			}()
+
+			err = manager.DeleteUser(context.Background(), account.Id, userID, "regularUser2")
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 	})
 }
 

From c5aa55d2b911f85fc8d2e7b8c6206be8e7dcdcd7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alberto=20Xos=C3=A9=20M=C3=A9ndez=20Taboada?=
 <amtaboada99@gmail.com>
Date: Tue, 6 Oct 2026 15:05:01 +0200
Subject: [PATCH 11/18] [client] feat(i18n): Add Galician (gl) localization for
 desktop client (#7041)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Add Galician (gl) localization for desktop client

* [client] Address review feedback and sync latest i18n keys for Galician

Fix terms per review feedback (usarase, creen, auditar, JWT cache, poscuántico, etc.) and translate newly added upstream i18n keys.

* [client] Fix translations, polish terminology, and sync latest keys for Galician

* [client] Fix i18n parity against branch source of truth and drop undeclared uk

* [ci] Skip Galician locales in codespell check

* [client] Add latest error keys for Galician and revert _index.json formatting

Add error.settings_locked and error.settings_managed_by_mdm to Galician locale for 100% key parity with en/common.json. Revert multi-line formatting in _index.json to keep a single-line entry for Galician.
---
 .github/workflows/golangci-lint.yml   |    2 +-
 client/ui/i18n/locales/_index.json    |    3 +-
 client/ui/i18n/locales/gl/common.json | 1397 +++++++++++++++++++++++++
 3 files changed, 1400 insertions(+), 2 deletions(-)
 create mode 100644 client/ui/i18n/locales/gl/common.json

diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index ff36a0854..843177b88 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -30,7 +30,7 @@ jobs:
           # segment by codespell and behave the same across versions; the
           # recursive "**" form did not take effect with the codespell shipped
           # by this action.
-          skip: go.mod,go.sum,*/proxy/web/*,*pnpm-lock.yaml,*package-lock.json,*/locales/de/*,*/locales/es/*,*/locales/fr/*,*/locales/hu/*,*/locales/it/*,*/locales/pt/*,*/locales/ru/*,*/locales/zh-CN/*,*/i18n/TRANSLATING.md
+          skip: go.mod,go.sum,*/proxy/web/*,*pnpm-lock.yaml,*package-lock.json,*/locales/de/*,*/locales/es/*,*/locales/fr/*,*/locales/gl/*,*/locales/hu/*,*/locales/it/*,*/locales/pt/*,*/locales/ru/*,*/locales/zh-CN/*,*/i18n/TRANSLATING.md
   golangci:
     strategy:
       fail-fast: false
diff --git a/client/ui/i18n/locales/_index.json b/client/ui/i18n/locales/_index.json
index 17fb1d8ea..a52ff5929 100644
--- a/client/ui/i18n/locales/_index.json
+++ b/client/ui/i18n/locales/_index.json
@@ -10,6 +10,7 @@
         {"code": "it", "displayName": "Italiano", "englishName": "Italian"},
         {"code": "pt", "displayName": "Português", "englishName": "Portuguese"},
         {"code": "zh-CN", "displayName": "简体中文", "englishName": "Simplified Chinese"},
-        {"code": "ja", "displayName": "日本語", "englishName": "Japanese"}
+        {"code": "ja", "displayName": "日本語", "englishName": "Japanese"},
+        {"code": "gl", "displayName": "Galego", "englishName": "Galician"}
     ]
 }
diff --git a/client/ui/i18n/locales/gl/common.json b/client/ui/i18n/locales/gl/common.json
new file mode 100644
index 000000000..2b948104e
--- /dev/null
+++ b/client/ui/i18n/locales/gl/common.json
@@ -0,0 +1,1397 @@
+{
+    "tray.tooltip": {
+        "message": "NetBird"
+    },
+    "tray.status.disconnected": {
+        "message": "Desconectado"
+    },
+    "tray.status.daemonUnavailable": {
+        "message": "Non está en execución"
+    },
+    "tray.status.error": {
+        "message": "Erro"
+    },
+    "tray.status.connected": {
+        "message": "Conectado"
+    },
+    "tray.status.connecting": {
+        "message": "Conectando"
+    },
+    "tray.status.needsLogin": {
+        "message": "Inicio de sesión requirido"
+    },
+    "tray.status.loginFailed": {
+        "message": "Erro ao iniciar sesión"
+    },
+    "tray.status.sessionExpired": {
+        "message": "Sesión caducada"
+    },
+    "tray.session.expiresIn": {
+        "message": "A sesión caduca en {remaining}"
+    },
+    "tray.session.unit.lessThanMinute": {
+        "message": "menos dun minuto"
+    },
+    "tray.session.unit.minute": {
+        "message": "1 minuto"
+    },
+    "tray.session.unit.minutes": {
+        "message": "{count} minutos"
+    },
+    "tray.session.unit.hour": {
+        "message": "1 hora"
+    },
+    "tray.session.unit.hours": {
+        "message": "{count} horas"
+    },
+    "tray.session.unit.day": {
+        "message": "1 día"
+    },
+    "tray.session.unit.days": {
+        "message": "{count} días"
+    },
+    "tray.menu.open": {
+        "message": "Abrir NetBird"
+    },
+    "tray.menu.connect": {
+        "message": "Conectar"
+    },
+    "tray.menu.disconnect": {
+        "message": "Desconectar"
+    },
+    "tray.menu.exitNode": {
+        "message": "Nodo de saída"
+    },
+    "tray.menu.networks": {
+        "message": "Recursos"
+    },
+    "tray.menu.profiles": {
+        "message": "Perfís"
+    },
+    "tray.menu.manageProfiles": {
+        "message": "Xestionar perfís"
+    },
+    "tray.menu.settings": {
+        "message": "Configuración..."
+    },
+    "tray.menu.debugBundle": {
+        "message": "Crear paquete de depuración"
+    },
+    "tray.menu.about": {
+        "message": "Axuda e soporte"
+    },
+    "tray.menu.github": {
+        "message": "GitHub"
+    },
+    "tray.menu.documentation": {
+        "message": "Documentación"
+    },
+    "tray.menu.troubleshoot": {
+        "message": "Resolución de problemas"
+    },
+    "tray.menu.downloadLatest": {
+        "message": "Descargar a última versión"
+    },
+    "tray.menu.installVersion": {
+        "message": "Instalar versión {version}"
+    },
+    "tray.menu.guiVersion": {
+        "message": "GUI: {version}"
+    },
+    "tray.menu.daemonVersion": {
+        "message": "Daemon: {version}"
+    },
+    "tray.menu.versionUnknown": {
+        "message": "—"
+    },
+    "tray.menu.quit": {
+        "message": "Saír de NetBird"
+    },
+    "notify.daemonOutdated.title": {
+        "message": "O servizo NetBird está desactualizado"
+    },
+    "notify.daemonOutdated.body": {
+        "message": "Actualice o servizo NetBird para usar esta aplicación."
+    },
+    "notify.update.title": {
+        "message": "Actualización de NetBird dispoñible"
+    },
+    "notify.update.body": {
+        "message": "NetBird {version} está dispoñible."
+    },
+    "notify.update.enforcedSuffix": {
+        "message": " O seu administrador require esta actualización."
+    },
+    "notify.error.title": {
+        "message": "Erro"
+    },
+    "notify.error.connect": {
+        "message": "Erro ao conectar"
+    },
+    "notify.error.disconnect": {
+        "message": "Erro ao desconectar"
+    },
+    "notify.error.switchProfile": {
+        "message": "Erro ao cambiar a {profile}"
+    },
+    "notify.error.exitNode": {
+        "message": "Erro ao actualizar o nodo de saída {name}"
+    },
+    "notify.sessionExpired.title": {
+        "message": "Sesión caducada"
+    },
+    "notify.sessionExpired.body": {
+        "message": "A súa sesión caducou. Volva iniciar sesión para conectar."
+    },
+    "notify.sessionWarning.title": {
+        "message": "A sesión caduca en breve"
+    },
+    "notify.sessionWarning.body": {
+        "message": "A súa sesión de NetBird caduca en {remaining}. Prema en Prolongar agora para renovar."
+    },
+    "notify.sessionWarning.bodyGeneric": {
+        "message": "A súa sesión de NetBird está a punto de caducar. Prema en Prolongar agora para renovar."
+    },
+    "notify.sessionWarning.extend": {
+        "message": "Prolongar agora"
+    },
+    "notify.sessionWarning.dismiss": {
+        "message": "Descartar"
+    },
+    "notify.sessionWarning.failed": {
+        "message": "Erro ao prolongar a sesión de NetBird"
+    },
+    "notify.sessionWarning.successTitle": {
+        "message": "Sesión de NetBird prolongada"
+    },
+    "notify.sessionWarning.successBody": {
+        "message": "A súa sesión foi renovada."
+    },
+    "notify.sessionDeadlineRejected.title": {
+        "message": "Data límite de sesión rexeitada"
+    },
+    "notify.sessionDeadlineRejected.body": {
+        "message": "O servidor enviou unha data límite de sesión non válida. Por favor, inicie sesión de novo."
+    },
+    "notify.mdm.policyApplied.title": {
+        "message": "Configuración de NetBird actualizada"
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "A súa configuración de NetBird foi actualizada pola súa política de IT."
+    },
+    "common.cancel": {
+        "message": "Cancelar"
+    },
+    "common.save": {
+        "message": "Gardar"
+    },
+    "common.saveChanges": {
+        "message": "Gardar cambios"
+    },
+    "common.saving": {
+        "message": "Gardando…"
+    },
+    "common.close": {
+        "message": "Pechar"
+    },
+    "common.copy": {
+        "message": "Copiar"
+    },
+    "common.togglePasswordVisibility": {
+        "message": "Amosar ou ocultar o contrasinal"
+    },
+    "common.increase": {
+        "message": "Aumentar"
+    },
+    "common.decrease": {
+        "message": "Diminuír"
+    },
+    "common.delete": {
+        "message": "Eliminar"
+    },
+    "common.create": {
+        "message": "Crear"
+    },
+    "common.add": {
+        "message": "Engadir"
+    },
+    "common.remove": {
+        "message": "Quitar"
+    },
+    "common.refresh": {
+        "message": "Actualizar"
+    },
+    "common.loading": {
+        "message": "Cargando…"
+    },
+    "common.netbird": {
+        "message": "NetBird"
+    },
+    "common.noResults.title": {
+        "message": "Non se puido atopar ningún resultado"
+    },
+    "common.noResults.description": {
+        "message": "Non puidemos atopar ningún resultado. Por favor, tente cun termo de busca diferente ou cambie os seus filtros."
+    },
+    "notConnected.title": {
+        "message": "Sen conexión"
+    },
+    "notConnected.description": {
+        "message": "Conéctese primeiro a NetBird para ver información detallada sobre os seus peers, recursos de rede e nodos de saída."
+    },
+    "connect.status.disconnected": {
+        "message": "Desconectado"
+    },
+    "connect.status.connecting": {
+        "message": "Establecendo conexión..."
+    },
+    "connect.status.connected": {
+        "message": "Conectado á rede NetBird"
+    },
+    "connect.status.disconnecting": {
+        "message": "Desconectando..."
+    },
+    "connect.status.daemonUnavailable": {
+        "message": "Daemon non dispoñible"
+    },
+    "connect.status.loginRequired": {
+        "message": "Inicie sesión para conectar"
+    },
+    "connect.error.loginTitle": {
+        "message": "Erro ao iniciar sesión"
+    },
+    "connect.error.connectTitle": {
+        "message": "Erro ao conectar"
+    },
+    "connect.error.disconnectTitle": {
+        "message": "Erro ao desconectar"
+    },
+    "nav.peers.title": {
+        "message": "Peers"
+    },
+    "nav.peers.description": {
+        "message": "{connected} de {total} conectados"
+    },
+    "nav.resources.title": {
+        "message": "Recursos"
+    },
+    "nav.resources.description": {
+        "message": "{active} de {total} activos"
+    },
+    "nav.exitNode.title": {
+        "message": "Nodos de saída"
+    },
+    "nav.exitNode.none": {
+        "message": "Non activo"
+    },
+    "nav.exitNode.using": {
+        "message": "Vía {name}"
+    },
+    "header.openSettings": {
+        "message": "Abrir configuración"
+    },
+    "header.togglePanel": {
+        "message": "Alternar panel lateral"
+    },
+    "profile.selector.loading": {
+        "message": "Cargando..."
+    },
+    "profile.selector.noProfile": {
+        "message": "Sen perfil"
+    },
+    "profile.selector.searchPlaceholder": {
+        "message": "Buscar perfil por nome..."
+    },
+    "profile.selector.emptyTitle": {
+        "message": "Non se atoparon perfís"
+    },
+    "profile.selector.emptyDescription": {
+        "message": "Probe cun termo de busca diferente ou cree un novo perfil."
+    },
+    "profile.selector.newProfile": {
+        "message": "Novo perfil"
+    },
+    "profile.selector.moreOptions": {
+        "message": "Máis opcións"
+    },
+    "profile.selector.deregister": {
+        "message": "Dar de baixa"
+    },
+    "profile.selector.delete": {
+        "message": "Eliminar"
+    },
+    "profile.selector.switchTo": {
+        "message": "Cambiar a este perfil"
+    },
+    "profile.selector.edit": {
+        "message": "Editar"
+    },
+    "profile.edit.title": {
+        "message": "Editar perfil"
+    },
+    "profile.edit.submit": {
+        "message": "Gardar cambios"
+    },
+    "profile.dialog.title": {
+        "message": "Introduza o nome do perfil"
+    },
+    "profile.dialog.nameLabel": {
+        "message": "Nome do perfil"
+    },
+    "profile.dialog.description": {
+        "message": "Estableza un nome facilmente identificable para o seu perfil."
+    },
+    "profile.dialog.placeholder": {
+        "message": "p. ex. Traballo"
+    },
+    "profile.dialog.submit": {
+        "message": "Engadir perfil"
+    },
+    "profile.dialog.required": {
+        "message": "Por favor, introduza un nome de perfil, p. ex. traballo, casa"
+    },
+    "profile.dialog.managementHelp": {
+        "message": "Use NetBird Cloud ou o seu propio servidor."
+    },
+    "profile.dialog.urlUnreachable": {
+        "message": "Non se puido acadar este servidor. Comprobe o URL ou engada o perfil de todas formas se ten a certeza de que é correcto."
+    },
+    "header.menu.settings": {
+        "message": "Configuración..."
+    },
+    "header.menu.defaultView": {
+        "message": "Vista predeterminada"
+    },
+    "header.menu.advancedView": {
+        "message": "Vista avanzada"
+    },
+    "header.menu.updateAvailable": {
+        "message": "Actualización dispoñible"
+    },
+    "header.menu.open": {
+        "message": "Abrir menú"
+    },
+    "header.profile.switch": {
+        "message": "Cambiar de perfil"
+    },
+    "connect.toggle.label": {
+        "message": "Alternar conexión de NetBird"
+    },
+    "connect.localIp.label": {
+        "message": "Enderezos IP locais"
+    },
+    "common.search": {
+        "message": "Buscar"
+    },
+    "common.filter": {
+        "message": "Filtrar"
+    },
+    "exitNodes.dropdown.trigger": {
+        "message": "Seleccionar nodo de saída"
+    },
+    "peers.row.label": {
+        "message": "Abrir detalles de {name}, {status}"
+    },
+    "peers.dialog.title": {
+        "message": "Detalles do peer"
+    },
+    "networks.row.toggle": {
+        "message": "Alternar {name}"
+    },
+    "networks.bulk.label": {
+        "message": "Alternar todos os recursos visibles"
+    },
+    "profile.switch.title": {
+        "message": "Cambiar ao perfil «{name}»?"
+    },
+    "profile.switch.message": {
+        "message": "Ten a certeza de que quere cambiar de perfil?\nO seu perfil actual desconectarase."
+    },
+    "profile.switch.confirm": {
+        "message": "Confirmar"
+    },
+    "profile.deregister.title": {
+        "message": "Dar de baixa o perfil «{name}»?"
+    },
+    "profile.deregister.message": {
+        "message": "Ten a certeza de que quere dar de baixa este perfil?\nTerá que iniciar sesión de novo para usalo."
+    },
+    "profile.deregister.confirm": {
+        "message": "Dar de baixa"
+    },
+    "profile.delete.title": {
+        "message": "Eliminar o perfil «{name}»?"
+    },
+    "profile.delete.message": {
+        "message": "Ten a certeza de que quere eliminar este perfil?\nEsta acción non se pode desfacer."
+    },
+    "profile.delete.disabledActive": {
+        "message": "Os perfís activos non se poden eliminar. Cambie a un perfil diferente antes de eliminar este perfil."
+    },
+    "profile.delete.disabledDefault": {
+        "message": "O perfil predeterminado non se pode eliminar."
+    },
+    "profile.error.switchTitle": {
+        "message": "Erro ao cambiar de perfil"
+    },
+    "profile.error.deregisterTitle": {
+        "message": "Erro ao dar de baixa o perfil"
+    },
+    "profile.error.deleteTitle": {
+        "message": "Erro ao eliminar o perfil"
+    },
+    "profile.error.createTitle": {
+        "message": "Erro ao crear o perfil"
+    },
+    "profile.error.editTitle": {
+        "message": "Erro ao editar o perfil"
+    },
+    "profile.error.loadTitle": {
+        "message": "Erro ao cargar os perfís"
+    },
+    "profile.dropdown.activeProfile": {
+        "message": "Perfil activo"
+    },
+    "profile.dropdown.switchProfile": {
+        "message": "Cambiar de perfil"
+    },
+    "profile.dropdown.noEmail": {
+        "message": "Outro"
+    },
+    "profile.dropdown.addProfile": {
+        "message": "Engadir perfil"
+    },
+    "profile.dropdown.manageProfiles": {
+        "message": "Xestionar perfís"
+    },
+    "profile.dropdown.settings": {
+        "message": "Configuración"
+    },
+    "settings.profiles.section.profiles": {
+        "message": "Perfís"
+    },
+    "settings.profiles.intro": {
+        "message": "Manteña identidades de NetBird separadas lado a lado, por exemplo contas de traballo e persoais, ou diferentes servidores de xestión. Engada, dea de baixa ou elimine perfís a continuación."
+    },
+    "settings.profiles.addProfile": {
+        "message": "Engadir perfil"
+    },
+    "settings.profiles.active": {
+        "message": "Activo"
+    },
+    "settings.profiles.emptyTitle": {
+        "message": "Sen perfís"
+    },
+    "settings.profiles.emptyDescription": {
+        "message": "Cree un perfil para conectarse a un servidor de xestión de NetBird."
+    },
+    "settings.error.loadTitle": {
+        "message": "Erro ao cargar a configuración"
+    },
+    "settings.error.saveTitle": {
+        "message": "Erro ao gardar a configuración"
+    },
+    "settings.error.debugBundleTitle": {
+        "message": "Erro no paquete de depuración"
+    },
+    "settings.nav.label": {
+        "message": "Seccións de configuración"
+    },
+    "settings.tabs.general": {
+        "message": "Xeral"
+    },
+    "settings.tabs.network": {
+        "message": "Rede"
+    },
+    "settings.tabs.security": {
+        "message": "Seguridade"
+    },
+    "settings.tabs.profiles": {
+        "message": "Perfís"
+    },
+    "settings.tabs.ssh": {
+        "message": "SSH"
+    },
+    "settings.tabs.advanced": {
+        "message": "Avanzado"
+    },
+    "settings.tabs.troubleshooting": {
+        "message": "Resolución de problemas"
+    },
+    "settings.tabs.about": {
+        "message": "Acerca de"
+    },
+    "settings.tabs.updateAvailable": {
+        "message": "Actualización dispoñible"
+    },
+    "settings.general.section.general": {
+        "message": "Xeral"
+    },
+    "settings.general.section.connection": {
+        "message": "Conexión"
+    },
+    "settings.general.connectOnStartup.label": {
+        "message": "Conectar ao iniciar"
+    },
+    "settings.general.connectOnStartup.help": {
+        "message": "Establece a conexión automaticamente cando se inicia o servizo."
+    },
+    "settings.general.notifications.label": {
+        "message": "Notificacións de escritorio"
+    },
+    "settings.general.notifications.help": {
+        "message": "Amosar notificacións de escritorio para novas actualizacións e eventos de conexión."
+    },
+    "settings.general.autostart.label": {
+        "message": "Iniciar UI de NetBird ao acceder"
+    },
+    "settings.general.autostart.help": {
+        "message": "Inicie a interface de NetBird automaticamente cando inicie sesión. Isto afecta só á interface gráfica, non ao servizo en segundo plano."
+    },
+    "settings.general.autostart.errorTitle": {
+        "message": "Erro ao cambiar o inicio automático"
+    },
+    "settings.general.keepConnectedOnQuit.label": {
+        "message": "Manter conectado ao pechar"
+    },
+    "settings.general.keepConnectedOnQuit.help": {
+        "message": "Mantén a conexión de NetBird en segundo plano cando se pecha a xanela principal."
+    },
+    "settings.general.language.label": {
+        "message": "Idioma da interface"
+    },
+    "settings.general.language.help": {
+        "message": "Escolla o idioma no que se amosa a aplicación NetBird."
+    },
+    "settings.general.language.search": {
+        "message": "Buscar idioma…"
+    },
+    "settings.general.language.empty": {
+        "message": "Ningún idioma coincide."
+    },
+    "settings.general.theme.label": {
+        "message": "Tema"
+    },
+    "settings.general.theme.help": {
+        "message": "Escolla claro ou escuro, ou siga a aparencia do seu sistema."
+    },
+    "settings.general.theme.system": {
+        "message": "Sistema"
+    },
+    "settings.general.theme.light": {
+        "message": "Claro"
+    },
+    "settings.general.theme.dark": {
+        "message": "Escuro"
+    },
+    "settings.general.management.label": {
+        "message": "Servidor de xestión"
+    },
+    "settings.general.management.help": {
+        "message": "Conéctese a NetBird Cloud ou ao seu propio servidor de xestión autoaloxado. Os cambios volverán conectar o cliente."
+    },
+    "settings.general.management.cloud": {
+        "message": "Cloud"
+    },
+    "settings.general.management.selfHosted": {
+        "message": "Autoaloxado"
+    },
+    "settings.general.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlError": {
+        "message": "Por favor, introduza un URL válido, p. ex. https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlUnreachable": {
+        "message": "Non se puido acadar este servidor. Comprobe o URL ou garde de todas formas se ten a certeza de que é correcto."
+    },
+    "settings.general.management.switchCloudTitle": {
+        "message": "Cambiar a NetBird Cloud?"
+    },
+    "settings.general.management.switchCloudMessage": {
+        "message": "Isto desconecta o seu servidor autoaloxado.\nPode que teña que iniciar sesión de novo."
+    },
+    "settings.general.management.switchCloudConfirm": {
+        "message": "Cambiar a Cloud"
+    },
+    "settings.network.section.connectivity": {
+        "message": "Conectividade"
+    },
+    "settings.network.section.routingDns": {
+        "message": "Encamiñamento e DNS"
+    },
+    "settings.network.monitor.label": {
+        "message": "Reconectar ao cambiar de rede"
+    },
+    "settings.network.monitor.help": {
+        "message": "Supervisa a rede e reconéctase automaticamente ante cambios como o cambio de Wi-Fi ou o reinicio tras a suspensión."
+    },
+    "settings.network.dns.label": {
+        "message": "Activar DNS"
+    },
+    "settings.network.dns.help": {
+        "message": "Aplica a configuración DNS xestionada por NetBird ao resolutor do sistema."
+    },
+    "settings.network.clientRoutes.label": {
+        "message": "Activar rutas de cliente"
+    },
+    "settings.network.clientRoutes.help": {
+        "message": "Acepta rutas doutros peers para acadar as súas redes."
+    },
+    "settings.network.serverRoutes.label": {
+        "message": "Activar rutas de servidor"
+    },
+    "settings.network.serverRoutes.help": {
+        "message": "Anuncia as rutas locais deste equipo a outros peers."
+    },
+    "settings.network.ipv6.label": {
+        "message": "Activar IPv6"
+    },
+    "settings.network.ipv6.help": {
+        "message": "Use o enderezamento IPv6 para a rede superposta de NetBird."
+    },
+    "settings.security.section.firewall": {
+        "message": "Cortafogos"
+    },
+    "settings.security.section.encryption": {
+        "message": "Cifrado"
+    },
+    "settings.security.blockInbound.label": {
+        "message": "Bloquear tráfico entrante"
+    },
+    "settings.security.blockInbound.help": {
+        "message": "Rexeita conexións non solicitadas de peers a este dispositivo e a calquera rede que encamiñe. O tráfico saínte non se ve afectado."
+    },
+    "settings.security.blockLan.label": {
+        "message": "Bloquear acceso a LAN"
+    },
+    "settings.security.blockLan.help": {
+        "message": "Evita que os peers acaden a súa rede local ou os seus dispositivos cando este dispositivo encamiñe o seu tráfico."
+    },
+    "settings.security.rosenpass.label": {
+        "message": "Activar resistencia cuántica"
+    },
+    "settings.security.rosenpass.help": {
+        "message": "Engade un intercambio de chaves poscuántico mediante Rosenpass sobre WireGuard®."
+    },
+    "settings.security.rosenpassPermissive.label": {
+        "message": "Activar modo permisivo"
+    },
+    "settings.security.rosenpassPermissive.help": {
+        "message": "Permite conexións con peers que non teñan soporte de resistencia cuántica."
+    },
+    "settings.ssh.section.server": {
+        "message": "Servidor"
+    },
+    "settings.ssh.section.capabilities": {
+        "message": "Capacidades"
+    },
+    "settings.ssh.section.authentication": {
+        "message": "Autenticación"
+    },
+    "settings.ssh.server.label": {
+        "message": "Activar servidor SSH"
+    },
+    "settings.ssh.server.help": {
+        "message": "Executa o servidor SSH de NetBird neste equipo para que outros peers poidan conectarse a el."
+    },
+    "settings.ssh.root.label": {
+        "message": "Permitir inicio de sesión de root"
+    },
+    "settings.ssh.root.help": {
+        "message": "Permite que os peers inicien sesión como usuario root. Desactíveo para requirir unha conta sen privilexios."
+    },
+    "settings.ssh.sftp.label": {
+        "message": "Permitir SFTP"
+    },
+    "settings.ssh.sftp.help": {
+        "message": "Transfire ficheiros de xeito seguro usando clientes nativos de SFTP ou SCP."
+    },
+    "settings.ssh.localForward.label": {
+        "message": "Reenvío de portos locais"
+    },
+    "settings.ssh.localForward.help": {
+        "message": "Permite que os peers conectados fagan túneles de portos locais cara a servizos accesibles desde este equipo."
+    },
+    "settings.ssh.remoteForward.label": {
+        "message": "Reenvío de portos remotos"
+    },
+    "settings.ssh.remoteForward.help": {
+        "message": "Permite que os peers conectados expoñan portos neste equipo cara á súa propia máquina."
+    },
+    "settings.ssh.jwt.label": {
+        "message": "Activar autenticación JWT"
+    },
+    "settings.ssh.jwt.help": {
+        "message": "Verifica cada sesión SSH co seu IdP para a identidade do usuario e auditar. Desactíveo para depender só de políticas ACL de rede, útil cando non hai IdP dispoñible."
+    },
+    "settings.ssh.jwtTtl.label": {
+        "message": "TTL da caché JWT"
+    },
+    "settings.ssh.jwtTtl.help": {
+        "message": "Canto tempo almacena este cliente un JWT na caché antes de solicitalo de novo nas conexións SSH saíntes. Estableza en 0 para desactivar a caché e autenticar en cada conexión."
+    },
+    "settings.ssh.jwtTtl.suffix": {
+        "message": "Segundo(s)"
+    },
+    "settings.advanced.section.interface": {
+        "message": "Interface"
+    },
+    "settings.advanced.section.security": {
+        "message": "Seguridade"
+    },
+    "settings.advanced.interfaceName.label": {
+        "message": "Nome"
+    },
+    "settings.advanced.interfaceName.error": {
+        "message": "Use entre 1 e 15 letras, díxitos, puntos, guións ou guións baixos."
+    },
+    "settings.advanced.interfaceName.errorMac": {
+        "message": "Debe comezar por \"utun\" seguido dun número (p. ex. utun100)."
+    },
+    "settings.advanced.port.label": {
+        "message": "Porto"
+    },
+    "settings.advanced.port.error": {
+        "message": "Introduza un porto entre {min} e {max}."
+    },
+    "settings.advanced.port.help": {
+        "message": "Se se establece en 0, usarase un porto libre ao azar."
+    },
+    "settings.advanced.mtu.label": {
+        "message": "MTU"
+    },
+    "settings.advanced.mtu.error": {
+        "message": "Introduza un valor de MTU entre {min} e {max}."
+    },
+    "settings.advanced.psk.label": {
+        "message": "Chave precompartida"
+    },
+    "settings.advanced.psk.help": {
+        "message": "Chave PSK opcional de WireGuard para cifrado simétrico adicional. Non é o mesmo que unha chave de configuración de NetBird. Só se comunicará con peers que usen a mesma chave precompartida."
+    },
+    "settings.troubleshooting.section.title": {
+        "message": "Paquete de depuración"
+    },
+    "settings.troubleshooting.anonymize.label": {
+        "message": "Anonimizar información confidencial"
+    },
+    "settings.troubleshooting.anonymize.help": {
+        "message": "Oculta enderezos IP públicos e dominios que non sexan de NetBird nos rexistros."
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "O nivel predeterminado mantén lexibles os enderezos IPv4 internos e os nomes dos peers para o soporte. O nivel estrito anonimiza ademais os enderezos IP privados (RFC 1918), CGNAT e de ligazón local, os nomes dos peers e as chaves públicas de WireGuard. Os valores recorrentes asígnanse ao mesmo marcador, polo que os peers seguen sendo distinguibles. Use Estrito cando comparta o paquete fóra da súa organización."
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "Ningunha"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "Predeterminada"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "Estrita"
+    },
+    "settings.troubleshooting.systemInfo.label": {
+        "message": "Incluír información do sistema"
+    },
+    "settings.troubleshooting.systemInfo.help": {
+        "message": "Inclúe SO, kernel, interfaces de rede e táboas de encamiñamento."
+    },
+    "settings.troubleshooting.upload.label": {
+        "message": "Subir paquete aos servidores de NetBird"
+    },
+    "settings.troubleshooting.upload.help": {
+        "message": "Devolve unha chave de subida para compartir co soporte de NetBird."
+    },
+    "settings.troubleshooting.trace.label": {
+        "message": "Activar rexistros de traza"
+    },
+    "settings.troubleshooting.trace.help": {
+        "message": "Eleva o nivel de rexistro a TRACE e restaúrao despois."
+    },
+    "settings.troubleshooting.capture.label": {
+        "message": "Sesión de captura"
+    },
+    "settings.troubleshooting.capture.help": {
+        "message": "Volve conectar e agarda para que poida reproducir a incidencia."
+    },
+    "settings.troubleshooting.packets.label": {
+        "message": "Capturar paquetes de rede"
+    },
+    "settings.troubleshooting.packets.help": {
+        "message": "Garda un ficheiro .pcap do tráfico de rede durante a xanela de captura."
+    },
+    "settings.troubleshooting.duration.label": {
+        "message": "Duración da captura"
+    },
+    "settings.troubleshooting.duration.help": {
+        "message": "Canto tempo se executa a sesión de captura."
+    },
+    "settings.troubleshooting.duration.suffix": {
+        "message": "Minuto(s)"
+    },
+    "settings.troubleshooting.create": {
+        "message": "Crear paquete"
+    },
+    "settings.troubleshooting.progress.description": {
+        "message": "Recompilando rexistros, detalles do sistema e estado de conexión. Isto adoita levar un momento. Pode seguir usando NetBird ou pechar a Configuración mentres remata."
+    },
+    "settings.troubleshooting.cancelling": {
+        "message": "Cancelando…"
+    },
+    "settings.troubleshooting.done.uploadedTitle": {
+        "message": "Paquete de depuración subido con éxito!"
+    },
+    "settings.troubleshooting.done.savedTitle": {
+        "message": "Paquete gardado"
+    },
+    "settings.troubleshooting.done.uploadedDescription": {
+        "message": "Comparta a chave de subida de abaixo co <docs>soporte de NetBird</docs>. Tamén se gardou unha copia local no seu dispositivo."
+    },
+    "settings.troubleshooting.done.savedDescription": {
+        "message": "O seu paquete de depuración gardouse localmente."
+    },
+    "settings.troubleshooting.done.copyKey": {
+        "message": "Copiar chave"
+    },
+    "settings.troubleshooting.done.openFolder": {
+        "message": "Abrir cartafol"
+    },
+    "settings.troubleshooting.done.openFileLocation": {
+        "message": "Abrir localización do ficheiro"
+    },
+    "settings.troubleshooting.uploadFailedWithReason": {
+        "message": "Erro na subida: {reason} O paquete aínda está gardado localmente."
+    },
+    "settings.troubleshooting.uploadFailed": {
+        "message": "Erro na subida. O paquete aínda está gardado localmente."
+    },
+    "settings.troubleshooting.stage.reconnecting": {
+        "message": "Reconectando NetBird…"
+    },
+    "settings.troubleshooting.stage.capturing": {
+        "message": "Capturando rexistros de depuración"
+    },
+    "settings.troubleshooting.stage.bundling": {
+        "message": "Xerando paquete de depuración…"
+    },
+    "settings.troubleshooting.stage.uploading": {
+        "message": "Subindo a NetBird…"
+    },
+    "settings.troubleshooting.stage.cancelling": {
+        "message": "Cancelando…"
+    },
+    "settings.about.client": {
+        "message": "Cliente NetBird v{version}"
+    },
+    "settings.about.clientName": {
+        "message": "Cliente NetBird"
+    },
+    "settings.about.development": {
+        "message": "[Desenvolvemento]"
+    },
+    "settings.about.gui": {
+        "message": "GUI v{version}"
+    },
+    "settings.about.guiName": {
+        "message": "GUI"
+    },
+    "settings.about.copyright": {
+        "message": "© {year} NetBird. Todos os dereitos reservados."
+    },
+    "settings.about.links.imprint": {
+        "message": "Aviso legal"
+    },
+    "settings.about.links.privacy": {
+        "message": "Privacidade"
+    },
+    "settings.about.links.cla": {
+        "message": "CLA"
+    },
+    "settings.about.links.terms": {
+        "message": "Termos do servizo"
+    },
+    "settings.about.community.github": {
+        "message": "GitHub"
+    },
+    "settings.about.community.slack": {
+        "message": "Slack"
+    },
+    "settings.about.community.forum": {
+        "message": "Foro"
+    },
+    "settings.about.community.documentation": {
+        "message": "Documentación"
+    },
+    "settings.about.community.feedback": {
+        "message": "Comentarios"
+    },
+    "update.banner.message": {
+        "message": "NetBird {version} está listo para instalar."
+    },
+    "update.banner.later": {
+        "message": "Máis tarde"
+    },
+    "update.banner.installNow": {
+        "message": "Instalar agora"
+    },
+    "update.card.versionAvailableDownload": {
+        "message": "A versión {version} está dispoñible para descargar."
+    },
+    "update.card.versionAvailableInstall": {
+        "message": "A versión {version} está dispoñible para instalar."
+    },
+    "update.card.whatsNew": {
+        "message": "Que hai de novo?"
+    },
+    "update.card.installNow": {
+        "message": "Instalar agora"
+    },
+    "update.card.getInstaller": {
+        "message": "Descargar"
+    },
+    "update.card.autoCheckInterval": {
+        "message": "NetBird busca actualizacións en segundo plano."
+    },
+    "update.card.changelog": {
+        "message": "Rexistro de cambios"
+    },
+    "update.card.onLatestVersion": {
+        "message": "Ten a versión máis recente"
+    },
+    "update.header.tooltip": {
+        "message": "Actualización dispoñible"
+    },
+    "update.overlay.updatingVersion": {
+        "message": "Actualizando NetBird á v{version}"
+    },
+    "update.overlay.updating": {
+        "message": "Actualizando NetBird"
+    },
+    "update.overlay.description": {
+        "message": "Unha versión máis recente está dispoñible e estase instalando. NetBird reiniciarase automaticamente unha vez remate a actualización."
+    },
+    "update.overlay.error.timeoutTitle": {
+        "message": "A actualización está tardando demasiado"
+    },
+    "update.overlay.error.timeoutDescription": {
+        "message": "A instalación de {target} tardou demasiado e non rematou."
+    },
+    "update.overlay.error.canceledTitle": {
+        "message": "Detívose a actualización"
+    },
+    "update.overlay.error.canceledDescription": {
+        "message": "A actualización a {target} cancelouse antes de rematar."
+    },
+    "update.overlay.error.failTitle": {
+        "message": "Non se puido instalar a actualización"
+    },
+    "update.overlay.error.failDescription": {
+        "message": "Non se puido instalar {target}."
+    },
+    "update.overlay.error.unknownMessage": {
+        "message": "erro descoñecido"
+    },
+    "update.overlay.error.targetVersion": {
+        "message": "v{version}"
+    },
+    "update.overlay.error.targetFallback": {
+        "message": "a nova versión"
+    },
+    "update.error.loadStateTitle": {
+        "message": "Erro ao cargar o estado de actualización"
+    },
+    "update.error.triggerTitle": {
+        "message": "Erro ao iniciar a actualización"
+    },
+    "update.page.versionLine": {
+        "message": "Actualizando cliente a: {version}."
+    },
+    "update.page.versionLineGeneric": {
+        "message": "Actualizando cliente."
+    },
+    "update.page.outdated": {
+        "message": "A súa versión de cliente é máis antiga que a versión de actualización automática establecida na xestión."
+    },
+    "update.page.status.running": {
+        "message": "Actualizando"
+    },
+    "update.page.status.timeout": {
+        "message": "Esgotouse o tempo de espera da actualización. Por favor, inténteo de novo."
+    },
+    "update.page.status.canceled": {
+        "message": "Actualización cancelada."
+    },
+    "update.page.status.failed": {
+        "message": "Erro na actualización: {message}"
+    },
+    "update.page.status.unknownError": {
+        "message": "erro de actualización descoñecido"
+    },
+    "update.page.failedTitle": {
+        "message": "Erro na actualización"
+    },
+    "update.page.timeoutMessage": {
+        "message": "Esgotouse o tempo de espera da actualización."
+    },
+    "update.page.dontClose": {
+        "message": "Por favor, non peche esta xanela."
+    },
+    "update.page.updating": {
+        "message": "Actualizando…"
+    },
+    "update.page.complete": {
+        "message": "Actualización completada"
+    },
+    "update.page.failed": {
+        "message": "Erro na actualización"
+    },
+    "window.title.settings": {
+        "message": "Configuración"
+    },
+    "window.title.signIn": {
+        "message": "Iniciar sesión"
+    },
+    "window.title.sessionExpiration": {
+        "message": "Sesión a punto de caducar"
+    },
+    "window.title.updating": {
+        "message": "Actualizando"
+    },
+    "window.title.welcome": {
+        "message": "Benvido a NetBird"
+    },
+    "window.title.error": {
+        "message": "Erro"
+    },
+    "welcome.title": {
+        "message": "Busque NetBird na súa área de notificación"
+    },
+    "welcome.titleMac": {
+        "message": "Busque NetBird na súa barra de menú"
+    },
+    "welcome.description": {
+        "message": "NetBird reside na súa área de notificación. Faga clic na icona para conectar, cambiar de perfil ou abrir a configuración."
+    },
+    "welcome.descriptionMac": {
+        "message": "NetBird reside na súa barra de menú. Faga clic na icona para conectar, cambiar de perfil ou abrir a configuración."
+    },
+    "welcome.continue": {
+        "message": "Continuar"
+    },
+    "welcome.back": {
+        "message": "Volver"
+    },
+    "welcome.management.title": {
+        "message": "Configurar NetBird"
+    },
+    "welcome.management.description": {
+        "message": "Faga clic en Continuar para comezar, ou escolla Autoaloxado se ten o seu propio servidor de NetBird."
+    },
+    "welcome.management.cloud.title": {
+        "message": "NetBird Cloud"
+    },
+    "welcome.management.cloud.description": {
+        "message": "Use o noso servizo aloxado. Sen necesidade de configuración."
+    },
+    "welcome.management.selfHosted.title": {
+        "message": "Autoaloxado"
+    },
+    "welcome.management.selfHosted.description": {
+        "message": "Conéctese ao seu propio servidor de xestión."
+    },
+    "welcome.management.urlLabel": {
+        "message": "URL do servidor de xestión"
+    },
+    "welcome.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlInvalid": {
+        "message": "Por favor, introduza un URL válido, p. ex. https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlUnreachable": {
+        "message": "Non se puido acadar este servidor. Comprobe o URL ou a súa rede, e continúe se ten a certeza de que é correcto."
+    },
+    "welcome.management.checking": {
+        "message": "Comprobando…"
+    },
+    "browserLogin.title": {
+        "message": "Complete o inicio de sesión no navegador"
+    },
+    "browserLogin.notSeeing": {
+        "message": "Abrimos unha lapela no seu navegador para que poida rematar de iniciar sesión. Non a ve?"
+    },
+    "browserLogin.tryAgain": {
+        "message": "Tentar de novo"
+    },
+    "browserLogin.openFailedTitle": {
+        "message": "Erro ao abrir o navegador"
+    },
+    "sessionExpiration.title": {
+        "message": "A sesión caduca en breve"
+    },
+    "sessionExpiration.titleLater": {
+        "message": "A súa sesión caducará"
+    },
+    "sessionExpiration.description": {
+        "message": "Este dispositivo desconectarase en breve. Renove iniciando sesión no navegador."
+    },
+    "sessionExpiration.descriptionLater": {
+        "message": "Un inicio de sesión no navegador mantén este dispositivo conectado á súa rede."
+    },
+    "sessionExpiration.stay": {
+        "message": "Renovar sesión"
+    },
+    "sessionExpiration.authenticate": {
+        "message": "Autenticar"
+    },
+    "sessionExpiration.logout": {
+        "message": "Pechar sesión"
+    },
+    "sessionExpiration.expired": {
+        "message": "Sesión caducada"
+    },
+    "sessionExpiration.expiredDescription": {
+        "message": "Dispositivo desconectado. Autentíquese cun inicio de sesión no navegador para volver conectar."
+    },
+    "sessionExpiration.close": {
+        "message": "Pechar"
+    },
+    "sessionExpiration.extendFailedTitle": {
+        "message": "Erro ao prolongar a sesión"
+    },
+    "sessionExpiration.logoutFailedTitle": {
+        "message": "Erro ao pechar sesión"
+    },
+    "peers.search.placeholder": {
+        "message": "Buscar por nome ou IP"
+    },
+    "peers.filter.all": {
+        "message": "Todos"
+    },
+    "peers.filter.online": {
+        "message": "En liña"
+    },
+    "peers.filter.offline": {
+        "message": "Fóra de liña"
+    },
+    "peers.empty.title": {
+        "message": "Sen peers dispoñibles"
+    },
+    "peers.empty.description": {
+        "message": "Ou non ten ningún peer dispoñible ou non ten acceso a ningún deles."
+    },
+    "peers.details.domain": {
+        "message": "Dominio"
+    },
+    "peers.details.netbirdIp": {
+        "message": "IP de NetBird"
+    },
+    "peers.details.netbirdIpv6": {
+        "message": "IPv6 de NetBird"
+    },
+    "peers.details.publicKey": {
+        "message": "Chave pública"
+    },
+    "peers.details.connection": {
+        "message": "Conexión"
+    },
+    "peers.details.latency": {
+        "message": "Latencia"
+    },
+    "peers.details.lastHandshake": {
+        "message": "Último handshake"
+    },
+    "peers.details.statusSince": {
+        "message": "Última actualización de conexión"
+    },
+    "peers.details.bytes": {
+        "message": "Bytes"
+    },
+    "peers.details.bytesSent": {
+        "message": "Enviados"
+    },
+    "peers.details.bytesReceived": {
+        "message": "Recibidos"
+    },
+    "peers.details.localIce": {
+        "message": "ICE local"
+    },
+    "peers.details.remoteIce": {
+        "message": "ICE remoto"
+    },
+    "peers.details.never": {
+        "message": "Nunca"
+    },
+    "peers.details.justNow": {
+        "message": "Agora mesmo"
+    },
+    "peers.details.refresh": {
+        "message": "Actualizar"
+    },
+    "peers.status.connected": {
+        "message": "Conectado"
+    },
+    "peers.status.connecting": {
+        "message": "Conectando"
+    },
+    "peers.status.disconnected": {
+        "message": "Desconectado"
+    },
+    "peers.details.relayAddress": {
+        "message": "Servidor de retransmisión"
+    },
+    "peers.details.networks": {
+        "message": "Recursos"
+    },
+    "peers.details.relayed": {
+        "message": "Retransmitido"
+    },
+    "peers.details.p2p": {
+        "message": "P2P"
+    },
+    "peers.details.rosenpass": {
+        "message": "Rosenpass activado"
+    },
+    "networks.search.placeholder": {
+        "message": "Buscar por rede ou dominio"
+    },
+    "networks.filter.all": {
+        "message": "Todos"
+    },
+    "networks.filter.active": {
+        "message": "Activos"
+    },
+    "networks.filter.overlapping": {
+        "message": "Sobrepostos"
+    },
+    "networks.empty.title": {
+        "message": "Sen recursos dispoñibles"
+    },
+    "networks.empty.description": {
+        "message": "Ou non ten recursos de rede dispoñibles ou non ten acceso a ningún deles."
+    },
+    "networks.selected": {
+        "message": "Seleccionado"
+    },
+    "networks.unselected": {
+        "message": "Non seleccionado"
+    },
+    "networks.ips.heading": {
+        "message": "IPs resoltas"
+    },
+    "networks.bulk.selectionCount": {
+        "message": "{selected} de {total} Activos"
+    },
+    "networks.bulk.enableAll": {
+        "message": "Activar todos"
+    },
+    "networks.bulk.disableAll": {
+        "message": "Desactivar todos"
+    },
+    "exitNodes.search.placeholder": {
+        "message": "Buscar nodos de saída"
+    },
+    "exitNodes.none": {
+        "message": "Ningún"
+    },
+    "exitNodes.empty.title": {
+        "message": "Sen nodos de saída dispoñibles"
+    },
+    "exitNodes.empty.description": {
+        "message": "Non se compartiron nodos de saída con este peer."
+    },
+    "exitNodes.card.title": {
+        "message": "Nodo de saída"
+    },
+    "exitNodes.card.statusActive": {
+        "message": "Activo"
+    },
+    "exitNodes.card.statusInactive": {
+        "message": "Inactivo"
+    },
+    "exitNodes.dropdown.noneTitle": {
+        "message": "Ningún"
+    },
+    "exitNodes.dropdown.noneDescription": {
+        "message": "Conexión directa sen nodo de saída"
+    },
+    "quickActions.connect": {
+        "message": "Conectar"
+    },
+    "quickActions.disconnect": {
+        "message": "Desconectar"
+    },
+    "daemon.unavailable.title": {
+        "message": "O servizo NetBird non está en execución"
+    },
+    "daemon.unavailable.description": {
+        "message": "A aplicación volverá conectar automaticamente cando o servizo estea en execución."
+    },
+    "daemon.unavailable.docsLink": {
+        "message": "Documentación"
+    },
+    "daemon.outdated.title": {
+        "message": "O cliente NetBird está desactualizado"
+    },
+    "daemon.outdated.description": {
+        "message": "A nova GUI non é compatible co cliente NetBird máis antigo. Actualice o seu cliente para usar a nova aplicación."
+    },
+    "daemon.outdated.download": {
+        "message": "Descargar a última versión"
+    },
+    "error.jwt_clock_skew": {
+        "message": "Erro ao iniciar sesión: o reloxo deste dispositivo non está sincronizado co servidor. Por favor, sincronice o reloxo do sistema e inténteo de novo."
+    },
+    "error.jwt_expired": {
+        "message": "O seu token de inicio de sesión caducou. Por favor, inicie sesión de novo."
+    },
+    "error.jwt_signature_invalid": {
+        "message": "Erro ao iniciar sesión: a sinatura do token non é válida. Por favor, contacte co seu administrador."
+    },
+    "error.session_expired": {
+        "message": "A súa sesión caducou. Por favor, inicie sesión de novo."
+    },
+    "error.invalid_setup_key": {
+        "message": "A chave de configuración falta ou non é válida."
+    },
+    "error.permission_denied": {
+        "message": "O inicio de sesión foi rexeitado polo servidor."
+    },
+    "error.daemon_unreachable": {
+        "message": "O daemon de NetBird non responde. Por favor, comprobe que o servizo está en execución."
+    },
+    "error.settings_locked": {
+        "message": "A configuración non se pode cambiar neste dispositivo: un administrador bloqueouna."
+    },
+    "error.settings_managed_by_mdm": {
+        "message": "Esta configuración está xestionada pola súa organización e non se pode cambiar."
+    },
+    "error.unknown": {
+        "message": "A operación fallou."
+    },
+    "error.elevation_unavailable": {
+        "message": "NetBird non puido solicitar a este sistema os privilexios que o cambio require. Execute isto no seu lugar:"
+    },
+    "error.elevation_failed": {
+        "message": "O cambio non se puido aplicar con privilexios elevados. Execute isto no seu lugar:"
+    },
+    "settings.ssh.privilege.actorRoot": {
+        "message": "root"
+    },
+    "settings.ssh.privilege.actorAdministrator": {
+        "message": "privilexios de administrador"
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "Require {actor}. Execute isto no seu lugar:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Pode desactivalo, pero para volvelo activar requírese {actor}:"
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Pode activalo, pero para volvelo desactivar requírese {actor}:"
+    },
+    "settings.ssh.privilege.authorizePending": {
+        "message": "Agardando pola autorización…"
+    }
+}

From d56e6fc5f4ae07e352ada103fd6354d95d1715c3 Mon Sep 17 00:00:00 2001
From: Zoltan Papp <zoltan.pmail@gmail.com>
Date: Tue, 6 Oct 2026 15:41:01 +0200
Subject: [PATCH 12/18] [client, android, ios] Coalesce peer list change
 notifications to the mobile listener (#7546)

* [client] Coalesce peer list change notifications to the mobile listener

Every peer state change spawned a goroutine to call the platform
listener. During a reconnect storm this pinned hundreds of OS threads
in JNI and let the UI call back into the engine from each of them.
Deliver peer list changes from a single goroutine per listener and
collapse pending changes into the latest count.

* [client] Cover a pending wake-up when the peer list deliverer is replaced

The replacement test waited for the old callback to finish before
swapping listeners, so it never exercised the stop check that runs
after a wake-up. Block the old callback, queue a peer list change and
swap while it is blocked, then assert the old listener never sees the
new count.

* [client] Signal peer list deliverer exit and wait for it in the test

The replacement test sampled the old listener after a fixed sleep, so a
late stale delivery could slip past it. Close a done channel when the
deliverer goroutine returns and let the test wait on it instead.

* [client] Drop the test-only peer list deliverer exit channel

The done channel was only read by the replacement test. Production code
cannot wait on it, since joining the deliverer would block on a mobile
callback. The tests now drive the deliverer loop directly and check that
setListener and removeListener close its stop channel.
---
 client/internal/peer/notifier.go      |  60 ++++++++--
 client/internal/peer/notifier_test.go | 155 ++++++++++++++++++++++++++
 2 files changed, 207 insertions(+), 8 deletions(-)

diff --git a/client/internal/peer/notifier.go b/client/internal/peer/notifier.go
index 1ee1d32ea..564098bd4 100644
--- a/client/internal/peer/notifier.go
+++ b/client/internal/peer/notifier.go
@@ -12,6 +12,8 @@ type notifier struct {
 	serverStateLock    sync.Mutex
 	listenersLock      sync.Mutex
 	listener           Listener
+	peerListWake       chan struct{}
+	peerListStop       chan struct{}
 	currentClientState bool
 	lastNotification   ClientState
 	lastNumberOfPeers  int
@@ -62,7 +64,6 @@ func (n *notifier) setNetworkAvailable(available bool) {
 func (n *notifier) setListener(listener Listener) {
 	n.serverStateLock.Lock()
 	lastNotification := n.effectiveState(n.lastNotification)
-	numOfPeers := n.lastNumberOfPeers
 	fqdnAddress := n.lastFqdnAddress
 	address := n.lastIPAddress
 	n.serverStateLock.Unlock()
@@ -70,17 +71,19 @@ func (n *notifier) setListener(listener Listener) {
 	n.listenersLock.Lock()
 	defer n.listenersLock.Unlock()
 
+	n.stopPeerListDelivererLocked()
 	n.listener = listener
 
 	listener.OnAddressChanged(fqdnAddress, address)
 	notifyListener(listener, lastNotification)
-	// run on go routine to avoid on Java layer to call go functions on same thread
-	go listener.OnPeersListChanged(numOfPeers)
+	n.startPeerListDelivererLocked(listener)
+	n.wakePeerListDelivererLocked()
 }
 
 func (n *notifier) removeListener() {
 	n.listenersLock.Lock()
 	defer n.listenersLock.Unlock()
+	n.stopPeerListDelivererLocked()
 	n.listener = nil
 }
 
@@ -178,15 +181,56 @@ func (n *notifier) peerListChanged(numOfPeers int) {
 	n.serverStateLock.Unlock()
 
 	n.listenersLock.Lock()
-	listener := n.listener
-	n.listenersLock.Unlock()
+	defer n.listenersLock.Unlock()
+	n.wakePeerListDelivererLocked()
+}
 
-	if listener == nil {
+func (n *notifier) startPeerListDelivererLocked(listener Listener) {
+	wake := make(chan struct{}, 1)
+	stop := make(chan struct{})
+	n.peerListWake = wake
+	n.peerListStop = stop
+	go n.deliverPeerListChanges(listener, wake, stop)
+}
+
+func (n *notifier) stopPeerListDelivererLocked() {
+	if n.peerListStop == nil {
 		return
 	}
+	close(n.peerListStop)
+	n.peerListStop = nil
+	n.peerListWake = nil
+}
 
-	// run on go routine to avoid on Java layer to call go functions on same thread
-	go listener.OnPeersListChanged(numOfPeers)
+func (n *notifier) wakePeerListDelivererLocked() {
+	if n.peerListWake == nil {
+		return
+	}
+	select {
+	case n.peerListWake <- struct{}{}:
+	default:
+	}
+}
+
+func (n *notifier) deliverPeerListChanges(listener Listener, wake <-chan struct{}, stop <-chan struct{}) {
+	for {
+		select {
+		case <-stop:
+			return
+		case <-wake:
+		}
+		select {
+		case <-stop:
+			return
+		default:
+		}
+
+		n.serverStateLock.Lock()
+		numOfPeers := n.lastNumberOfPeers
+		n.serverStateLock.Unlock()
+
+		listener.OnPeersListChanged(numOfPeers)
+	}
 }
 
 func (n *notifier) localAddressChanged(fqdn, address string) {
diff --git a/client/internal/peer/notifier_test.go b/client/internal/peer/notifier_test.go
index a73016b05..f81866214 100644
--- a/client/internal/peer/notifier_test.go
+++ b/client/internal/peer/notifier_test.go
@@ -2,7 +2,9 @@ package peer
 
 import (
 	"sync"
+	"sync/atomic"
 	"testing"
+	"time"
 )
 
 type mocListener struct {
@@ -115,3 +117,156 @@ func Test_notifier_RemoveListener(t *testing.T) {
 		t.Errorf("invalid state: %d", listener.peers)
 	}
 }
+
+type coalescingListener struct {
+	final       int
+	calls       atomic.Int32
+	inFlight    atomic.Int32
+	maxInFlight atomic.Int32
+	last        atomic.Int32
+	done        chan struct{}
+	entered     chan struct{}
+	release     chan struct{}
+	once        sync.Once
+}
+
+func (l *coalescingListener) OnStateChanged(ClientState)      {}
+func (l *coalescingListener) OnConnected()                    {}
+func (l *coalescingListener) OnDisconnected()                 {}
+func (l *coalescingListener) OnConnecting()                   {}
+func (l *coalescingListener) OnDisconnecting()                {}
+func (l *coalescingListener) OnAddressChanged(string, string) {}
+
+func (l *coalescingListener) OnPeersListChanged(size int) {
+	current := l.inFlight.Add(1)
+	for {
+		seen := l.maxInFlight.Load()
+		if current <= seen || l.maxInFlight.CompareAndSwap(seen, current) {
+			break
+		}
+	}
+	if l.calls.Add(1) == 1 && l.entered != nil {
+		close(l.entered)
+	}
+	if l.release != nil {
+		<-l.release
+	}
+	time.Sleep(time.Millisecond)
+	l.last.Store(int32(size))
+	l.inFlight.Add(-1)
+	if size == l.final {
+		l.once.Do(func() { close(l.done) })
+	}
+}
+
+func Test_notifier_PeerListChangedCoalesces(t *testing.T) {
+	const events = 1000
+	listener := &coalescingListener{final: events, done: make(chan struct{})}
+	n := newNotifier()
+	n.setListener(listener)
+
+	for i := 1; i <= events; i++ {
+		n.peerListChanged(i)
+	}
+
+	select {
+	case <-listener.done:
+	case <-time.After(5 * time.Second):
+		t.Fatalf("last peer count not delivered, last seen: %d", listener.last.Load())
+	}
+
+	if got := listener.maxInFlight.Load(); got != 1 {
+		t.Errorf("concurrent deliveries: %d, expected 1", got)
+	}
+	if got := listener.calls.Load(); got >= events {
+		t.Errorf("deliveries not coalesced: %d calls for %d events", got, events)
+	}
+}
+
+func Test_notifier_SetListenerStopsPreviousDeliverer(t *testing.T) {
+	old := &coalescingListener{final: -1}
+	replacement := &coalescingListener{final: 7, done: make(chan struct{})}
+	n := newNotifier()
+	n.setListener(old)
+	oldStop := n.peerListStop
+
+	n.peerListChanged(7)
+	n.setListener(replacement)
+
+	select {
+	case <-oldStop:
+	default:
+		t.Fatal("old deliverer not stopped on listener replacement")
+	}
+	waitFor(t, replacement.done, "replacement listener not notified")
+}
+
+func Test_notifier_RemoveListenerStopsDeliverer(t *testing.T) {
+	n := newNotifier()
+	n.setListener(&coalescingListener{final: -1})
+	stop := n.peerListStop
+
+	n.removeListener()
+
+	select {
+	case <-stop:
+	default:
+		t.Fatal("deliverer not stopped on listener removal")
+	}
+}
+
+func Test_notifier_DelivererExitsAfterInFlightCallback(t *testing.T) {
+	listener := &coalescingListener{
+		final:   -1,
+		entered: make(chan struct{}),
+		release: make(chan struct{}),
+	}
+	n := newNotifier()
+	wake := make(chan struct{}, 1)
+	stop := make(chan struct{})
+	exited := make(chan struct{})
+	go func() {
+		n.deliverPeerListChanges(listener, wake, stop)
+		close(exited)
+	}()
+
+	wake <- struct{}{}
+	waitFor(t, listener.entered, "listener not called")
+
+	n.peerListChanged(7)
+	wake <- struct{}{}
+	close(stop)
+	close(listener.release)
+
+	waitFor(t, exited, "deliverer did not exit after stop")
+	if got := listener.calls.Load(); got != 1 {
+		t.Errorf("deliverer ran %d callbacks after stop, expected only the in-flight one", got)
+	}
+	if got := listener.last.Load(); got == 7 {
+		t.Errorf("deliverer delivered the peer count queued after stop")
+	}
+}
+
+func Test_notifier_DelivererPrefersStopOverPendingWake(t *testing.T) {
+	listener := &coalescingListener{final: -1}
+	n := newNotifier()
+	wake := make(chan struct{}, 1)
+	stop := make(chan struct{})
+
+	wake <- struct{}{}
+	close(stop)
+	n.deliverPeerListChanges(listener, wake, stop)
+
+	if got := listener.calls.Load(); got != 0 {
+		t.Errorf("deliverer ran %d callbacks with stop closed, expected 0", got)
+	}
+}
+
+func waitFor(t *testing.T, ch <-chan struct{}, msg string) {
+	t.Helper()
+	select {
+	case <-ch:
+	case <-time.After(5 * time.Second):
+		t.Fatal(msg)
+	}
+}

From 2623feeb5b7ca6338f98de697076bc835bed6fee Mon Sep 17 00:00:00 2001
From: Pascal Fischer <32096965+pascal-fischer@users.noreply.github.com>
Date: Tue, 6 Oct 2026 16:35:31 +0200
Subject: [PATCH 13/18] [management] remove ingress ports (#8062)

---
 client/cmd/forwarding_rules.go                |  98 --
 client/cmd/root.go                            |   3 -
 client/cmd/testutil_test.go                   |   7 +-
 client/embed/embed_test.go                    |   7 +-
 client/firewall/iptables/dnat_linux.go        | 166 ----
 .../iptables/dnat_refcount_linux_test.go      | 240 -----
 client/firewall/iptables/family_linux.go      |   4 -
 client/firewall/iptables/filter_linux.go      |   9 -
 client/firewall/iptables/manager_linux.go     |  25 -
 .../firewall/iptables/manager_linux_test.go   |  10 -
 client/firewall/manager/firewall.go           |   6 -
 client/firewall/manager/forward_rule.go       |  27 -
 client/firewall/nftables/dnat_linux.go        | 321 -------
 .../nftables/dnat_refcount_linux_test.go      | 249 -----
 client/firewall/nftables/family_linux.go      |   8 -
 client/firewall/nftables/filter_linux.go      |   5 -
 client/firewall/nftables/manager_linux.go     |  47 +-
 .../firewall/nftables/manager_linux_test.go   |  24 -
 client/firewall/nftables/routing_linux.go     |  35 -
 client/firewall/uspfilter/nat.go              |  10 -
 client/internal/engine.go                     |  92 +-
 client/internal/engine_privileged_test.go     |   5 +-
 client/internal/ingressgw/manager.go          | 111 ---
 client/internal/ingressgw/manager_test.go     | 281 ------
 client/internal/message_convert.go            |  43 -
 client/internal/peer/status.go                |  35 -
 .../routemanager/ipfwdstate/ipfwdstate.go     |  28 +-
 .../ipfwdstate_privileged_linux_test.go       |  10 +-
 client/proto/daemon.pb.go                     |  55 +-
 client/proto/daemon.proto                     |  18 +-
 client/proto/daemon_grpc.pb.go                |   5 +
 client/server/forwardingrules.go              |  54 --
 client/server/server_privileged_test.go       |   7 +-
 client/status/status.go                       |  94 +-
 client/status/status_test.go                  |   2 -
 client/ui/frontend/WAILS-API.md               |  17 +-
 client/ui/main.go                             |   1 -
 client/ui/services/forwarding.go              |  83 --
 go.mod                                        |   2 +-
 go.sum                                        |   4 +-
 .../network_map/controller/controller.go      | 122 +--
 .../network_map/controller/controller_test.go |   3 +-
 .../network_map/controller/repository_mock.go |  15 +
 .../controllers/network_map/interface.go      |   2 +-
 .../controllers/network_map/interface_mock.go |  11 +-
 .../network_map/nmaptest/canonicalize.go      |  11 -
 .../network_map/nmaptest/runner.go            |   2 +-
 management/internals/server/controllers.go    |  11 +-
 management/internals/server/modules.go        |   4 +-
 .../shared/grpc/components_encoder.go         |   6 -
 .../shared/grpc/components_encoder_test.go    |  60 --
 .../grpc/components_envelope_response.go      |  43 -
 .../internals/shared/grpc/conversion.go       |   8 -
 management/internals/shared/grpc/server.go    |   4 +-
 management/server/account.go                  |   4 -
 management/server/account_test.go             |   5 +-
 management/server/dns_test.go                 |   5 +-
 .../testing/testing_tools/channel/channel.go  |  11 +-
 management/server/identity_provider_test.go   |   5 +-
 .../port_forwarding/controller.go             |  38 -
 management/server/management_proto_test.go    |   7 +-
 management/server/management_test.go          |   6 +-
 management/server/nameserver_test.go          |   5 +-
 management/server/peer.go                     |   9 -
 management/server/peer_test.go                |  39 +-
 management/server/route_test.go               |   5 +-
 .../server/types/account_networkmapdata.go    |   3 +-
 management/server/types/aliases.go            |   1 -
 management/server/types/legacynmap/aliases.go |   1 -
 .../server/types/legacynmap/converters.go     |   1 -
 .../types/legacynmap/equivalence_test.go      |  12 -
 .../server/types/legacynmap/proto_legacy.go   |   8 -
 shared/management/client/client_test.go       |   7 +-
 shared/management/client/rest/client.go       |   5 -
 shared/management/client/rest/ingress.go      |  92 --
 shared/management/client/rest/ingress_test.go | 184 ----
 shared/management/client/rest/peers.go        |  92 --
 shared/management/client/rest/peers_test.go   | 145 ---
 shared/management/http/api/openapi.yml        | 554 -----------
 shared/management/http/api/types.gen.go       | 223 -----
 shared/management/networkmap/envelope.go      |  68 +-
 shared/management/proto/management.pb.go      | 907 +++++++++---------
 shared/management/proto/management.proto      |  35 +-
 shared/management/types/network.go            | 104 --
 shared/management/types/network_test.go       |  41 -
 85 files changed, 667 insertions(+), 4505 deletions(-)
 delete mode 100644 client/cmd/forwarding_rules.go
 delete mode 100644 client/firewall/iptables/dnat_refcount_linux_test.go
 delete mode 100644 client/firewall/manager/forward_rule.go
 delete mode 100644 client/firewall/nftables/dnat_refcount_linux_test.go
 delete mode 100644 client/internal/ingressgw/manager.go
 delete mode 100644 client/internal/ingressgw/manager_test.go
 delete mode 100644 client/internal/message_convert.go
 delete mode 100644 client/server/forwardingrules.go
 delete mode 100644 client/ui/services/forwarding.go
 delete mode 100644 management/server/integrations/port_forwarding/controller.go
 delete mode 100644 shared/management/client/rest/ingress.go
 delete mode 100644 shared/management/client/rest/ingress_test.go
 delete mode 100644 shared/management/types/network_test.go

diff --git a/client/cmd/forwarding_rules.go b/client/cmd/forwarding_rules.go
deleted file mode 100644
index b3052746a..000000000
--- a/client/cmd/forwarding_rules.go
+++ /dev/null
@@ -1,98 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-	"sort"
-
-	"github.com/spf13/cobra"
-	"google.golang.org/grpc/status"
-
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-var forwardingRulesCmd = &cobra.Command{
-	Use:   "forwarding",
-	Short: "List forwarding rules",
-	Long:  `Commands to list forwarding rules.`,
-}
-
-var forwardingRulesListCmd = &cobra.Command{
-	Use:     "list",
-	Aliases: []string{"ls"},
-	Short:   "List forwarding rules",
-	Example: "  netbird forwarding list",
-	Long:    "Commands to list forwarding rules.",
-	RunE:    listForwardingRules,
-}
-
-func listForwardingRules(cmd *cobra.Command, _ []string) error {
-	conn, err := getClient(cmd)
-	if err != nil {
-		return err
-	}
-	defer conn.Close()
-
-	client := proto.NewDaemonServiceClient(conn)
-	resp, err := client.ForwardingRules(cmd.Context(), &proto.EmptyRequest{})
-	if err != nil {
-		return fmt.Errorf("failed to list network: %v", status.Convert(err).Message())
-	}
-
-	if len(resp.GetRules()) == 0 {
-		cmd.Println("No forwarding rules available.")
-		return nil
-	}
-
-	printForwardingRules(cmd, resp.GetRules())
-	return nil
-}
-
-func printForwardingRules(cmd *cobra.Command, rules []*proto.ForwardingRule) {
-	cmd.Println("Available forwarding rules:")
-
-	// Sort rules by translated address
-	sort.Slice(rules, func(i, j int) bool {
-		if rules[i].GetTranslatedAddress() != rules[j].GetTranslatedAddress() {
-			return rules[i].GetTranslatedAddress() < rules[j].GetTranslatedAddress()
-		}
-		if rules[i].GetProtocol() != rules[j].GetProtocol() {
-			return rules[i].GetProtocol() < rules[j].GetProtocol()
-		}
-
-		return getFirstPort(rules[i].GetDestinationPort()) < getFirstPort(rules[j].GetDestinationPort())
-	})
-
-	var lastIP string
-	for _, rule := range rules {
-		dPort := portToString(rule.GetDestinationPort())
-		tPort := portToString(rule.GetTranslatedPort())
-		if lastIP != rule.GetTranslatedAddress() {
-			lastIP = rule.GetTranslatedAddress()
-			cmd.Printf("\nTranslated peer: %s\n", rule.GetTranslatedHostname())
-		}
-
-		cmd.Printf("  Local %s/%s to %s:%s\n", rule.GetProtocol(), dPort, rule.GetTranslatedAddress(), tPort)
-	}
-}
-
-func getFirstPort(portInfo *proto.PortInfo) int {
-	switch v := portInfo.PortSelection.(type) {
-	case *proto.PortInfo_Port:
-		return int(v.Port)
-	case *proto.PortInfo_Range_:
-		return int(v.Range.GetStart())
-	default:
-		return 0
-	}
-}
-
-func portToString(translatedPort *proto.PortInfo) string {
-	switch v := translatedPort.PortSelection.(type) {
-	case *proto.PortInfo_Port:
-		return fmt.Sprintf("%d", v.Port)
-	case *proto.PortInfo_Range_:
-		return fmt.Sprintf("%d-%d", v.Range.GetStart(), v.Range.GetEnd())
-	default:
-		return "No port specified"
-	}
-}
diff --git a/client/cmd/root.go b/client/cmd/root.go
index 2ca14c39c..4525a9bd6 100644
--- a/client/cmd/root.go
+++ b/client/cmd/root.go
@@ -177,7 +177,6 @@ func init() {
 	rootCmd.AddCommand(versionCmd)
 	rootCmd.AddCommand(sshCmd)
 	rootCmd.AddCommand(networksCMD)
-	rootCmd.AddCommand(forwardingRulesCmd)
 	rootCmd.AddCommand(debugCmd)
 	rootCmd.AddCommand(profileCmd)
 	rootCmd.AddCommand(exposeCmd)
@@ -185,8 +184,6 @@ func init() {
 	networksCMD.AddCommand(routesListCmd)
 	networksCMD.AddCommand(routesSelectCmd, routesDeselectCmd)
 
-	forwardingRulesCmd.AddCommand(forwardingRulesListCmd)
-
 	debugCmd.AddCommand(debugBundleCmd)
 	debugCmd.AddCommand(logCmd)
 	logCmd.AddCommand(logLevelCmd)
diff --git a/client/cmd/testutil_test.go b/client/cmd/testutil_test.go
index 328a15454..46bf31837 100644
--- a/client/cmd/testutil_test.go
+++ b/client/cmd/testutil_test.go
@@ -6,9 +6,9 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
 	"github.com/stretchr/testify/require"
 	"go.opentelemetry.io/otel"
+	"go.uber.org/mock/gomock"
 	"google.golang.org/grpc"
 
 	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator/validator"
@@ -28,7 +28,6 @@ import (
 	mgmt "github.com/netbirdio/netbird/management/server"
 	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/management/server/groups"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
 	"github.com/netbirdio/netbird/management/server/store"
@@ -124,9 +123,9 @@ func startManagement(t *testing.T, config *config.Config, testFile string) (*grp
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := mgmt.NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, mgmt.MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), manager.NewEphemeralManager(store, peersmanager), config, nil)
+	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, mgmt.MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", manager.NewEphemeralManager(store, peersmanager), config, nil)
 
-	accountManager, err := mgmt.BuildManager(ctx, config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, iv, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManagerMock, false, cacheStore)
+	accountManager, err := mgmt.BuildManager(ctx, config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, iv, metrics, settingsMockManager, permissionsManagerMock, false, cacheStore)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/client/embed/embed_test.go b/client/embed/embed_test.go
index 4ff5c9978..a818af055 100644
--- a/client/embed/embed_test.go
+++ b/client/embed/embed_test.go
@@ -6,8 +6,8 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 	"google.golang.org/grpc"
 
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller"
@@ -21,7 +21,6 @@ import (
 	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/groups"
 	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator/validator"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
@@ -146,8 +145,8 @@ func startManagement(t *testing.T, signalAddr string) string {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := mgmt.NewAccountRequestBuffer(context.Background(), testStore)
-	networkMapController := controller.NewController(context.Background(), testStore, metrics, updateManager, requestBuffer, mgmt.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), manager.NewEphemeralManager(testStore, peersManager), cfg, nil)
-	accountManager, err := mgmt.BuildManager(context.Background(), cfg, testStore, networkMapController, jobManager, nil, "", eventStore, nil, false, iv, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	networkMapController := controller.NewController(context.Background(), testStore, metrics, updateManager, requestBuffer, mgmt.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", manager.NewEphemeralManager(testStore, peersManager), cfg, nil)
+	accountManager, err := mgmt.BuildManager(context.Background(), cfg, testStore, networkMapController, jobManager, nil, "", eventStore, nil, false, iv, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	require.NoError(t, err)
 
 	secretsManager, err := nbgrpc.NewTimeBasedAuthSecretsManager(updateManager, cfg.TURNConfig, cfg.Relay, settingsMockManager, groupsManager)
diff --git a/client/firewall/iptables/dnat_linux.go b/client/firewall/iptables/dnat_linux.go
index eca8386c0..f118c9dfe 100644
--- a/client/firewall/iptables/dnat_linux.go
+++ b/client/firewall/iptables/dnat_linux.go
@@ -8,177 +8,11 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/hashicorp/go-multierror"
 	log "github.com/sirupsen/logrus"
 
-	nberrors "github.com/netbirdio/netbird/client/errors"
 	firewall "github.com/netbirdio/netbird/client/firewall/manager"
 )
 
-func (r *family) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error) {
-	ruleID := rule.ID()
-	if _, exists := r.rules[ruleID+dnatSuffix]; exists {
-		return rule, nil
-	}
-
-	toDestination := rule.TranslatedAddress.String()
-	switch {
-	case len(rule.TranslatedPort.Values) == 0:
-		// no translated port, use original port
-	case len(rule.TranslatedPort.Values) == 1:
-		toDestination += fmt.Sprintf(":%d", rule.TranslatedPort.Values[0])
-	case rule.TranslatedPort.IsRange && len(rule.TranslatedPort.Values) == 2:
-		// need the "/originalport" suffix to avoid dnat port randomization
-		toDestination += fmt.Sprintf(":%d-%d/%d", rule.TranslatedPort.Values[0], rule.TranslatedPort.Values[1], rule.DestinationPort.Values[0])
-	default:
-		return nil, fmt.Errorf("invalid translated port: %v", rule.TranslatedPort)
-	}
-
-	proto := strings.ToLower(string(rule.Protocol))
-
-	rules := make(map[firewall.RuleID]ruleInfo, 3)
-
-	// DNAT rule
-	dnatRule := []string{
-		"!", "-i", r.wgIface.Name(),
-		"-p", proto,
-		"-j", "DNAT",
-		"--to-destination", toDestination,
-	}
-	dnatRule = append(dnatRule, applyPort("--dport", &rule.DestinationPort)...)
-	rules[ruleID+dnatSuffix] = ruleInfo{
-		table: tableNat,
-		chain: chainRTRdr,
-		rule:  dnatRule,
-	}
-
-	// SNAT rule
-	snatRule := []string{
-		"-o", r.wgIface.Name(),
-		"-p", proto,
-		"-d", rule.TranslatedAddress.String(),
-		"-j", "MASQUERADE",
-	}
-	snatRule = append(snatRule, applyPort("--dport", &rule.TranslatedPort)...)
-	rules[ruleID+snatSuffix] = ruleInfo{
-		table: tableNat,
-		chain: chainRTNAT,
-		rule:  snatRule,
-	}
-
-	// Forward filtering rule, if fwd policy is DROP
-	forwardRule := []string{
-		"-o", r.wgIface.Name(),
-		"-p", proto,
-		"-d", rule.TranslatedAddress.String(),
-		"-j", "ACCEPT",
-	}
-	forwardRule = append(forwardRule, applyPort("--dport", &rule.TranslatedPort)...)
-	rules[ruleID+fwdSuffix] = ruleInfo{
-		table: tableFilter,
-		chain: chainRTFwdOut,
-		rule:  forwardRule,
-	}
-
-	for key, ruleInfo := range rules {
-		if err := r.iptablesClient.Append(ruleInfo.table, ruleInfo.chain, ruleInfo.rule...); err != nil {
-			r.cleanupFailedDNATAdd(rules)
-			return nil, fmt.Errorf("add rule %s: %w", key, err)
-		}
-		r.rules[key] = ruleInfo.rule
-	}
-
-	if err := r.ipFwdState.RequestForwarding(r.v6); err != nil {
-		r.cleanupFailedDNATAdd(rules)
-		return nil, fmt.Errorf("enable forwarding: %w", err)
-	}
-
-	r.updateState()
-	return rule, nil
-}
-
-// cleanupFailedDNATAdd removes the bookkeeping written by a partially applied
-// AddDNATRule before rolling back the kernel rules, so no entries remain that
-// never got a forwarding refcount. rollbackRules re-adds entries it failed to
-// remove from the kernel.
-func (r *family) cleanupFailedDNATAdd(rules map[firewall.RuleID]ruleInfo) {
-	for key := range rules {
-		delete(r.rules, key)
-	}
-	if err := r.rollbackRules(rules); err != nil {
-		log.Errorf("rollback failed: %v", err)
-	}
-}
-
-func (r *family) rollbackRules(rules map[firewall.RuleID]ruleInfo) error {
-	var merr *multierror.Error
-	for key, ruleInfo := range rules {
-		if err := r.iptablesClient.DeleteIfExists(ruleInfo.table, ruleInfo.chain, ruleInfo.rule...); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("rollback rule %s: %w", key, err))
-			// On rollback error, add to rules map for next cleanup
-			r.rules[key] = ruleInfo.rule
-		}
-	}
-	if merr != nil {
-		r.updateState()
-	}
-	return nberrors.FormatErrorOrNil(merr)
-}
-
-func (r *family) DeleteDNATRule(rule firewall.Rule) error {
-	ruleID := rule.ID()
-
-	_, hadDNAT := r.rules[ruleID+dnatSuffix]
-	_, hadSNAT := r.rules[ruleID+snatSuffix]
-	_, hadFWD := r.rules[ruleID+fwdSuffix]
-	if !hadDNAT && !hadSNAT && !hadFWD {
-		return nil
-	}
-
-	var merr *multierror.Error
-	if dnatRule, exists := r.rules[ruleID+dnatSuffix]; exists {
-		if err := r.iptablesClient.Delete(tableNat, chainRTRdr, dnatRule...); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("delete DNAT rule: %w", err))
-		} else {
-			delete(r.rules, ruleID+dnatSuffix)
-		}
-	}
-
-	if snatRule, exists := r.rules[ruleID+snatSuffix]; exists {
-		if err := r.iptablesClient.Delete(tableNat, chainRTNAT, snatRule...); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("delete SNAT rule: %w", err))
-		} else {
-			delete(r.rules, ruleID+snatSuffix)
-		}
-	}
-
-	if fwdRule, exists := r.rules[ruleID+fwdSuffix]; exists {
-		if err := r.iptablesClient.Delete(tableFilter, chainRTFwdOut, fwdRule...); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("delete forward rule: %w", err))
-		} else {
-			delete(r.rules, ruleID+fwdSuffix)
-		}
-	}
-
-	// Release the refcount only once all rules are gone from the kernel. On
-	// partial failure the failed entries stay in r.rules so a retry can remove
-	// them and release then.
-	if merr == nil {
-		r.releaseForwarding()
-	}
-
-	r.updateState()
-
-	return nberrors.FormatErrorOrNil(merr)
-}
-
-// releaseForwarding drops one IP forwarding reference, logging any error.
-func (r *family) releaseForwarding() {
-	if err := r.ipFwdState.ReleaseForwarding(r.v6); err != nil {
-		log.Errorf("release IP forwarding: %v", err)
-	}
-}
-
 func (r *family) AddInboundDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error {
 	ruleID := firewall.RuleID(fmt.Sprintf("inbound-dnat-%s-%s-%d-%d", localAddr.String(), protocol, originalPort, translatedPort))
 
diff --git a/client/firewall/iptables/dnat_refcount_linux_test.go b/client/firewall/iptables/dnat_refcount_linux_test.go
deleted file mode 100644
index 40ebc6cc3..000000000
--- a/client/firewall/iptables/dnat_refcount_linux_test.go
+++ /dev/null
@@ -1,240 +0,0 @@
-//go:build privileged
-
-package iptables
-
-import (
-	"net/netip"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	fw "github.com/netbirdio/netbird/client/firewall/manager"
-	"github.com/netbirdio/netbird/client/iface"
-	"github.com/netbirdio/netbird/client/iface/wgaddr"
-)
-
-func iptRefcountIfaceV4() *iFaceMock {
-	return &iFaceMock{
-		NameFunc: func() string { return "wt-refcount" },
-		AddressFunc: func() wgaddr.Address {
-			return wgaddr.Address{
-				IP:      netip.MustParseAddr("10.20.0.1"),
-				Network: netip.MustParsePrefix("10.20.0.0/24"),
-			}
-		},
-	}
-}
-
-func iptRefcountIfaceDual() *iFaceMock {
-	return &iFaceMock{
-		NameFunc: func() string { return "wt-refcount" },
-		AddressFunc: func() wgaddr.Address {
-			return wgaddr.Address{
-				IP:      netip.MustParseAddr("10.20.0.1"),
-				Network: netip.MustParsePrefix("10.20.0.0/24"),
-				IPv6:    netip.MustParseAddr("fd00::1"),
-				IPv6Net: netip.MustParsePrefix("fd00::/64"),
-			}
-		},
-	}
-}
-
-func newIptRefcountManager(t *testing.T, dual bool) *Manager {
-	t.Helper()
-	var ifMock *iFaceMock
-	if dual {
-		ifMock = iptRefcountIfaceDual()
-	} else {
-		ifMock = iptRefcountIfaceV4()
-	}
-	m, err := Create(ifMock, iface.DefaultMTU)
-	require.NoError(t, err, "create manager")
-	require.NoError(t, m.Init(nil), "init manager")
-	t.Cleanup(func() {
-		require.NoError(t, m.Close(nil), "close manager")
-	})
-	return m
-}
-
-func iptDnatV4(port uint16) fw.ForwardRule {
-	return fw.ForwardRule{
-		Protocol:          fw.ProtocolTCP,
-		DestinationPort:   fw.Port{Values: []uint16{port}},
-		TranslatedAddress: netip.MustParseAddr("10.20.0.2"),
-		TranslatedPort:    fw.Port{Values: []uint16{80}},
-	}
-}
-
-func iptDnatV6(port uint16) fw.ForwardRule {
-	return fw.ForwardRule{
-		Protocol:          fw.ProtocolTCP,
-		DestinationPort:   fw.Port{Values: []uint16{port}},
-		TranslatedAddress: netip.MustParseAddr("fd00::2"),
-		TranslatedPort:    fw.Port{Values: []uint16{80}},
-	}
-}
-
-// TestIptablesRouting_RepeatedEnableSingleReference verifies that EnableRouting
-// (called on every network-map update) holds at most one reference per family
-// and a single DisableRouting drops both back to zero.
-func TestIptablesRouting_RepeatedEnableSingleReference(t *testing.T) {
-	m := newIptRefcountManager(t, true)
-	state := m.family4.ipFwdState
-
-	require.NoError(t, m.EnableRouting(), "first enable")
-	require.NoError(t, m.EnableRouting(), "second enable")
-	require.NoError(t, m.EnableRouting(), "third enable")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 1, v4, "repeated enable holds a single v4 reference")
-	assert.Equal(t, 1, v6, "repeated enable holds a single v6 reference")
-
-	require.NoError(t, m.DisableRouting(), "disable")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "single disable releases the v4 reference")
-	assert.Equal(t, 0, v6, "single disable releases the v6 reference")
-}
-
-// TestIptablesRouting_DisableKeepsDNATReference verifies that an unpaired
-// DisableRouting does not release references held by active DNAT rules.
-func TestIptablesRouting_DisableKeepsDNATReference(t *testing.T) {
-	m := newIptRefcountManager(t, true)
-	state := m.family4.ipFwdState
-
-	r1, err := m.AddDNATRule(iptDnatV6(9095))
-	require.NoError(t, err, "add v6 dnat")
-
-	require.NoError(t, m.DisableRouting(), "unpaired disable")
-	_, v6 := state.Counts()
-	assert.Equal(t, 1, v6, "DNAT-held reference survives unpaired DisableRouting")
-
-	require.NoError(t, m.DeleteDNATRule(r1), "delete v6 dnat")
-	_, v6 = state.Counts()
-	assert.Equal(t, 0, v6, "delete releases the DNAT reference")
-}
-
-// TestIptablesDNAT_RefcountBalancedV4 covers a Balanced Add/Delete pair on v4.
-func TestIptablesDNAT_RefcountBalancedV4(t *testing.T) {
-	m := newIptRefcountManager(t, false)
-	state := m.family4.ipFwdState
-
-	r1, err := m.AddDNATRule(iptDnatV4(7081))
-	require.NoError(t, err, "add v4 dnat 1")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 1, v4, "v4 refcount after first add")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-
-	r2, err := m.AddDNATRule(iptDnatV4(7082))
-	require.NoError(t, err, "add v4 dnat 2")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 2, v4, "v4 refcount after second add")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-
-	require.NoError(t, m.DeleteDNATRule(r1))
-	v4, v6 = state.Counts()
-	assert.Equal(t, 1, v4, "v4 refcount after first delete")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-
-	require.NoError(t, m.DeleteDNATRule(r2))
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount after second delete")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-}
-
-// TestIptablesDNAT_RefcountBalancedV6 checks the v6 path increments v6 only and
-// decrements back to zero.
-func TestIptablesDNAT_RefcountBalancedV6(t *testing.T) {
-	m := newIptRefcountManager(t, true)
-	require.NotNil(t, m.family6, "v6 family")
-	require.Same(t, m.family4.ipFwdState, m.family6.ipFwdState, "shared state")
-	state := m.family4.ipFwdState
-
-	r1, err := m.AddDNATRule(iptDnatV6(9081))
-	require.NoError(t, err, "add v6 dnat 1")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 1, v6, "v6 refcount after first add")
-
-	r2, err := m.AddDNATRule(iptDnatV6(9082))
-	require.NoError(t, err, "add v6 dnat 2")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount unchanged")
-	assert.Equal(t, 2, v6, "v6 refcount after second add")
-
-	require.NoError(t, m.DeleteDNATRule(r1))
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount unchanged")
-	assert.Equal(t, 1, v6, "v6 refcount after first delete")
-
-	require.NoError(t, m.DeleteDNATRule(r2))
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 0, v6, "v6 refcount after second delete")
-}
-
-// TestIptablesDNAT_DuplicateAddNoLeak verifies the duplicate-rule path returns
-// without bumping the refcount.
-func TestIptablesDNAT_DuplicateAddNoLeak(t *testing.T) {
-	m := newIptRefcountManager(t, true)
-	state := m.family4.ipFwdState
-
-	rule := iptDnatV4(7083)
-	r1, err := m.AddDNATRule(rule)
-	require.NoError(t, err)
-	v4, _ := state.Counts()
-	assert.Equal(t, 1, v4)
-
-	_, err = m.AddDNATRule(rule)
-	require.NoError(t, err, "duplicate add")
-	v4, _ = state.Counts()
-	assert.Equal(t, 1, v4, "duplicate add must not increment")
-
-	require.NoError(t, m.DeleteDNATRule(r1))
-	v4, _ = state.Counts()
-	assert.Equal(t, 0, v4, "single delete must drop to zero")
-}
-
-// TestIptablesDNAT_DeleteMissingNoUnderflow verifies Delete on an unknown rule
-// neither errors nor releases the refcount.
-func TestIptablesDNAT_DeleteMissingNoUnderflow(t *testing.T) {
-	m := newIptRefcountManager(t, true)
-	state := m.family4.ipFwdState
-
-	phantom := iptDnatV4(7099)
-	require.NoError(t, m.DeleteDNATRule(&phantom), "delete missing v4")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 0, v6)
-
-	phantom6 := iptDnatV6(9099)
-	require.NoError(t, m.DeleteDNATRule(&phantom6), "delete missing v6")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 0, v6)
-
-	r1, err := m.AddDNATRule(iptDnatV4(7100))
-	require.NoError(t, err)
-	v4, _ = state.Counts()
-	assert.Equal(t, 1, v4, "real add still increments after phantom delete")
-	require.NoError(t, m.DeleteDNATRule(r1))
-}
-
-// TestIptablesDNAT_DoubleDeleteNoUnderflow verifies a second Delete on the same
-// rule is a no-op.
-func TestIptablesDNAT_DoubleDeleteNoUnderflow(t *testing.T) {
-	m := newIptRefcountManager(t, true)
-	state := m.family4.ipFwdState
-
-	r1, err := m.AddDNATRule(iptDnatV6(9083))
-	require.NoError(t, err)
-	_, v6 := state.Counts()
-	assert.Equal(t, 1, v6)
-
-	require.NoError(t, m.DeleteDNATRule(r1), "first delete")
-	_, v6 = state.Counts()
-	assert.Equal(t, 0, v6)
-
-	require.NoError(t, m.DeleteDNATRule(r1), "second delete must be no-op")
-	_, v6 = state.Counts()
-	assert.Equal(t, 0, v6, "double delete must not underflow")
-}
diff --git a/client/firewall/iptables/family_linux.go b/client/firewall/iptables/family_linux.go
index 0e1ce5440..2ac860a0a 100644
--- a/client/firewall/iptables/family_linux.go
+++ b/client/firewall/iptables/family_linux.go
@@ -56,10 +56,6 @@ const (
 	markManglePost = "mark-mangle-post"
 	matchSet       = "--match-set"
 
-	dnatSuffix firewall.RuleID = "_dnat"
-	snatSuffix firewall.RuleID = "_snat"
-	fwdSuffix  firewall.RuleID = "_fwd"
-
 	// ipv4TCPHeaderSize is the minimum IPv4 (20) + TCP (20) header size for MSS calculation.
 	ipv4TCPHeaderSize = 40
 	// ipv6TCPHeaderSize is the minimum IPv6 (40) + TCP (20) header size for MSS calculation.
diff --git a/client/firewall/iptables/filter_linux.go b/client/firewall/iptables/filter_linux.go
index dc606da2d..30cd81018 100644
--- a/client/firewall/iptables/filter_linux.go
+++ b/client/firewall/iptables/filter_linux.go
@@ -81,15 +81,6 @@ func (r *family) hasRule(id nbid.RuleID) bool {
 	return ok
 }
 
-// hasDNATRule reports whether this family owns the DNAT rule set for
-// the given user id. DNAT rules live in r.rules under the well-known
-// "<id>_dnat" key; the lookup here is used by Manager.DeleteDNATRule
-// to pick the right family.
-func (r *family) hasDNATRule(id firewall.RuleID) bool {
-	_, ok := r.rules[id+dnatSuffix]
-	return ok
-}
-
 // DeleteFilterRule removes a previously installed filter rule. The
 // rule's stored chain/table identify where to delete from; source set
 // references are recovered from the spec via findSets and dropped
diff --git a/client/firewall/iptables/manager_linux.go b/client/firewall/iptables/manager_linux.go
index 0f0b0110e..a566909c8 100644
--- a/client/firewall/iptables/manager_linux.go
+++ b/client/firewall/iptables/manager_linux.go
@@ -323,31 +323,6 @@ func (m *Manager) DisableRouting() error {
 	return m.family4.ipFwdState.ReleaseRouting()
 }
 
-// AddDNATRule adds a DNAT rule
-func (m *Manager) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error) {
-	m.mutex.Lock()
-	defer m.mutex.Unlock()
-
-	if rule.TranslatedAddress.Is6() {
-		if !m.hasIPv6() {
-			return nil, fmt.Errorf("add DNAT rule: %w", firewall.ErrIPv6NotInitialized)
-		}
-		return m.family6.AddDNATRule(rule)
-	}
-	return m.family4.AddDNATRule(rule)
-}
-
-// DeleteDNATRule deletes a DNAT rule
-func (m *Manager) DeleteDNATRule(rule firewall.Rule) error {
-	m.mutex.Lock()
-	defer m.mutex.Unlock()
-
-	if m.hasIPv6() && !m.family4.hasDNATRule(rule.ID()) {
-		return m.family6.DeleteDNATRule(rule)
-	}
-	return m.family4.DeleteDNATRule(rule)
-}
-
 // UpdateSet updates the set with the given prefixes
 func (m *Manager) UpdateSet(set firewall.Set, prefixes []netip.Prefix) error {
 	m.mutex.Lock()
diff --git a/client/firewall/iptables/manager_linux_test.go b/client/firewall/iptables/manager_linux_test.go
index 9f53352e1..8435bf6a5 100644
--- a/client/firewall/iptables/manager_linux_test.go
+++ b/client/firewall/iptables/manager_linux_test.go
@@ -497,16 +497,6 @@ func TestIptablesCloseRemovesAllState(t *testing.T) {
 	require.NoError(t, manager.AddNatRule(pair), "add nat rule")
 	require.NoError(t, manager.EnableRouting(), "enable routing")
 
-	// A DNAT redirect, which also holds a forwarding reference.
-	dnat := fw.ForwardRule{
-		Protocol:          fw.ProtocolTCP,
-		DestinationPort:   fw.Port{Values: []uint16{8080}},
-		TranslatedAddress: netip.MustParseAddr("10.20.0.44"),
-		TranslatedPort:    fw.Port{Values: []uint16{80}},
-	}
-	_, err = manager.AddDNATRule(dnat)
-	require.NoError(t, err, "add dnat rule")
-
 	require.NotEqual(t, before, snapshotIptables(t, ipv4Client), "the manager must have installed state")
 
 	// Everything above stays in place, so Close is what has to remove it.
diff --git a/client/firewall/manager/firewall.go b/client/firewall/manager/firewall.go
index 0eb376875..f8de1e2b5 100644
--- a/client/firewall/manager/firewall.go
+++ b/client/firewall/manager/firewall.go
@@ -172,12 +172,6 @@ type Manager interface {
 
 	DisableRouting() error
 
-	// AddDNATRule adds outbound DNAT rule for forwarding external traffic to the NetBird network.
-	AddDNATRule(ForwardRule) (Rule, error)
-
-	// DeleteDNATRule deletes the outbound DNAT rule.
-	DeleteDNATRule(Rule) error
-
 	// UpdateSet updates the set with the given prefixes
 	UpdateSet(hash Set, prefixes []netip.Prefix) error
 
diff --git a/client/firewall/manager/forward_rule.go b/client/firewall/manager/forward_rule.go
deleted file mode 100644
index c2e9e5c60..000000000
--- a/client/firewall/manager/forward_rule.go
+++ /dev/null
@@ -1,27 +0,0 @@
-package manager
-
-import (
-	"fmt"
-	"net/netip"
-)
-
-// ForwardRule todo figure out better place to this to avoid circular imports
-type ForwardRule struct {
-	Protocol          Protocol
-	DestinationPort   Port
-	TranslatedAddress netip.Addr
-	TranslatedPort    Port
-}
-
-func (r ForwardRule) ID() RuleID {
-	id := fmt.Sprintf("%s;%s;%s;%s",
-		r.Protocol,
-		r.DestinationPort.String(),
-		r.TranslatedAddress.String(),
-		r.TranslatedPort.String())
-	return RuleID(id)
-}
-
-func (r ForwardRule) String() string {
-	return fmt.Sprintf("protocol: %s, destinationPort: %s, translatedAddress: %s, translatedPort: %s", r.Protocol, r.DestinationPort.String(), r.TranslatedAddress.String(), r.TranslatedPort.String())
-}
diff --git a/client/firewall/nftables/dnat_linux.go b/client/firewall/nftables/dnat_linux.go
index 8eae694a2..c179d60cc 100644
--- a/client/firewall/nftables/dnat_linux.go
+++ b/client/firewall/nftables/dnat_linux.go
@@ -9,332 +9,11 @@ import (
 	"github.com/google/nftables"
 	"github.com/google/nftables/binaryutil"
 	"github.com/google/nftables/expr"
-	"github.com/google/nftables/xt"
-	"github.com/hashicorp/go-multierror"
 	log "github.com/sirupsen/logrus"
 
-	nberrors "github.com/netbirdio/netbird/client/errors"
 	firewall "github.com/netbirdio/netbird/client/firewall/manager"
 )
 
-func (r *family) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error) {
-	ruleID := rule.ID()
-	if _, exists := r.rules[ruleID+dnatSuffix]; exists {
-		return rule, nil
-	}
-
-	protoNum, err := r.af.protoNum(rule.Protocol)
-	if err != nil {
-		return nil, fmt.Errorf("convert protocol to number: %w", err)
-	}
-
-	// Request forwarding before queueing rules: addDnatRedirect/addDnatMasq
-	// buffer netlink messages on r.conn that the next caller's Flush would
-	// commit if we returned without flushing them ourselves.
-	if err := r.ipFwdState.RequestForwarding(r.isV6()); err != nil {
-		return nil, fmt.Errorf("enable forwarding: %w", err)
-	}
-
-	if err := r.addDnatRedirect(rule, protoNum, ruleID); err != nil {
-		r.releaseForwarding()
-		return nil, err
-	}
-
-	if err := r.addDnatMasq(rule, protoNum, ruleID); err != nil {
-		r.releaseForwarding()
-		delete(r.rules, ruleID+dnatSuffix)
-		return nil, err
-	}
-
-	// Unlike iptables, there's no point in adding "out" rules in the forward chain here as our policy is ACCEPT.
-	// To overcome DROP policies in other chains, we'd have to add rules to the chains there.
-	// We also cannot just add "oif <iface> accept" there and filter in our own table as we don't know what is supposed to be allowed.
-	// TODO: find chains with drop policies and add rules there
-
-	if err := r.conn.Flush(); err != nil {
-		r.releaseForwarding()
-		delete(r.rules, ruleID+dnatSuffix)
-		delete(r.rules, ruleID+snatSuffix)
-		return nil, fmt.Errorf("flush rules: %w", err)
-	}
-
-	return &rule, nil
-}
-
-func (r *family) addDnatRedirect(rule firewall.ForwardRule, protoNum uint8, ruleID firewall.RuleID) error {
-	dnatExprs := []expr.Any{
-		&expr.Meta{Key: expr.MetaKeyIIFNAME, Register: 1},
-		&expr.Cmp{
-			Op:       expr.CmpOpNeq,
-			Register: 1,
-			Data:     ifname(r.wgIface.Name()),
-		},
-		&expr.Meta{Key: expr.MetaKeyL4PROTO, Register: 1},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 1,
-			Data:     []byte{protoNum},
-		},
-		&expr.Payload{
-			DestRegister: 1,
-			Base:         expr.PayloadBaseTransportHeader,
-			Offset:       2,
-			Len:          2,
-		},
-	}
-	portExprs, err := r.applyPort(&rule.DestinationPort, false)
-	if err != nil {
-		return fmt.Errorf("apply destination port: %w", err)
-	}
-	dnatExprs = append(dnatExprs, portExprs...)
-
-	// shifted translated port is not supported in nftables, so we hand this over to xtables
-	if rule.TranslatedPort.IsRange && len(rule.TranslatedPort.Values) == 2 {
-		if rule.TranslatedPort.Values[0] != rule.DestinationPort.Values[0] ||
-			rule.TranslatedPort.Values[1] != rule.DestinationPort.Values[1] {
-			return r.addXTablesRedirect(dnatExprs, ruleID, rule)
-		}
-	}
-
-	additionalExprs, regProtoMin, regProtoMax, err := r.handleTranslatedPort(rule)
-	if err != nil {
-		return err
-	}
-	dnatExprs = append(dnatExprs, additionalExprs...)
-
-	dnatExprs = append(dnatExprs,
-		&expr.NAT{
-			Type:        expr.NATTypeDestNAT,
-			Family:      uint32(r.af.tableFamily),
-			RegAddrMin:  1,
-			RegProtoMin: regProtoMin,
-			RegProtoMax: regProtoMax,
-		},
-	)
-
-	dnatRule := &nftables.Rule{
-		Table:    r.workTable,
-		Chain:    r.chains[chainNameRoutingRdr],
-		Exprs:    dnatExprs,
-		UserData: []byte(ruleID + dnatSuffix),
-	}
-	r.conn.AddRule(dnatRule)
-	r.rules[ruleID+dnatSuffix] = dnatRule
-
-	return nil
-}
-
-func (r *family) handleTranslatedPort(rule firewall.ForwardRule) ([]expr.Any, uint32, uint32, error) {
-	switch {
-	case rule.TranslatedPort.IsRange && len(rule.TranslatedPort.Values) == 2:
-		return r.handlePortRange(rule)
-	case len(rule.TranslatedPort.Values) == 0:
-		return r.handleAddressOnly(rule)
-	case len(rule.TranslatedPort.Values) == 1:
-		return r.handleSinglePort(rule)
-	default:
-		return nil, 0, 0, fmt.Errorf("invalid translated port: %v", rule.TranslatedPort)
-	}
-}
-
-func (r *family) handlePortRange(rule firewall.ForwardRule) ([]expr.Any, uint32, uint32, error) {
-	exprs := []expr.Any{
-		&expr.Immediate{
-			Register: 1,
-			Data:     rule.TranslatedAddress.AsSlice(),
-		},
-		&expr.Immediate{
-			Register: 2,
-			Data:     binaryutil.BigEndian.PutUint16(rule.TranslatedPort.Values[0]),
-		},
-		&expr.Immediate{
-			Register: 3,
-			Data:     binaryutil.BigEndian.PutUint16(rule.TranslatedPort.Values[1]),
-		},
-	}
-	return exprs, 2, 3, nil
-}
-
-func (r *family) handleAddressOnly(rule firewall.ForwardRule) ([]expr.Any, uint32, uint32, error) {
-	exprs := []expr.Any{
-		&expr.Immediate{
-			Register: 1,
-			Data:     rule.TranslatedAddress.AsSlice(),
-		},
-	}
-	return exprs, 0, 0, nil
-}
-
-func (r *family) handleSinglePort(rule firewall.ForwardRule) ([]expr.Any, uint32, uint32, error) {
-	exprs := []expr.Any{
-		&expr.Immediate{
-			Register: 1,
-			Data:     rule.TranslatedAddress.AsSlice(),
-		},
-		&expr.Immediate{
-			Register: 2,
-			Data:     binaryutil.BigEndian.PutUint16(rule.TranslatedPort.Values[0]),
-		},
-	}
-	return exprs, 2, 0, nil
-}
-
-func (r *family) addXTablesRedirect(dnatExprs []expr.Any, ruleID firewall.RuleID, rule firewall.ForwardRule) error {
-	dnatExprs = append(dnatExprs,
-		&expr.Counter{},
-		&expr.Target{
-			Name: "DNAT",
-			Rev:  2,
-			Info: &xt.NatRange2{
-				NatRange: xt.NatRange{
-					Flags:   uint(xt.NatRangeMapIPs | xt.NatRangeProtoSpecified | xt.NatRangeProtoOffset),
-					MinIP:   rule.TranslatedAddress.AsSlice(),
-					MaxIP:   rule.TranslatedAddress.AsSlice(),
-					MinPort: rule.TranslatedPort.Values[0],
-					MaxPort: rule.TranslatedPort.Values[1],
-				},
-				BasePort: rule.DestinationPort.Values[0],
-			},
-		},
-	)
-
-	natTable := &nftables.Table{
-		Name:   tableNat,
-		Family: r.af.tableFamily,
-	}
-	dnatRule := &nftables.Rule{
-		Table: natTable,
-		Chain: &nftables.Chain{
-			Name:     chainNameNatPrerouting,
-			Table:    natTable,
-			Type:     nftables.ChainTypeNAT,
-			Hooknum:  nftables.ChainHookPrerouting,
-			Priority: nftables.ChainPriorityNATDest,
-		},
-		Exprs:    dnatExprs,
-		UserData: []byte(ruleID + dnatSuffix),
-	}
-	r.conn.AddRule(dnatRule)
-	r.rules[ruleID+dnatSuffix] = dnatRule
-
-	return nil
-}
-
-func (r *family) addDnatMasq(rule firewall.ForwardRule, protoNum uint8, ruleID firewall.RuleID) error {
-	portExprs, err := r.applyPort(&rule.TranslatedPort, false)
-	if err != nil {
-		return fmt.Errorf("apply translated port: %w", err)
-	}
-
-	masqExprs := []expr.Any{
-		&expr.Meta{Key: expr.MetaKeyOIFNAME, Register: 1},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 1,
-			Data:     ifname(r.wgIface.Name()),
-		},
-		&expr.Meta{Key: expr.MetaKeyL4PROTO, Register: 1},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 1,
-			Data:     []byte{protoNum},
-		},
-		&expr.Payload{
-			DestRegister: 1,
-			Base:         expr.PayloadBaseNetworkHeader,
-			Offset:       r.af.dstAddrOffset,
-			Len:          r.af.addrLen,
-		},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 1,
-			Data:     rule.TranslatedAddress.AsSlice(),
-		},
-	}
-
-	masqExprs = append(masqExprs, portExprs...)
-	masqExprs = append(masqExprs, &expr.Masq{})
-
-	masqRule := &nftables.Rule{
-		Table:    r.workTable,
-		Chain:    r.chains[chainNameRoutingNat],
-		Exprs:    masqExprs,
-		UserData: []byte(ruleID + snatSuffix),
-	}
-	r.conn.AddRule(masqRule)
-	r.rules[ruleID+snatSuffix] = masqRule
-
-	return nil
-}
-
-func (r *family) DeleteDNATRule(rule firewall.Rule) error {
-	ruleID := rule.ID()
-
-	if err := r.refreshRulesMap(); err != nil {
-		return fmt.Errorf(refreshRulesMapError, err)
-	}
-
-	var merr *multierror.Error
-	var needsFlush bool
-	var found bool
-
-	if dnatRule, exists := r.rules[ruleID+dnatSuffix]; exists {
-		found = true
-		if dnatRule.Handle == 0 {
-			log.Warnf("dnat rule %s has no handle, removing stale entry", ruleID+dnatSuffix)
-			delete(r.rules, ruleID+dnatSuffix)
-		} else if err := r.conn.DelRule(dnatRule); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("delete dnat rule: %w", err))
-		} else {
-			needsFlush = true
-		}
-	}
-
-	if masqRule, exists := r.rules[ruleID+snatSuffix]; exists {
-		found = true
-		if masqRule.Handle == 0 {
-			log.Warnf("snat rule %s has no handle, removing stale entry", ruleID+snatSuffix)
-			delete(r.rules, ruleID+snatSuffix)
-		} else if err := r.conn.DelRule(masqRule); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("delete snat rule: %w", err))
-		} else {
-			needsFlush = true
-		}
-	}
-
-	if needsFlush {
-		if err := r.conn.Flush(); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf(flushError, err))
-		}
-	}
-
-	if merr != nil {
-		return nberrors.FormatErrorOrNil(merr)
-	}
-
-	delete(r.rules, ruleID+dnatSuffix)
-	delete(r.rules, ruleID+snatSuffix)
-
-	// Release once, only if the rule was present and removed.
-	if found {
-		r.releaseForwarding()
-	}
-
-	return nil
-}
-
-// releaseForwarding drops one IP forwarding reference, logging any error.
-func (r *family) releaseForwarding() {
-	if err := r.ipFwdState.ReleaseForwarding(r.isV6()); err != nil {
-		log.Errorf("release IP forwarding: %v", err)
-	}
-}
-
-// isV6 reports whether this family handles the IPv6 table.
-func (r *family) isV6() bool {
-	return r.af.tableFamily == nftables.TableFamilyIPv6
-}
-
 func (r *family) AddInboundDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error {
 	ruleID := firewall.RuleID(fmt.Sprintf("inbound-dnat-%s-%s-%d-%d", localAddr.String(), protocol, originalPort, translatedPort))
 
diff --git a/client/firewall/nftables/dnat_refcount_linux_test.go b/client/firewall/nftables/dnat_refcount_linux_test.go
deleted file mode 100644
index cdc24e77f..000000000
--- a/client/firewall/nftables/dnat_refcount_linux_test.go
+++ /dev/null
@@ -1,249 +0,0 @@
-//go:build privileged
-
-package nftables
-
-import (
-	"net/netip"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	fw "github.com/netbirdio/netbird/client/firewall/manager"
-	"github.com/netbirdio/netbird/client/iface"
-	"github.com/netbirdio/netbird/client/iface/wgaddr"
-)
-
-func nftRefcountIfaceV4() *iFaceMock {
-	return &iFaceMock{
-		NameFunc: func() string { return "wt-refcount" },
-		AddressFunc: func() wgaddr.Address {
-			return wgaddr.Address{
-				IP:      netip.MustParseAddr("100.96.0.1"),
-				Network: netip.MustParsePrefix("100.96.0.0/16"),
-			}
-		},
-	}
-}
-
-func nftRefcountIfaceDual() *iFaceMock {
-	return &iFaceMock{
-		NameFunc: func() string { return "wt-refcount" },
-		AddressFunc: func() wgaddr.Address {
-			return wgaddr.Address{
-				IP:      netip.MustParseAddr("100.96.0.1"),
-				Network: netip.MustParsePrefix("100.96.0.0/16"),
-				IPv6:    netip.MustParseAddr("fd00::1"),
-				IPv6Net: netip.MustParsePrefix("fd00::/64"),
-			}
-		},
-	}
-}
-
-func newNftRefcountManager(t *testing.T, dual bool) *Manager {
-	t.Helper()
-	if check() != NFTABLES {
-		t.Skip("nftables not supported on this system")
-	}
-	var ifMock *iFaceMock
-	if dual {
-		ifMock = nftRefcountIfaceDual()
-	} else {
-		ifMock = nftRefcountIfaceV4()
-	}
-	m, err := Create(ifMock, iface.DefaultMTU)
-	require.NoError(t, err, "create manager")
-	require.NoError(t, m.Init(nil), "init manager")
-	t.Cleanup(func() {
-		require.NoError(t, m.Close(nil), "close manager")
-	})
-	return m
-}
-
-func dnatV4(port uint16) fw.ForwardRule {
-	return fw.ForwardRule{
-		Protocol:          fw.ProtocolTCP,
-		DestinationPort:   fw.Port{Values: []uint16{port}},
-		TranslatedAddress: netip.MustParseAddr("100.96.0.2"),
-		TranslatedPort:    fw.Port{Values: []uint16{80}},
-	}
-}
-
-func dnatV6(port uint16) fw.ForwardRule {
-	return fw.ForwardRule{
-		Protocol:          fw.ProtocolTCP,
-		DestinationPort:   fw.Port{Values: []uint16{port}},
-		TranslatedAddress: netip.MustParseAddr("fd00::2"),
-		TranslatedPort:    fw.Port{Values: []uint16{80}},
-	}
-}
-
-// TestNftablesDNAT_RefcountBalancedV4 verifies that Add/Delete pairs leave the
-// v4 refcount at zero.
-func TestNftablesDNAT_RefcountBalancedV4(t *testing.T) {
-	m := newNftRefcountManager(t, false)
-	state := m.family4.ipFwdState
-
-	r1, err := m.AddDNATRule(dnatV4(8081))
-	require.NoError(t, err, "add v4 dnat 1")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 1, v4, "v4 refcount after first add")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-
-	r2, err := m.AddDNATRule(dnatV4(8082))
-	require.NoError(t, err, "add v4 dnat 2")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 2, v4, "v4 refcount after second add")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-
-	require.NoError(t, m.DeleteDNATRule(r1), "delete v4 dnat 1")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 1, v4, "v4 refcount after first delete")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-
-	require.NoError(t, m.DeleteDNATRule(r2), "delete v4 dnat 2")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount after second delete")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-}
-
-// TestNftablesDNAT_RefcountBalancedV6 verifies the v6 path increments v6 only
-// and decrements back to zero on Delete.
-func TestNftablesDNAT_RefcountBalancedV6(t *testing.T) {
-	m := newNftRefcountManager(t, true)
-	require.NotNil(t, m.family6, "v6 family")
-	require.Same(t, m.family4.ipFwdState, m.family6.ipFwdState, "shared state")
-	state := m.family4.ipFwdState
-
-	r1, err := m.AddDNATRule(dnatV6(9091))
-	require.NoError(t, err, "add v6 dnat 1")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount unchanged")
-	assert.Equal(t, 1, v6, "v6 refcount after first add")
-
-	r2, err := m.AddDNATRule(dnatV6(9092))
-	require.NoError(t, err, "add v6 dnat 2")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 2, v6, "v6 refcount after second add")
-
-	require.NoError(t, m.DeleteDNATRule(r1), "delete v6 dnat 1")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount unchanged")
-	assert.Equal(t, 1, v6, "v6 refcount after first delete")
-
-	require.NoError(t, m.DeleteDNATRule(r2), "delete v6 dnat 2")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 0, v6, "v6 refcount after second delete")
-}
-
-// TestNftablesDNAT_DuplicateAddNoLeak verifies that a duplicate Add (same
-// ForwardRule) does not double-increment the refcount.
-func TestNftablesDNAT_DuplicateAddNoLeak(t *testing.T) {
-	m := newNftRefcountManager(t, true)
-	state := m.family4.ipFwdState
-
-	rule := dnatV4(8083)
-	r1, err := m.AddDNATRule(rule)
-	require.NoError(t, err, "add v4 dnat")
-	v4, _ := state.Counts()
-	assert.Equal(t, 1, v4)
-
-	// duplicate add: same rule ID, must be a no-op for the refcount.
-	_, err = m.AddDNATRule(rule)
-	require.NoError(t, err, "duplicate add")
-	v4, _ = state.Counts()
-	assert.Equal(t, 1, v4, "duplicate add must not increment")
-
-	require.NoError(t, m.DeleteDNATRule(r1), "delete v4 dnat")
-	v4, _ = state.Counts()
-	assert.Equal(t, 0, v4, "single delete must drop to zero")
-}
-
-// TestNftablesDNAT_DeleteMissingNoUnderflow verifies deleting a rule that was
-// never added does not underflow the refcount.
-func TestNftablesDNAT_DeleteMissingNoUnderflow(t *testing.T) {
-	m := newNftRefcountManager(t, true)
-	state := m.family4.ipFwdState
-
-	// Construct a Rule reference for something never added. The router stores
-	// rules by ID(), and DeleteDNATRule looks them up in r.rules; a missing
-	// entry must be a no-op rather than calling Release.
-	phantom := dnatV4(8099)
-	require.NoError(t, m.DeleteDNATRule(&phantom), "delete missing v4 dnat")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount unaffected by missing delete")
-	assert.Equal(t, 0, v6, "v6 refcount unaffected")
-
-	phantom6 := dnatV6(9099)
-	require.NoError(t, m.DeleteDNATRule(&phantom6), "delete missing v6 dnat")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 0, v6, "v6 refcount unaffected by missing delete")
-
-	// And after a phantom delete, a real add still results in count=1.
-	r1, err := m.AddDNATRule(dnatV4(8100))
-	require.NoError(t, err, "add v4 dnat after phantom delete")
-	v4, _ = state.Counts()
-	assert.Equal(t, 1, v4, "real add still increments after phantom delete")
-	require.NoError(t, m.DeleteDNATRule(r1))
-}
-
-// TestNftablesRouting_RepeatedEnableSingleReference verifies that EnableRouting
-// (called on every network-map update) holds at most one reference per family
-// and a single DisableRouting drops both back to zero.
-func TestNftablesRouting_RepeatedEnableSingleReference(t *testing.T) {
-	m := newNftRefcountManager(t, true)
-	state := m.family4.ipFwdState
-
-	require.NoError(t, m.EnableRouting(), "first enable")
-	require.NoError(t, m.EnableRouting(), "second enable")
-	require.NoError(t, m.EnableRouting(), "third enable")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 1, v4, "repeated enable holds a single v4 reference")
-	assert.Equal(t, 1, v6, "repeated enable holds a single v6 reference")
-
-	require.NoError(t, m.DisableRouting(), "disable")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "single disable releases the v4 reference")
-	assert.Equal(t, 0, v6, "single disable releases the v6 reference")
-}
-
-// TestNftablesRouting_DisableKeepsDNATReference verifies that an unpaired
-// DisableRouting does not release references held by active DNAT rules.
-func TestNftablesRouting_DisableKeepsDNATReference(t *testing.T) {
-	m := newNftRefcountManager(t, true)
-	state := m.family4.ipFwdState
-
-	r1, err := m.AddDNATRule(dnatV6(9095))
-	require.NoError(t, err, "add v6 dnat")
-
-	require.NoError(t, m.DisableRouting(), "unpaired disable")
-	_, v6 := state.Counts()
-	assert.Equal(t, 1, v6, "DNAT-held reference survives unpaired DisableRouting")
-
-	require.NoError(t, m.DeleteDNATRule(r1), "delete v6 dnat")
-	_, v6 = state.Counts()
-	assert.Equal(t, 0, v6, "delete releases the DNAT reference")
-}
-
-// TestNftablesDNAT_DoubleDeleteNoUnderflow verifies that deleting the same rule
-// twice does not underflow the refcount (the second delete is a no-op).
-func TestNftablesDNAT_DoubleDeleteNoUnderflow(t *testing.T) {
-	m := newNftRefcountManager(t, true)
-	state := m.family4.ipFwdState
-
-	r1, err := m.AddDNATRule(dnatV6(9093))
-	require.NoError(t, err)
-	_, v6 := state.Counts()
-	assert.Equal(t, 1, v6)
-
-	require.NoError(t, m.DeleteDNATRule(r1), "first delete")
-	_, v6 = state.Counts()
-	assert.Equal(t, 0, v6)
-
-	require.NoError(t, m.DeleteDNATRule(r1), "second delete must be no-op")
-	_, v6 = state.Counts()
-	assert.Equal(t, 0, v6, "double delete must not underflow")
-}
diff --git a/client/firewall/nftables/family_linux.go b/client/firewall/nftables/family_linux.go
index 7a5df3ed7..4169c9d2d 100644
--- a/client/firewall/nftables/family_linux.go
+++ b/client/firewall/nftables/family_linux.go
@@ -24,7 +24,6 @@ const (
 	tableRaw      = "raw"
 	tableSecurity = "security"
 
-	chainNameNatPrerouting = "PREROUTING"
 	chainNameRoutingFw     = "netbird-rt-fwd"
 	chainNameRoutingNat    = "netbird-rt-postrouting"
 	chainNameRoutingRdr    = "netbird-rt-redirect"
@@ -47,9 +46,6 @@ const (
 	userDataAcceptForwardRuleOif = "frwacceptoif"
 	userDataAcceptInputRule      = "inputaccept"
 
-	dnatSuffix firewall.RuleID = "_dnat"
-	snatSuffix firewall.RuleID = "_snat"
-
 	// ipv4TCPHeaderSize is the minimum IPv4 (20) + TCP (20) header size for MSS calculation.
 	ipv4TCPHeaderSize = 40
 	// ipv6TCPHeaderSize is the minimum IPv6 (40) + TCP (20) header size for MSS calculation.
@@ -167,10 +163,6 @@ func (r *family) Reset() error {
 		merr = multierror.Append(merr, err)
 	}
 
-	if err := r.removeNatPreroutingRules(); err != nil {
-		merr = multierror.Append(merr, fmt.Errorf("remove filter prerouting rules: %w", err))
-	}
-
 	return nberrors.FormatErrorOrNil(merr)
 }
 
diff --git a/client/firewall/nftables/filter_linux.go b/client/firewall/nftables/filter_linux.go
index ebd238063..bb3ac1dfe 100644
--- a/client/firewall/nftables/filter_linux.go
+++ b/client/firewall/nftables/filter_linux.go
@@ -197,11 +197,6 @@ func (r *family) hasRule(id firewall.RuleID) bool {
 	return ok
 }
 
-func (r *family) hasDNATRule(id firewall.RuleID) bool {
-	_, ok := r.rules[id+dnatSuffix]
-	return ok
-}
-
 // DeleteFilterRule removes a previously installed filter rule. Source
 // set references are recovered from the stored rule's expressions via
 // findSets and dropped from the shared refcounter.
diff --git a/client/firewall/nftables/manager_linux.go b/client/firewall/nftables/manager_linux.go
index 87651761f..75405e213 100644
--- a/client/firewall/nftables/manager_linux.go
+++ b/client/firewall/nftables/manager_linux.go
@@ -252,7 +252,7 @@ func (m *Manager) DeleteFilterRule(rule firewall.Rule) error {
 	m.mutex.Lock()
 	defer m.mutex.Unlock()
 
-	fam, err := m.familyForRuleID(rule.ID(), (*family).hasRule, false)
+	fam, err := m.familyForRuleID(rule.ID(), (*family).hasRule)
 	if err != nil {
 		return err
 	}
@@ -260,11 +260,8 @@ func (m *Manager) DeleteFilterRule(rule firewall.Rule) error {
 }
 
 // familyForRuleID picks the family holding the rule with the given id, using
-// the supplied lookup. With refresh set, a miss in both cached maps reloads
-// the NAT/DNAT rule maps from the kernel once and re-checks before falling
-// back to the v4 family. Filter rules are tracked only in memory and have no
-// kernel-backed reload, so their callers pass refresh as false.
-func (m *Manager) familyForRuleID(id firewall.RuleID, has func(*family, firewall.RuleID) bool, refresh bool) (*family, error) {
+// the supplied lookup, and falls back to the v4 family on a miss.
+func (m *Manager) familyForRuleID(id firewall.RuleID, has func(*family, firewall.RuleID) bool) (*family, error) {
 	if has(m.family4, id) {
 		return m.family4, nil
 	}
@@ -274,18 +271,6 @@ func (m *Manager) familyForRuleID(id firewall.RuleID, has func(*family, firewall
 	if has(m.family6, id) {
 		return m.family6, nil
 	}
-	if !refresh {
-		return m.family4, nil
-	}
-	if err := m.family4.refreshRulesMap(); err != nil {
-		return nil, fmt.Errorf("refresh v4 rules: %w", err)
-	}
-	if err := m.family6.refreshRulesMap(); err != nil {
-		return nil, fmt.Errorf("refresh v6 rules: %w", err)
-	}
-	if has(m.family6, id) && !has(m.family4, id) {
-		return m.family6, nil
-	}
 	return m.family4, nil
 }
 
@@ -450,32 +435,6 @@ func (m *Manager) Flush() error {
 	return nil
 }
 
-// AddDNATRule adds a DNAT rule
-func (m *Manager) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error) {
-	m.mutex.Lock()
-	defer m.mutex.Unlock()
-
-	if rule.TranslatedAddress.Is6() {
-		if !m.hasIPv6() {
-			return nil, fmt.Errorf("add DNAT rule: %w", firewall.ErrIPv6NotInitialized)
-		}
-		return m.family6.AddDNATRule(rule)
-	}
-	return m.family4.AddDNATRule(rule)
-}
-
-// DeleteDNATRule deletes a DNAT rule
-func (m *Manager) DeleteDNATRule(rule firewall.Rule) error {
-	m.mutex.Lock()
-	defer m.mutex.Unlock()
-
-	r, err := m.familyForRuleID(rule.ID(), (*family).hasDNATRule, true)
-	if err != nil {
-		return err
-	}
-	return r.DeleteDNATRule(rule)
-}
-
 // UpdateSet updates the set with the given prefixes
 func (m *Manager) UpdateSet(set firewall.Set, prefixes []netip.Prefix) error {
 	m.mutex.Lock()
diff --git a/client/firewall/nftables/manager_linux_test.go b/client/firewall/nftables/manager_linux_test.go
index 0ca56409e..4d6eec3c1 100644
--- a/client/firewall/nftables/manager_linux_test.go
+++ b/client/firewall/nftables/manager_linux_test.go
@@ -378,18 +378,6 @@ func TestNftablesManagerCompatibilityWithIptables(t *testing.T) {
 	err = manager.AddNatRule(pair)
 	require.NoError(t, err, "failed to add NAT rule")
 
-	dnatRule, err := manager.AddDNATRule(fw.ForwardRule{
-		Protocol:          fw.ProtocolTCP,
-		DestinationPort:   fw.Port{Values: []uint16{8080}},
-		TranslatedAddress: netip.MustParseAddr("100.96.0.2"),
-		TranslatedPort:    fw.Port{Values: []uint16{80}},
-	})
-	require.NoError(t, err, "failed to add DNAT rule")
-
-	t.Cleanup(func() {
-		require.NoError(t, manager.DeleteDNATRule(dnatRule), "failed to delete DNAT rule")
-	})
-
 	stdout, stderr = runIptablesSave(t)
 	verifyIptablesOutput(t, stdout, stderr)
 }
@@ -453,18 +441,6 @@ func TestNftablesManagerIPv6CompatibilityWithIp6tables(t *testing.T) {
 	})
 	require.NoError(t, err, "add v6 NAT rule")
 
-	dnatRule, err := manager.AddDNATRule(fw.ForwardRule{
-		Protocol:          fw.ProtocolTCP,
-		DestinationPort:   fw.Port{Values: []uint16{8080}},
-		TranslatedAddress: netip.MustParseAddr("fd00::2"),
-		TranslatedPort:    fw.Port{Values: []uint16{80}},
-	})
-	require.NoError(t, err, "add v6 DNAT rule")
-
-	t.Cleanup(func() {
-		require.NoError(t, manager.DeleteDNATRule(dnatRule), "delete v6 DNAT rule")
-	})
-
 	stdout, stderr := runIptablesSave(t)
 	verifyIptablesOutput(t, stdout, stderr)
 
diff --git a/client/firewall/nftables/routing_linux.go b/client/firewall/nftables/routing_linux.go
index d619c5543..e98471e8f 100644
--- a/client/firewall/nftables/routing_linux.go
+++ b/client/firewall/nftables/routing_linux.go
@@ -459,41 +459,6 @@ func (r *family) RemoveAllLegacyRouteRules() error {
 	return nberrors.FormatErrorOrNil(merr)
 }
 
-func (r *family) removeNatPreroutingRules() error {
-	table := &nftables.Table{
-		Name:   tableNat,
-		Family: r.af.tableFamily,
-	}
-	chain := &nftables.Chain{
-		Name:     chainNameNatPrerouting,
-		Table:    table,
-		Hooknum:  nftables.ChainHookPrerouting,
-		Priority: nftables.ChainPriorityNATDest,
-		Type:     nftables.ChainTypeNAT,
-	}
-	rules, err := r.conn.GetRules(table, chain)
-	if err != nil {
-		return fmt.Errorf("get rules from nat table: %w", err)
-	}
-
-	var merr *multierror.Error
-
-	// Delete rules that have our UserData suffix
-	for _, rule := range rules {
-		if len(rule.UserData) == 0 || !strings.HasSuffix(string(rule.UserData), string(dnatSuffix)) {
-			continue
-		}
-		if err := r.conn.DelRule(rule); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("delete rule %s: %w", rule.UserData, err))
-		}
-	}
-
-	if err := r.conn.Flush(); err != nil {
-		merr = multierror.Append(merr, fmt.Errorf(flushError, err))
-	}
-	return nberrors.FormatErrorOrNil(merr)
-}
-
 func (r *family) RemoveNatRule(pair firewall.RouterPair) error {
 	if err := r.refreshRulesMap(); err != nil {
 		return fmt.Errorf(refreshRulesMapError, err)
diff --git a/client/firewall/uspfilter/nat.go b/client/firewall/uspfilter/nat.go
index 06312aabf..49c26766a 100644
--- a/client/firewall/uspfilter/nat.go
+++ b/client/firewall/uspfilter/nat.go
@@ -486,16 +486,6 @@ func incrementalUpdate(oldChecksum uint16, oldBytes, newBytes []byte) uint16 {
 	return ^uint16(sum)
 }
 
-// AddDNATRule adds outbound DNAT rule for forwarding external traffic to NetBird network.
-func (m *Manager) AddDNATRule(firewall.ForwardRule) (firewall.Rule, error) {
-	return nil, errNotSupported
-}
-
-// DeleteDNATRule deletes outbound DNAT rule.
-func (m *Manager) DeleteDNATRule(firewall.Rule) error {
-	return errNotSupported
-}
-
 // addPortRedirection adds a port redirection rule.
 func (m *Manager) addPortRedirection(targetIP netip.Addr, protocol gopacket.LayerType, originalPort, translatedPort uint16) error {
 	m.portDNATMutex.Lock()
diff --git a/client/internal/engine.go b/client/internal/engine.go
index 7e9375771..4d731cbd7 100644
--- a/client/internal/engine.go
+++ b/client/internal/engine.go
@@ -42,7 +42,6 @@ import (
 	dnsconfig "github.com/netbirdio/netbird/client/internal/dns/config"
 	"github.com/netbirdio/netbird/client/internal/dnsfwd"
 	"github.com/netbirdio/netbird/client/internal/expose"
-	"github.com/netbirdio/netbird/client/internal/ingressgw"
 	"github.com/netbirdio/netbird/client/internal/lazyconn"
 	"github.com/netbirdio/netbird/client/internal/metrics"
 	"github.com/netbirdio/netbird/client/internal/netflow"
@@ -262,11 +261,10 @@ type Engine struct {
 
 	statusRecorder *peer.Status
 
-	firewall          firewallManager.Manager
-	routeManager      routemanager.Manager
-	acl               acl.Manager
-	dnsForwardMgr     *dnsfwd.Manager
-	ingressGatewayMgr *ingressgw.Manager
+	firewall      firewallManager.Manager
+	routeManager  routemanager.Manager
+	acl           acl.Manager
+	dnsForwardMgr *dnsfwd.Manager
 
 	dnsServer dns.Server
 
@@ -448,13 +446,6 @@ func (e *Engine) stopLocked() {
 
 	e.cleanupSSHConfig()
 
-	if e.ingressGatewayMgr != nil {
-		if err := e.ingressGatewayMgr.Close(); err != nil {
-			log.Warnf("failed to cleanup forward rules: %v", err)
-		}
-		e.ingressGatewayMgr = nil
-	}
-
 	if e.srWatcher != nil {
 		e.srWatcher.Close()
 	}
@@ -1627,13 +1618,6 @@ func (e *Engine) updateNetworkMap(networkMap *mgmProto.NetworkMap) error {
 	e.updateDNSForwarder(dnsRouteFeatureFlag, fwdEntries)
 	done()
 
-	// Ingress forward rules
-	done = e.phase("forward_rules")
-	if _, err := e.updateForwardRules(networkMap.GetForwardingRules()); err != nil {
-		log.Errorf("failed to update forward rules, err: %v", err)
-	}
-	done()
-
 	log.Debugf("got peers update from Management Service, total peers to connect to = %d", len(networkMap.GetRemotePeers()))
 
 	done = e.phase("offline_peers")
@@ -2733,74 +2717,6 @@ func (e *Engine) setForwarderCapture(pc device.PacketCapture) {
 	}
 }
 
-func (e *Engine) updateForwardRules(rules []*mgmProto.ForwardingRule) ([]firewallManager.ForwardRule, error) {
-	if e.firewall == nil {
-		log.Warn("firewall is disabled, not updating forwarding rules")
-		return nil, nil
-	}
-
-	if len(rules) == 0 {
-		if e.ingressGatewayMgr == nil {
-			return nil, nil
-		}
-
-		err := e.ingressGatewayMgr.Close()
-		e.ingressGatewayMgr = nil
-		e.statusRecorder.SetIngressGwMgr(nil)
-		return nil, err
-	}
-
-	if e.ingressGatewayMgr == nil {
-		mgr := ingressgw.NewManager(e.firewall)
-		e.ingressGatewayMgr = mgr
-		e.statusRecorder.SetIngressGwMgr(mgr)
-	}
-
-	var merr *multierror.Error
-	forwardingRules := make([]firewallManager.ForwardRule, 0, len(rules))
-	for _, rule := range rules {
-		proto, err := acl.ConvertToFirewallProtocol(rule.GetProtocol())
-		if err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("failed to convert protocol '%s': %w", rule.GetProtocol(), err))
-			continue
-		}
-
-		dstPortInfo, err := convertPortInfo(rule.GetDestinationPort())
-		if err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("invalid destination port '%v': %w", rule.GetDestinationPort(), err))
-			continue
-		}
-
-		translateIP, err := convertToIP(rule.GetTranslatedAddress())
-		if err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("failed to convert translated address '%s': %w", rule.GetTranslatedAddress(), err))
-			continue
-		}
-
-		translatePort, err := convertPortInfo(rule.GetTranslatedPort())
-		if err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("invalid translate port '%v': %w", rule.GetTranslatedPort(), err))
-			continue
-		}
-
-		forwardRule := firewallManager.ForwardRule{
-			Protocol:          proto,
-			DestinationPort:   *dstPortInfo,
-			TranslatedAddress: translateIP,
-			TranslatedPort:    *translatePort,
-		}
-
-		forwardingRules = append(forwardingRules, forwardRule)
-	}
-
-	log.Infof("updating forwarding rules: %d", len(forwardingRules))
-	if err := e.ingressGatewayMgr.Update(forwardingRules); err != nil {
-		log.Errorf("failed to update forwarding rules: %v", err)
-	}
-
-	return forwardingRules, nberrors.FormatErrorOrNil(merr)
-}
-
 // toExcludedLazyPeers returns the peers that must have an always-active
 // connection: those that are not lazy by policy (the per-peer lazy state or the
 // account flag, subject to the local override).
diff --git a/client/internal/engine_privileged_test.go b/client/internal/engine_privileged_test.go
index 2db0cd5ed..4449b5788 100644
--- a/client/internal/engine_privileged_test.go
+++ b/client/internal/engine_privileged_test.go
@@ -42,7 +42,6 @@ import (
 	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/groups"
 	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator/validator"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
@@ -523,8 +522,8 @@ func startManagement(t *testing.T, dataDir, testFile string) (*grpc.Server, stri
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := server.NewAccountRequestBuffer(context.Background(), store)
-	networkMapController := controller.NewController(context.Background(), store, metrics, updateManager, requestBuffer, server.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), manager.NewEphemeralManager(store, peersManager), config, nil)
-	accountManager, err := server.BuildManager(context.Background(), config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, ia, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	networkMapController := controller.NewController(context.Background(), store, metrics, updateManager, requestBuffer, server.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", manager.NewEphemeralManager(store, peersManager), config, nil)
+	accountManager, err := server.BuildManager(context.Background(), config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, ia, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	if err != nil {
 		return nil, "", err
 	}
diff --git a/client/internal/ingressgw/manager.go b/client/internal/ingressgw/manager.go
deleted file mode 100644
index 605543d1c..000000000
--- a/client/internal/ingressgw/manager.go
+++ /dev/null
@@ -1,111 +0,0 @@
-package ingressgw
-
-import (
-	"fmt"
-	"sync"
-
-	"github.com/hashicorp/go-multierror"
-	log "github.com/sirupsen/logrus"
-
-	nberrors "github.com/netbirdio/netbird/client/errors"
-	firewall "github.com/netbirdio/netbird/client/firewall/manager"
-)
-
-type DNATFirewall interface {
-	AddDNATRule(fwdRule firewall.ForwardRule) (firewall.Rule, error)
-	DeleteDNATRule(rule firewall.Rule) error
-}
-
-type RulePair struct {
-	firewall.ForwardRule
-	firewall.Rule
-}
-
-type Manager struct {
-	dnatFirewall DNATFirewall
-
-	rules   map[firewall.RuleID]RulePair
-	rulesMu sync.Mutex
-}
-
-func NewManager(dnatFirewall DNATFirewall) *Manager {
-	return &Manager{
-		dnatFirewall: dnatFirewall,
-		rules:        make(map[firewall.RuleID]RulePair),
-	}
-}
-
-func (h *Manager) Update(forwardRules []firewall.ForwardRule) error {
-	h.rulesMu.Lock()
-	defer h.rulesMu.Unlock()
-
-	var mErr *multierror.Error
-
-	toDelete := make(map[firewall.RuleID]RulePair, len(h.rules))
-	for id, r := range h.rules {
-		toDelete[id] = r
-	}
-
-	// Process new/updated rules
-	for _, fwdRule := range forwardRules {
-		id := fwdRule.ID()
-		if _, ok := h.rules[id]; ok {
-			delete(toDelete, id)
-			continue
-		}
-
-		rule, err := h.dnatFirewall.AddDNATRule(fwdRule)
-		if err != nil {
-			mErr = multierror.Append(mErr, fmt.Errorf("add forward rule '%s': %v", fwdRule.String(), err))
-			continue
-		}
-		if rule == nil {
-			mErr = multierror.Append(mErr, fmt.Errorf("add forward rule '%s': backend returned no rule", fwdRule.String()))
-			continue
-		}
-		log.Infof("forward rule has been added '%s'", fwdRule)
-		h.rules[id] = RulePair{
-			ForwardRule: fwdRule,
-			Rule:        rule,
-		}
-	}
-
-	// Remove deleted rules
-	for id, rulePair := range toDelete {
-		if err := h.dnatFirewall.DeleteDNATRule(rulePair.Rule); err != nil {
-			mErr = multierror.Append(mErr, fmt.Errorf("failed to delete forward rule '%s': %v", rulePair.ForwardRule.String(), err))
-		}
-		log.Infof("forward rule has been deleted '%s'", rulePair.ForwardRule)
-		delete(h.rules, id)
-	}
-
-	return nberrors.FormatErrorOrNil(mErr)
-}
-
-func (h *Manager) Close() error {
-	h.rulesMu.Lock()
-	defer h.rulesMu.Unlock()
-
-	log.Infof("clean up all (%d) forward rules", len(h.rules))
-	var mErr *multierror.Error
-	for _, rule := range h.rules {
-		if err := h.dnatFirewall.DeleteDNATRule(rule.Rule); err != nil {
-			mErr = multierror.Append(mErr, fmt.Errorf("failed to delete forward rule '%s': %v", rule, err))
-		}
-	}
-
-	h.rules = make(map[firewall.RuleID]RulePair)
-	return nberrors.FormatErrorOrNil(mErr)
-}
-
-func (h *Manager) Rules() []firewall.ForwardRule {
-	h.rulesMu.Lock()
-	defer h.rulesMu.Unlock()
-
-	rules := make([]firewall.ForwardRule, 0, len(h.rules))
-	for _, rulePair := range h.rules {
-		rules = append(rules, rulePair.ForwardRule)
-	}
-
-	return rules
-}
diff --git a/client/internal/ingressgw/manager_test.go b/client/internal/ingressgw/manager_test.go
deleted file mode 100644
index 0cd40fcc4..000000000
--- a/client/internal/ingressgw/manager_test.go
+++ /dev/null
@@ -1,281 +0,0 @@
-package ingressgw
-
-import (
-	"fmt"
-	"net/netip"
-	"testing"
-
-	firewall "github.com/netbirdio/netbird/client/firewall/manager"
-)
-
-var (
-	_ firewall.Rule = (*MocFwRule)(nil)
-	_ DNATFirewall  = &MockDNATFirewall{}
-)
-
-type MocFwRule struct {
-	id firewall.RuleID
-}
-
-func (m *MocFwRule) ID() firewall.RuleID {
-	return m.id
-}
-
-type MockDNATFirewall struct {
-	throwError bool
-}
-
-func (m *MockDNATFirewall) AddDNATRule(fwdRule firewall.ForwardRule) (firewall.Rule, error) {
-	if m.throwError {
-		return nil, fmt.Errorf("moc error")
-	}
-
-	fwRule := &MocFwRule{
-		id: fwdRule.ID(),
-	}
-	return fwRule, nil
-}
-
-func (m *MockDNATFirewall) DeleteDNATRule(rule firewall.Rule) error {
-	if m.throwError {
-		return fmt.Errorf("moc error")
-	}
-	return nil
-}
-
-func (m *MockDNATFirewall) forceToThrowErrors() {
-	m.throwError = true
-}
-
-func TestManager_AddRule(t *testing.T) {
-	fw := &MockDNATFirewall{}
-	mgr := NewManager(fw)
-
-	port, _ := firewall.NewPort(8080)
-
-	updates := []firewall.ForwardRule{
-		{
-			Protocol:          firewall.ProtocolTCP,
-			DestinationPort:   *port,
-			TranslatedAddress: netip.MustParseAddr("172.16.254.1"),
-			TranslatedPort:    *port,
-		},
-		{
-			Protocol:          firewall.ProtocolUDP,
-			DestinationPort:   *port,
-			TranslatedAddress: netip.MustParseAddr("172.16.254.1"),
-			TranslatedPort:    *port,
-		}}
-
-	if err := mgr.Update(updates); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	rules := mgr.Rules()
-	if len(rules) != len(updates) {
-		t.Errorf("unexpected rules count: %d", len(rules))
-	}
-}
-
-func TestManager_UpdateRule(t *testing.T) {
-	fw := &MockDNATFirewall{}
-	mgr := NewManager(fw)
-
-	port, _ := firewall.NewPort(8080)
-	ruleTCP := firewall.ForwardRule{
-		Protocol:          firewall.ProtocolTCP,
-		DestinationPort:   *port,
-		TranslatedAddress: netip.MustParseAddr("172.16.254.1"),
-		TranslatedPort:    *port,
-	}
-
-	if err := mgr.Update([]firewall.ForwardRule{ruleTCP}); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	ruleUDP := firewall.ForwardRule{
-		Protocol:          firewall.ProtocolUDP,
-		DestinationPort:   *port,
-		TranslatedAddress: netip.MustParseAddr("172.16.254.2"),
-		TranslatedPort:    *port,
-	}
-
-	if err := mgr.Update([]firewall.ForwardRule{ruleUDP}); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	rules := mgr.Rules()
-	if len(rules) != 1 {
-		t.Errorf("unexpected rules count: %d", len(rules))
-	}
-
-	if rules[0].TranslatedAddress.String() != ruleUDP.TranslatedAddress.String() {
-		t.Errorf("unexpected rule: %v", rules[0])
-	}
-
-	if rules[0].TranslatedPort.String() != ruleUDP.TranslatedPort.String() {
-		t.Errorf("unexpected rule: %v", rules[0])
-	}
-
-	if rules[0].DestinationPort.String() != ruleUDP.DestinationPort.String() {
-		t.Errorf("unexpected rule: %v", rules[0])
-	}
-
-	if rules[0].Protocol != ruleUDP.Protocol {
-		t.Errorf("unexpected rule: %v", rules[0])
-	}
-}
-
-func TestManager_ExtendRules(t *testing.T) {
-	fw := &MockDNATFirewall{}
-	mgr := NewManager(fw)
-
-	port, _ := firewall.NewPort(8080)
-	ruleTCP := firewall.ForwardRule{
-		Protocol:          firewall.ProtocolTCP,
-		DestinationPort:   *port,
-		TranslatedAddress: netip.MustParseAddr("172.16.254.1"),
-		TranslatedPort:    *port,
-	}
-
-	ruleUDP := firewall.ForwardRule{
-		Protocol:          firewall.ProtocolUDP,
-		DestinationPort:   *port,
-		TranslatedAddress: netip.MustParseAddr("172.16.254.2"),
-		TranslatedPort:    *port,
-	}
-
-	if err := mgr.Update([]firewall.ForwardRule{ruleTCP}); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	if err := mgr.Update([]firewall.ForwardRule{ruleTCP, ruleUDP}); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	rules := mgr.Rules()
-	if len(rules) != 2 {
-		t.Errorf("unexpected rules count: %d", len(rules))
-	}
-}
-
-func TestManager_UnderlingError(t *testing.T) {
-	fw := &MockDNATFirewall{}
-	mgr := NewManager(fw)
-
-	port, _ := firewall.NewPort(8080)
-	ruleTCP := firewall.ForwardRule{
-		Protocol:          firewall.ProtocolTCP,
-		DestinationPort:   *port,
-		TranslatedAddress: netip.MustParseAddr("172.16.254.1"),
-		TranslatedPort:    *port,
-	}
-
-	ruleUDP := firewall.ForwardRule{
-		Protocol:          firewall.ProtocolUDP,
-		DestinationPort:   *port,
-		TranslatedAddress: netip.MustParseAddr("172.16.254.2"),
-		TranslatedPort:    *port,
-	}
-
-	if err := mgr.Update([]firewall.ForwardRule{ruleTCP}); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	fw.forceToThrowErrors()
-
-	if err := mgr.Update([]firewall.ForwardRule{ruleTCP, ruleUDP}); err == nil {
-		t.Errorf("expected error")
-	}
-
-	rules := mgr.Rules()
-	if len(rules) != 1 {
-		t.Errorf("unexpected rules count: %d", len(rules))
-	}
-}
-
-func TestManager_Cleanup(t *testing.T) {
-	fw := &MockDNATFirewall{}
-	mgr := NewManager(fw)
-
-	port, _ := firewall.NewPort(8080)
-	ruleTCP := firewall.ForwardRule{
-		Protocol:          firewall.ProtocolTCP,
-		DestinationPort:   *port,
-		TranslatedAddress: netip.MustParseAddr("172.16.254.1"),
-		TranslatedPort:    *port,
-	}
-
-	if err := mgr.Update([]firewall.ForwardRule{ruleTCP}); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	if err := mgr.Update([]firewall.ForwardRule{}); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	rules := mgr.Rules()
-	if len(rules) != 0 {
-		t.Errorf("unexpected rules count: %d", len(rules))
-	}
-}
-
-func TestManager_DeleteBrokenRule(t *testing.T) {
-	fw := &MockDNATFirewall{}
-
-	// force to throw errors when Add DNAT Rule
-	fw.forceToThrowErrors()
-	mgr := NewManager(fw)
-
-	port, _ := firewall.NewPort(8080)
-	ruleTCP := firewall.ForwardRule{
-		Protocol:          firewall.ProtocolTCP,
-		DestinationPort:   *port,
-		TranslatedAddress: netip.MustParseAddr("172.16.254.1"),
-		TranslatedPort:    *port,
-	}
-
-	if err := mgr.Update([]firewall.ForwardRule{ruleTCP}); err == nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	rules := mgr.Rules()
-	if len(rules) != 0 {
-		t.Errorf("unexpected rules count: %d", len(rules))
-	}
-
-	// simulate that to remove a broken rule
-	if err := mgr.Update([]firewall.ForwardRule{}); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	if err := mgr.Close(); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-}
-
-func TestManager_Close(t *testing.T) {
-	fw := &MockDNATFirewall{}
-	mgr := NewManager(fw)
-
-	port, _ := firewall.NewPort(8080)
-	ruleTCP := firewall.ForwardRule{
-		Protocol:          firewall.ProtocolTCP,
-		DestinationPort:   *port,
-		TranslatedAddress: netip.MustParseAddr("172.16.254.1"),
-		TranslatedPort:    *port,
-	}
-
-	if err := mgr.Update([]firewall.ForwardRule{ruleTCP}); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	if err := mgr.Close(); err != nil {
-		t.Errorf("unexpected error: %v", err)
-	}
-
-	rules := mgr.Rules()
-	if len(rules) != 0 {
-		t.Errorf("unexpected rules count: %d", len(rules))
-	}
-}
diff --git a/client/internal/message_convert.go b/client/internal/message_convert.go
deleted file mode 100644
index 60f19e228..000000000
--- a/client/internal/message_convert.go
+++ /dev/null
@@ -1,43 +0,0 @@
-package internal
-
-import (
-	"errors"
-	"fmt"
-	"net"
-	"net/netip"
-
-	firewallManager "github.com/netbirdio/netbird/client/firewall/manager"
-	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
-)
-
-func convertPortInfo(portInfo *mgmProto.PortInfo) (*firewallManager.Port, error) {
-	if portInfo == nil {
-		return nil, errors.New("portInfo cannot be nil")
-	}
-
-	if portInfo.GetPort() != 0 {
-		return firewallManager.NewPort(int(portInfo.GetPort()))
-	}
-
-	if portInfo.GetRange() != nil {
-		return firewallManager.NewPort(int(portInfo.GetRange().Start), int(portInfo.GetRange().End))
-	}
-
-	return nil, fmt.Errorf("invalid portInfo: %v", portInfo)
-}
-
-func convertToIP(rawIP []byte) (netip.Addr, error) {
-	if rawIP == nil {
-		return netip.Addr{}, errors.New("input bytes cannot be nil")
-	}
-
-	if len(rawIP) != net.IPv4len && len(rawIP) != net.IPv6len {
-		return netip.Addr{}, fmt.Errorf("invalid IP length: %d", len(rawIP))
-	}
-
-	if len(rawIP) == net.IPv4len {
-		return netip.AddrFrom4([4]byte(rawIP)), nil
-	}
-
-	return netip.AddrFrom16([16]byte(rawIP)), nil
-}
diff --git a/client/internal/peer/status.go b/client/internal/peer/status.go
index 826bf6fe0..6c44178e1 100644
--- a/client/internal/peer/status.go
+++ b/client/internal/peer/status.go
@@ -18,9 +18,7 @@ import (
 	"google.golang.org/protobuf/types/known/durationpb"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
-	firewall "github.com/netbirdio/netbird/client/firewall/manager"
 	"github.com/netbirdio/netbird/client/iface/configurer"
-	"github.com/netbirdio/netbird/client/internal/ingressgw"
 	"github.com/netbirdio/netbird/client/internal/relay"
 	"github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/route"
@@ -161,7 +159,6 @@ type FullStatus struct {
 	RosenpassState        RosenpassState
 	Relays                []relay.ProbeResult
 	NSGroupStates         []NSGroupState
-	NumOfForwardingRules  int
 	LazyConnectionEnabled bool
 	Events                []*proto.SystemEvent
 }
@@ -247,8 +244,6 @@ type Status struct {
 	// read it without taking mux.
 	networksRevision atomic.Uint64
 
-	ingressGwMgr *ingressgw.Manager
-
 	routeIDLookup routeIDLookup
 	wgIface       WGIfaceStatus
 }
@@ -276,12 +271,6 @@ func (d *Status) SetRelayMgr(manager *relayClient.Manager) {
 	d.relayMgr = manager
 }
 
-func (d *Status) SetIngressGwMgr(ingressGwMgr *ingressgw.Manager) {
-	d.mux.Lock()
-	defer d.mux.Unlock()
-	d.ingressGwMgr = ingressGwMgr
-}
-
 // ReplaceOfflinePeers replaces
 func (d *Status) ReplaceOfflinePeers(replacement []State) {
 	d.mux.Lock()
@@ -332,18 +321,6 @@ func (d *Status) GetPeer(peerPubKey string) (State, error) {
 	return state, nil
 }
 
-func (d *Status) PeerByIP(ip string) (string, bool) {
-	d.mux.RLock()
-	defer d.mux.RUnlock()
-
-	for _, state := range d.peers {
-		if state.IP == ip {
-			return state.FQDN, true
-		}
-	}
-	return "", false
-}
-
 // PeerStateByIP returns the full peer State for the given tunnel IP.
 // Matches against either the IPv4 (State.IP) or IPv6 (State.IPv6) tunnel
 // address so dual-stack peers are reachable on either family. Only
@@ -1163,16 +1140,6 @@ func (d *Status) GetRelayStates() []relay.ProbeResult {
 	return relayStates
 }
 
-func (d *Status) ForwardingRules() []firewall.ForwardRule {
-	d.mux.RLock()
-	defer d.mux.RUnlock()
-	if d.ingressGwMgr == nil {
-		return nil
-	}
-
-	return d.ingressGwMgr.Rules()
-}
-
 func (d *Status) GetDNSStates() []NSGroupState {
 	d.mux.RLock()
 	defer d.mux.RUnlock()
@@ -1207,7 +1174,6 @@ func (d *Status) GetFullStatus() FullStatus {
 		Relays:                d.GetRelayStates(),
 		RosenpassState:        d.GetRosenpassState(),
 		NSGroupStates:         d.GetDNSStates(),
-		NumOfForwardingRules:  len(d.ForwardingRules()),
 		LazyConnectionEnabled: d.GetLazyConnection(),
 	}
 
@@ -1579,7 +1545,6 @@ func (fs FullStatus) ToProto() *proto.FullStatus {
 	pbFullStatus.LocalPeerState.WgPort = int32(fs.LocalPeerState.WgPort)
 	pbFullStatus.LocalPeerState.RosenpassPermissive = fs.RosenpassState.Permissive
 	pbFullStatus.LocalPeerState.RosenpassEnabled = fs.RosenpassState.Enabled
-	pbFullStatus.NumberOfForwardingRules = int32(fs.NumOfForwardingRules)
 	pbFullStatus.LazyConnectionEnabled = fs.LazyConnectionEnabled
 
 	pbFullStatus.LocalPeerState.Networks = maps.Keys(fs.LocalPeerState.Routes)
diff --git a/client/internal/routemanager/ipfwdstate/ipfwdstate.go b/client/internal/routemanager/ipfwdstate/ipfwdstate.go
index 3d571e16b..22f7bd07a 100644
--- a/client/internal/routemanager/ipfwdstate/ipfwdstate.go
+++ b/client/internal/routemanager/ipfwdstate/ipfwdstate.go
@@ -19,8 +19,7 @@ type IPForwardingState struct {
 
 	// routingV4/routingV6 track whether the routing path currently holds a
 	// reference, so repeated EnableRouting calls (one per network-map update)
-	// hold at most one reference per family and an unpaired DisableRouting
-	// can't release references held by DNAT rules.
+	// hold at most one reference per family.
 	routingV4 bool
 	routingV6 bool
 
@@ -95,31 +94,6 @@ func (f *IPForwardingState) ReleaseRouting() error {
 	return nil
 }
 
-// RequestForwarding enables the family's forwarding sysctl on first request.
-func (f *IPForwardingState) RequestForwarding(v6 bool) error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-
-	if v6 {
-		return f.requestV6()
-	}
-	return f.requestV4()
-}
-
-// ReleaseForwarding decrements the family counter. The last v6 release restores
-// what enable captured. v4 stays on: net.ipv4.ip_forward is co-owned by other
-// tooling (docker, k8s, libvirt).
-func (f *IPForwardingState) ReleaseForwarding(v6 bool) error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-
-	if v6 {
-		return f.releaseV6()
-	}
-	f.releaseV4()
-	return nil
-}
-
 func (f *IPForwardingState) requestV4() error {
 	if f.v4Count == 0 {
 		if err := systemops.EnableV4IPForwarding(); err != nil {
diff --git a/client/internal/routemanager/ipfwdstate/ipfwdstate_privileged_linux_test.go b/client/internal/routemanager/ipfwdstate/ipfwdstate_privileged_linux_test.go
index b4615ff02..75209965c 100644
--- a/client/internal/routemanager/ipfwdstate/ipfwdstate_privileged_linux_test.go
+++ b/client/internal/routemanager/ipfwdstate/ipfwdstate_privileged_linux_test.go
@@ -10,8 +10,7 @@ import (
 )
 
 // TestRequestRoutingV6ToV4Transition verifies that a v4-only routing request
-// releases a previously held routing-owned v6 reference without touching
-// references held by DNAT rules.
+// releases a previously held routing-owned v6 reference.
 func TestRequestRoutingV6ToV4Transition(t *testing.T) {
 	f := NewIPForwardingState("wt-fwd-test")
 
@@ -25,13 +24,6 @@ func TestRequestRoutingV6ToV4Transition(t *testing.T) {
 	assert.Equal(t, 1, v4, "v4 reference kept")
 	assert.Equal(t, 0, v6, "routing-owned v6 reference released")
 
-	// A DNAT-held reference survives a v4-only routing request.
-	require.NoError(t, f.RequestForwarding(true), "dnat v6 reference")
-	require.NoError(t, f.RequestRouting(false), "repeat v4-only request")
-	_, v6 = f.Counts()
-	assert.Equal(t, 1, v6, "dnat-held v6 reference survives")
-	require.NoError(t, f.ReleaseForwarding(true), "release dnat v6 reference")
-
 	require.NoError(t, f.ReleaseRouting(), "release routing")
 	v4, v6 = f.Counts()
 	assert.Equal(t, 0, v4, "all v4 references released")
diff --git a/client/proto/daemon.pb.go b/client/proto/daemon.pb.go
index 7f3ce1bbf..ec0cd6258 100644
--- a/client/proto/daemon.pb.go
+++ b/client/proto/daemon.pb.go
@@ -2176,17 +2176,20 @@ func (x *SSHServerState) GetSessions() []*SSHSessionInfo {
 
 // FullStatus contains the full state held by the Status instance
 type FullStatus struct {
-	state                   protoimpl.MessageState `protogen:"open.v1"`
-	ManagementState         *ManagementState       `protobuf:"bytes,1,opt,name=managementState,proto3" json:"managementState,omitempty"`
-	SignalState             *SignalState           `protobuf:"bytes,2,opt,name=signalState,proto3" json:"signalState,omitempty"`
-	LocalPeerState          *LocalPeerState        `protobuf:"bytes,3,opt,name=localPeerState,proto3" json:"localPeerState,omitempty"`
-	Peers                   []*PeerState           `protobuf:"bytes,4,rep,name=peers,proto3" json:"peers,omitempty"`
-	Relays                  []*RelayState          `protobuf:"bytes,5,rep,name=relays,proto3" json:"relays,omitempty"`
-	DnsServers              []*NSGroupState        `protobuf:"bytes,6,rep,name=dns_servers,json=dnsServers,proto3" json:"dns_servers,omitempty"`
-	NumberOfForwardingRules int32                  `protobuf:"varint,8,opt,name=NumberOfForwardingRules,proto3" json:"NumberOfForwardingRules,omitempty"`
-	Events                  []*SystemEvent         `protobuf:"bytes,7,rep,name=events,proto3" json:"events,omitempty"`
-	LazyConnectionEnabled   bool                   `protobuf:"varint,9,opt,name=lazyConnectionEnabled,proto3" json:"lazyConnectionEnabled,omitempty"`
-	SshServerState          *SSHServerState        `protobuf:"bytes,10,opt,name=sshServerState,proto3" json:"sshServerState,omitempty"`
+	state           protoimpl.MessageState `protogen:"open.v1"`
+	ManagementState *ManagementState       `protobuf:"bytes,1,opt,name=managementState,proto3" json:"managementState,omitempty"`
+	SignalState     *SignalState           `protobuf:"bytes,2,opt,name=signalState,proto3" json:"signalState,omitempty"`
+	LocalPeerState  *LocalPeerState        `protobuf:"bytes,3,opt,name=localPeerState,proto3" json:"localPeerState,omitempty"`
+	Peers           []*PeerState           `protobuf:"bytes,4,rep,name=peers,proto3" json:"peers,omitempty"`
+	Relays          []*RelayState          `protobuf:"bytes,5,rep,name=relays,proto3" json:"relays,omitempty"`
+	DnsServers      []*NSGroupState        `protobuf:"bytes,6,rep,name=dns_servers,json=dnsServers,proto3" json:"dns_servers,omitempty"`
+	// Unused; the ingress port-forwarding feature was discontinued.
+	//
+	// Deprecated: Marked as deprecated in daemon.proto.
+	NumberOfForwardingRules int32           `protobuf:"varint,8,opt,name=NumberOfForwardingRules,proto3" json:"NumberOfForwardingRules,omitempty"`
+	Events                  []*SystemEvent  `protobuf:"bytes,7,rep,name=events,proto3" json:"events,omitempty"`
+	LazyConnectionEnabled   bool            `protobuf:"varint,9,opt,name=lazyConnectionEnabled,proto3" json:"lazyConnectionEnabled,omitempty"`
+	SshServerState          *SSHServerState `protobuf:"bytes,10,opt,name=sshServerState,proto3" json:"sshServerState,omitempty"`
 	// networksRevision bumps whenever the set of routed networks (route and
 	// exit-node candidates) or their selected state changes. The UI fingerprints
 	// on it to know when to re-fetch ListNetworks via the push stream, instead
@@ -2268,6 +2271,7 @@ func (x *FullStatus) GetDnsServers() []*NSGroupState {
 	return nil
 }
 
+// Deprecated: Marked as deprecated in daemon.proto.
 func (x *FullStatus) GetNumberOfForwardingRules() int32 {
 	if x != nil {
 		return x.NumberOfForwardingRules
@@ -2600,7 +2604,10 @@ func (x *Network) GetResolvedIPs() map[string]*IPList {
 	return nil
 }
 
-// ForwardingRules
+// PortInfo, ForwardingRule and ForwardingRulesResponse are unused; the ingress
+// port-forwarding feature was discontinued.
+//
+// Deprecated: Marked as deprecated in daemon.proto.
 type PortInfo struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// Types that are valid to be assigned to PortSelection:
@@ -2683,6 +2690,7 @@ func (*PortInfo_Port) isPortInfo_PortSelection() {}
 
 func (*PortInfo_Range_) isPortInfo_PortSelection() {}
 
+// Deprecated: Marked as deprecated in daemon.proto.
 type ForwardingRule struct {
 	state              protoimpl.MessageState `protogen:"open.v1"`
 	Protocol           string                 `protobuf:"bytes,1,opt,name=protocol,proto3" json:"protocol,omitempty"`
@@ -2759,6 +2767,7 @@ func (x *ForwardingRule) GetTranslatedPort() *PortInfo {
 	return nil
 }
 
+// Deprecated: Marked as deprecated in daemon.proto.
 type ForwardingRulesResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Rules         []*ForwardingRule      `protobuf:"bytes,1,rep,name=rules,proto3" json:"rules,omitempty"`
@@ -7303,7 +7312,7 @@ const file_daemon_proto_rawDesc = "" +
 	"\fportForwards\x18\x05 \x03(\tR\fportForwards\"^\n" +
 	"\x0eSSHServerState\x12\x18\n" +
 	"\aenabled\x18\x01 \x01(\bR\aenabled\x122\n" +
-	"\bsessions\x18\x02 \x03(\v2\x16.daemon.SSHSessionInfoR\bsessions\"\xdb\x04\n" +
+	"\bsessions\x18\x02 \x03(\v2\x16.daemon.SSHSessionInfoR\bsessions\"\xdf\x04\n" +
 	"\n" +
 	"FullStatus\x12A\n" +
 	"\x0fmanagementState\x18\x01 \x01(\v2\x17.daemon.ManagementStateR\x0fmanagementState\x125\n" +
@@ -7312,8 +7321,8 @@ const file_daemon_proto_rawDesc = "" +
 	"\x05peers\x18\x04 \x03(\v2\x11.daemon.PeerStateR\x05peers\x12*\n" +
 	"\x06relays\x18\x05 \x03(\v2\x12.daemon.RelayStateR\x06relays\x125\n" +
 	"\vdns_servers\x18\x06 \x03(\v2\x14.daemon.NSGroupStateR\n" +
-	"dnsServers\x128\n" +
-	"\x17NumberOfForwardingRules\x18\b \x01(\x05R\x17NumberOfForwardingRules\x12+\n" +
+	"dnsServers\x12<\n" +
+	"\x17NumberOfForwardingRules\x18\b \x01(\x05B\x02\x18\x01R\x17NumberOfForwardingRules\x12+\n" +
 	"\x06events\x18\a \x03(\v2\x13.daemon.SystemEventR\x06events\x124\n" +
 	"\x15lazyConnectionEnabled\x18\t \x01(\bR\x15lazyConnectionEnabled\x12>\n" +
 	"\x0esshServerState\x18\n" +
@@ -7339,22 +7348,22 @@ const file_daemon_proto_rawDesc = "" +
 	"\vresolvedIPs\x18\x05 \x03(\v2 .daemon.Network.ResolvedIPsEntryR\vresolvedIPs\x1aN\n" +
 	"\x10ResolvedIPsEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12$\n" +
-	"\x05value\x18\x02 \x01(\v2\x0e.daemon.IPListR\x05value:\x028\x01\"\x92\x01\n" +
+	"\x05value\x18\x02 \x01(\v2\x0e.daemon.IPListR\x05value:\x028\x01\"\x96\x01\n" +
 	"\bPortInfo\x12\x14\n" +
 	"\x04port\x18\x01 \x01(\rH\x00R\x04port\x12.\n" +
 	"\x05range\x18\x02 \x01(\v2\x16.daemon.PortInfo.RangeH\x00R\x05range\x1a/\n" +
 	"\x05Range\x12\x14\n" +
 	"\x05start\x18\x01 \x01(\rR\x05start\x12\x10\n" +
-	"\x03end\x18\x02 \x01(\rR\x03endB\x0f\n" +
-	"\rportSelection\"\x80\x02\n" +
+	"\x03end\x18\x02 \x01(\rR\x03end:\x02\x18\x01B\x0f\n" +
+	"\rportSelection\"\x84\x02\n" +
 	"\x0eForwardingRule\x12\x1a\n" +
 	"\bprotocol\x18\x01 \x01(\tR\bprotocol\x12:\n" +
 	"\x0fdestinationPort\x18\x02 \x01(\v2\x10.daemon.PortInfoR\x0fdestinationPort\x12,\n" +
 	"\x11translatedAddress\x18\x03 \x01(\tR\x11translatedAddress\x12.\n" +
 	"\x12translatedHostname\x18\x04 \x01(\tR\x12translatedHostname\x128\n" +
-	"\x0etranslatedPort\x18\x05 \x01(\v2\x10.daemon.PortInfoR\x0etranslatedPort\"G\n" +
+	"\x0etranslatedPort\x18\x05 \x01(\v2\x10.daemon.PortInfoR\x0etranslatedPort:\x02\x18\x01\"K\n" +
 	"\x17ForwardingRulesResponse\x12,\n" +
-	"\x05rules\x18\x01 \x03(\v2\x16.daemon.ForwardingRuleR\x05rules\"\x84\x02\n" +
+	"\x05rules\x18\x01 \x03(\v2\x16.daemon.ForwardingRuleR\x05rules:\x02\x18\x01\"\x84\x02\n" +
 	"\x12DebugBundleRequest\x12\x1c\n" +
 	"\tanonymize\x18\x01 \x01(\bR\tanonymize\x12\x1e\n" +
 	"\n" +
@@ -7705,7 +7714,7 @@ const file_daemon_proto_rawDesc = "" +
 	"\n" +
 	"EXPOSE_UDP\x10\x03\x12\x0e\n" +
 	"\n" +
-	"EXPOSE_TLS\x10\x042\xa3\x1c\n" +
+	"EXPOSE_TLS\x10\x042\xa6\x1c\n" +
 	"\rDaemonService\x126\n" +
 	"\x05Login\x12\x14.daemon.LoginRequest\x1a\x15.daemon.LoginResponse\"\x00\x12K\n" +
 	"\fWaitSSOLogin\x12\x1b.daemon.WaitSSOLoginRequest\x1a\x1c.daemon.WaitSSOLoginResponse\"\x00\x12-\n" +
@@ -7716,8 +7725,8 @@ const file_daemon_proto_rawDesc = "" +
 	"\tGetConfig\x12\x18.daemon.GetConfigRequest\x1a\x19.daemon.GetConfigResponse\"\x00\x12K\n" +
 	"\fListNetworks\x12\x1b.daemon.ListNetworksRequest\x1a\x1c.daemon.ListNetworksResponse\"\x00\x12Q\n" +
 	"\x0eSelectNetworks\x12\x1d.daemon.SelectNetworksRequest\x1a\x1e.daemon.SelectNetworksResponse\"\x00\x12S\n" +
-	"\x10DeselectNetworks\x12\x1d.daemon.SelectNetworksRequest\x1a\x1e.daemon.SelectNetworksResponse\"\x00\x12J\n" +
-	"\x0fForwardingRules\x12\x14.daemon.EmptyRequest\x1a\x1f.daemon.ForwardingRulesResponse\"\x00\x12H\n" +
+	"\x10DeselectNetworks\x12\x1d.daemon.SelectNetworksRequest\x1a\x1e.daemon.SelectNetworksResponse\"\x00\x12M\n" +
+	"\x0fForwardingRules\x12\x14.daemon.EmptyRequest\x1a\x1f.daemon.ForwardingRulesResponse\"\x03\x88\x02\x01\x12H\n" +
 	"\vDebugBundle\x12\x1a.daemon.DebugBundleRequest\x1a\x1b.daemon.DebugBundleResponse\"\x00\x12H\n" +
 	"\vGetLogLevel\x12\x1a.daemon.GetLogLevelRequest\x1a\x1b.daemon.GetLogLevelResponse\"\x00\x12H\n" +
 	"\vSetLogLevel\x12\x1a.daemon.SetLogLevelRequest\x1a\x1b.daemon.SetLogLevelResponse\"\x00\x12E\n" +
diff --git a/client/proto/daemon.proto b/client/proto/daemon.proto
index 3953f9c15..39a8ea7c6 100644
--- a/client/proto/daemon.proto
+++ b/client/proto/daemon.proto
@@ -45,7 +45,10 @@ service DaemonService {
   // Deselect specific routes
   rpc DeselectNetworks(SelectNetworksRequest) returns (SelectNetworksResponse) {}
 
-  rpc ForwardingRules(EmptyRequest) returns (ForwardingRulesResponse) {}
+  // Unused; the ingress port-forwarding feature was discontinued.
+  rpc ForwardingRules(EmptyRequest) returns (ForwardingRulesResponse) {
+    option deprecated = true;
+  }
 
   // DebugBundle creates a debug bundle
   rpc DebugBundle(DebugBundleRequest) returns (DebugBundleResponse) {}
@@ -468,7 +471,8 @@ message FullStatus {
   repeated PeerState peers = 4;
   repeated RelayState relays = 5;
   repeated NSGroupState dns_servers = 6;
-  int32 NumberOfForwardingRules = 8;
+  // Unused; the ingress port-forwarding feature was discontinued.
+  int32 NumberOfForwardingRules = 8 [deprecated = true];
 
   repeated SystemEvent events = 7;
 
@@ -511,8 +515,11 @@ message Network {
   map<string, IPList> resolvedIPs = 5;
 }
 
-// ForwardingRules
+// PortInfo, ForwardingRule and ForwardingRulesResponse are unused; the ingress
+// port-forwarding feature was discontinued.
 message PortInfo {
+  option deprecated = true;
+
   oneof portSelection {
     uint32 port = 1;
     Range range = 2;
@@ -525,6 +532,8 @@ message PortInfo {
 }
 
 message ForwardingRule {
+  option deprecated = true;
+
   string protocol = 1;
   PortInfo destinationPort = 2;
   string translatedAddress = 3;
@@ -533,10 +542,11 @@ message ForwardingRule {
 }
 
 message ForwardingRulesResponse {
+  option deprecated = true;
+
   repeated ForwardingRule rules = 1;
 }
 
-
 // DebugBundler
 message DebugBundleRequest {
   bool anonymize = 1;
diff --git a/client/proto/daemon_grpc.pb.go b/client/proto/daemon_grpc.pb.go
index 2d01d474d..c9b291e14 100644
--- a/client/proto/daemon_grpc.pb.go
+++ b/client/proto/daemon_grpc.pb.go
@@ -95,6 +95,8 @@ type DaemonServiceClient interface {
 	SelectNetworks(ctx context.Context, in *SelectNetworksRequest, opts ...grpc.CallOption) (*SelectNetworksResponse, error)
 	// Deselect specific routes
 	DeselectNetworks(ctx context.Context, in *SelectNetworksRequest, opts ...grpc.CallOption) (*SelectNetworksResponse, error)
+	// Deprecated: Do not use.
+	// Unused; the ingress port-forwarding feature was discontinued.
 	ForwardingRules(ctx context.Context, in *EmptyRequest, opts ...grpc.CallOption) (*ForwardingRulesResponse, error)
 	// DebugBundle creates a debug bundle
 	DebugBundle(ctx context.Context, in *DebugBundleRequest, opts ...grpc.CallOption) (*DebugBundleResponse, error)
@@ -290,6 +292,7 @@ func (c *daemonServiceClient) DeselectNetworks(ctx context.Context, in *SelectNe
 	return out, nil
 }
 
+// Deprecated: Do not use.
 func (c *daemonServiceClient) ForwardingRules(ctx context.Context, in *EmptyRequest, opts ...grpc.CallOption) (*ForwardingRulesResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ForwardingRulesResponse)
@@ -705,6 +708,8 @@ type DaemonServiceServer interface {
 	SelectNetworks(context.Context, *SelectNetworksRequest) (*SelectNetworksResponse, error)
 	// Deselect specific routes
 	DeselectNetworks(context.Context, *SelectNetworksRequest) (*SelectNetworksResponse, error)
+	// Deprecated: Do not use.
+	// Unused; the ingress port-forwarding feature was discontinued.
 	ForwardingRules(context.Context, *EmptyRequest) (*ForwardingRulesResponse, error)
 	// DebugBundle creates a debug bundle
 	DebugBundle(context.Context, *DebugBundleRequest) (*DebugBundleResponse, error)
diff --git a/client/server/forwardingrules.go b/client/server/forwardingrules.go
deleted file mode 100644
index 3d706c36d..000000000
--- a/client/server/forwardingrules.go
+++ /dev/null
@@ -1,54 +0,0 @@
-package server
-
-import (
-	"context"
-
-	firewall "github.com/netbirdio/netbird/client/firewall/manager"
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-func (s *Server) ForwardingRules(context.Context, *proto.EmptyRequest) (*proto.ForwardingRulesResponse, error) {
-	s.mutex.Lock()
-	defer s.mutex.Unlock()
-
-	rules := s.statusRecorder.ForwardingRules()
-	responseRules := make([]*proto.ForwardingRule, 0, len(rules))
-	for _, rule := range rules {
-		respRule := &proto.ForwardingRule{
-			Protocol:           string(rule.Protocol),
-			DestinationPort:    portToProto(rule.DestinationPort),
-			TranslatedAddress:  rule.TranslatedAddress.String(),
-			TranslatedHostname: s.hostNameByTranslateAddress(rule.TranslatedAddress.String()),
-			TranslatedPort:     portToProto(rule.TranslatedPort),
-		}
-		responseRules = append(responseRules, respRule)
-
-	}
-
-	return &proto.ForwardingRulesResponse{Rules: responseRules}, nil
-}
-
-func (s *Server) hostNameByTranslateAddress(ip string) string {
-	hostName, ok := s.statusRecorder.PeerByIP(ip)
-	if !ok {
-		return ip
-	}
-
-	return hostName
-}
-
-func portToProto(port firewall.Port) *proto.PortInfo {
-	var portInfo proto.PortInfo
-
-	if !port.IsRange {
-		portInfo.PortSelection = &proto.PortInfo_Port{Port: uint32(port.Values[0])}
-	} else {
-		portInfo.PortSelection = &proto.PortInfo_Range_{
-			Range: &proto.PortInfo_Range{
-				Start: uint32(port.Values[0]),
-				End:   uint32(port.Values[1]),
-			},
-		}
-	}
-	return &portInfo
-}
diff --git a/client/server/server_privileged_test.go b/client/server/server_privileged_test.go
index aa6e99026..bea2e8568 100644
--- a/client/server/server_privileged_test.go
+++ b/client/server/server_privileged_test.go
@@ -10,9 +10,9 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
 	"github.com/stretchr/testify/require"
 	"go.opentelemetry.io/otel"
+	"go.uber.org/mock/gomock"
 
 	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator/validator"
 
@@ -36,7 +36,6 @@ import (
 	"github.com/netbirdio/netbird/management/server"
 	"github.com/netbirdio/netbird/management/server/activity"
 	nbcache "github.com/netbirdio/netbird/management/server/cache"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
 	"github.com/netbirdio/netbird/management/server/store"
@@ -200,8 +199,8 @@ func startManagement(t *testing.T, signalAddr string, counter *int) (*grpc.Serve
 
 	requestBuffer := server.NewAccountRequestBuffer(context.Background(), store)
 	peersUpdateManager := update_channel.NewPeersUpdateManager(metrics)
-	networkMapController := controller.NewController(context.Background(), store, metrics, peersUpdateManager, requestBuffer, server.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), manager.NewEphemeralManager(store, peersManager), config, nil)
-	accountManager, err := server.BuildManager(context.Background(), config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, ia, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManagerMock, false, cacheStore)
+	networkMapController := controller.NewController(context.Background(), store, metrics, peersUpdateManager, requestBuffer, server.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", manager.NewEphemeralManager(store, peersManager), config, nil)
+	accountManager, err := server.BuildManager(context.Background(), config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, ia, metrics, settingsMockManager, permissionsManagerMock, false, cacheStore)
 	if err != nil {
 		return nil, "", err
 	}
diff --git a/client/status/status.go b/client/status/status.go
index 1c204cdb1..e0585b8f0 100644
--- a/client/status/status.go
+++ b/client/status/status.go
@@ -140,28 +140,27 @@ type SSHServerStateOutput struct {
 }
 
 type OutputOverview struct {
-	Peers                   PeersStateOutput           `json:"peers" yaml:"peers"`
-	CliVersion              string                     `json:"cliVersion" yaml:"cliVersion"`
-	DaemonVersion           string                     `json:"daemonVersion" yaml:"daemonVersion"`
-	DaemonStatus            DaemonStatus               `json:"daemonStatus" yaml:"daemonStatus"`
-	ManagementState         ManagementStateOutput      `json:"management" yaml:"management"`
-	SignalState             SignalStateOutput          `json:"signal" yaml:"signal"`
-	Relays                  RelayStateOutput           `json:"relays" yaml:"relays"`
-	IP                      string                     `json:"netbirdIp" yaml:"netbirdIp"`
-	IPv6                    string                     `json:"netbirdIpv6,omitempty" yaml:"netbirdIpv6,omitempty"`
-	PubKey                  string                     `json:"publicKey" yaml:"publicKey"`
-	KernelInterface         bool                       `json:"usesKernelInterface" yaml:"usesKernelInterface"`
-	WgPort                  int                        `json:"wireguardPort" yaml:"wireguardPort"`
-	FQDN                    string                     `json:"fqdn" yaml:"fqdn"`
-	RosenpassEnabled        bool                       `json:"quantumResistance" yaml:"quantumResistance"`
-	RosenpassPermissive     bool                       `json:"quantumResistancePermissive" yaml:"quantumResistancePermissive"`
-	Networks                []string                   `json:"networks" yaml:"networks"`
-	NumberOfForwardingRules int                        `json:"forwardingRules" yaml:"forwardingRules"`
-	NSServerGroups          []NsServerGroupStateOutput `json:"dnsServers" yaml:"dnsServers"`
-	Events                  []SystemEventOutput        `json:"events" yaml:"events"`
-	LazyConnectionEnabled   bool                       `json:"lazyConnectionEnabled" yaml:"lazyConnectionEnabled"`
-	ProfileName             string                     `json:"profileName" yaml:"profileName"`
-	SSHServerState          SSHServerStateOutput       `json:"sshServer" yaml:"sshServer"`
+	Peers                 PeersStateOutput           `json:"peers" yaml:"peers"`
+	CliVersion            string                     `json:"cliVersion" yaml:"cliVersion"`
+	DaemonVersion         string                     `json:"daemonVersion" yaml:"daemonVersion"`
+	DaemonStatus          DaemonStatus               `json:"daemonStatus" yaml:"daemonStatus"`
+	ManagementState       ManagementStateOutput      `json:"management" yaml:"management"`
+	SignalState           SignalStateOutput          `json:"signal" yaml:"signal"`
+	Relays                RelayStateOutput           `json:"relays" yaml:"relays"`
+	IP                    string                     `json:"netbirdIp" yaml:"netbirdIp"`
+	IPv6                  string                     `json:"netbirdIpv6,omitempty" yaml:"netbirdIpv6,omitempty"`
+	PubKey                string                     `json:"publicKey" yaml:"publicKey"`
+	KernelInterface       bool                       `json:"usesKernelInterface" yaml:"usesKernelInterface"`
+	WgPort                int                        `json:"wireguardPort" yaml:"wireguardPort"`
+	FQDN                  string                     `json:"fqdn" yaml:"fqdn"`
+	RosenpassEnabled      bool                       `json:"quantumResistance" yaml:"quantumResistance"`
+	RosenpassPermissive   bool                       `json:"quantumResistancePermissive" yaml:"quantumResistancePermissive"`
+	Networks              []string                   `json:"networks" yaml:"networks"`
+	NSServerGroups        []NsServerGroupStateOutput `json:"dnsServers" yaml:"dnsServers"`
+	Events                []SystemEventOutput        `json:"events" yaml:"events"`
+	LazyConnectionEnabled bool                       `json:"lazyConnectionEnabled" yaml:"lazyConnectionEnabled"`
+	ProfileName           string                     `json:"profileName" yaml:"profileName"`
+	SSHServerState        SSHServerStateOutput       `json:"sshServer" yaml:"sshServer"`
 	// SessionExpiresAt is the absolute UTC instant at which the peer's SSO
 	// session expires. nil when the peer is not SSO-tracked or login
 	// expiration is disabled. Pointer (rather than zero-value time.Time) so
@@ -190,28 +189,27 @@ func ConvertToStatusOutputOverview(pbFullStatus *proto.FullStatus, opts ConvertO
 	peersOverview := mapPeers(pbFullStatus.GetPeers(), opts.StatusFilter, opts.PrefixNamesFilter, opts.PrefixNamesFilterMap, opts.IPsFilter, opts.ConnectionTypeFilter)
 
 	overview := OutputOverview{
-		Peers:                   peersOverview,
-		CliVersion:              version.NetbirdVersion(),
-		DaemonVersion:           opts.DaemonVersion,
-		DaemonStatus:            opts.DaemonStatus,
-		ManagementState:         managementOverview,
-		SignalState:             signalOverview,
-		Relays:                  relayOverview,
-		IP:                      pbFullStatus.GetLocalPeerState().GetIP(),
-		IPv6:                    pbFullStatus.GetLocalPeerState().GetIpv6(),
-		PubKey:                  pbFullStatus.GetLocalPeerState().GetPubKey(),
-		KernelInterface:         pbFullStatus.GetLocalPeerState().GetKernelInterface(),
-		WgPort:                  int(pbFullStatus.GetLocalPeerState().GetWgPort()),
-		FQDN:                    pbFullStatus.GetLocalPeerState().GetFqdn(),
-		RosenpassEnabled:        pbFullStatus.GetLocalPeerState().GetRosenpassEnabled(),
-		RosenpassPermissive:     pbFullStatus.GetLocalPeerState().GetRosenpassPermissive(),
-		Networks:                pbFullStatus.GetLocalPeerState().GetNetworks(),
-		NumberOfForwardingRules: int(pbFullStatus.GetNumberOfForwardingRules()),
-		NSServerGroups:          mapNSGroups(pbFullStatus.GetDnsServers()),
-		Events:                  mapEvents(pbFullStatus.GetEvents()),
-		LazyConnectionEnabled:   pbFullStatus.GetLazyConnectionEnabled(),
-		ProfileName:             opts.ProfileName,
-		SSHServerState:          sshServerOverview,
+		Peers:                 peersOverview,
+		CliVersion:            version.NetbirdVersion(),
+		DaemonVersion:         opts.DaemonVersion,
+		DaemonStatus:          opts.DaemonStatus,
+		ManagementState:       managementOverview,
+		SignalState:           signalOverview,
+		Relays:                relayOverview,
+		IP:                    pbFullStatus.GetLocalPeerState().GetIP(),
+		IPv6:                  pbFullStatus.GetLocalPeerState().GetIpv6(),
+		PubKey:                pbFullStatus.GetLocalPeerState().GetPubKey(),
+		KernelInterface:       pbFullStatus.GetLocalPeerState().GetKernelInterface(),
+		WgPort:                int(pbFullStatus.GetLocalPeerState().GetWgPort()),
+		FQDN:                  pbFullStatus.GetLocalPeerState().GetFqdn(),
+		RosenpassEnabled:      pbFullStatus.GetLocalPeerState().GetRosenpassEnabled(),
+		RosenpassPermissive:   pbFullStatus.GetLocalPeerState().GetRosenpassPermissive(),
+		Networks:              pbFullStatus.GetLocalPeerState().GetNetworks(),
+		NSServerGroups:        mapNSGroups(pbFullStatus.GetDnsServers()),
+		Events:                mapEvents(pbFullStatus.GetEvents()),
+		LazyConnectionEnabled: pbFullStatus.GetLazyConnectionEnabled(),
+		ProfileName:           opts.ProfileName,
+		SSHServerState:        sshServerOverview,
 	}
 	if !opts.SessionExpiresAt.IsZero() {
 		t := opts.SessionExpiresAt
@@ -573,11 +571,6 @@ func (o *OutputOverview) GeneralSummary(showURL bool, showRelays bool, showNameS
 		)
 	}
 
-	var forwardingRulesString string
-	if o.NumberOfForwardingRules > 0 {
-		forwardingRulesString = fmt.Sprintf("Forwarding rules: %d\n", o.NumberOfForwardingRules)
-	}
-
 	goos := runtime.GOOS
 	goarch := runtime.GOARCH
 	goarm := ""
@@ -619,7 +612,6 @@ func (o *OutputOverview) GeneralSummary(showURL bool, showRelays bool, showNameS
 			"SSH Server: %s\n"+
 			"Networks: %s\n"+
 			"%s"+
-			"%s"+
 			"Peers count: %s\n",
 		fmt.Sprintf("%s/%s%s", goos, goarch, goarm),
 		daemonVersion,
@@ -638,7 +630,6 @@ func (o *OutputOverview) GeneralSummary(showURL bool, showRelays bool, showNameS
 		lazyConnectionEnabledStatus,
 		sshServerStatus,
 		networks,
-		forwardingRulesString,
 		sessionExpiryString,
 		peersCountString,
 	)
@@ -691,7 +682,6 @@ func ToProtoFullStatus(fullStatus peer.FullStatus) *proto.FullStatus {
 	pbFullStatus.LocalPeerState.RosenpassPermissive = fullStatus.RosenpassState.Permissive
 	pbFullStatus.LocalPeerState.RosenpassEnabled = fullStatus.RosenpassState.Enabled
 	pbFullStatus.LocalPeerState.Networks = maps.Keys(fullStatus.LocalPeerState.Routes)
-	pbFullStatus.NumberOfForwardingRules = int32(fullStatus.NumOfForwardingRules)
 	pbFullStatus.LazyConnectionEnabled = fullStatus.LazyConnectionEnabled
 
 	for _, peerState := range fullStatus.Peers {
diff --git a/client/status/status_test.go b/client/status/status_test.go
index 2babd9342..1580aca6d 100644
--- a/client/status/status_test.go
+++ b/client/status/status_test.go
@@ -378,7 +378,6 @@ func TestParsingToJSON(t *testing.T) {
           "networks": [
             "10.10.0.0/24"
           ],
-          "forwardingRules": 0,
           "dnsServers": [
             {
               "servers": [
@@ -496,7 +495,6 @@ quantumResistance: false
 quantumResistancePermissive: false
 networks:
     - 10.10.0.0/24
-forwardingRules: 0
 dnsServers:
     - servers:
         - 8.8.8.8:53
diff --git a/client/ui/frontend/WAILS-API.md b/client/ui/frontend/WAILS-API.md
index 494812d35..6cc1dd79c 100644
--- a/client/ui/frontend/WAILS-API.md
+++ b/client/ui/frontend/WAILS-API.md
@@ -10,7 +10,7 @@ Every method returns `$CancellablePromise<T>` (a Wails3 wrapper around `Promise`
 // Services
 import {
   Connection, Peers, ProfileSwitcher, Profiles,
-  Settings, Networks, Forwarding, Debug, Update, WindowManager,
+  Settings, Networks, Debug, Update, WindowManager,
   I18n, Preferences,
 } from "@bindings/services";
 
@@ -20,7 +20,6 @@ import type {
   Profile, ProfileRef, ActiveProfile,
   Config, ConfigParams, SetConfigParams, Features,
   Network, SelectNetworksParams,
-  ForwardingRule, PortInfo, PortRange,
   LoginParams, LoginResult, LogoutParams, WaitSSOParams, UpParams,
   DebugBundleParams, DebugBundleResult, LogLevel,
   UpdateResult, UpdateAvailable, UpdateProgress,
@@ -129,14 +128,6 @@ Networks.Deselect(p: SelectNetworksParams): Promise<void>
 
 Exit-node filter: `range === "0.0.0.0/0" || range === "::/0"`. Domain network: `domains.length > 0`. CIDR overlap check is client-side.
 
-## `Forwarding`
-
-```ts
-Forwarding.List(): Promise<ForwardingRule[]>
-```
-
-`PortInfo` is a daemon-side oneof — exactly one of `port?: number` or `range?: PortRange` is populated. `protocol` is the lowercase daemon string (`"tcp"` / `"udp"`).
-
 ## `Debug`
 
 ```ts
@@ -269,12 +260,6 @@ The tray also reads a tray-only synthetic `"Error"` for icon purposes; the front
 
 `Network`: `{ id, range: string; selected: boolean; domains: string[]; resolvedIps: Record<string, string[]> }`.
 
-`ForwardingRule`: `{ protocol: string; destinationPort: PortInfo; translatedAddress, translatedHostname: string; translatedPort: PortInfo }`.
-
-`PortInfo`: `{ port?: number | null; range?: PortRange | null }` (exactly one populated).
-
-`PortRange`: `{ start, end: number }` (inclusive).
-
 `LoginParams`: `{ profileName, username, managementUrl, setupKey, preSharedKey, hostname, hint: string }`.
 
 `LoginResult`: `{ needsSsoLogin: boolean; userCode, verificationUri, verificationUriComplete: string }`.
diff --git a/client/ui/main.go b/client/ui/main.go
index 74a87b4df..764562fe7 100644
--- a/client/ui/main.go
+++ b/client/ui/main.go
@@ -336,7 +336,6 @@ func registerServices(app *application.App, conn *Conn, s registeredServices) {
 	app.RegisterService(application.NewService(services.NewSession(s.authSession, s.bundle, s.prefStore)))
 	app.RegisterService(application.NewService(s.settings))
 	app.RegisterService(application.NewService(s.networks))
-	app.RegisterService(application.NewService(services.NewForwarding(conn)))
 	app.RegisterService(application.NewService(s.profiles))
 	app.RegisterService(application.NewService(services.NewDebug(conn)))
 	app.RegisterService(application.NewService(s.update))
diff --git a/client/ui/services/forwarding.go b/client/ui/services/forwarding.go
deleted file mode 100644
index 4ba979ad0..000000000
--- a/client/ui/services/forwarding.go
+++ /dev/null
@@ -1,83 +0,0 @@
-//go:build !android && !ios && !freebsd && !js
-
-package services
-
-import (
-	"context"
-
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-// PortRange is a port range; both ends are inclusive.
-type PortRange struct {
-	Start uint32 `json:"start"`
-	End   uint32 `json:"end"`
-}
-
-// PortInfo holds exactly one of Port or Range (the daemon's oneof).
-type PortInfo struct {
-	Port  *uint32    `json:"port,omitempty"`
-	Range *PortRange `json:"range,omitempty"`
-}
-
-// ForwardingRule is one entry from the daemon's reverse-proxy table.
-type ForwardingRule struct {
-	Protocol           string   `json:"protocol"`
-	DestinationPort    PortInfo `json:"destinationPort"`
-	TranslatedAddress  string   `json:"translatedAddress"`
-	TranslatedHostname string   `json:"translatedHostname"`
-	TranslatedPort     PortInfo `json:"translatedPort"`
-}
-
-// Forwarding groups the daemon RPCs that surface exposed/forwarded services.
-type Forwarding struct {
-	conn DaemonConn
-}
-
-func NewForwarding(conn DaemonConn) *Forwarding {
-	return &Forwarding{conn: conn}
-}
-
-func (s *Forwarding) List(ctx context.Context) ([]ForwardingRule, error) {
-	cli, err := s.conn.Client()
-	if err != nil {
-		return nil, err
-	}
-	resp, err := cli.ForwardingRules(ctx, &proto.EmptyRequest{})
-	if err != nil {
-		return nil, err
-	}
-	out := make([]ForwardingRule, 0, len(resp.GetRules()))
-	for _, r := range resp.GetRules() {
-		out = append(out, forwardingRuleFromProto(r))
-	}
-	return out, nil
-}
-
-func forwardingRuleFromProto(r *proto.ForwardingRule) ForwardingRule {
-	return ForwardingRule{
-		Protocol:           r.GetProtocol(),
-		DestinationPort:    portInfoFromProto(r.GetDestinationPort()),
-		TranslatedAddress:  r.GetTranslatedAddress(),
-		TranslatedHostname: r.GetTranslatedHostname(),
-		TranslatedPort:     portInfoFromProto(r.GetTranslatedPort()),
-	}
-}
-
-func portInfoFromProto(p *proto.PortInfo) PortInfo {
-	if p == nil {
-		return PortInfo{}
-	}
-	switch sel := p.GetPortSelection().(type) {
-	case *proto.PortInfo_Port:
-		port := sel.Port
-		return PortInfo{Port: &port}
-	case *proto.PortInfo_Range_:
-		r := sel.Range
-		if r == nil {
-			return PortInfo{}
-		}
-		return PortInfo{Range: &PortRange{Start: r.GetStart(), End: r.GetEnd()}}
-	}
-	return PortInfo{}
-}
diff --git a/go.mod b/go.mod
index 35e254f8e..eeb73cd68 100644
--- a/go.mod
+++ b/go.mod
@@ -85,7 +85,7 @@ require (
 	github.com/mitchellh/hashstructure/v2 v2.0.2
 	github.com/moby/moby/api v1.54.1
 	github.com/netbirdio/go-nat v0.0.0-20260821095157-6b2c8c5c74e8
-	github.com/netbirdio/management-integrations/integrations v0.0.0-20260803100840-78e79ba20f87
+	github.com/netbirdio/management-integrations/integrations v0.0.0-20261006132740-6e6b0cb01f2e
 	github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45
 	github.com/oapi-codegen/runtime v1.1.2
 	github.com/okta/okta-sdk-golang/v2 v2.18.0
diff --git a/go.sum b/go.sum
index c193a388f..115bb3373 100644
--- a/go.sum
+++ b/go.sum
@@ -519,8 +519,8 @@ github.com/netbirdio/go-nat v0.0.0-20260821095157-6b2c8c5c74e8 h1:pBxXEsxcsO3qVU
 github.com/netbirdio/go-nat v0.0.0-20260821095157-6b2c8c5c74e8/go.mod h1:mFViabv4PpnoDw9w7W21a7xux6APA4q7KQZRsv4BCl8=
 github.com/netbirdio/ice/v4 v4.0.0-20250908184934-6202be846b51 h1:Ov4qdafATOgGMB1wbSuh+0aAHcwz9hdvB6VZjh1mVMI=
 github.com/netbirdio/ice/v4 v4.0.0-20250908184934-6202be846b51/go.mod h1:ZSIbPdBn5hePO8CpF1PekH2SfpTxg1PDhEwtbqZS7R8=
-github.com/netbirdio/management-integrations/integrations v0.0.0-20260803100840-78e79ba20f87 h1:iJeUvSMC0BTpkw7u4JyWcY4/3dl7fEL9DR/TpKf2+1w=
-github.com/netbirdio/management-integrations/integrations v0.0.0-20260803100840-78e79ba20f87/go.mod h1:pmsCPx1S0nuZRxCextGpc9AV4hLgGSuTsc4NMuwGeCo=
+github.com/netbirdio/management-integrations/integrations v0.0.0-20261006132740-6e6b0cb01f2e h1:SnDCreUnY+QDxKPueUoNrniMALCu2VFkXTCr/RIZjdg=
+github.com/netbirdio/management-integrations/integrations v0.0.0-20261006132740-6e6b0cb01f2e/go.mod h1:n47r67ZSPgwSmT/Z1o48JjZQW9YJ6m/6Bd/uAXkL3Pg=
 github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502 h1:3tHlFmhTdX9axERMVN63dqyFqnvuD+EMJHzM7mNGON8=
 github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502/go.mod h1:CIMRFEJVL+0DS1a3Nx06NaMn4Dz63Ng6O7dl0qH0zVM=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45 h1:ujgviVYmx243Ksy7NdSwrdGPSRNE3pb8kEDSpH0QuAQ=
diff --git a/management/internals/controllers/network_map/controller/controller.go b/management/internals/controllers/network_map/controller/controller.go
index 9727ff958..b9c27e57e 100644
--- a/management/internals/controllers/network_map/controller/controller.go
+++ b/management/internals/controllers/network_map/controller/controller.go
@@ -24,7 +24,6 @@ import (
 	"github.com/netbirdio/netbird/management/internals/shared/requestbuffer"
 	"github.com/netbirdio/netbird/management/server/account"
 	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/posture"
 	"github.com/netbirdio/netbird/management/server/settings"
@@ -60,8 +59,6 @@ type Controller struct {
 
 	requestBuffer account.RequestBuffer
 
-	proxyController port_forwarding.Controller
-
 	integratedPeerValidator integrated_validator.IntegratedValidator
 
 	serverSupportedSyncMessageVersion sharedgrpc.SyncMessageVersion
@@ -87,7 +84,7 @@ type bufferAffectedUpdate struct {
 
 var _ network_map.Controller = (*Controller)(nil)
 
-func NewController(ctx context.Context, store store.Store, metrics telemetry.AppMetrics, peersUpdateManager network_map.PeersUpdateManager, requestBuffer account.RequestBuffer, integratedPeerValidator integrated_validator.IntegratedValidator, settingsManager settings.Manager, dnsDomain string, proxyController port_forwarding.Controller, ephemeralPeersManager ephemeral.Manager, config *config.Config, nmdataStore *networkmapdb.NetworkMapDBStoreImpl) *Controller {
+func NewController(ctx context.Context, store store.Store, metrics telemetry.AppMetrics, peersUpdateManager network_map.PeersUpdateManager, requestBuffer account.RequestBuffer, integratedPeerValidator integrated_validator.IntegratedValidator, settingsManager settings.Manager, dnsDomain string, ephemeralPeersManager ephemeral.Manager, config *config.Config, nmdataStore *networkmapdb.NetworkMapDBStoreImpl) *Controller {
 	nMetrics, err := newMetrics(metrics.UpdateChannelMetrics())
 	if err != nil {
 		log.Fatal(fmt.Errorf("error creating metrics: %w", err))
@@ -104,11 +101,10 @@ func NewController(ctx context.Context, store store.Store, metrics telemetry.App
 		dnsDomain:               dnsDomain,
 		config:                  config,
 
-		proxyController:                              proxyController,
 		EphemeralPeersManager:                        ephemeralPeersManager,
 		serverSupportedSyncMessageVersion:            sharedgrpc.SyncMessageVersionFromConfig(config.HighestSupportedSyncMessageVersion),
 		perAccountServerSupportedSyncMessageVersions: sharedgrpc.SyncMessageVersionsFromMap(config.PerAccountHighestSupportedSyncMessageVersion),
-		nmdataStore:                                  nmdataStore,
+		nmdataStore: nmdataStore,
 	}
 
 	if nmdataStore != nil {
@@ -226,12 +222,6 @@ func (c *Controller) sendUpdateAccountPeers(ctx context.Context, accountID strin
 	routers := account.GetResourceRoutersMap()
 	groupIDToUserIDs := account.GetActiveGroupUsers()
 
-	proxyNetworkMaps, err := c.proxyController.GetProxyNetworkMapsAll(ctx, accountID, account.Peers)
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to get proxy network maps: %v", err)
-		return fmt.Errorf("failed to get proxy network maps: %v", err)
-	}
-
 	extraSetting, err := c.settingsManager.GetExtraSettings(ctx, accountID)
 	if err != nil {
 		return fmt.Errorf("failed to get flow enabled status: %v", err)
@@ -273,7 +263,6 @@ func (c *Controller) sendUpdateAccountPeers(ctx context.Context, accountID strin
 			start = time.Now()
 
 			peerGroups := account.GetPeerGroups(p.ID)
-			proxyNetworkMap := proxyNetworkMaps[p.ID]
 			var update *proto.SyncResponse
 
 			commonSyncMessageVersion := sharedgrpc.HighestCommonSyncMessageVersion(
@@ -294,10 +283,7 @@ func (c *Controller) sendUpdateAccountPeers(ctx context.Context, accountID strin
 				c.metrics.CountCalcPeerNetworkMapDuration(time.Since(start))
 
 				start = time.Now()
-				// proxyNetworkMap rides the envelope as a ProxyPatch sidecar;
-				// the client merges it into Calculate()'s output the same
-				// way the legacy server did via NetworkMap.Merge.
-				update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(p), nil, nil, components, proxyNetworkMap, dnsDomain, postureChecks, types.TwinAccountSettings(account.Settings), extraSetting, maps.Keys(peerGroups), dnsFwdPort)
+				update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(p), nil, nil, components, dnsDomain, postureChecks, types.TwinAccountSettings(account.Settings), extraSetting, maps.Keys(peerGroups), dnsFwdPort)
 				c.metrics.CountToComponentSyncResponseDuration(time.Since(start))
 
 				c.peersUpdateManager.SendUpdate(ctx, p.ID, &network_map.UpdateMessage{
@@ -313,10 +299,6 @@ func (c *Controller) sendUpdateAccountPeers(ctx context.Context, accountID strin
 
 			c.metrics.CountCalcPeerNetworkMapDuration(time.Since(start))
 
-			if proxyNetworkMap != nil {
-				nmap.Merge(proxyNetworkMap)
-			}
-
 			start = time.Now()
 			update = grpc.ToSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(p), nil, nil, nmap, dnsDomain, postureChecks, dnsCache, types.TwinAccountSettings(account.Settings), extraSetting, maps.Keys(peerGroups), dnsFwdPort)
 			c.metrics.CountToSyncResponseDuration(time.Since(start))
@@ -451,7 +433,7 @@ func (c *Controller) sendUpdatesFromData(ctx context.Context, accountID string,
 				c.metrics.CountCalcPeerNetworkMapDuration(time.Since(start))
 
 				start = time.Now()
-				update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, p, nil, nil, components, nil, dnsDomain, postureChecks, nmData.AccountSettings, extraSettings, peerGroups, dnsFwdPort)
+				update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, p, nil, nil, components, dnsDomain, postureChecks, nmData.AccountSettings, extraSettings, peerGroups, dnsFwdPort)
 				c.metrics.CountToComponentSyncResponseDuration(time.Since(start))
 
 				c.peersUpdateManager.SendUpdate(ctx, p.ID, &network_map.UpdateMessage{
@@ -684,12 +666,6 @@ func (c *Controller) sendUpdateForAffectedPeers(ctx context.Context, accountID s
 	routers := account.GetResourceRoutersMap()
 	groupIDToUserIDs := account.GetActiveGroupUsers()
 
-	proxyNetworkMaps, err := c.proxyController.GetProxyNetworkMapsAll(ctx, accountID, account.Peers)
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to get proxy network maps: %v", err)
-		return fmt.Errorf("failed to get proxy network maps: %v", err)
-	}
-
 	extraSetting, err := c.settingsManager.GetExtraSettings(ctx, accountID)
 	if err != nil {
 		return fmt.Errorf("failed to get flow enabled status: %v", err)
@@ -722,7 +698,6 @@ func (c *Controller) sendUpdateForAffectedPeers(ctx context.Context, accountID s
 			start = time.Now()
 
 			peerGroups := account.GetPeerGroups(p.ID)
-			proxyNetworkMap := proxyNetworkMaps[p.ID]
 			var update *proto.SyncResponse
 
 			commonSyncMessageVersion := sharedgrpc.HighestCommonSyncMessageVersion(
@@ -743,10 +718,7 @@ func (c *Controller) sendUpdateForAffectedPeers(ctx context.Context, accountID s
 				c.metrics.CountCalcPeerNetworkMapDuration(time.Since(start))
 
 				start = time.Now()
-				// proxyNetworkMap rides the envelope as a ProxyPatch sidecar;
-				// the client merges it into Calculate()'s output the same
-				// way the legacy server did via NetworkMap.Merge.
-				update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(p), nil, nil, components, proxyNetworkMap, dnsDomain, postureChecks, types.TwinAccountSettings(account.Settings), extraSetting, maps.Keys(peerGroups), dnsFwdPort)
+				update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(p), nil, nil, components, dnsDomain, postureChecks, types.TwinAccountSettings(account.Settings), extraSetting, maps.Keys(peerGroups), dnsFwdPort)
 				c.metrics.CountToComponentSyncResponseDuration(time.Since(start))
 
 				c.peersUpdateManager.SendUpdate(ctx, p.ID, &network_map.UpdateMessage{
@@ -762,10 +734,6 @@ func (c *Controller) sendUpdateForAffectedPeers(ctx context.Context, accountID s
 
 			c.metrics.CountCalcPeerNetworkMapDuration(time.Since(start))
 
-			if proxyNetworkMap != nil {
-				nmap.Merge(proxyNetworkMap)
-			}
-
 			start = time.Now()
 			update = grpc.ToSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(p), nil, nil, nmap, dnsDomain, postureChecks, dnsCache, types.TwinAccountSettings(account.Settings), extraSetting, maps.Keys(peerGroups), dnsFwdPort)
 			c.metrics.CountToSyncResponseDuration(time.Since(start))
@@ -843,19 +811,12 @@ func (c *Controller) UpdateAccountPeer(ctx context.Context, accountId string, pe
 		return fmt.Errorf("failed to get posture checks for peer %s: %v", peerId, err)
 	}
 
-	proxyNetworkMaps, err := c.proxyController.GetProxyNetworkMaps(ctx, account.Id, peer.ID, account.Peers)
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to get proxy network maps: %v", err)
-		return err
-	}
-
 	accountZones, err := c.repo.GetAccountZones(ctx, account.Id)
 	if err != nil {
 		log.WithContext(ctx).Errorf("failed to get account zones: %v", err)
 		return err
 	}
 
-	proxyNetworkMap := proxyNetworkMaps[peer.ID]
 	extraSettings, err := c.settingsManager.GetExtraSettings(ctx, peer.AccountID)
 	if err != nil {
 		return fmt.Errorf("failed to get extra settings: %v", err)
@@ -881,10 +842,7 @@ func (c *Controller) UpdateAccountPeer(ctx context.Context, accountId string, pe
 		components := account.GetPeerNetworkMapComponents(
 			ctx, peer.ID, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, groupIDToUserIDs)
 
-		// proxyNetworkMap rides the envelope as a ProxyPatch sidecar;
-		// the client merges it into Calculate()'s output the same
-		// way the legacy server did via NetworkMap.Merge.
-		update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(peer), nil, nil, components, proxyNetworkMap, dnsDomain, postureChecks, types.TwinAccountSettings(account.Settings), extraSettings, maps.Keys(peerGroups), dnsFwdPort)
+		update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(peer), nil, nil, components, dnsDomain, postureChecks, types.TwinAccountSettings(account.Settings), extraSettings, maps.Keys(peerGroups), dnsFwdPort)
 
 		c.peersUpdateManager.SendUpdate(ctx, peer.ID, &network_map.UpdateMessage{
 			Update:      update,
@@ -897,10 +855,6 @@ func (c *Controller) UpdateAccountPeer(ctx context.Context, accountId string, pe
 	nmap := account.GetPeerNetworkMapFromComponents(
 		ctx, peer.ID, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, c.accountManagerMetrics, groupIDToUserIDs)
 
-	if proxyNetworkMap != nil {
-		nmap.Merge(proxyNetworkMap)
-	}
-
 	update = grpc.ToSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(peer), nil, nil, nmap, dnsDomain, postureChecks, dnsCache, types.TwinAccountSettings(account.Settings), extraSettings, maps.Keys(peerGroups), dnsFwdPort)
 
 	c.peersUpdateManager.SendUpdate(ctx, peer.ID, &network_map.UpdateMessage{
@@ -951,17 +905,16 @@ func (c *Controller) BufferUpdateAccountPeers(ctx context.Context, accountID str
 
 // GetValidatedPeerWithComponents is the components-format counterpart of
 // GetValidatedPeerWithMap. It returns raw NetworkMapComponents for capable
-// peers along with the proxy NetworkMap fragment (BYOP / port-forwarding
-// data the legacy server folds in via NetworkMap.Merge). The gRPC layer
-// encodes both into the wire envelope. Callers must gate on capability
-// themselves before dispatching here — this method does NOT branch on it.
-func (c *Controller) GetValidatedPeerWithComponents(ctx context.Context, isRequiresApproval bool, accountID string, peer *nbpeer.Peer) (*nbpeer.Peer, *types.NetworkMapComponents, *types.NetworkMap, []*nmdata.PostureChecks, int64, error) {
+// peers, which the gRPC layer encodes into the wire envelope. Callers must
+// gate on capability themselves before dispatching here — this method does
+// NOT branch on it.
+func (c *Controller) GetValidatedPeerWithComponents(ctx context.Context, isRequiresApproval bool, accountID string, peer *nbpeer.Peer) (*nbpeer.Peer, *types.NetworkMapComponents, []*nmdata.PostureChecks, int64, error) {
 	if isRequiresApproval {
 		network, err := c.repo.GetAccountNetwork(ctx, accountID)
 		if err != nil {
-			return nil, nil, nil, nil, 0, err
+			return nil, nil, nil, 0, err
 		}
-		return peer, &types.NetworkMapComponents{Network: types.TwinNetwork(network)}, nil, nil, 0, nil
+		return peer, &types.NetworkMapComponents{Network: types.TwinNetwork(network)}, nil, 0, nil
 	}
 
 	if nmData := c.getNetworkMapData(ctx, accountID); nmData != nil {
@@ -970,39 +923,29 @@ func (c *Controller) GetValidatedPeerWithComponents(ctx context.Context, isRequi
 
 	account, err := c.requestBuffer.GetAccountWithBackpressure(ctx, accountID)
 	if err != nil {
-		return nil, nil, nil, nil, 0, err
+		return nil, nil, nil, 0, err
 	}
 
 	// it's possible that the peer gets deleted between the call to "sendInitialSync()" and here, bail out in this case
 	if _, ok := account.Peers[peer.ID]; !ok {
-		return nil, nil, nil, nil, 0, fmt.Errorf("peer '%s' no longer exists", peer.ID)
+		return nil, nil, nil, 0, fmt.Errorf("peer '%s' no longer exists", peer.ID)
 	}
 
 	c.injectAllProxyPolicies(ctx, account)
 
 	approvedPeersMap, err := c.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, types.TwinGroups(maps.Values(account.Groups)), types.TwinPeers(maps.Values(account.Peers)), account.Settings.Extra)
 	if err != nil {
-		return nil, nil, nil, nil, 0, err
+		return nil, nil, nil, 0, err
 	}
 
 	postureChecks, err := c.getPeerPostureChecks(account, peer.ID)
 	if err != nil {
-		return nil, nil, nil, nil, 0, err
+		return nil, nil, nil, 0, err
 	}
 
 	accountZones, err := c.repo.GetAccountZones(ctx, account.Id)
 	if err != nil {
-		return nil, nil, nil, nil, 0, err
-	}
-
-	// Fetch the proxy network map fragment for this peer alongside the
-	// components — same single-account-load path the streaming controller
-	// uses, so initial-sync delivers BYOP/forwarding patches synchronously
-	// instead of waiting for the next streaming push.
-	proxyNetworkMaps, err := c.proxyController.GetProxyNetworkMaps(ctx, account.Id, peer.ID, account.Peers)
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to get proxy network maps: %v", err)
-		return nil, nil, nil, nil, 0, err
+		return nil, nil, nil, 0, err
 	}
 
 	dnsDomain := c.GetDNSDomain(account.Settings)
@@ -1014,13 +957,12 @@ func (c *Controller) GetValidatedPeerWithComponents(ctx context.Context, isRequi
 	components := account.GetPeerNetworkMapComponents(ctx, peer.ID, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, groupIDToUserIDs)
 	dnsFwdPort := computeForwarderPort(maps.Values(account.Peers), network_map.DnsForwarderPortMinVersion)
 
-	return peer, components, proxyNetworkMaps[peer.ID], postureChecks, dnsFwdPort, nil
+	return peer, components, postureChecks, dnsFwdPort, nil
 }
 
 // getValidatedPeerWithComponentsFromData is the account-free variant of
-// GetValidatedPeerWithComponents. The proxy network map fragment is omitted
-// like on the other nmdata paths.
-func (c *Controller) getValidatedPeerWithComponentsFromData(ctx context.Context, accountID string, peer *nbpeer.Peer, nmData *networkmap.NetworkMapData) (*nbpeer.Peer, *types.NetworkMapComponents, *types.NetworkMap, []*nmdata.PostureChecks, int64, error) {
+// GetValidatedPeerWithComponents.
+func (c *Controller) getValidatedPeerWithComponentsFromData(ctx context.Context, accountID string, peer *nbpeer.Peer, nmData *networkmap.NetworkMapData) (*nbpeer.Peer, *types.NetworkMapComponents, []*nmdata.PostureChecks, int64, error) {
 	postureChecks := peerPostureChecksFromData(nmData, peer.ID)
 
 	dnsDomain := c.getDNSDomainFromData(nmData.AccountSettings)
@@ -1029,7 +971,7 @@ func (c *Controller) getValidatedPeerWithComponentsFromData(ctx context.Context,
 	components := nmData.GetPeerNetworkMapComponents(peer.ID, peersCustomZone)
 	dnsFwdPort := ComputeForwarderPortFromData(nmData.Peers, network_map.DnsForwarderPortMinVersion)
 
-	return peer, components, nil, postureChecks, dnsFwdPort, nil
+	return peer, components, postureChecks, dnsFwdPort, nil
 }
 
 // BufferUpdateAffectedPeers accumulates peer IDs and flushes them after the buffer interval.
@@ -1173,22 +1115,11 @@ func (c *Controller) GetValidatedPeerWithMap(ctx context.Context, isRequiresAppr
 	dnsDomain := c.GetDNSDomain(account.Settings)
 	peersCustomZone := account.GetPeersCustomZone(ctx, dnsDomain)
 
-	proxyNetworkMaps, err := c.proxyController.GetProxyNetworkMaps(ctx, account.Id, peerID, account.Peers)
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to get proxy network maps: %v", err)
-		return nil, nil, 0, err
-	}
-
 	resourcePolicies := account.GetResourcePoliciesMap()
 	routers := account.GetResourceRoutersMap()
 	groupIDToUserIDs := account.GetActiveGroupUsers()
 	networkMap := account.GetPeerNetworkMapFromComponents(ctx, peerID, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, c.accountManagerMetrics, groupIDToUserIDs)
 
-	proxyNetworkMap, ok := proxyNetworkMaps[peerID]
-	if ok {
-		networkMap.Merge(proxyNetworkMap)
-	}
-
 	dnsFwdPort := computeForwarderPort(maps.Values(account.Peers), network_map.DnsForwarderPortMinVersion)
 
 	return networkMap, postureChecks, dnsFwdPort, nil
@@ -1457,23 +1388,12 @@ func (c *Controller) GetNetworkMap(ctx context.Context, peerID string) (*types.N
 	dnsDomain := c.GetDNSDomain(account.Settings)
 	peersCustomZone := account.GetPeersCustomZone(ctx, dnsDomain)
 
-	proxyNetworkMaps, err := c.proxyController.GetProxyNetworkMaps(ctx, account.Id, peerID, account.Peers)
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to get proxy network maps: %v", err)
-		return nil, err
-	}
-
 	c.injectAllProxyPolicies(ctx, account)
 	resourcePolicies := account.GetResourcePoliciesMap()
 	routers := account.GetResourceRoutersMap()
 	groupIDToUserIDs := account.GetActiveGroupUsers()
 	networkMap := account.GetPeerNetworkMapFromComponents(ctx, peer.ID, peersCustomZone, accountZones, validatedPeers, resourcePolicies, routers, nil, groupIDToUserIDs)
 
-	proxyNetworkMap, ok := proxyNetworkMaps[peer.ID]
-	if ok {
-		networkMap.Merge(proxyNetworkMap)
-	}
-
 	return networkMap, nil
 }
 
diff --git a/management/internals/controllers/network_map/controller/controller_test.go b/management/internals/controllers/network_map/controller/controller_test.go
index dfbbb2915..74e2553d6 100644
--- a/management/internals/controllers/network_map/controller/controller_test.go
+++ b/management/internals/controllers/network_map/controller/controller_test.go
@@ -122,11 +122,10 @@ func TestGetValidatedPeerWithComponents_DeletedPeer(t *testing.T) {
 	}
 
 	mockrequestBuffer.EXPECT().GetAccountWithBackpressure(gomock.Any(), gomock.Any()).Return(&types.Account{}, nil)
-	peer, components, netmap, posturechecks, dnsforwardPort, err := c.GetValidatedPeerWithComponents(context.TODO(), false, "test-account-id", &nbpeer.Peer{ID: "test-peer-id"})
+	peer, components, posturechecks, dnsforwardPort, err := c.GetValidatedPeerWithComponents(context.TODO(), false, "test-account-id", &nbpeer.Peer{ID: "test-peer-id"})
 
 	assert.Nil(t, peer)
 	assert.Nil(t, components)
-	assert.Nil(t, netmap)
 	assert.Nil(t, posturechecks)
 	assert.Equal(t, int64(0), dnsforwardPort)
 	assert.NotNil(t, err)
diff --git a/management/internals/controllers/network_map/controller/repository_mock.go b/management/internals/controllers/network_map/controller/repository_mock.go
index 5246eef4b..9c6b1af4c 100644
--- a/management/internals/controllers/network_map/controller/repository_mock.go
+++ b/management/internals/controllers/network_map/controller/repository_mock.go
@@ -89,6 +89,21 @@ func (mr *MockRepositoryMockRecorder) GetAccountPeers(ctx, accountID any) *gomoc
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountPeers", reflect.TypeOf((*MockRepository)(nil).GetAccountPeers), ctx, accountID)
 }
 
+// GetAccountServices mocks base method.
+func (m *MockRepository) GetAccountServices(ctx context.Context, accountID string) ([]*service.Service, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAccountServices", ctx, accountID)
+	ret0, _ := ret[0].([]*service.Service)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAccountServices indicates an expected call of GetAccountServices.
+func (mr *MockRepositoryMockRecorder) GetAccountServices(ctx, accountID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountServices", reflect.TypeOf((*MockRepository)(nil).GetAccountServices), ctx, accountID)
+}
+
 // GetAccountZones mocks base method.
 func (m *MockRepository) GetAccountZones(ctx context.Context, accountID string) ([]*zones.Zone, error) {
 	m.ctrl.T.Helper()
diff --git a/management/internals/controllers/network_map/interface.go b/management/internals/controllers/network_map/interface.go
index 1e8c219b3..f447387b4 100644
--- a/management/internals/controllers/network_map/interface.go
+++ b/management/internals/controllers/network_map/interface.go
@@ -24,7 +24,7 @@ type Controller interface {
 	UpdateAccountPeer(ctx context.Context, accountId string, peerId string) error
 	BufferUpdateAccountPeers(ctx context.Context, accountID string, reason types.UpdateReason) error
 	GetValidatedPeerWithMap(ctx context.Context, isRequiresApproval bool, accountID string, peerID string) (*types.NetworkMap, []*nmdata.PostureChecks, int64, error)
-	GetValidatedPeerWithComponents(ctx context.Context, isRequiresApproval bool, accountID string, p *nbpeer.Peer) (*nbpeer.Peer, *types.NetworkMapComponents, *types.NetworkMap, []*nmdata.PostureChecks, int64, error)
+	GetValidatedPeerWithComponents(ctx context.Context, isRequiresApproval bool, accountID string, p *nbpeer.Peer) (*nbpeer.Peer, *types.NetworkMapComponents, []*nmdata.PostureChecks, int64, error)
 	GetDNSDomain(settings *types.Settings) string
 	StartWarmup(context.Context)
 	GetNetworkMap(ctx context.Context, peerID string) (*types.NetworkMap, error)
diff --git a/management/internals/controllers/network_map/interface_mock.go b/management/internals/controllers/network_map/interface_mock.go
index 8b104dfa0..5dcd241e1 100644
--- a/management/internals/controllers/network_map/interface_mock.go
+++ b/management/internals/controllers/network_map/interface_mock.go
@@ -127,16 +127,15 @@ func (mr *MockControllerMockRecorder) GetNetworkMap(ctx, peerID any) *gomock.Cal
 }
 
 // GetValidatedPeerWithComponents mocks base method.
-func (m *MockController) GetValidatedPeerWithComponents(ctx context.Context, isRequiresApproval bool, accountID string, p *peer.Peer) (*peer.Peer, *types.NetworkMapComponents, *types.NetworkMap, []*nmdata.PostureChecks, int64, error) {
+func (m *MockController) GetValidatedPeerWithComponents(ctx context.Context, isRequiresApproval bool, accountID string, p *peer.Peer) (*peer.Peer, *types.NetworkMapComponents, []*nmdata.PostureChecks, int64, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetValidatedPeerWithComponents", ctx, isRequiresApproval, accountID, p)
 	ret0, _ := ret[0].(*peer.Peer)
 	ret1, _ := ret[1].(*types.NetworkMapComponents)
-	ret2, _ := ret[2].(*types.NetworkMap)
-	ret3, _ := ret[3].([]*nmdata.PostureChecks)
-	ret4, _ := ret[4].(int64)
-	ret5, _ := ret[5].(error)
-	return ret0, ret1, ret2, ret3, ret4, ret5
+	ret2, _ := ret[2].([]*nmdata.PostureChecks)
+	ret3, _ := ret[3].(int64)
+	ret4, _ := ret[4].(error)
+	return ret0, ret1, ret2, ret3, ret4
 }
 
 // GetValidatedPeerWithComponents indicates an expected call of GetValidatedPeerWithComponents.
diff --git a/management/internals/controllers/network_map/nmaptest/canonicalize.go b/management/internals/controllers/network_map/nmaptest/canonicalize.go
index ec6614d81..643105b89 100644
--- a/management/internals/controllers/network_map/nmaptest/canonicalize.go
+++ b/management/internals/controllers/network_map/nmaptest/canonicalize.go
@@ -123,7 +123,6 @@ func canonicalize(nm *proto.NetworkMap) {
 	slices.SortFunc(nm.Routes, cmpRoute)
 	slices.SortFunc(nm.FirewallRules, cmpFirewallRule)
 	slices.SortFunc(nm.RoutesFirewallRules, cmpRouteFirewallRule)
-	slices.SortFunc(nm.ForwardingRules, cmpForwardingRule)
 
 	for _, r := range nm.FirewallRules {
 		slices.SortFunc(r.SourcePrefixes, bytes.Compare)
@@ -353,16 +352,6 @@ func cmpRouteFirewallRule(a, b *proto.RouteFirewallRule) int {
 	return boolCmp(a.IsDynamic, b.IsDynamic)
 }
 
-func cmpForwardingRule(a, b *proto.ForwardingRule) int {
-	if a == nil || b == nil {
-		return boolCmp(a == nil, b == nil)
-	}
-	if c := cmp.Compare(int32(a.Protocol), int32(b.Protocol)); c != 0 {
-		return c
-	}
-	return bytes.Compare(a.TranslatedAddress, b.TranslatedAddress)
-}
-
 func portInfoKey(pi *proto.PortInfo) string {
 	if pi == nil {
 		return ""
diff --git a/management/internals/controllers/network_map/nmaptest/runner.go b/management/internals/controllers/network_map/nmaptest/runner.go
index ffce6483e..b6fc81df6 100644
--- a/management/internals/controllers/network_map/nmaptest/runner.go
+++ b/management/internals/controllers/network_map/nmaptest/runner.go
@@ -243,7 +243,7 @@ func computeMode(t *testing.T, ctx context.Context, mode Mode, nmData *networkma
 	case ModeEnvelope:
 		components := nmData.GetPeerNetworkMapComponents(peerID, zone)
 		peerGroups := maps.Keys(nmData.GetPeerGroups(peerID))
-		resp := mgmtgrpc.ToComponentSyncResponse(ctx, nil, nil, nil, peer, nil, nil, components, nil,
+		resp := mgmtgrpc.ToComponentSyncResponse(ctx, nil, nil, nil, peer, nil, nil, components,
 			dnsDomain, nil, nmData.AccountSettings, nil, peerGroups, dnsFwdPort)
 		res, err := networkmap.EnvelopeToNetworkMap(ctx, resp.NetworkMapEnvelope, peer.Key, dnsDomain, false)
 		require.NoError(t, err, "expand envelope")
diff --git a/management/internals/server/controllers.go b/management/internals/server/controllers.go
index a9293d266..d9c8ee9d8 100644
--- a/management/internals/server/controllers.go
+++ b/management/internals/server/controllers.go
@@ -5,8 +5,6 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
-	"github.com/netbirdio/management-integrations/integrations"
-
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
 	proxymanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy/manager"
 
@@ -20,7 +18,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/auth"
 	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator"
 	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator/validator"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	nbjwt "github.com/netbirdio/netbird/shared/auth/jwt"
 )
@@ -52,12 +49,6 @@ func (s *BaseServer) IntegratedValidator() integrated_validator.IntegratedValida
 	})
 }
 
-func (s *BaseServer) ProxyController() port_forwarding.Controller {
-	return Create(s, func() port_forwarding.Controller {
-		return integrations.NewController(s.Store())
-	})
-}
-
 func (s *BaseServer) SecretsManager() grpc.SecretsManager {
 	return Create(s, func() grpc.SecretsManager {
 		secretsManager, err := grpc.NewTimeBasedAuthSecretsManager(s.PeersUpdateManager(), s.Config.TURNConfig, s.Config.Relay, s.SettingsManager(), s.GroupsManager())
@@ -123,7 +114,7 @@ func (s *BaseServer) EphemeralManager() ephemeral.Manager {
 
 func (s *BaseServer) NetworkMapController() network_map.Controller {
 	return Create(s, func() network_map.Controller {
-		return nmapcontroller.NewController(context.Background(), s.Store(), s.Metrics(), s.PeersUpdateManager(), s.AccountRequestBuffer(), s.IntegratedValidator(), s.SettingsManager(), s.DNSDomain(), s.ProxyController(), s.EphemeralManager(), s.Config, s.NetworkMapStore())
+		return nmapcontroller.NewController(context.Background(), s.Store(), s.Metrics(), s.PeersUpdateManager(), s.AccountRequestBuffer(), s.IntegratedValidator(), s.SettingsManager(), s.DNSDomain(), s.EphemeralManager(), s.Config, s.NetworkMapStore())
 	})
 }
 
diff --git a/management/internals/server/modules.go b/management/internals/server/modules.go
index 4840e40ad..f548e9238 100644
--- a/management/internals/server/modules.go
+++ b/management/internals/server/modules.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/netbirdio/management-integrations/integrations"
 
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/peers"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain/manager"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
@@ -20,7 +21,6 @@ import (
 	recordsManager "github.com/netbirdio/netbird/management/internals/modules/zones/records/manager"
 	"github.com/netbirdio/netbird/management/server"
 	"github.com/netbirdio/netbird/management/server/account"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/server/geolocation"
 	"github.com/netbirdio/netbird/management/server/groups"
 	"github.com/netbirdio/netbird/management/server/idp"
@@ -96,7 +96,7 @@ func (s *BaseServer) PeersManager() peers.Manager {
 
 func (s *BaseServer) AccountManager() account.Manager {
 	return Create(s, func() account.Manager {
-		accountManager, err := server.BuildManager(context.Background(), s.Config, s.Store(), s.NetworkMapController(), s.JobManager(), s.IdpManager(), s.mgmtSingleAccModeDomain, s.EventStore(), s.GeoLocationManager(), s.userDeleteFromIDPEnabled, s.IntegratedValidator(), s.Metrics(), s.ProxyController(), s.SettingsManager(), s.PermissionsManager(), s.Config.DisableDefaultPolicy, s.CacheStore())
+		accountManager, err := server.BuildManager(context.Background(), s.Config, s.Store(), s.NetworkMapController(), s.JobManager(), s.IdpManager(), s.mgmtSingleAccModeDomain, s.EventStore(), s.GeoLocationManager(), s.userDeleteFromIDPEnabled, s.IntegratedValidator(), s.Metrics(), s.SettingsManager(), s.PermissionsManager(), s.Config.DisableDefaultPolicy, s.CacheStore())
 		if err != nil {
 			log.Fatalf("failed to create account service: %v", err)
 		}
diff --git a/management/internals/shared/grpc/components_encoder.go b/management/internals/shared/grpc/components_encoder.go
index a2aad19b6..a4516be52 100644
--- a/management/internals/shared/grpc/components_encoder.go
+++ b/management/internals/shared/grpc/components_encoder.go
@@ -28,10 +28,6 @@ type ComponentsEnvelopeInput struct {
 	// SshAuth.UserIDClaim when reconstructing the NetworkMap. Empty value
 	// is OK — client treats empty as "no SshAuth to build".
 	UserIDClaim string
-	// ProxyPatch carries pre-expanded NetworkMap fragments injected by
-	// external controllers (BYOP/port-forwarding). Nil when no proxy data
-	// is present; encoder skips the field in that case.
-	ProxyPatch *proto.ProxyPatch
 }
 
 // EncodeNetworkMapEnvelope converts NetworkMapComponents into the component
@@ -69,7 +65,6 @@ func EncodeNetworkMapEnvelope(in ComponentsEnvelopeInput) *proto.NetworkMapEnvel
 					DnsForwarderPort: in.DNSForwarderPort,
 					UserIdClaim:      in.UserIDClaim,
 					AccountSettings:  &proto.AccountSettingsCompact{},
-					ProxyPatch:       in.ProxyPatch,
 				},
 			},
 		}
@@ -101,7 +96,6 @@ func EncodeNetworkMapEnvelope(in ComponentsEnvelopeInput) *proto.NetworkMapEnvel
 		AccountSettings:     toAccountSettingsCompact(c.AccountSettings),
 		DnsForwarderPort:    in.DNSForwarderPort,
 		UserIdClaim:         in.UserIDClaim,
-		ProxyPatch:          in.ProxyPatch,
 		DnsSettings:         enc.encodeDNSSettings(c.DNSSettings),
 		DnsDomain:           in.DNSDomain,
 		CustomZoneDomain:    c.CustomZoneDomain,
diff --git a/management/internals/shared/grpc/components_encoder_test.go b/management/internals/shared/grpc/components_encoder_test.go
index 6ee554e8b..a6421af11 100644
--- a/management/internals/shared/grpc/components_encoder_test.go
+++ b/management/internals/shared/grpc/components_encoder_test.go
@@ -713,66 +713,6 @@ func TestEncodeNetworkMapEnvelope_GroupIDToUserIDs(t *testing.T) {
 	assert.ElementsMatch(t, []string{"user-4"}, full.GroupIdToUserIds["group-users"].UserIds)
 }
 
-func TestToProxyPatch_EmptyInputReturnsNil(t *testing.T) {
-	assert.Nil(t, toProxyPatch(nil, "netbird.cloud", false, false, false))
-	assert.Nil(t, toProxyPatch(&types.NetworkMap{}, "netbird.cloud", false, false, false),
-		"empty NetworkMap (no peers, rules, routes etc) → nil patch so proto3 omits the field")
-}
-
-func TestToProxyPatch_PopulatesAllFields(t *testing.T) {
-	nm := &types.NetworkMap{
-		Peers: []*nmdata.Peer{{
-			ID: "ext-peer", Key: testWgKeyA, IP: netip.AddrFrom4([4]byte{100, 64, 0, 9}),
-			DNSLabel: "extpeer", Meta: nmdata.PeerSystemMeta{WtVersion: "0.40.0"},
-		}},
-		FirewallRules: []*types.FirewallRule{{
-			PeerIP: "100.64.0.9", Action: "accept", Direction: 0, Protocol: "tcp",
-		}},
-	}
-
-	patch := toProxyPatch(nm, "netbird.cloud", false, false, false)
-
-	require.NotNil(t, patch)
-	assert.Len(t, patch.Peers, 1)
-	assert.Len(t, patch.FirewallRules, 1)
-}
-
-// TestEncodeNetworkMapEnvelope_ProxyPatchPropagated covers the ProxyPatch
-// pass-through in both encoder branches (normal path + nil-Components
-// graceful-degrade). Guards against a regression that drops `ProxyPatch:`
-// from one of the envelope struct literals.
-func TestEncodeNetworkMapEnvelope_ProxyPatchPropagated(t *testing.T) {
-	patch := &proto.ProxyPatch{
-		ForwardingRules: []*proto.ForwardingRule{{
-			Protocol:          proto.RuleProtocol_TCP,
-			DestinationPort:   &proto.PortInfo{PortSelection: &proto.PortInfo_Port{Port: 80}},
-			TranslatedAddress: net.IPv4(10, 0, 0, 1).To4(),
-			TranslatedPort:    &proto.PortInfo{PortSelection: &proto.PortInfo_Port{Port: 8080}},
-		}},
-	}
-
-	t.Run("normal_path", func(t *testing.T) {
-		c := newTestComponents()
-		full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{
-			Components: c,
-			ProxyPatch: patch,
-		}).GetFull()
-
-		require.NotNil(t, full.ProxyPatch, "ProxyPatch must propagate through the normal encode path")
-		assert.Len(t, full.ProxyPatch.ForwardingRules, 1)
-	})
-
-	t.Run("empty_components_graceful_degrade", func(t *testing.T) {
-		full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{
-			Components: emptyNetworkMapComponents(),
-			ProxyPatch: patch,
-		}).GetFull()
-
-		require.NotNil(t, full.ProxyPatch, "ProxyPatch must propagate through the nil-Components branch too")
-		assert.Len(t, full.ProxyPatch.ForwardingRules, 1)
-	})
-}
-
 func TestEncodeNetworkMapEnvelope_NilComponentsGracefulDegrade(t *testing.T) {
 	// nil Components → minimal envelope, no crash. Matches the legacy
 	// behaviour for missing/unvalidated peers.
diff --git a/management/internals/shared/grpc/components_envelope_response.go b/management/internals/shared/grpc/components_envelope_response.go
index cdd2a7f37..cbf9bb477 100644
--- a/management/internals/shared/grpc/components_envelope_response.go
+++ b/management/internals/shared/grpc/components_envelope_response.go
@@ -9,7 +9,6 @@ import (
 	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
 	"github.com/netbirdio/netbird/management/server/types"
 	sharedgrpc "github.com/netbirdio/netbird/shared/management/grpc"
-	"github.com/netbirdio/netbird/shared/management/networkmap"
 	nmdata "github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
@@ -34,7 +33,6 @@ func ToComponentSyncResponse(
 	turnCredentials *Token,
 	relayCredentials *Token,
 	components *types.NetworkMapComponents,
-	proxyPatch *types.NetworkMap,
 	dnsName string,
 	checks []*nmdata.PostureChecks,
 	settings *nmdata.AccountSettingsInfo,
@@ -51,9 +49,6 @@ func ToComponentSyncResponse(
 	enableSSH := computeSSHEnabledForPeer(components, peer)
 	peerConfig := toPeerConfig(peer, components.Network, dnsName, settings, httpConfig, deviceFlowConfig, enableSSH, components.ForceRoutingPeerDNSResolution)
 
-	includeIPv6 := peer.SupportsIPv6() && peer.IPv6.IsValid()
-	useSourcePrefixes := peer.SupportsSourcePrefixes()
-
 	userIDClaim := auth.DefaultUserIDClaim
 	if httpConfig != nil && httpConfig.AuthUserIDClaim != "" {
 		userIDClaim = httpConfig.AuthUserIDClaim
@@ -65,7 +60,6 @@ func ToComponentSyncResponse(
 		DNSDomain:        dnsName,
 		DNSForwarderPort: dnsFwdPort,
 		UserIDClaim:      userIDClaim,
-		ProxyPatch:       toProxyPatch(proxyPatch, dnsName, includeIPv6, useSourcePrefixes, peer.ProxyMeta.Embedded),
 	})
 
 	resp := &proto.SyncResponse{
@@ -91,43 +85,6 @@ func ToComponentSyncResponse(
 	return resp
 }
 
-// toProxyPatch converts a proxy-injected *types.NetworkMap into the wire
-// patch the components envelope ships alongside. Returns nil when there are
-// no fragments to merge — proto3 omits a nil message field, so the receiver
-// sees no patch and skips the merge step entirely.
-//
-// We reuse the legacy proto-conversion helpers (toProtocolRoutes,
-// toProtocolFirewallRules, toProtocolRoutesFirewallRules,
-// appendRemotePeerConfig, ForwardingRule.ToProto) because the proxy
-// delivers fragments pre-expanded — there's no raw component shape to
-// derive them from. Components purity isn't violated: proxy data isn't
-// policy-graph-derived, it's externally injected post-Calculate, so the
-// client merges it on top of its locally-computed NetworkMap.
-func toProxyPatch(nm *types.NetworkMap, dnsName string, includeIPv6, useSourcePrefixes, localIsProxy bool) *proto.ProxyPatch {
-	if nm == nil {
-		return nil
-	}
-	if len(nm.Peers) == 0 && len(nm.OfflinePeers) == 0 && len(nm.FirewallRules) == 0 &&
-		len(nm.Routes) == 0 && len(nm.RoutesFirewallRules) == 0 && len(nm.ForwardingRules) == 0 {
-		return nil
-	}
-
-	patch := &proto.ProxyPatch{
-		Peers:              networkmap.AppendRemotePeerConfig(nil, nm.Peers, dnsName, includeIPv6, localIsProxy),
-		OfflinePeers:       networkmap.AppendRemotePeerConfig(nil, nm.OfflinePeers, dnsName, includeIPv6, localIsProxy),
-		FirewallRules:      networkmap.ToProtocolFirewallRules(nm.FirewallRules, includeIPv6, useSourcePrefixes),
-		Routes:             networkmap.ToProtocolRoutes(nm.Routes),
-		RouteFirewallRules: networkmap.ToProtocolRoutesFirewallRules(nm.RoutesFirewallRules),
-	}
-	if len(nm.ForwardingRules) > 0 {
-		patch.ForwardingRules = make([]*proto.ForwardingRule, 0, len(nm.ForwardingRules))
-		for _, r := range nm.ForwardingRules {
-			patch.ForwardingRules = append(patch.ForwardingRules, r.ToProto())
-		}
-	}
-	return patch
-}
-
 // computeSSHEnabledForPeer mirrors the SSH-server-activation bit that
 // Calculate() folds into NetworkMap.EnableSSH. Components-format peers
 // receive a freshly-computed PeerConfig.SshConfig.SshEnabled at sync time;
diff --git a/management/internals/shared/grpc/conversion.go b/management/internals/shared/grpc/conversion.go
index 96bd9f1f4..908118aff 100644
--- a/management/internals/shared/grpc/conversion.go
+++ b/management/internals/shared/grpc/conversion.go
@@ -199,14 +199,6 @@ func ToSyncResponse(ctx context.Context, config *nbconfig.Config, httpConfig *nb
 	response.NetworkMap.RoutesFirewallRules = routesFirewallRules
 	response.NetworkMap.RoutesFirewallRulesIsEmpty = len(routesFirewallRules) == 0
 
-	if networkMap.ForwardingRules != nil {
-		forwardingRules := make([]*proto.ForwardingRule, 0, len(networkMap.ForwardingRules))
-		for _, rule := range networkMap.ForwardingRules {
-			forwardingRules = append(forwardingRules, rule.ToProto())
-		}
-		response.NetworkMap.ForwardingRules = forwardingRules
-	}
-
 	if networkMap.AuthorizedUsers != nil {
 		hashedUsers, machineUsers := networkmap.BuildAuthorizedUsersProto(ctx, networkMap.AuthorizedUsers)
 		userIDClaim := auth.DefaultUserIDClaim
diff --git a/management/internals/shared/grpc/server.go b/management/internals/shared/grpc/server.go
index c178b6fa1..6e95a8998 100644
--- a/management/internals/shared/grpc/server.go
+++ b/management/internals/shared/grpc/server.go
@@ -955,12 +955,12 @@ func (s *Server) sendInitialSync(ctx context.Context, peerKey wgtypes.Key, peer
 		// stops doing duplicate work. Deferred until the client-side
 		// decoder lands and there's a real deployment of capability=3 peers
 		// worth optimizing for.
-		freshPeer, components, proxyPatch, freshPostureChecks, freshDnsFwdPort, err := s.networkMapController.GetValidatedPeerWithComponents(ctx, false, peer.AccountID, peer)
+		freshPeer, components, freshPostureChecks, freshDnsFwdPort, err := s.networkMapController.GetValidatedPeerWithComponents(ctx, false, peer.AccountID, peer)
 		if err != nil {
 			log.WithContext(ctx).Errorf("failed to build components for peer %s on initial sync: %v", peer.ID, err)
 			return status.Errorf(codes.Internal, "failed to build initial sync envelope")
 		}
-		plainResp = ToComponentSyncResponse(ctx, s.config, s.config.HttpConfig, s.config.DeviceAuthorizationFlow, types.TwinPeer(freshPeer), turnToken, relayToken, components, proxyPatch, dnsName, freshPostureChecks, types.TwinAccountSettings(settings), settings.Extra, peerGroups, freshDnsFwdPort)
+		plainResp = ToComponentSyncResponse(ctx, s.config, s.config.HttpConfig, s.config.DeviceAuthorizationFlow, types.TwinPeer(freshPeer), turnToken, relayToken, components, dnsName, freshPostureChecks, types.TwinAccountSettings(settings), settings.Extra, peerGroups, freshDnsFwdPort)
 	} else {
 		plainResp = ToSyncResponse(ctx, s.config, s.config.HttpConfig, s.config.DeviceAuthorizationFlow, types.TwinPeer(peer), turnToken, relayToken, networkMap, dnsName, postureChecks, nil, types.TwinAccountSettings(settings), settings.Extra, peerGroups, dnsFwdPort)
 	}
diff --git a/management/server/account.go b/management/server/account.go
index 038c5d8db..1b7e4d66c 100644
--- a/management/server/account.go
+++ b/management/server/account.go
@@ -35,7 +35,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/geolocation"
 	"github.com/netbirdio/netbird/management/server/idp"
 	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/permissions"
@@ -84,7 +83,6 @@ type DefaultAccountManager struct {
 
 	requestBuffer *AccountRequestBuffer
 
-	proxyController port_forwarding.Controller
 	settingsManager settings.Manager
 	serviceManager  service.Manager
 
@@ -225,7 +223,6 @@ func BuildManager(
 	userDeleteFromIDPEnabled bool,
 	integratedPeerValidator integrated_validator.IntegratedValidator,
 	metrics telemetry.AppMetrics,
-	proxyController port_forwarding.Controller,
 	settingsManager settings.Manager,
 	permissionsManager permissions.Manager,
 	disableDefaultPolicy bool,
@@ -253,7 +250,6 @@ func BuildManager(
 		integratedPeerValidator:  integratedPeerValidator,
 		metrics:                  metrics,
 		requestBuffer:            NewAccountRequestBuffer(ctx, store),
-		proxyController:          proxyController,
 		settingsManager:          settingsManager,
 		permissionsManager:       permissionsManager,
 		disableDefaultPolicy:     disableDefaultPolicy,
diff --git a/management/server/account_test.go b/management/server/account_test.go
index 6067b6023..7dc02b428 100644
--- a/management/server/account_test.go
+++ b/management/server/account_test.go
@@ -49,7 +49,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/http/testing/testing_tools"
 	"github.com/netbirdio/netbird/management/server/idp"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
@@ -3661,8 +3660,8 @@ func buildTestManager(t testing.TB, store store.Store, nmdataStore *networkmapdb
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nmdataStore)
-	manager, err := BuildManager(ctx, &config.Config{}, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nmdataStore)
+	manager, err := BuildManager(ctx, &config.Config{}, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	if err != nil {
 		return nil, nil, err
 	}
diff --git a/management/server/dns_test.go b/management/server/dns_test.go
index d21864cbb..bd1b4c923 100644
--- a/management/server/dns_test.go
+++ b/management/server/dns_test.go
@@ -16,7 +16,6 @@ import (
 	ephemeral_manager "github.com/netbirdio/netbird/management/internals/modules/peers/ephemeral/manager"
 	"github.com/netbirdio/netbird/management/internals/server/config"
 	"github.com/netbirdio/netbird/management/server/cache"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
@@ -234,9 +233,9 @@ func createDNSManager(t *testing.T) (*DefaultAccountManager, error) {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.test", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nil)
+	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.test", ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nil)
 
-	return BuildManager(context.Background(), nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	return BuildManager(context.Background(), nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 }
 
 func createDNSStore(t *testing.T) (store.Store, error) {
diff --git a/management/server/http/testing/testing_tools/channel/channel.go b/management/server/http/testing/testing_tools/channel/channel.go
index c3f6a06e0..3f2056c32 100644
--- a/management/server/http/testing/testing_tools/channel/channel.go
+++ b/management/server/http/testing/testing_tools/channel/channel.go
@@ -29,7 +29,6 @@ import (
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/update_channel"
 	"github.com/netbirdio/netbird/management/internals/modules/peers"
 	ephemeral_manager "github.com/netbirdio/netbird/management/internals/modules/peers/ephemeral/manager"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 
 	"github.com/netbirdio/netbird/management/server"
@@ -88,7 +87,6 @@ func BuildApiBlackBoxWithDBState(t testing_tools.TB, sqlFile string, expectedPee
 
 	geoMock := &geolocation.Mock{}
 	validatorMock := server.MockIntegratedValidator{}
-	proxyController := integrations.NewController(store)
 	userManager := users.NewManager(store)
 	permissionsManager := permissions.NewManager(store)
 	settingsManager := settings.NewManager(store, userManager, integrations.NewManager(&activity.InMemoryEventStore{}), permissionsManager, settings.IdpConfig{})
@@ -102,8 +100,8 @@ func BuildApiBlackBoxWithDBState(t testing_tools.TB, sqlFile string, expectedPee
 	}
 
 	requestBuffer := server.NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, peersUpdateManager, requestBuffer, server.MockIntegratedValidator{}, settingsManager, "", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peersManager), &config.Config{}, nil)
-	am, err := server.BuildManager(ctx, nil, store, networkMapController, jobManager, nil, "", &activity.InMemoryEventStore{}, geoMock, false, validatorMock, metrics, proxyController, settingsManager, permissionsManager, false, cacheStore)
+	networkMapController := controller.NewController(ctx, store, metrics, peersUpdateManager, requestBuffer, server.MockIntegratedValidator{}, settingsManager, "", ephemeral_manager.NewEphemeralManager(store, peersManager), &config.Config{}, nil)
+	am, err := server.BuildManager(ctx, nil, store, networkMapController, jobManager, nil, "", &activity.InMemoryEventStore{}, geoMock, false, validatorMock, metrics, settingsManager, permissionsManager, false, cacheStore)
 	if err != nil {
 		t.Fatalf("Failed to create manager: %v", err)
 	}
@@ -228,7 +226,6 @@ func BuildApiBlackBoxWithDBStateAndPeerChannel(t testing_tools.TB, sqlFile strin
 
 	geoMock := &geolocation.Mock{}
 	validatorMock := server.MockIntegratedValidator{}
-	proxyController := integrations.NewController(store)
 	userManager := users.NewManager(store)
 	permissionsManager := permissions.NewManager(store)
 	settingsManager := settings.NewManager(store, userManager, integrations.NewManager(&activity.InMemoryEventStore{}), permissionsManager, settings.IdpConfig{})
@@ -242,8 +239,8 @@ func BuildApiBlackBoxWithDBStateAndPeerChannel(t testing_tools.TB, sqlFile strin
 	}
 
 	requestBuffer := server.NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, peersUpdateManager, requestBuffer, server.MockIntegratedValidator{}, settingsManager, "", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peersManager), &config.Config{}, nil)
-	am, err := server.BuildManager(ctx, nil, store, networkMapController, jobManager, nil, "", &activity.InMemoryEventStore{}, geoMock, false, validatorMock, metrics, proxyController, settingsManager, permissionsManager, false, cacheStore)
+	networkMapController := controller.NewController(ctx, store, metrics, peersUpdateManager, requestBuffer, server.MockIntegratedValidator{}, settingsManager, "", ephemeral_manager.NewEphemeralManager(store, peersManager), &config.Config{}, nil)
+	am, err := server.BuildManager(ctx, nil, store, networkMapController, jobManager, nil, "", &activity.InMemoryEventStore{}, geoMock, false, validatorMock, metrics, settingsManager, permissionsManager, false, cacheStore)
 	if err != nil {
 		t.Fatalf("Failed to create manager: %v", err)
 	}
diff --git a/management/server/identity_provider_test.go b/management/server/identity_provider_test.go
index c7a8af1d2..bb576a71f 100644
--- a/management/server/identity_provider_test.go
+++ b/management/server/identity_provider_test.go
@@ -23,7 +23,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/idp"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
@@ -112,8 +111,8 @@ func createManagerWithEmbeddedIdPModeAndSetup(
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, testStore)
-	networkMapController := controller.NewController(ctx, testStore, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(testStore, peersManager), &config.Config{}, nil)
-	manager, err := BuildManager(ctx, &config.Config{}, testStore, networkMapController, job.NewJobManager(nil, testStore, peersManager), idpManager, singleAccountModeDomain, eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	networkMapController := controller.NewController(ctx, testStore, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", ephemeral_manager.NewEphemeralManager(testStore, peersManager), &config.Config{}, nil)
+	manager, err := BuildManager(ctx, &config.Config{}, testStore, networkMapController, job.NewJobManager(nil, testStore, peersManager), idpManager, singleAccountModeDomain, eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	if err != nil {
 		return nil, nil, err
 	}
diff --git a/management/server/integrations/port_forwarding/controller.go b/management/server/integrations/port_forwarding/controller.go
deleted file mode 100644
index f2ce81839..000000000
--- a/management/server/integrations/port_forwarding/controller.go
+++ /dev/null
@@ -1,38 +0,0 @@
-package port_forwarding
-
-import (
-	"context"
-
-	"github.com/netbirdio/netbird/management/server/peer"
-	nbtypes "github.com/netbirdio/netbird/management/server/types"
-)
-
-type Controller interface {
-	SendUpdate(ctx context.Context, accountID string, affectedProxyID string, affectedPeerIDs []string, accountPeers map[string]*peer.Peer)
-	GetProxyNetworkMaps(ctx context.Context, accountID, peerID string, accountPeers map[string]*peer.Peer) (map[string]*nbtypes.NetworkMap, error)
-	GetProxyNetworkMapsAll(ctx context.Context, accountID string, accountPeers map[string]*peer.Peer) (map[string]*nbtypes.NetworkMap, error)
-	IsPeerInIngressPorts(ctx context.Context, accountID, peerID string) (bool, error)
-}
-
-type ControllerMock struct {
-}
-
-func NewControllerMock() *ControllerMock {
-	return &ControllerMock{}
-}
-
-func (c *ControllerMock) SendUpdate(ctx context.Context, accountID string, affectedProxyID string, affectedPeerIDs []string, accountPeers map[string]*peer.Peer) {
-	// noop
-}
-
-func (c *ControllerMock) GetProxyNetworkMaps(ctx context.Context, accountID, peerID string, accountPeers map[string]*peer.Peer) (map[string]*nbtypes.NetworkMap, error) {
-	return make(map[string]*nbtypes.NetworkMap), nil
-}
-
-func (c *ControllerMock) GetProxyNetworkMapsAll(ctx context.Context, accountID string, accountPeers map[string]*peer.Peer) (map[string]*nbtypes.NetworkMap, error) {
-	return make(map[string]*nbtypes.NetworkMap), nil
-}
-
-func (c *ControllerMock) IsPeerInIngressPorts(ctx context.Context, accountID, peerID string) (bool, error) {
-	return false, nil
-}
diff --git a/management/server/management_proto_test.go b/management/server/management_proto_test.go
index 4f8aa8265..4e21ea7a3 100644
--- a/management/server/management_proto_test.go
+++ b/management/server/management_proto_test.go
@@ -12,9 +12,9 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
@@ -31,7 +31,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/groups"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/permissions"
@@ -376,9 +375,9 @@ func startManagementForTest(t *testing.T, testFile string, config *config.Config
 		return nil, nil, "", cleanup, err
 	}
 
-	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), ephemeralMgr, config, nil)
+	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", ephemeralMgr, config, nil)
 	accountManager, err := BuildManager(ctx, nil, store, networkMapController, jobManager, nil, "",
-		eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+		eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 
 	if err != nil {
 		cleanup()
diff --git a/management/server/management_test.go b/management/server/management_test.go
index 3a8d6ecc2..4d27e6edc 100644
--- a/management/server/management_test.go
+++ b/management/server/management_test.go
@@ -10,10 +10,10 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
 	pb "github.com/golang/protobuf/proto" //nolint
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
+	"go.uber.org/mock/gomock"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
@@ -30,7 +30,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/activity"
 	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/groups"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
@@ -216,7 +215,7 @@ func startServer(
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := server.NewAccountRequestBuffer(ctx, str)
-	networkMapController := controller.NewController(ctx, str, metrics, updateManager, requestBuffer, server.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(str, peers.NewManager(str, permissionsManager)), config, nil)
+	networkMapController := controller.NewController(ctx, str, metrics, updateManager, requestBuffer, server.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", ephemeral_manager.NewEphemeralManager(str, peers.NewManager(str, permissionsManager)), config, nil)
 
 	accountManager, err := server.BuildManager(
 		context.Background(),
@@ -231,7 +230,6 @@ func startServer(
 		false,
 		server.MockIntegratedValidator{},
 		metrics,
-		port_forwarding.NewControllerMock(),
 		settingsMockManager,
 		permissionsManager,
 		false,
diff --git a/management/server/nameserver_test.go b/management/server/nameserver_test.go
index 1460893cf..1e24390be 100644
--- a/management/server/nameserver_test.go
+++ b/management/server/nameserver_test.go
@@ -18,7 +18,6 @@ import (
 	"github.com/netbirdio/netbird/management/internals/server/config"
 	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/management/server/cache"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/permissions"
@@ -803,9 +802,9 @@ func createNSManager(t *testing.T) (*DefaultAccountManager, error) {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nil)
+	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nil)
 
-	return BuildManager(context.Background(), nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	return BuildManager(context.Background(), nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 }
 
 func createNSStore(t *testing.T) (store.Store, error) {
diff --git a/management/server/peer.go b/management/server/peer.go
index 5d5863fa7..8d99bebb0 100644
--- a/management/server/peer.go
+++ b/management/server/peer.go
@@ -1839,15 +1839,6 @@ func deletePeers(ctx context.Context, am *DefaultAccountManager, transaction sto
 
 // validatePeerDelete checks if the peer can be deleted.
 func (am *DefaultAccountManager) validatePeerDelete(ctx context.Context, transaction store.Store, accountId, peerId string) error {
-	linkedInIngressPorts, err := am.proxyController.IsPeerInIngressPorts(ctx, accountId, peerId)
-	if err != nil {
-		return err
-	}
-
-	if linkedInIngressPorts {
-		return status.Errorf(status.PreconditionFailed, "peer is linked to ingress ports: %s", peerId)
-	}
-
 	linked, router := isPeerLinkedToNetworkRouter(ctx, transaction, accountId, peerId)
 	if linked {
 		return status.Errorf(status.PreconditionFailed, "peer is linked to a network router: %s", router.ID)
diff --git a/management/server/peer_test.go b/management/server/peer_test.go
index 5307300d6..ec4f0ef01 100644
--- a/management/server/peer_test.go
+++ b/management/server/peer_test.go
@@ -40,7 +40,6 @@ import (
 	nbcontext "github.com/netbirdio/netbird/management/server/context"
 	peershandler "github.com/netbirdio/netbird/management/server/http/handlers/peers"
 	"github.com/netbirdio/netbird/management/server/http/testing/testing_tools"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
@@ -1226,20 +1225,6 @@ func TestToSyncResponse(t *testing.T) {
 		FirewallRules: []*types.FirewallRule{
 			{PeerIP: "192.168.1.2", Direction: types.FirewallRuleDirectionIN, Action: string(types.PolicyTrafficActionAccept), Protocol: string(types.PolicyRuleProtocolTCP), Port: "80"},
 		},
-		ForwardingRules: []*types.ForwardingRule{
-			{
-				RuleProtocol: "tcp",
-				DestinationPorts: types.RulePortRange{
-					Start: 1000,
-					End:   2000,
-				},
-				TranslatedAddress: net.IPv4(192, 168, 1, 2),
-				TranslatedPorts: types.RulePortRange{
-					Start: 11000,
-					End:   12000,
-				},
-			},
-		},
 	}
 	dnsName := "example.com"
 	checks := []*nmdata.PostureChecks{
@@ -1334,14 +1319,6 @@ func TestToSyncResponse(t *testing.T) {
 	// assert posture checks
 	assert.Equal(t, 1, len(response.Checks))
 	assert.Equal(t, "/usr/bin/netbird", response.Checks[0].Files[0])
-	// assert network map ForwardingRules
-	assert.Equal(t, 1, len(response.NetworkMap.ForwardingRules))
-	assert.Equal(t, proto.RuleProtocol_TCP, response.NetworkMap.ForwardingRules[0].Protocol)
-	assert.Equal(t, uint32(1000), response.NetworkMap.ForwardingRules[0].DestinationPort.GetRange().Start)
-	assert.Equal(t, uint32(2000), response.NetworkMap.ForwardingRules[0].DestinationPort.GetRange().End)
-	assert.Equal(t, net.IPv4(192, 168, 1, 2).To4(), net.IP(response.NetworkMap.ForwardingRules[0].TranslatedAddress))
-	assert.Equal(t, uint32(11000), response.NetworkMap.ForwardingRules[0].TranslatedPort.GetRange().Start)
-	assert.Equal(t, uint32(12000), response.NetworkMap.ForwardingRules[0].TranslatedPort.GetRange().End)
 }
 
 func Test_RegisterPeerByUser(t *testing.T) {
@@ -1373,9 +1350,9 @@ func Test_RegisterPeerByUser(t *testing.T) {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, s)
-	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{}, nil)
+	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{}, nil)
 
-	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	assert.NoError(t, err)
 
 	existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
@@ -1464,9 +1441,9 @@ func Test_RegisterPeerBySetupKey(t *testing.T) {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, s)
-	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{}, nil)
+	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{}, nil)
 
-	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	assert.NoError(t, err)
 
 	existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
@@ -1623,9 +1600,9 @@ func Test_RegisterPeerRollbackOnFailure(t *testing.T) {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, s)
-	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{}, nil)
+	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{}, nil)
 
-	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	assert.NoError(t, err)
 
 	existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
@@ -1708,9 +1685,9 @@ func Test_LoginPeer(t *testing.T) {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, s)
-	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{}, nil)
+	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{}, nil)
 
-	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	assert.NoError(t, err)
 
 	existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
diff --git a/management/server/route_test.go b/management/server/route_test.go
index 69b9aec6c..d4bfa417e 100644
--- a/management/server/route_test.go
+++ b/management/server/route_test.go
@@ -18,7 +18,6 @@ import (
 	"github.com/netbirdio/netbird/management/internals/server/config"
 	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/management/server/cache"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
@@ -1301,9 +1300,9 @@ func createRouterManager(t *testing.T) (*DefaultAccountManager, *update_channel.
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nil)
+	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nil)
 
-	am, err := BuildManager(ctx, nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	am, err := BuildManager(ctx, nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	if err != nil {
 		return nil, nil, err
 	}
diff --git a/management/server/types/account_networkmapdata.go b/management/server/types/account_networkmapdata.go
index 80052d393..4ebd23f95 100644
--- a/management/server/types/account_networkmapdata.go
+++ b/management/server/types/account_networkmapdata.go
@@ -213,8 +213,7 @@ func twinPeer(p *nbpeer.Peer) *nmdata.Peer {
 	}
 }
 
-// TwinPeer converts a real peer to its slim nmdata twin. Exported for the
-// port-forwarding integration, which builds proxy NetworkMaps holding twins.
+// TwinPeer converts a real peer to its slim nmdata twin.
 func TwinPeer(p *nbpeer.Peer) *nmdata.Peer {
 	return twinPeer(p)
 }
diff --git a/management/server/types/aliases.go b/management/server/types/aliases.go
index 452a2746d..fa9af12f8 100644
--- a/management/server/types/aliases.go
+++ b/management/server/types/aliases.go
@@ -15,7 +15,6 @@ import (
 type FirewallRule = sharedtypes.FirewallRule
 
 type NetworkMap = sharedtypes.NetworkMap
-type ForwardingRule = sharedtypes.ForwardingRule
 
 type PolicyTrafficActionType = sharedtypes.PolicyTrafficActionType
 type PolicyRuleProtocolType = sharedtypes.PolicyRuleProtocolType
diff --git a/management/server/types/legacynmap/aliases.go b/management/server/types/legacynmap/aliases.go
index 82a18192b..6b8f9574b 100644
--- a/management/server/types/legacynmap/aliases.go
+++ b/management/server/types/legacynmap/aliases.go
@@ -10,7 +10,6 @@ type (
 
 	DNSSettings       = types.DNSSettings
 	FirewallRule      = sharedtypes.FirewallRule
-	ForwardingRule    = sharedtypes.ForwardingRule
 	Group             = types.Group
 	Network           = types.Network
 	Policy            = types.Policy
diff --git a/management/server/types/legacynmap/converters.go b/management/server/types/legacynmap/converters.go
index 34e709413..d1cae6b63 100644
--- a/management/server/types/legacynmap/converters.go
+++ b/management/server/types/legacynmap/converters.go
@@ -19,7 +19,6 @@ type NetworkMap struct {
 	OfflinePeers        []*ComponentPeer
 	FirewallRules       []*FirewallRule
 	RoutesFirewallRules []*RouteFirewallRule
-	ForwardingRules     []*ForwardingRule
 	AuthorizedUsers     map[string]map[string]struct{}
 	EnableSSH           bool
 	// ForceRoutingPeerDNSResolution forces the peer to run/use routing-peer DNS
diff --git a/management/server/types/legacynmap/equivalence_test.go b/management/server/types/legacynmap/equivalence_test.go
index d12e666b8..20770e29b 100644
--- a/management/server/types/legacynmap/equivalence_test.go
+++ b/management/server/types/legacynmap/equivalence_test.go
@@ -320,7 +320,6 @@ func canonicalize(nm *proto.NetworkMap) {
 	slices.SortFunc(nm.Routes, cmpRoute)
 	slices.SortFunc(nm.FirewallRules, cmpFirewallRule)
 	slices.SortFunc(nm.RoutesFirewallRules, cmpRouteFirewallRule)
-	slices.SortFunc(nm.ForwardingRules, cmpForwardingRule)
 
 	for _, r := range nm.FirewallRules {
 		slices.SortFunc(r.SourcePrefixes, bytes.Compare)
@@ -550,16 +549,6 @@ func cmpRouteFirewallRule(a, b *proto.RouteFirewallRule) int {
 	return boolCmp(a.IsDynamic, b.IsDynamic)
 }
 
-func cmpForwardingRule(a, b *proto.ForwardingRule) int {
-	if a == nil || b == nil {
-		return boolCmp(a == nil, b == nil)
-	}
-	if c := cmp.Compare(int32(a.Protocol), int32(b.Protocol)); c != 0 {
-		return c
-	}
-	return bytes.Compare(a.TranslatedAddress, b.TranslatedAddress)
-}
-
 func portInfoKey(pi *proto.PortInfo) string {
 	if pi == nil {
 		return ""
@@ -591,7 +580,6 @@ func describeDivergence(legacy, updated *proto.NetworkMap, accountID, peerID str
 		{"Routes", len(legacy.Routes), len(updated.Routes), func() string { return diffLists(legacy.Routes, updated.Routes) }},
 		{"FirewallRules", len(legacy.FirewallRules), len(updated.FirewallRules), func() string { return diffLists(legacy.FirewallRules, updated.FirewallRules) }},
 		{"RoutesFirewallRules", len(legacy.RoutesFirewallRules), len(updated.RoutesFirewallRules), func() string { return diffLists(legacy.RoutesFirewallRules, updated.RoutesFirewallRules) }},
-		{"ForwardingRules", len(legacy.ForwardingRules), len(updated.ForwardingRules), func() string { return diffLists(legacy.ForwardingRules, updated.ForwardingRules) }},
 	}
 	for _, l := range lens {
 		if l.a != l.b {
diff --git a/management/server/types/legacynmap/proto_legacy.go b/management/server/types/legacynmap/proto_legacy.go
index 74451b268..36dc35401 100644
--- a/management/server/types/legacynmap/proto_legacy.go
+++ b/management/server/types/legacynmap/proto_legacy.go
@@ -186,14 +186,6 @@ func ToProtoNetworkMap(
 	pm.RoutesFirewallRules = routesFirewallRules
 	pm.RoutesFirewallRulesIsEmpty = len(routesFirewallRules) == 0
 
-	if nm.ForwardingRules != nil {
-		forwardingRules := make([]*proto.ForwardingRule, 0, len(nm.ForwardingRules))
-		for _, rule := range nm.ForwardingRules {
-			forwardingRules = append(forwardingRules, rule.ToProto())
-		}
-		pm.ForwardingRules = forwardingRules
-	}
-
 	if nm.AuthorizedUsers != nil {
 		hashedUsers, machineUsers := networkmap.BuildAuthorizedUsersProto(ctx, nm.AuthorizedUsers)
 		userIDClaim := auth.DefaultUserIDClaim
diff --git a/shared/management/client/client_test.go b/shared/management/client/client_test.go
index e6335dccb..c1d394e7e 100644
--- a/shared/management/client/client_test.go
+++ b/shared/management/client/client_test.go
@@ -10,10 +10,10 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
@@ -35,7 +35,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/activity"
 	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/groups"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/mock_server"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
@@ -128,8 +127,8 @@ func startManagement(t *testing.T) (*grpc.Server, net.Listener) {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := mgmt.NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, mgmt.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peersManger), config, nil)
-	accountManager, err := mgmt.BuildManager(context.Background(), config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, ia, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManagerMock, false, cacheStore)
+	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, mgmt.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", ephemeral_manager.NewEphemeralManager(store, peersManger), config, nil)
+	accountManager, err := mgmt.BuildManager(context.Background(), config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, ia, metrics, settingsMockManager, permissionsManagerMock, false, cacheStore)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/shared/management/client/rest/client.go b/shared/management/client/rest/client.go
index 6154a6637..7dea4a3f0 100644
--- a/shared/management/client/rest/client.go
+++ b/shared/management/client/rest/client.go
@@ -127,10 +127,6 @@ type Client struct {
 	// see more: https://docs.netbird.io/api/resources/identity-providers
 	IdentityProviders *IdentityProvidersAPI
 
-	// Ingress NetBird Ingress Peers APIs
-	// see more: https://docs.netbird.io/api/resources/ingress-ports
-	Ingress *IngressAPI
-
 	// Instance NetBird Instance API
 	// see more: https://docs.netbird.io/api/resources/instance
 	Instance *InstanceAPI
@@ -207,7 +203,6 @@ func (c *Client) initialize() {
 	c.OktaScimIDP = &OktaScimIDPAPI{c}
 	c.EventStreaming = &EventStreamingAPI{c}
 	c.IdentityProviders = &IdentityProvidersAPI{c}
-	c.Ingress = &IngressAPI{c}
 	c.Instance = &InstanceAPI{c}
 	c.ReverseProxyServices = &ReverseProxyServicesAPI{c}
 	c.ReverseProxyClusters = &ReverseProxyClustersAPI{c}
diff --git a/shared/management/client/rest/ingress.go b/shared/management/client/rest/ingress.go
deleted file mode 100644
index f69288d7e..000000000
--- a/shared/management/client/rest/ingress.go
+++ /dev/null
@@ -1,92 +0,0 @@
-package rest
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-
-	"github.com/netbirdio/netbird/shared/management/http/api"
-)
-
-// IngressAPI APIs for Ingress Peers, do not use directly
-type IngressAPI struct {
-	c *Client
-}
-
-// List all ingress peers
-// See more: https://docs.netbird.io/api/resources/ingress#list-all-ingress-peers
-func (a *IngressAPI) List(ctx context.Context) ([]api.IngressPeer, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/ingress/peers", nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[[]api.IngressPeer](resp)
-	return ret, err
-}
-
-// Get ingress peer info
-// See more: https://docs.netbird.io/api/resources/ingress#retrieve-an-ingress-peer
-func (a *IngressAPI) Get(ctx context.Context, ingressPeerID string) (*api.IngressPeer, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/ingress/peers/"+ingressPeerID, nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.IngressPeer](resp)
-	return &ret, err
-}
-
-// Create new ingress peer
-// See more: https://docs.netbird.io/api/resources/ingress#create-an-ingress-peer
-func (a *IngressAPI) Create(ctx context.Context, request api.PostApiIngressPeersJSONRequestBody) (*api.IngressPeer, error) {
-	requestBytes, err := json.Marshal(request)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := a.c.NewRequest(ctx, "POST", "/api/ingress/peers", bytes.NewReader(requestBytes), nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.IngressPeer](resp)
-	return &ret, err
-}
-
-// Update update ingress peer
-// See more: https://docs.netbird.io/api/resources/ingress#update-an-ingress-peer
-func (a *IngressAPI) Update(ctx context.Context, ingressPeerID string, request api.PutApiIngressPeersIngressPeerIdJSONRequestBody) (*api.IngressPeer, error) {
-	requestBytes, err := json.Marshal(request)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := a.c.NewRequest(ctx, "PUT", "/api/ingress/peers/"+ingressPeerID, bytes.NewReader(requestBytes), nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.IngressPeer](resp)
-	return &ret, err
-}
-
-// Delete delete ingress peer
-// See more: https://docs.netbird.io/api/resources/ingress#delete-an-ingress-peer
-func (a *IngressAPI) Delete(ctx context.Context, ingressPeerID string) error {
-	resp, err := a.c.NewRequest(ctx, "DELETE", "/api/ingress/peers/"+ingressPeerID, nil, nil)
-	if err != nil {
-		return err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-
-	return nil
-}
diff --git a/shared/management/client/rest/ingress_test.go b/shared/management/client/rest/ingress_test.go
deleted file mode 100644
index c915db094..000000000
--- a/shared/management/client/rest/ingress_test.go
+++ /dev/null
@@ -1,184 +0,0 @@
-//go:build integration
-
-package rest_test
-
-import (
-	"context"
-	"encoding/json"
-	"io"
-	"net/http"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/shared/management/client/rest"
-	"github.com/netbirdio/netbird/shared/management/http/api"
-	"github.com/netbirdio/netbird/shared/management/http/util"
-)
-
-var testIngressPeer = api.IngressPeer{
-	Connected: true,
-	Enabled:   true,
-	Id:        "Test",
-}
-
-func TestIngress_List_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/ingress/peers", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal([]api.IngressPeer{testIngressPeer})
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Ingress.List(context.Background())
-		require.NoError(t, err)
-		assert.Len(t, ret, 1)
-		assert.Equal(t, testIngressPeer, ret[0])
-	})
-}
-
-func TestIngress_List_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/ingress/peers", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "No", Code: 400})
-			w.WriteHeader(400)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Ingress.List(context.Background())
-		assert.Error(t, err)
-		assert.Equal(t, "No", err.Error())
-		assert.Empty(t, ret)
-	})
-}
-
-func TestIngress_Get_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/ingress/peers/Test", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(testIngressPeer)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Ingress.Get(context.Background(), "Test")
-		require.NoError(t, err)
-		assert.Equal(t, testIngressPeer, *ret)
-	})
-}
-
-func TestIngress_Get_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/ingress/peers/Test", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "No", Code: 400})
-			w.WriteHeader(400)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Ingress.Get(context.Background(), "Test")
-		assert.Error(t, err)
-		assert.Equal(t, "No", err.Error())
-		assert.Empty(t, ret)
-	})
-}
-
-func TestIngress_Create_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/ingress/peers", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "POST", r.Method)
-			reqBytes, err := io.ReadAll(r.Body)
-			require.NoError(t, err)
-			var req api.PostApiIngressPeersJSONRequestBody
-			err = json.Unmarshal(reqBytes, &req)
-			require.NoError(t, err)
-			assert.Equal(t, "peer-id", req.PeerId)
-			retBytes, _ := json.Marshal(testIngressPeer)
-			_, err = w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Ingress.Create(context.Background(), api.PostApiIngressPeersJSONRequestBody{
-			PeerId: "peer-id",
-		})
-		require.NoError(t, err)
-		assert.Equal(t, testIngressPeer, *ret)
-	})
-}
-
-func TestIngress_Create_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/ingress/peers", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "No", Code: 400})
-			w.WriteHeader(400)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Ingress.Create(context.Background(), api.PostApiIngressPeersJSONRequestBody{
-			PeerId: "peer-id",
-		})
-		assert.Error(t, err)
-		assert.Equal(t, "No", err.Error())
-		assert.Nil(t, ret)
-	})
-}
-
-func TestIngress_Update_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/ingress/peers/Test", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "PUT", r.Method)
-			reqBytes, err := io.ReadAll(r.Body)
-			require.NoError(t, err)
-			var req api.PutApiIngressPeersIngressPeerIdJSONRequestBody
-			err = json.Unmarshal(reqBytes, &req)
-			require.NoError(t, err)
-			assert.Equal(t, true, req.Enabled)
-			retBytes, _ := json.Marshal(testIngressPeer)
-			_, err = w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Ingress.Update(context.Background(), "Test", api.PutApiIngressPeersIngressPeerIdJSONRequestBody{
-			Enabled: true,
-		})
-		require.NoError(t, err)
-		assert.Equal(t, testIngressPeer, *ret)
-	})
-}
-
-func TestIngress_Update_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/ingress/peers/Test", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "No", Code: 400})
-			w.WriteHeader(400)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Ingress.Update(context.Background(), "Test", api.PutApiIngressPeersIngressPeerIdJSONRequestBody{
-			Enabled: true,
-		})
-		assert.Error(t, err)
-		assert.Equal(t, "No", err.Error())
-		assert.Nil(t, ret)
-	})
-}
-
-func TestIngress_Delete_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/ingress/peers/Test", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "DELETE", r.Method)
-			w.WriteHeader(200)
-		})
-		err := c.Ingress.Delete(context.Background(), "Test")
-		require.NoError(t, err)
-	})
-}
-
-func TestIngress_Delete_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/ingress/peers/Test", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "Not found", Code: 404})
-			w.WriteHeader(404)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		err := c.Ingress.Delete(context.Background(), "Test")
-		assert.Error(t, err)
-		assert.Equal(t, "Not found", err.Error())
-	})
-}
diff --git a/shared/management/client/rest/peers.go b/shared/management/client/rest/peers.go
index b22bcae67..30faff925 100644
--- a/shared/management/client/rest/peers.go
+++ b/shared/management/client/rest/peers.go
@@ -125,98 +125,6 @@ func (a *PeersAPI) CreateTemporaryAccess(ctx context.Context, peerID string, req
 	return &ret, err
 }
 
-// PeerIngressPortsAPI APIs for Peer Ingress Ports, do not use directly
-type PeerIngressPortsAPI struct {
-	c      *Client
-	peerID string
-}
-
-// IngressPorts APIs for peer ingress ports
-func (a *PeersAPI) IngressPorts(peerID string) *PeerIngressPortsAPI {
-	return &PeerIngressPortsAPI{
-		c:      a.c,
-		peerID: peerID,
-	}
-}
-
-// List list all ingress port allocations for a peer
-// See more: https://docs.netbird.io/api/resources/peers#list-all-ingress-port-allocations
-func (a *PeerIngressPortsAPI) List(ctx context.Context) ([]api.IngressPortAllocation, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/peers/"+a.peerID+"/ingress/ports", nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[[]api.IngressPortAllocation](resp)
-	return ret, err
-}
-
-// Get get ingress port allocation info
-// See more: https://docs.netbird.io/api/resources/peers#retrieve-an-ingress-port-allocation
-func (a *PeerIngressPortsAPI) Get(ctx context.Context, allocationID string) (*api.IngressPortAllocation, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/peers/"+a.peerID+"/ingress/ports/"+allocationID, nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.IngressPortAllocation](resp)
-	return &ret, err
-}
-
-// Create create new ingress port allocation
-// See more: https://docs.netbird.io/api/resources/peers#create-an-ingress-port-allocation
-func (a *PeerIngressPortsAPI) Create(ctx context.Context, request api.PostApiPeersPeerIdIngressPortsJSONRequestBody) (*api.IngressPortAllocation, error) {
-	requestBytes, err := json.Marshal(request)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := a.c.NewRequest(ctx, "POST", "/api/peers/"+a.peerID+"/ingress/ports", bytes.NewReader(requestBytes), nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.IngressPortAllocation](resp)
-	return &ret, err
-}
-
-// Update update ingress port allocation
-// See more: https://docs.netbird.io/api/resources/peers#update-an-ingress-port-allocation
-func (a *PeerIngressPortsAPI) Update(ctx context.Context, allocationID string, request api.PutApiPeersPeerIdIngressPortsAllocationIdJSONRequestBody) (*api.IngressPortAllocation, error) {
-	requestBytes, err := json.Marshal(request)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := a.c.NewRequest(ctx, "PUT", "/api/peers/"+a.peerID+"/ingress/ports/"+allocationID, bytes.NewReader(requestBytes), nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.IngressPortAllocation](resp)
-	return &ret, err
-}
-
-// Delete delete ingress port allocation
-// See more: https://docs.netbird.io/api/resources/peers#delete-an-ingress-port-allocation
-func (a *PeerIngressPortsAPI) Delete(ctx context.Context, allocationID string) error {
-	resp, err := a.c.NewRequest(ctx, "DELETE", "/api/peers/"+a.peerID+"/ingress/ports/"+allocationID, nil, nil)
-	if err != nil {
-		return err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-
-	return nil
-}
-
 // PeerJobsAPI APIs for Peer Jobs, do not use directly
 type PeerJobsAPI struct {
 	c      *Client
diff --git a/shared/management/client/rest/peers_test.go b/shared/management/client/rest/peers_test.go
index 5724b57f9..7370b238b 100644
--- a/shared/management/client/rest/peers_test.go
+++ b/shared/management/client/rest/peers_test.go
@@ -31,11 +31,6 @@ var (
 		Name: "test-peer",
 	}
 
-	testIngressPortAllocation = api.IngressPortAllocation{
-		Enabled: true,
-		Id:      "alloc-1",
-	}
-
 	testJobResponse = api.JobResponse{
 		Id:     "job-1",
 		Status: "pending",
@@ -221,146 +216,6 @@ func TestPeers_CreateTemporaryAccess_Err(t *testing.T) {
 	})
 }
 
-func TestPeerIngressPorts_List_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/peers/Test/ingress/ports", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal([]api.IngressPortAllocation{testIngressPortAllocation})
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Peers.IngressPorts("Test").List(context.Background())
-		require.NoError(t, err)
-		assert.Len(t, ret, 1)
-		assert.Equal(t, testIngressPortAllocation, ret[0])
-	})
-}
-
-func TestPeerIngressPorts_List_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/peers/Test/ingress/ports", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "No", Code: 400})
-			w.WriteHeader(400)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Peers.IngressPorts("Test").List(context.Background())
-		assert.Error(t, err)
-		assert.Equal(t, "No", err.Error())
-		assert.Empty(t, ret)
-	})
-}
-
-func TestPeerIngressPorts_Get_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/peers/Test/ingress/ports/alloc-1", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(testIngressPortAllocation)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Peers.IngressPorts("Test").Get(context.Background(), "alloc-1")
-		require.NoError(t, err)
-		assert.Equal(t, testIngressPortAllocation, *ret)
-	})
-}
-
-func TestPeerIngressPorts_Get_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/peers/Test/ingress/ports/alloc-1", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "No", Code: 400})
-			w.WriteHeader(400)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Peers.IngressPorts("Test").Get(context.Background(), "alloc-1")
-		assert.Error(t, err)
-		assert.Equal(t, "No", err.Error())
-		assert.Empty(t, ret)
-	})
-}
-
-func TestPeerIngressPorts_Create_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/peers/Test/ingress/ports", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "POST", r.Method)
-			retBytes, _ := json.Marshal(testIngressPortAllocation)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Peers.IngressPorts("Test").Create(context.Background(), api.PostApiPeersPeerIdIngressPortsJSONRequestBody{})
-		require.NoError(t, err)
-		assert.Equal(t, testIngressPortAllocation, *ret)
-	})
-}
-
-func TestPeerIngressPorts_Create_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/peers/Test/ingress/ports", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "No", Code: 400})
-			w.WriteHeader(400)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Peers.IngressPorts("Test").Create(context.Background(), api.PostApiPeersPeerIdIngressPortsJSONRequestBody{})
-		assert.Error(t, err)
-		assert.Equal(t, "No", err.Error())
-		assert.Nil(t, ret)
-	})
-}
-
-func TestPeerIngressPorts_Update_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/peers/Test/ingress/ports/alloc-1", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "PUT", r.Method)
-			retBytes, _ := json.Marshal(testIngressPortAllocation)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Peers.IngressPorts("Test").Update(context.Background(), "alloc-1", api.PutApiPeersPeerIdIngressPortsAllocationIdJSONRequestBody{})
-		require.NoError(t, err)
-		assert.Equal(t, testIngressPortAllocation, *ret)
-	})
-}
-
-func TestPeerIngressPorts_Update_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/peers/Test/ingress/ports/alloc-1", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "No", Code: 400})
-			w.WriteHeader(400)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.Peers.IngressPorts("Test").Update(context.Background(), "alloc-1", api.PutApiPeersPeerIdIngressPortsAllocationIdJSONRequestBody{})
-		assert.Error(t, err)
-		assert.Equal(t, "No", err.Error())
-		assert.Nil(t, ret)
-	})
-}
-
-func TestPeerIngressPorts_Delete_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/peers/Test/ingress/ports/alloc-1", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "DELETE", r.Method)
-			w.WriteHeader(200)
-		})
-		err := c.Peers.IngressPorts("Test").Delete(context.Background(), "alloc-1")
-		require.NoError(t, err)
-	})
-}
-
-func TestPeerIngressPorts_Delete_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/peers/Test/ingress/ports/alloc-1", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "Not found", Code: 404})
-			w.WriteHeader(404)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		err := c.Peers.IngressPorts("Test").Delete(context.Background(), "alloc-1")
-		assert.Error(t, err)
-		assert.Equal(t, "Not found", err.Error())
-	})
-}
-
 func TestPeerJobs_List_200(t *testing.T) {
 	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
 		mux.HandleFunc("/api/peers/Test/jobs", func(w http.ResponseWriter, r *http.Request) {
diff --git a/shared/management/http/api/openapi.yml b/shared/management/http/api/openapi.yml
index 90b87462f..a8e0a7a56 100644
--- a/shared/management/http/api/openapi.yml
+++ b/shared/management/http/api/openapi.yml
@@ -31,9 +31,6 @@ tags:
     description: View information about the account and network events.
   - name: Accounts
     description: View information about the accounts.
-  - name: Ingress Ports
-    description: Interact with and view information about the ingress peers and ports.
-    x-cloud-only: true
   - name: Identity Providers
     description: Interact with and view information about identity providers.
   - name: Services
@@ -2439,222 +2436,6 @@ components:
         - initiator_email
         - target_id
         - meta
-    IngressPeerCreateRequest:
-      type: object
-      properties:
-        peer_id:
-          description: ID of the peer that is used as an ingress peer
-          type: string
-          example: ch8i4ug6lnn4g9hqv7m0
-        enabled:
-          description: Defines if an ingress peer is enabled
-          type: boolean
-          example: true
-        fallback:
-          description: Defines if an ingress peer can be used as a fallback if no ingress peer can be found in the region of the forwarded peer
-          type: boolean
-          example: true
-      required:
-        - peer_id
-        - enabled
-        - fallback
-    IngressPeerUpdateRequest:
-      type: object
-      properties:
-        enabled:
-          description: Defines if an ingress peer is enabled
-          type: boolean
-          example: true
-        fallback:
-          description: Defines if an ingress peer can be used as a fallback if no ingress peer can be found in the region of the forwarded peer
-          type: boolean
-          example: true
-      required:
-        - enabled
-        - fallback
-    IngressPeer:
-      type: object
-      properties:
-        id:
-          description: ID of the ingress peer
-          type: string
-          example: ch8i4ug6lnn4g9hqv7m0
-        peer_id:
-          description: ID of the peer that is used as an ingress peer
-          type: string
-          example: x7p3kqf2rdd8j5zxw4n9
-        ingress_ip:
-          description: Ingress IP address of the ingress peer where the traffic arrives
-          type: string
-          example: 192.34.0.123
-        available_ports:
-          $ref: '#/components/schemas/AvailablePorts'
-        enabled:
-          description: Indicates if an ingress peer is enabled
-          type: boolean
-          example: true
-        connected:
-          description: Indicates if an ingress peer is connected to the management server
-          type: boolean
-          example: true
-        fallback:
-          description: Indicates if an ingress peer can be used as a fallback if no ingress peer can be found in the region of the forwarded peer
-          type: boolean
-          example: true
-        region:
-          description: Region of the ingress peer
-          type: string
-          example: germany
-      required:
-        - id
-        - peer_id
-        - ingress_ip
-        - available_ports
-        - enabled
-        - connected
-        - fallback
-        - region
-    AvailablePorts:
-      type: object
-      properties:
-        tcp:
-          description: Number of available TCP  ports left on the ingress peer
-          type: integer
-          example: 45765
-        udp:
-          description: Number of available UDP ports left on the ingress peer
-          type: integer
-          example: 50000
-      required:
-        - tcp
-        - udp
-    IngressPortAllocationRequest:
-      type: object
-      properties:
-        name:
-          description: Name of the ingress port allocation
-          type: string
-          example: Ingress Port Allocation 1
-        enabled:
-          description: Indicates if an ingress port allocation is enabled
-          type: boolean
-          example: true
-        port_ranges:
-          description: List of port ranges that are forwarded by the ingress peer
-          type: array
-          items:
-            $ref: '#/components/schemas/IngressPortAllocationRequestPortRange'
-        direct_port:
-          description: Direct port allocation
-          $ref: '#/components/schemas/IngressPortAllocationRequestDirectPort'
-      required:
-        - name
-        - enabled
-    IngressPortAllocationRequestPortRange:
-      type: object
-      properties:
-        start:
-          description: The starting port of the range of forwarded ports
-          type: integer
-          example: 80
-        end:
-          description: The ending port of the range of forwarded ports
-          type: integer
-          example: 320
-        protocol:
-          description: The protocol accepted by the port range
-          type: string
-          enum: [ "tcp", "udp", "tcp/udp" ]
-          example: tcp
-      required:
-        - start
-        - end
-        - protocol
-    IngressPortAllocationRequestDirectPort:
-      type: object
-      properties:
-        count:
-          description: The number of ports to be forwarded
-          type: integer
-          example: 5
-        protocol:
-          description: The protocol accepted by the port
-          type: string
-          enum: [ "tcp", "udp", "tcp/udp" ]
-          example: udp
-      required:
-        - count
-        - protocol
-    IngressPortAllocation:
-      type: object
-      properties:
-        id:
-          description: ID of the ingress port allocation
-          type: string
-          example: ch8i4ug6lnn4g9hqv7m0
-        name:
-          description: Name of the ingress port allocation
-          type: string
-          example: Ingress Peer Allocation 1
-        ingress_peer_id:
-          description: ID of the ingress peer that forwards the ports
-          type: string
-          example: x7p3kqf2rdd8j5zxw4n9
-        region:
-          description: Region of the ingress peer
-          type: string
-          example: germany
-        enabled:
-          description: Indicates if an ingress port allocation is enabled
-          type: boolean
-          example: true
-        ingress_ip:
-          description: Ingress IP address of the ingress peer where the traffic arrives
-          type: string
-          example: 192.34.0.123
-        port_range_mappings:
-          description: List of port ranges that are allowed to be used by the ingress peer
-          type: array
-          items:
-            $ref: '#/components/schemas/IngressPortAllocationPortMapping'
-      required:
-        - id
-        - name
-        - ingress_peer_id
-        - region
-        - enabled
-        - ingress_ip
-        - port_range_mappings
-    IngressPortAllocationPortMapping:
-      type: object
-      properties:
-        translated_start:
-          description: The starting port of the translated range of forwarded ports
-          type: integer
-          example: 80
-        translated_end:
-          description: The ending port of the translated range of forwarded ports
-          type: integer
-          example: 320
-        ingress_start:
-          description: The starting port of the range of ingress ports mapped to the forwarded ports
-          type: integer
-          example: 1080
-        ingress_end:
-          description: The ending port of the range of ingress ports mapped to the forwarded ports
-          type: integer
-          example: 1320
-        protocol:
-          description: Protocol accepted by the ports
-          type: string
-          enum: [ "tcp", "udp", "tcp/udp" ]
-          example: tcp
-      required:
-        - translated_start
-        - translated_end
-        - ingress_start
-        - ingress_end
-        - protocol
     NetworkTrafficLocation:
       type: object
       properties:
@@ -7719,341 +7500,6 @@ paths:
           "$ref": "#/components/responses/forbidden"
         '500':
           "$ref": "#/components/responses/internal_error"
-  /api/peers/{peerId}/ingress/ports:
-    get:
-      x-cloud-only: true
-      summary: List all Port Allocations
-      description: Returns a list of all ingress port allocations for a peer
-      tags: [ Ingress Ports ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      parameters:
-        - in: path
-          name: peerId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of a peer
-        - in: query
-          name: name
-          schema:
-            type: string
-          description: Filters ingress port allocations by name
-      responses:
-        '200':
-          description: A JSON Array of Ingress Port Allocations
-          content:
-            application/json:
-              schema:
-                type: array
-                items:
-                  $ref: '#/components/schemas/IngressPortAllocation'
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '500':
-          "$ref": "#/components/responses/internal_error"
-    post:
-      x-cloud-only: true
-      summary: Create a Port Allocation
-      description: Creates a new ingress port allocation for a peer
-      tags: [ Ingress Ports ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      parameters:
-        - in: path
-          name: peerId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of a peer
-      requestBody:
-        description: New Ingress Port Allocation request
-        content:
-          'application/json':
-            schema:
-              $ref: '#/components/schemas/IngressPortAllocationRequest'
-      responses:
-        '200':
-          description: A Ingress Port Allocation object
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/IngressPortAllocation'
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '500':
-          "$ref": "#/components/responses/internal_error"
-  /api/peers/{peerId}/ingress/ports/{allocationId}:
-    get:
-      x-cloud-only: true
-      summary: Retrieve a Port Allocation
-      description: Get information about an ingress port allocation
-      tags: [ Ingress Ports ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      parameters:
-        - in: path
-          name: peerId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of a peer
-        - in: path
-          name: allocationId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of an ingress port allocation
-      responses:
-        '200':
-          description: A Ingress Port Allocation object
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/IngressPortAllocation'
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '500':
-          "$ref": "#/components/responses/internal_error"
-    put:
-      x-cloud-only: true
-      summary: Update a Port Allocation
-      description: Update information about an ingress port allocation
-      tags: [ Ingress Ports ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      parameters:
-        - in: path
-          name: peerId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of a peer
-        - in: path
-          name: allocationId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of an ingress port allocation
-      requestBody:
-        description: update an ingress port allocation
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/IngressPortAllocationRequest'
-      responses:
-        '200':
-          description: A Ingress Port Allocation object
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/IngressPortAllocation'
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '500':
-          "$ref": "#/components/responses/internal_error"
-    delete:
-      x-cloud-only: true
-      summary: Delete a Port Allocation
-      description: Delete an ingress port allocation
-      tags: [ Ingress Ports ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      parameters:
-        - in: path
-          name: peerId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of a peer
-        - in: path
-          name: allocationId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of an ingress port allocation
-      responses:
-        '200':
-          description: Delete status code
-          content: { }
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '500':
-          "$ref": "#/components/responses/internal_error"
-  /api/ingress/peers:
-    get:
-      x-cloud-only: true
-      summary: List all Ingress Peers
-      description: Returns a list of all ingress peers
-      tags: [ Ingress Ports ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      responses:
-        '200':
-          description: A JSON Array of Ingress Peers
-          content:
-            application/json:
-              schema:
-                type: array
-                items:
-                  $ref: '#/components/schemas/IngressPeer'
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '500':
-          "$ref": "#/components/responses/internal_error"
-    post:
-      x-cloud-only: true
-      summary: Create a Ingress Peer
-      description: Creates a new ingress peer
-      tags: [ Ingress Ports ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      requestBody:
-        description: New Ingress Peer request
-        content:
-          'application/json':
-            schema:
-              $ref: '#/components/schemas/IngressPeerCreateRequest'
-      responses:
-        '200':
-          description: A Ingress Peer object
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/IngressPeer'
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '500':
-          "$ref": "#/components/responses/internal_error"
-  /api/ingress/peers/{ingressPeerId}:
-    get:
-      x-cloud-only: true
-      summary: Retrieve a Ingress Peer
-      description: Get information about an ingress peer
-      tags: [ Ingress Ports ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      parameters:
-        - in: path
-          name: ingressPeerId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of an ingress peer
-      responses:
-        '200':
-          description: A Ingress Peer object
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/IngressPeer'
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '500':
-          "$ref": "#/components/responses/internal_error"
-    put:
-      x-cloud-only: true
-      summary: Update a Ingress Peer
-      description: Update information about an ingress peer
-      tags: [ Ingress Ports ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      parameters:
-        - in: path
-          name: ingressPeerId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of an ingress peer
-      requestBody:
-        description: update an ingress peer
-        content:
-          'application/json':
-            schema:
-              $ref: '#/components/schemas/IngressPeerUpdateRequest'
-      responses:
-        '200':
-          description: A Ingress Peer object
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/IngressPeer'
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '500':
-          "$ref": "#/components/responses/internal_error"
-    delete:
-      x-cloud-only: true
-      summary: Delete a Ingress Peer
-      description: Delete an ingress peer
-      tags: [ Ingress Ports ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      parameters:
-        - in: path
-          name: ingressPeerId
-          required: true
-          schema:
-            type: string
-          description: The unique identifier of an ingress peer
-      responses:
-        '200':
-          description: Delete status code
-          content: { }
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '500':
-          "$ref": "#/components/responses/internal_error"
   /api/setup-keys:
     get:
       summary: List all Setup Keys
diff --git a/shared/management/http/api/types.gen.go b/shared/management/http/api/types.gen.go
index 009a9a7a7..9be676a91 100644
--- a/shared/management/http/api/types.gen.go
+++ b/shared/management/http/api/types.gen.go
@@ -608,69 +608,6 @@ func (e IdentityProviderType) Valid() bool {
 	}
 }
 
-// Defines values for IngressPortAllocationPortMappingProtocol.
-const (
-	IngressPortAllocationPortMappingProtocolTcp    IngressPortAllocationPortMappingProtocol = "tcp"
-	IngressPortAllocationPortMappingProtocolTcpudp IngressPortAllocationPortMappingProtocol = "tcp/udp"
-	IngressPortAllocationPortMappingProtocolUdp    IngressPortAllocationPortMappingProtocol = "udp"
-)
-
-// Valid indicates whether the value is a known member of the IngressPortAllocationPortMappingProtocol enum.
-func (e IngressPortAllocationPortMappingProtocol) Valid() bool {
-	switch e {
-	case IngressPortAllocationPortMappingProtocolTcp:
-		return true
-	case IngressPortAllocationPortMappingProtocolTcpudp:
-		return true
-	case IngressPortAllocationPortMappingProtocolUdp:
-		return true
-	default:
-		return false
-	}
-}
-
-// Defines values for IngressPortAllocationRequestDirectPortProtocol.
-const (
-	IngressPortAllocationRequestDirectPortProtocolTcp    IngressPortAllocationRequestDirectPortProtocol = "tcp"
-	IngressPortAllocationRequestDirectPortProtocolTcpudp IngressPortAllocationRequestDirectPortProtocol = "tcp/udp"
-	IngressPortAllocationRequestDirectPortProtocolUdp    IngressPortAllocationRequestDirectPortProtocol = "udp"
-)
-
-// Valid indicates whether the value is a known member of the IngressPortAllocationRequestDirectPortProtocol enum.
-func (e IngressPortAllocationRequestDirectPortProtocol) Valid() bool {
-	switch e {
-	case IngressPortAllocationRequestDirectPortProtocolTcp:
-		return true
-	case IngressPortAllocationRequestDirectPortProtocolTcpudp:
-		return true
-	case IngressPortAllocationRequestDirectPortProtocolUdp:
-		return true
-	default:
-		return false
-	}
-}
-
-// Defines values for IngressPortAllocationRequestPortRangeProtocol.
-const (
-	IngressPortAllocationRequestPortRangeProtocolTcp    IngressPortAllocationRequestPortRangeProtocol = "tcp"
-	IngressPortAllocationRequestPortRangeProtocolTcpudp IngressPortAllocationRequestPortRangeProtocol = "tcp/udp"
-	IngressPortAllocationRequestPortRangeProtocolUdp    IngressPortAllocationRequestPortRangeProtocol = "udp"
-)
-
-// Valid indicates whether the value is a known member of the IngressPortAllocationRequestPortRangeProtocol enum.
-func (e IngressPortAllocationRequestPortRangeProtocol) Valid() bool {
-	switch e {
-	case IngressPortAllocationRequestPortRangeProtocolTcp:
-		return true
-	case IngressPortAllocationRequestPortRangeProtocolTcpudp:
-		return true
-	case IngressPortAllocationRequestPortRangeProtocolUdp:
-		return true
-	default:
-		return false
-	}
-}
-
 // Defines values for IntegrationResponsePlatform.
 const (
 	IntegrationResponsePlatformDatadog     IntegrationResponsePlatform = "datadog"
@@ -2600,15 +2537,6 @@ type AgentNetworkUsageBucket struct {
 	TotalTokens int64 `json:"total_tokens"`
 }
 
-// AvailablePorts defines model for AvailablePorts.
-type AvailablePorts struct {
-	// Tcp Number of available TCP  ports left on the ingress peer
-	Tcp int `json:"tcp"`
-
-	// Udp Number of available UDP ports left on the ingress peer
-	Udp int `json:"udp"`
-}
-
 // AzureIntegration defines model for AzureIntegration.
 type AzureIntegration struct {
 	// ClientId Azure AD application (client) ID
@@ -3461,139 +3389,6 @@ type IdpIntegrationSyncLog struct {
 	Timestamp time.Time `json:"timestamp"`
 }
 
-// IngressPeer defines model for IngressPeer.
-type IngressPeer struct {
-	AvailablePorts AvailablePorts `json:"available_ports"`
-
-	// Connected Indicates if an ingress peer is connected to the management server
-	Connected bool `json:"connected"`
-
-	// Enabled Indicates if an ingress peer is enabled
-	Enabled bool `json:"enabled"`
-
-	// Fallback Indicates if an ingress peer can be used as a fallback if no ingress peer can be found in the region of the forwarded peer
-	Fallback bool `json:"fallback"`
-
-	// Id ID of the ingress peer
-	Id string `json:"id"`
-
-	// IngressIp Ingress IP address of the ingress peer where the traffic arrives
-	IngressIp string `json:"ingress_ip"`
-
-	// PeerId ID of the peer that is used as an ingress peer
-	PeerId string `json:"peer_id"`
-
-	// Region Region of the ingress peer
-	Region string `json:"region"`
-}
-
-// IngressPeerCreateRequest defines model for IngressPeerCreateRequest.
-type IngressPeerCreateRequest struct {
-	// Enabled Defines if an ingress peer is enabled
-	Enabled bool `json:"enabled"`
-
-	// Fallback Defines if an ingress peer can be used as a fallback if no ingress peer can be found in the region of the forwarded peer
-	Fallback bool `json:"fallback"`
-
-	// PeerId ID of the peer that is used as an ingress peer
-	PeerId string `json:"peer_id"`
-}
-
-// IngressPeerUpdateRequest defines model for IngressPeerUpdateRequest.
-type IngressPeerUpdateRequest struct {
-	// Enabled Defines if an ingress peer is enabled
-	Enabled bool `json:"enabled"`
-
-	// Fallback Defines if an ingress peer can be used as a fallback if no ingress peer can be found in the region of the forwarded peer
-	Fallback bool `json:"fallback"`
-}
-
-// IngressPortAllocation defines model for IngressPortAllocation.
-type IngressPortAllocation struct {
-	// Enabled Indicates if an ingress port allocation is enabled
-	Enabled bool `json:"enabled"`
-
-	// Id ID of the ingress port allocation
-	Id string `json:"id"`
-
-	// IngressIp Ingress IP address of the ingress peer where the traffic arrives
-	IngressIp string `json:"ingress_ip"`
-
-	// IngressPeerId ID of the ingress peer that forwards the ports
-	IngressPeerId string `json:"ingress_peer_id"`
-
-	// Name Name of the ingress port allocation
-	Name string `json:"name"`
-
-	// PortRangeMappings List of port ranges that are allowed to be used by the ingress peer
-	PortRangeMappings []IngressPortAllocationPortMapping `json:"port_range_mappings"`
-
-	// Region Region of the ingress peer
-	Region string `json:"region"`
-}
-
-// IngressPortAllocationPortMapping defines model for IngressPortAllocationPortMapping.
-type IngressPortAllocationPortMapping struct {
-	// IngressEnd The ending port of the range of ingress ports mapped to the forwarded ports
-	IngressEnd int `json:"ingress_end"`
-
-	// IngressStart The starting port of the range of ingress ports mapped to the forwarded ports
-	IngressStart int `json:"ingress_start"`
-
-	// Protocol Protocol accepted by the ports
-	Protocol IngressPortAllocationPortMappingProtocol `json:"protocol"`
-
-	// TranslatedEnd The ending port of the translated range of forwarded ports
-	TranslatedEnd int `json:"translated_end"`
-
-	// TranslatedStart The starting port of the translated range of forwarded ports
-	TranslatedStart int `json:"translated_start"`
-}
-
-// IngressPortAllocationPortMappingProtocol Protocol accepted by the ports
-type IngressPortAllocationPortMappingProtocol string
-
-// IngressPortAllocationRequest defines model for IngressPortAllocationRequest.
-type IngressPortAllocationRequest struct {
-	DirectPort *IngressPortAllocationRequestDirectPort `json:"direct_port,omitempty"`
-
-	// Enabled Indicates if an ingress port allocation is enabled
-	Enabled bool `json:"enabled"`
-
-	// Name Name of the ingress port allocation
-	Name string `json:"name"`
-
-	// PortRanges List of port ranges that are forwarded by the ingress peer
-	PortRanges *[]IngressPortAllocationRequestPortRange `json:"port_ranges,omitempty"`
-}
-
-// IngressPortAllocationRequestDirectPort defines model for IngressPortAllocationRequestDirectPort.
-type IngressPortAllocationRequestDirectPort struct {
-	// Count The number of ports to be forwarded
-	Count int `json:"count"`
-
-	// Protocol The protocol accepted by the port
-	Protocol IngressPortAllocationRequestDirectPortProtocol `json:"protocol"`
-}
-
-// IngressPortAllocationRequestDirectPortProtocol The protocol accepted by the port
-type IngressPortAllocationRequestDirectPortProtocol string
-
-// IngressPortAllocationRequestPortRange defines model for IngressPortAllocationRequestPortRange.
-type IngressPortAllocationRequestPortRange struct {
-	// End The ending port of the range of forwarded ports
-	End int `json:"end"`
-
-	// Protocol The protocol accepted by the port range
-	Protocol IngressPortAllocationRequestPortRangeProtocol `json:"protocol"`
-
-	// Start The starting port of the range of forwarded ports
-	Start int `json:"start"`
-}
-
-// IngressPortAllocationRequestPortRangeProtocol The protocol accepted by the port range
-type IngressPortAllocationRequestPortRangeProtocol string
-
 // InstanceStatus Instance status information
 type InstanceStatus struct {
 	// SetupRequired Indicates whether the instance requires initial setup
@@ -6314,12 +6109,6 @@ type GetApiPeersParams struct {
 	Mac *string `form:"mac,omitempty" json:"mac,omitempty"`
 }
 
-// GetApiPeersPeerIdIngressPortsParams defines parameters for GetApiPeersPeerIdIngressPorts.
-type GetApiPeersPeerIdIngressPortsParams struct {
-	// Name Filters ingress port allocations by name
-	Name *string `form:"name,omitempty" json:"name,omitempty"`
-}
-
 // GetApiUsersParams defines parameters for GetApiUsers.
 type GetApiUsersParams struct {
 	// ServiceUser Filters users and returns either regular users or service users
@@ -6401,12 +6190,6 @@ type PostApiIdentityProvidersJSONRequestBody = IdentityProviderRequest
 // PutApiIdentityProvidersIdpIdJSONRequestBody defines body for PutApiIdentityProvidersIdpId for application/json ContentType.
 type PutApiIdentityProvidersIdpIdJSONRequestBody = IdentityProviderRequest
 
-// PostApiIngressPeersJSONRequestBody defines body for PostApiIngressPeers for application/json ContentType.
-type PostApiIngressPeersJSONRequestBody = IngressPeerCreateRequest
-
-// PutApiIngressPeersIngressPeerIdJSONRequestBody defines body for PutApiIngressPeersIngressPeerId for application/json ContentType.
-type PutApiIngressPeersIngressPeerIdJSONRequestBody = IngressPeerUpdateRequest
-
 // CreateAzureIntegrationJSONRequestBody defines body for CreateAzureIntegration for application/json ContentType.
 type CreateAzureIntegrationJSONRequestBody = CreateAzureIntegrationRequest
 
@@ -6515,12 +6298,6 @@ type PutApiNetworksNetworkIdRoutersRouterIdJSONRequestBody = NetworkRouterReques
 // PutApiPeersPeerIdJSONRequestBody defines body for PutApiPeersPeerId for application/json ContentType.
 type PutApiPeersPeerIdJSONRequestBody = PeerRequest
 
-// PostApiPeersPeerIdIngressPortsJSONRequestBody defines body for PostApiPeersPeerIdIngressPorts for application/json ContentType.
-type PostApiPeersPeerIdIngressPortsJSONRequestBody = IngressPortAllocationRequest
-
-// PutApiPeersPeerIdIngressPortsAllocationIdJSONRequestBody defines body for PutApiPeersPeerIdIngressPortsAllocationId for application/json ContentType.
-type PutApiPeersPeerIdIngressPortsAllocationIdJSONRequestBody = IngressPortAllocationRequest
-
 // PostApiPeersPeerIdJobsJSONRequestBody defines body for PostApiPeersPeerIdJobs for application/json ContentType.
 type PostApiPeersPeerIdJobsJSONRequestBody = JobRequest
 
diff --git a/shared/management/networkmap/envelope.go b/shared/management/networkmap/envelope.go
index fd9dd6bbd..b2fbbef08 100644
--- a/shared/management/networkmap/envelope.go
+++ b/shared/management/networkmap/envelope.go
@@ -15,7 +15,7 @@ import (
 //   - NetworkMap is the *proto.NetworkMap shape the engine reads today via
 //     update.GetNetworkMap() — built from the envelope's components by
 //     running Calculate() locally + converting back through the shared
-//     proto helpers + merging the optional ProxyPatch.
+//     proto helpers.
 //   - Components is the *types.NetworkMapComponents the engine retains so
 //     future incremental delta updates have a base to apply changes
 //     against. The client keeps it under its sync lock.
@@ -26,8 +26,8 @@ type EnvelopeResult struct {
 
 // EnvelopeToNetworkMap is the full client-side pipeline: decode the
 // component envelope back to a typed NetworkMapComponents, run Calculate()
-// locally to produce the typed NetworkMap, convert it to the wire form the
-// engine consumes, and fold in any ProxyPatch the server attached.
+// locally to produce the typed NetworkMap and convert it to the wire form the
+// engine consumes.
 //
 // localPeerKey is the receiving peer's WG pub key (used to derive
 // includeIPv6 / useSourcePrefixes from the receiving peer's own record in
@@ -107,74 +107,12 @@ func EnvelopeToNetworkMap(ctx context.Context, env *proto.NetworkMapEnvelope, lo
 		}
 	}
 
-	if typedNM.ForwardingRules != nil {
-		forwardingRules := make([]*proto.ForwardingRule, 0, len(typedNM.ForwardingRules))
-		for _, rule := range typedNM.ForwardingRules {
-			forwardingRules = append(forwardingRules, rule.ToProto())
-		}
-		protoNM.ForwardingRules = forwardingRules
-	}
-
-	// Merge the proxy patch the server attached. Mirrors the legacy
-	// NetworkMap.Merge step that the server runs after Calculate().
-	if full != nil && full.ProxyPatch != nil {
-		mergeProxyPatch(protoNM, full.ProxyPatch)
-	}
-
 	return &EnvelopeResult{
 		NetworkMap: protoNM,
 		Components: components,
 	}, nil
 }
 
-// mergeProxyPatch folds a ProxyPatch's pre-expanded fragments into the
-// proto.NetworkMap that Calculate() produced. Mirrors types.NetworkMap.Merge
-// — same six collections, deduplicated where the legacy merge dedupes.
-func mergeProxyPatch(nm *proto.NetworkMap, patch *proto.ProxyPatch) {
-	nm.RemotePeers = appendUniquePeers(nm.RemotePeers, patch.Peers)
-	nm.OfflinePeers = appendUniquePeers(nm.OfflinePeers, patch.OfflinePeers)
-	nm.FirewallRules = append(nm.FirewallRules, patch.FirewallRules...)
-	nm.Routes = append(nm.Routes, patch.Routes...)
-	nm.RoutesFirewallRules = append(nm.RoutesFirewallRules, patch.RouteFirewallRules...)
-	nm.ForwardingRules = append(nm.ForwardingRules, patch.ForwardingRules...)
-	if len(nm.RemotePeers) > 0 {
-		nm.RemotePeersIsEmpty = false
-	}
-	if len(nm.FirewallRules) > 0 {
-		nm.FirewallRulesIsEmpty = false
-	}
-	if len(nm.RoutesFirewallRules) > 0 {
-		nm.RoutesFirewallRulesIsEmpty = false
-	}
-}
-
-// appendUniquePeers dedupes by WgPubKey — mirrors legacy
-// mergeUniquePeersByID's intent (legacy keyed off Peer.ID; in proto form the
-// closest stable identifier is WgPubKey).
-func appendUniquePeers(dst, extra []*proto.RemotePeerConfig) []*proto.RemotePeerConfig {
-	if len(extra) == 0 {
-		return dst
-	}
-	seen := make(map[string]struct{}, len(dst))
-	for _, p := range dst {
-		if p == nil {
-			continue
-		}
-		seen[p.WgPubKey] = struct{}{}
-	}
-	for _, p := range extra {
-		if p == nil {
-			continue
-		}
-		if _, ok := seen[p.WgPubKey]; ok {
-			continue
-		}
-		seen[p.WgPubKey] = struct{}{}
-		dst = append(dst, p)
-	}
-	return dst
-}
-
 func trimKey(s string) string {
 	if len(s) > 12 {
 		return s[:12]
diff --git a/shared/management/proto/management.pb.go b/shared/management/proto/management.pb.go
index 60cfc71fe..de0fdd84d 100644
--- a/shared/management/proto/management.pb.go
+++ b/shared/management/proto/management.pb.go
@@ -2739,8 +2739,11 @@ type NetworkMap struct {
 	// RoutesFirewallRules represents a list of routes firewall rules to be applied to peer
 	RoutesFirewallRules []*RouteFirewallRule `protobuf:"bytes,10,rep,name=routesFirewallRules,proto3" json:"routesFirewallRules,omitempty"`
 	// RoutesFirewallRulesIsEmpty indicates whether RouteFirewallRule array is empty or not to bypass protobuf null and empty array equality.
-	RoutesFirewallRulesIsEmpty bool              `protobuf:"varint,11,opt,name=routesFirewallRulesIsEmpty,proto3" json:"routesFirewallRulesIsEmpty,omitempty"`
-	ForwardingRules            []*ForwardingRule `protobuf:"bytes,12,rep,name=forwardingRules,proto3" json:"forwardingRules,omitempty"`
+	RoutesFirewallRulesIsEmpty bool `protobuf:"varint,11,opt,name=routesFirewallRulesIsEmpty,proto3" json:"routesFirewallRulesIsEmpty,omitempty"`
+	// Unused; the ingress port-forwarding feature was discontinued.
+	//
+	// Deprecated: Do not use.
+	ForwardingRules []*ForwardingRule `protobuf:"bytes,12,rep,name=forwardingRules,proto3" json:"forwardingRules,omitempty"`
 	// SSHAuth represents SSH authorization configuration
 	SshAuth *SSHAuth `protobuf:"bytes,13,opt,name=sshAuth,proto3" json:"sshAuth,omitempty"`
 }
@@ -2854,6 +2857,7 @@ func (x *NetworkMap) GetRoutesFirewallRulesIsEmpty() bool {
 	return false
 }
 
+// Deprecated: Do not use.
 func (x *NetworkMap) GetForwardingRules() []*ForwardingRule {
 	if x != nil {
 		return x.ForwardingRules
@@ -4401,19 +4405,18 @@ func (x *RouteFirewallRule) GetRouteID() string {
 	return ""
 }
 
+// ForwardingRule is unused; the ingress port-forwarding feature was discontinued.
+//
+// Deprecated: Do not use.
 type ForwardingRule struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	// Protocol of the forwarding rule
-	Protocol RuleProtocol `protobuf:"varint,1,opt,name=protocol,proto3,enum=management.RuleProtocol" json:"protocol,omitempty"`
-	// portInfo is the ingress destination port information, where the traffic arrives in the gateway node
-	DestinationPort *PortInfo `protobuf:"bytes,2,opt,name=destinationPort,proto3" json:"destinationPort,omitempty"`
-	// IP address of the translated address (remote peer) to send traffic to
-	TranslatedAddress []byte `protobuf:"bytes,3,opt,name=translatedAddress,proto3" json:"translatedAddress,omitempty"`
-	// Translated port information, where the traffic should be forwarded to
-	TranslatedPort *PortInfo `protobuf:"bytes,4,opt,name=translatedPort,proto3" json:"translatedPort,omitempty"`
+	Protocol          RuleProtocol `protobuf:"varint,1,opt,name=protocol,proto3,enum=management.RuleProtocol" json:"protocol,omitempty"`
+	DestinationPort   *PortInfo    `protobuf:"bytes,2,opt,name=destinationPort,proto3" json:"destinationPort,omitempty"`
+	TranslatedAddress []byte       `protobuf:"bytes,3,opt,name=translatedAddress,proto3" json:"translatedAddress,omitempty"`
+	TranslatedPort    *PortInfo    `protobuf:"bytes,4,opt,name=translatedPort,proto3" json:"translatedPort,omitempty"`
 }
 
 func (x *ForwardingRule) Reset() {
@@ -4907,8 +4910,8 @@ func (*NetworkMapEnvelope_Delta) isNetworkMapEnvelope_Payload() {}
 // client decodes it into a types.NetworkMapComponents and runs Calculate()
 // locally to produce the same NetworkMap the legacy server path would have
 // produced. Every field carries RAW component data — no server-side
-// expansion (firewall rules, DNS config, SSH auth, route firewall rules,
-// forwarding rules) is shipped; the client computes those itself.
+// expansion (firewall rules, DNS config, SSH auth, route firewall rules)
+// is shipped; the client computes those itself.
 type NetworkMapComponentsFull struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -4973,11 +4976,9 @@ type NetworkMapComponentsFull struct {
 	// proto.DNSConfig.ForwarderPort). Computed by the controller from peer
 	// versions; clients fold it into their Calculate() DNS output.
 	DnsForwarderPort int64 `protobuf:"varint,23,opt,name=dns_forwarder_port,json=dnsForwarderPort,proto3" json:"dns_forwarder_port,omitempty"`
-	// Pre-expanded NetworkMap fragments injected post-Calculate by external
-	// controllers (BYOP / port-forwarding proxies). The receiving client
-	// merges these into its locally-computed NetworkMap the same way the
-	// legacy server does via NetworkMap.Merge — so downstream consumers see
-	// a unified merged result regardless of source.
+	// Unused; the ingress port-forwarding feature was discontinued.
+	//
+	// Deprecated: Do not use.
 	ProxyPatch *ProxyPatch `protobuf:"bytes,24,opt,name=proxy_patch,json=proxyPatch,proto3" json:"proxy_patch,omitempty"`
 	// SSH UserIDClaim — server-side HttpServerConfig.AuthUserIDClaim, or
 	// "sub" by default. Populated in proto.SSHAuth.UserIDClaim when the
@@ -5179,6 +5180,7 @@ func (x *NetworkMapComponentsFull) GetDnsForwarderPort() int64 {
 	return 0
 }
 
+// Deprecated: Do not use.
 func (x *NetworkMapComponentsFull) GetProxyPatch() *ProxyPatch {
 	if x != nil {
 		return x.ProxyPatch
@@ -5193,11 +5195,9 @@ func (x *NetworkMapComponentsFull) GetUserIdClaim() string {
 	return ""
 }
 
-// ProxyPatch carries NetworkMap fragments that don't fit the component-graph
-// model — they're pre-expanded by external controllers (BYOP /
-// port-forwarding proxies) and injected post-Calculate. Fields use the
-// legacy wire types because the proxy delivers them pre-formed; there is
-// no raw component shape to convert from. Empty when no proxy is active.
+// ProxyPatch is unused; the ingress port-forwarding feature was discontinued.
+//
+// Deprecated: Do not use.
 type ProxyPatch struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -7185,7 +7185,7 @@ var file_management_proto_rawDesc = []byte{
 	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x22, 0x0a,
 	0x0c, 0x61, 0x6c, 0x77, 0x61, 0x79, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x18, 0x02, 0x20,
 	0x01, 0x28, 0x08, 0x52, 0x0c, 0x61, 0x6c, 0x77, 0x61, 0x79, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74,
-	0x65, 0x22, 0xe8, 0x05, 0x0a, 0x0a, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70,
+	0x65, 0x22, 0xec, 0x05, 0x0a, 0x0a, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70,
 	0x12, 0x16, 0x0a, 0x06, 0x53, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04,
 	0x52, 0x06, 0x53, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x12, 0x36, 0x0a, 0x0a, 0x70, 0x65, 0x65, 0x72,
 	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d,
@@ -7224,444 +7224,445 @@ var file_management_proto_rawDesc = []byte{
 	0x73, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x49, 0x73,
 	0x45, 0x6d, 0x70, 0x74, 0x79, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x52, 0x1a, 0x72, 0x6f, 0x75,
 	0x74, 0x65, 0x73, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73,
-	0x49, 0x73, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x44, 0x0a, 0x0f, 0x66, 0x6f, 0x72, 0x77, 0x61,
+	0x49, 0x73, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x48, 0x0a, 0x0f, 0x66, 0x6f, 0x72, 0x77, 0x61,
 	0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x18, 0x0c, 0x20, 0x03, 0x28, 0x0b,
 	0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x46, 0x6f,
-	0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x52, 0x0f, 0x66, 0x6f,
-	0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x12, 0x2d, 0x0a,
-	0x07, 0x73, 0x73, 0x68, 0x41, 0x75, 0x74, 0x68, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x13,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x53, 0x48, 0x41,
-	0x75, 0x74, 0x68, 0x52, 0x07, 0x73, 0x73, 0x68, 0x41, 0x75, 0x74, 0x68, 0x22, 0x82, 0x02, 0x0a,
-	0x07, 0x53, 0x53, 0x48, 0x41, 0x75, 0x74, 0x68, 0x12, 0x20, 0x0a, 0x0b, 0x55, 0x73, 0x65, 0x72,
-	0x49, 0x44, 0x43, 0x6c, 0x61, 0x69, 0x6d, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x55,
-	0x73, 0x65, 0x72, 0x49, 0x44, 0x43, 0x6c, 0x61, 0x69, 0x6d, 0x12, 0x28, 0x0a, 0x0f, 0x41, 0x75,
-	0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x55, 0x73, 0x65, 0x72, 0x73, 0x18, 0x02, 0x20,
-	0x03, 0x28, 0x0c, 0x52, 0x0f, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x55,
-	0x73, 0x65, 0x72, 0x73, 0x12, 0x4a, 0x0a, 0x0d, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f,
-	0x75, 0x73, 0x65, 0x72, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x53, 0x48, 0x41, 0x75, 0x74, 0x68,
-	0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x55, 0x73, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74,
-	0x72, 0x79, 0x52, 0x0c, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x55, 0x73, 0x65, 0x72, 0x73,
-	0x1a, 0x5f, 0x0a, 0x11, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x55, 0x73, 0x65, 0x72, 0x73,
-	0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x34, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x55, 0x73, 0x65, 0x72, 0x49,
-	0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38,
-	0x01, 0x22, 0x2e, 0x0a, 0x12, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x55, 0x73, 0x65, 0x72,
-	0x49, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x69, 0x6e, 0x64, 0x65, 0x78,
-	0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0d, 0x52, 0x07, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x65,
-	0x73, 0x22, 0xf0, 0x01, 0x0a, 0x10, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72,
-	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x1a, 0x0a, 0x08, 0x77, 0x67, 0x50, 0x75, 0x62, 0x4b,
-	0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x77, 0x67, 0x50, 0x75, 0x62, 0x4b,
-	0x65, 0x79, 0x12, 0x1e, 0x0a, 0x0a, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x49, 0x70, 0x73,
-	0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0a, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x49,
-	0x70, 0x73, 0x12, 0x33, 0x0a, 0x09, 0x73, 0x73, 0x68, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x2e, 0x53, 0x53, 0x48, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x09, 0x73, 0x73,
-	0x68, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x66, 0x71, 0x64, 0x6e, 0x18,
-	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x66, 0x71, 0x64, 0x6e, 0x12, 0x22, 0x0a, 0x0c, 0x61,
-	0x67, 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x0c, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12,
-	0x33, 0x0a, 0x09, 0x6c, 0x61, 0x7a, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x18, 0x06, 0x20, 0x01,
-	0x28, 0x0e, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x4c, 0x61, 0x7a, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x09, 0x6c, 0x61, 0x7a, 0x79, 0x53,
-	0x74, 0x61, 0x74, 0x65, 0x22, 0x7e, 0x0a, 0x09, 0x53, 0x53, 0x48, 0x43, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x12, 0x1e, 0x0a, 0x0a, 0x73, 0x73, 0x68, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x73, 0x73, 0x68, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65,
-	0x64, 0x12, 0x1c, 0x0a, 0x09, 0x73, 0x73, 0x68, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x73, 0x73, 0x68, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x12,
-	0x33, 0x0a, 0x09, 0x6a, 0x77, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x03, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x4a, 0x57, 0x54, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x09, 0x6a, 0x77, 0x74, 0x43, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x22, 0x20, 0x0a, 0x1e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75,
-	0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0xbf, 0x01, 0x0a, 0x17, 0x44, 0x65, 0x76, 0x69, 0x63,
-	0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c,
-	0x6f, 0x77, 0x12, 0x48, 0x0a, 0x08, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x0e, 0x32, 0x2c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
-	0x74, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64,
-	0x65, 0x72, 0x52, 0x08, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x12, 0x42, 0x0a, 0x0e,
-	0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
-	0x74, 0x2e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x52, 0x0e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x22, 0x16, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x12, 0x0a, 0x0a, 0x06,
-	0x48, 0x4f, 0x53, 0x54, 0x45, 0x44, 0x10, 0x00, 0x22, 0x1e, 0x0a, 0x1c, 0x50, 0x4b, 0x43, 0x45,
-	0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f,
-	0x77, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x5b, 0x0a, 0x15, 0x50, 0x4b, 0x43, 0x45,
-	0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f,
-	0x77, 0x12, 0x42, 0x0a, 0x0e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0xbc, 0x03, 0x0a, 0x0e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64,
-	0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x1a, 0x0a, 0x08, 0x43, 0x6c, 0x69, 0x65,
-	0x6e, 0x74, 0x49, 0x44, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x43, 0x6c, 0x69, 0x65,
-	0x6e, 0x74, 0x49, 0x44, 0x12, 0x26, 0x0a, 0x0c, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x53, 0x65,
-	0x63, 0x72, 0x65, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x02, 0x18, 0x01, 0x52, 0x0c,
-	0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x16, 0x0a, 0x06,
-	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x44, 0x6f,
-	0x6d, 0x61, 0x69, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x41, 0x75, 0x64, 0x69, 0x65, 0x6e, 0x63, 0x65,
-	0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x41, 0x75, 0x64, 0x69, 0x65, 0x6e, 0x63, 0x65,
-	0x12, 0x2e, 0x0a, 0x12, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x45, 0x6e,
-	0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x44, 0x65,
-	0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74,
-	0x12, 0x24, 0x0a, 0x0d, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e,
-	0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x45, 0x6e,
-	0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x18,
-	0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x12, 0x1e, 0x0a, 0x0a,
-	0x55, 0x73, 0x65, 0x49, 0x44, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08,
-	0x52, 0x0a, 0x55, 0x73, 0x65, 0x49, 0x44, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x34, 0x0a, 0x15,
-	0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x64,
-	0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x52, 0x15, 0x41, 0x75, 0x74,
-	0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69,
-	0x6e, 0x74, 0x12, 0x22, 0x0a, 0x0c, 0x52, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x55, 0x52,
-	0x4c, 0x73, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x52, 0x65, 0x64, 0x69, 0x72, 0x65,
-	0x63, 0x74, 0x55, 0x52, 0x4c, 0x73, 0x12, 0x2e, 0x0a, 0x12, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c,
-	0x65, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x18, 0x0b, 0x20, 0x01,
-	0x28, 0x08, 0x52, 0x12, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x6d, 0x70,
-	0x74, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x1c, 0x0a, 0x09, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x46,
-	0x6c, 0x61, 0x67, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x09, 0x4c, 0x6f, 0x67, 0x69, 0x6e,
-	0x46, 0x6c, 0x61, 0x67, 0x22, 0x93, 0x02, 0x0a, 0x05, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x12, 0x0e,
-	0x0a, 0x02, 0x49, 0x44, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x49, 0x44, 0x12, 0x18,
-	0x0a, 0x07, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x07, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x12, 0x20, 0x0a, 0x0b, 0x4e, 0x65, 0x74, 0x77,
-	0x6f, 0x72, 0x6b, 0x54, 0x79, 0x70, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0b, 0x4e,
-	0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x54, 0x79, 0x70, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x50, 0x65,
-	0x65, 0x72, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x50, 0x65, 0x65, 0x72, 0x12, 0x16,
-	0x0a, 0x06, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x18, 0x05, 0x20, 0x01, 0x28, 0x03, 0x52, 0x06,
-	0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x12, 0x1e, 0x0a, 0x0a, 0x4d, 0x61, 0x73, 0x71, 0x75, 0x65,
-	0x72, 0x61, 0x64, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x4d, 0x61, 0x73, 0x71,
-	0x75, 0x65, 0x72, 0x61, 0x64, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x4e, 0x65, 0x74, 0x49, 0x44, 0x18,
-	0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x4e, 0x65, 0x74, 0x49, 0x44, 0x12, 0x18, 0x0a, 0x07,
-	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x44,
-	0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x1c, 0x0a, 0x09, 0x6b, 0x65, 0x65, 0x70, 0x52, 0x6f,
-	0x75, 0x74, 0x65, 0x18, 0x09, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x6b, 0x65, 0x65, 0x70, 0x52,
-	0x6f, 0x75, 0x74, 0x65, 0x12, 0x24, 0x0a, 0x0d, 0x73, 0x6b, 0x69, 0x70, 0x41, 0x75, 0x74, 0x6f,
-	0x41, 0x70, 0x70, 0x6c, 0x79, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x73, 0x6b, 0x69,
-	0x70, 0x41, 0x75, 0x74, 0x6f, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x22, 0xde, 0x01, 0x0a, 0x09, 0x44,
-	0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x24, 0x0a, 0x0d, 0x53, 0x65, 0x72, 0x76,
-	0x69, 0x63, 0x65, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x0d, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x12, 0x47,
-	0x0a, 0x10, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75,
-	0x70, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72,
-	0x47, 0x72, 0x6f, 0x75, 0x70, 0x52, 0x10, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65,
-	0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x38, 0x0a, 0x0b, 0x43, 0x75, 0x73, 0x74, 0x6f,
-	0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d,
-	0x5a, 0x6f, 0x6e, 0x65, 0x52, 0x0b, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65,
-	0x73, 0x12, 0x28, 0x0a, 0x0d, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x50, 0x6f,
-	0x72, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x42, 0x02, 0x18, 0x01, 0x52, 0x0d, 0x46, 0x6f,
-	0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x50, 0x6f, 0x72, 0x74, 0x22, 0xb8, 0x01, 0x0a, 0x0a,
-	0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x44, 0x6f,
-	0x6d, 0x61, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x44, 0x6f, 0x6d, 0x61,
-	0x69, 0x6e, 0x12, 0x32, 0x0a, 0x07, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x18, 0x02, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x2e, 0x53, 0x69, 0x6d, 0x70, 0x6c, 0x65, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x52, 0x07, 0x52,
-	0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x12, 0x32, 0x0a, 0x14, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68,
-	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x03,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x14, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x44, 0x6f, 0x6d, 0x61,
-	0x69, 0x6e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x2a, 0x0a, 0x10, 0x4e, 0x6f,
-	0x6e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x61, 0x74, 0x69, 0x76, 0x65, 0x18, 0x04,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x4e, 0x6f, 0x6e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
-	0x74, 0x61, 0x74, 0x69, 0x76, 0x65, 0x22, 0x74, 0x0a, 0x0c, 0x53, 0x69, 0x6d, 0x70, 0x6c, 0x65,
-	0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x54, 0x79,
-	0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x04, 0x54, 0x79, 0x70, 0x65, 0x12, 0x14,
-	0x0a, 0x05, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x43,
-	0x6c, 0x61, 0x73, 0x73, 0x12, 0x10, 0x0a, 0x03, 0x54, 0x54, 0x4c, 0x18, 0x04, 0x20, 0x01, 0x28,
-	0x03, 0x52, 0x03, 0x54, 0x54, 0x4c, 0x12, 0x14, 0x0a, 0x05, 0x52, 0x44, 0x61, 0x74, 0x61, 0x18,
-	0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x52, 0x44, 0x61, 0x74, 0x61, 0x22, 0xb3, 0x01, 0x0a,
-	0x0f, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70,
-	0x12, 0x38, 0x0a, 0x0b, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x18,
-	0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x0b, 0x4e,
-	0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x50, 0x72,
-	0x69, 0x6d, 0x61, 0x72, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x50, 0x72, 0x69,
-	0x6d, 0x61, 0x72, 0x79, 0x12, 0x18, 0x0a, 0x07, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18,
-	0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x32,
-	0x0a, 0x14, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x45,
-	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x14, 0x53, 0x65,
-	0x61, 0x72, 0x63, 0x68, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x45, 0x6e, 0x61, 0x62, 0x6c,
-	0x65, 0x64, 0x22, 0x48, 0x0a, 0x0a, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72,
-	0x12, 0x0e, 0x0a, 0x02, 0x49, 0x50, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x49, 0x50,
-	0x12, 0x16, 0x0a, 0x06, 0x4e, 0x53, 0x54, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03,
-	0x52, 0x06, 0x4e, 0x53, 0x54, 0x79, 0x70, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x50, 0x6f, 0x72, 0x74,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52, 0x04, 0x50, 0x6f, 0x72, 0x74, 0x22, 0xfb, 0x02, 0x0a,
-	0x0c, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x12, 0x1a, 0x0a,
-	0x06, 0x50, 0x65, 0x65, 0x72, 0x49, 0x50, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x02, 0x18,
-	0x01, 0x52, 0x06, 0x50, 0x65, 0x65, 0x72, 0x49, 0x50, 0x12, 0x37, 0x0a, 0x09, 0x44, 0x69, 0x72,
-	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x19, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x44, 0x69,
-	0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x09, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x12, 0x2e, 0x0a, 0x06, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01,
-	0x28, 0x0e, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x52, 0x75, 0x6c, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x41, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x12, 0x34, 0x0a, 0x08, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x04,
-	0x20, 0x01, 0x28, 0x0e, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
-	0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08,
-	0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x12, 0x0a, 0x04, 0x50, 0x6f, 0x72, 0x74,
-	0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x30, 0x0a, 0x08,
-	0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74,
-	0x49, 0x6e, 0x66, 0x6f, 0x52, 0x08, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x1a,
-	0x0a, 0x08, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x44, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0c,
-	0x52, 0x08, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x44, 0x12, 0x26, 0x0a, 0x0e, 0x63, 0x75,
-	0x73, 0x74, 0x6f, 0x6d, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x08, 0x20, 0x01,
-	0x28, 0x0d, 0x52, 0x0e, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63,
-	0x6f, 0x6c, 0x12, 0x26, 0x0a, 0x0e, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x72, 0x65, 0x66,
-	0x69, 0x78, 0x65, 0x73, 0x18, 0x09, 0x20, 0x03, 0x28, 0x0c, 0x52, 0x0e, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x65, 0x73, 0x22, 0x38, 0x0a, 0x0e, 0x4e, 0x65,
-	0x74, 0x77, 0x6f, 0x72, 0x6b, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x14, 0x0a, 0x05,
-	0x6e, 0x65, 0x74, 0x49, 0x50, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6e, 0x65, 0x74,
-	0x49, 0x50, 0x12, 0x10, 0x0a, 0x03, 0x6d, 0x61, 0x63, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x03, 0x6d, 0x61, 0x63, 0x22, 0x1e, 0x0a, 0x06, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x73, 0x12, 0x14,
-	0x0a, 0x05, 0x46, 0x69, 0x6c, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x05, 0x46,
-	0x69, 0x6c, 0x65, 0x73, 0x22, 0x96, 0x01, 0x0a, 0x08, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66,
-	0x6f, 0x12, 0x14, 0x0a, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x48,
-	0x00, 0x52, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x32, 0x0a, 0x05, 0x72, 0x61, 0x6e, 0x67, 0x65,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x2e, 0x52, 0x61, 0x6e,
-	0x67, 0x65, 0x48, 0x00, 0x52, 0x05, 0x72, 0x61, 0x6e, 0x67, 0x65, 0x1a, 0x2f, 0x0a, 0x05, 0x52,
-	0x61, 0x6e, 0x67, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x0d, 0x52, 0x05, 0x73, 0x74, 0x61, 0x72, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x6e,
-	0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x03, 0x65, 0x6e, 0x64, 0x42, 0x0f, 0x0a, 0x0d,
-	0x70, 0x6f, 0x72, 0x74, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x87, 0x03,
-	0x0a, 0x11, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52,
-	0x75, 0x6c, 0x65, 0x12, 0x22, 0x0a, 0x0c, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x61, 0x6e,
-	0x67, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x12, 0x2e, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52,
-	0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x74, 0x69,
-	0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65,
-	0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x34, 0x0a, 0x08, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x18, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f,
-	0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12,
-	0x30, 0x0a, 0x08, 0x70, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x18, 0x05, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50,
-	0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x08, 0x70, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66,
-	0x6f, 0x12, 0x1c, 0x0a, 0x09, 0x69, 0x73, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x18, 0x06,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x69, 0x73, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x12,
-	0x18, 0x0a, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x09,
-	0x52, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x26, 0x0a, 0x0e, 0x63, 0x75, 0x73,
-	0x74, 0x6f, 0x6d, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x08, 0x20, 0x01, 0x28,
-	0x0d, 0x52, 0x0e, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f,
-	0x6c, 0x12, 0x1a, 0x0a, 0x08, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x44, 0x18, 0x09, 0x20,
-	0x01, 0x28, 0x0c, 0x52, 0x08, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x44, 0x12, 0x18, 0x0a,
-	0x07, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x49, 0x44, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07,
-	0x52, 0x6f, 0x75, 0x74, 0x65, 0x49, 0x44, 0x22, 0xf2, 0x01, 0x0a, 0x0e, 0x46, 0x6f, 0x72, 0x77,
-	0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x12, 0x34, 0x0a, 0x08, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x18, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x50, 0x72,
-	0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c,
-	0x12, 0x3e, 0x0a, 0x0f, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50,
-	0x6f, 0x72, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52,
-	0x0f, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x6f, 0x72, 0x74,
-	0x12, 0x2c, 0x0a, 0x11, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x41, 0x64,
-	0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x11, 0x74, 0x72, 0x61,
-	0x6e, 0x73, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x3c,
-	0x0a, 0x0e, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x50, 0x6f, 0x72, 0x74,
-	0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x0e, 0x74, 0x72,
-	0x61, 0x6e, 0x73, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x50, 0x6f, 0x72, 0x74, 0x22, 0x8b, 0x02, 0x0a,
-	0x14, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x0d, 0x52, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x36, 0x0a, 0x08, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1a, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x50,
-	0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f,
-	0x6c, 0x12, 0x10, 0x0a, 0x03, 0x70, 0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03,
-	0x70, 0x69, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18,
-	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12,
-	0x1f, 0x0a, 0x0b, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x05,
-	0x20, 0x03, 0x28, 0x09, 0x52, 0x0a, 0x75, 0x73, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73,
-	0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x1f, 0x0a, 0x0b, 0x6e, 0x61, 0x6d, 0x65,
-	0x5f, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6e,
-	0x61, 0x6d, 0x65, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x12, 0x1f, 0x0a, 0x0b, 0x6c, 0x69, 0x73,
-	0x74, 0x65, 0x6e, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0a,
-	0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x50, 0x6f, 0x72, 0x74, 0x22, 0xa1, 0x01, 0x0a, 0x15, 0x45,
-	0x78, 0x70, 0x6f, 0x73, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f,
-	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76,
-	0x69, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69,
-	0x63, 0x65, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x73, 0x65,
-	0x72, 0x76, 0x69, 0x63, 0x65, 0x55, 0x72, 0x6c, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61,
-	0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
-	0x12, 0x2c, 0x0a, 0x12, 0x70, 0x6f, 0x72, 0x74, 0x5f, 0x61, 0x75, 0x74, 0x6f, 0x5f, 0x61, 0x73,
-	0x73, 0x69, 0x67, 0x6e, 0x65, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x70, 0x6f,
-	0x72, 0x74, 0x41, 0x75, 0x74, 0x6f, 0x41, 0x73, 0x73, 0x69, 0x67, 0x6e, 0x65, 0x64, 0x22, 0x2c,
-	0x0a, 0x12, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x22, 0x15, 0x0a, 0x13,
-	0x52, 0x65, 0x6e, 0x65, 0x77, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x22, 0x2b, 0x0a, 0x11, 0x53, 0x74, 0x6f, 0x70, 0x45, 0x78, 0x70, 0x6f, 0x73,
-	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61,
-	0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
-	0x22, 0x14, 0x0a, 0x12, 0x53, 0x74, 0x6f, 0x70, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x9a, 0x01, 0x0a, 0x12, 0x4e, 0x65, 0x74, 0x77, 0x6f,
-	0x72, 0x6b, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x76, 0x65, 0x6c, 0x6f, 0x70, 0x65, 0x12, 0x3a, 0x0a,
-	0x04, 0x66, 0x75, 0x6c, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
-	0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c,
-	0x6c, 0x48, 0x00, 0x52, 0x04, 0x66, 0x75, 0x6c, 0x6c, 0x12, 0x3d, 0x0a, 0x05, 0x64, 0x65, 0x6c,
-	0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70,
-	0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x44, 0x65, 0x6c, 0x74, 0x61, 0x48,
-	0x00, 0x52, 0x05, 0x64, 0x65, 0x6c, 0x74, 0x61, 0x42, 0x09, 0x0a, 0x07, 0x70, 0x61, 0x79, 0x6c,
-	0x6f, 0x61, 0x64, 0x22, 0x92, 0x0f, 0x0a, 0x18, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d,
-	0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c,
-	0x12, 0x16, 0x0a, 0x06, 0x73, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04,
-	0x52, 0x06, 0x73, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x12, 0x37, 0x0a, 0x0b, 0x70, 0x65, 0x65, 0x72,
-	0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x43,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0a, 0x70, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x12, 0x34, 0x0a, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18, 0x03, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x07,
-	0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x12, 0x4d, 0x0a, 0x10, 0x61, 0x63, 0x63, 0x6f, 0x75,
-	0x6e, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41,
-	0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x43, 0x6f,
-	0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x0f, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x53, 0x65,
-	0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x41, 0x0a, 0x0c, 0x64, 0x6e, 0x73, 0x5f, 0x73, 0x65,
-	0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x44, 0x4e, 0x53, 0x53, 0x65, 0x74,
-	0x74, 0x69, 0x6e, 0x67, 0x73, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x0b, 0x64, 0x6e,
-	0x73, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x64, 0x6e, 0x73,
-	0x5f, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x64,
-	0x6e, 0x73, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x2c, 0x0a, 0x12, 0x63, 0x75, 0x73, 0x74,
-	0x6f, 0x6d, 0x5f, 0x7a, 0x6f, 0x6e, 0x65, 0x5f, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x07,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65,
-	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x25, 0x0a, 0x0e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x5f,
-	0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0d,
-	0x61, 0x67, 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x2d, 0x0a,
-	0x05, 0x70, 0x65, 0x65, 0x72, 0x73, 0x18, 0x09, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f,
-	0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x05, 0x70, 0x65, 0x65, 0x72, 0x73, 0x12, 0x2e, 0x0a, 0x13,
-	0x72, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x5f, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65,
-	0x78, 0x65, 0x73, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x0d, 0x52, 0x11, 0x72, 0x6f, 0x75, 0x74, 0x65,
-	0x72, 0x50, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x12, 0x35, 0x0a, 0x08,
-	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x18, 0x0b, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x19,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x6c, 0x69,
-	0x63, 0x79, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x08, 0x70, 0x6f, 0x6c, 0x69, 0x63,
-	0x69, 0x65, 0x73, 0x12, 0x30, 0x0a, 0x06, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x0c, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x2e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x06, 0x67,
-	0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x2c, 0x0a, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18,
-	0x0d, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x61, 0x77, 0x52, 0x06, 0x72, 0x6f, 0x75,
-	0x74, 0x65, 0x73, 0x12, 0x4b, 0x0a, 0x11, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65,
-	0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x0e, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x61, 0x6d, 0x65,
-	0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x52, 0x61, 0x77, 0x52, 0x10,
-	0x6e, 0x61, 0x6d, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73,
-	0x12, 0x40, 0x0a, 0x0f, 0x61, 0x6c, 0x6c, 0x5f, 0x64, 0x6e, 0x73, 0x5f, 0x72, 0x65, 0x63, 0x6f,
-	0x72, 0x64, 0x73, 0x18, 0x0f, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x69, 0x6d, 0x70, 0x6c, 0x65, 0x52, 0x65, 0x63,
-	0x6f, 0x72, 0x64, 0x52, 0x0d, 0x61, 0x6c, 0x6c, 0x44, 0x6e, 0x73, 0x52, 0x65, 0x63, 0x6f, 0x72,
-	0x64, 0x73, 0x12, 0x3b, 0x0a, 0x0d, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x7a, 0x6f,
-	0x6e, 0x65, 0x73, 0x18, 0x10, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e,
-	0x65, 0x52, 0x0c, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5a, 0x6f, 0x6e, 0x65, 0x73, 0x12,
-	0x4b, 0x0a, 0x11, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x73, 0x18, 0x11, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x61, 0x77, 0x52, 0x10, 0x6e, 0x65, 0x74, 0x77,
-	0x6f, 0x72, 0x6b, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x55, 0x0a, 0x0b,
-	0x72, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x73, 0x5f, 0x6d, 0x61, 0x70, 0x18, 0x12, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x34, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e,
-	0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65,
-	0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x73, 0x4d,
-	0x61, 0x70, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0a, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x73,
-	0x4d, 0x61, 0x70, 0x12, 0x71, 0x0a, 0x15, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f,
-	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x5f, 0x6d, 0x61, 0x70, 0x18, 0x13, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x3d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x42, 0x02, 0x18, 0x01,
+	0x52, 0x0f, 0x66, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65,
+	0x73, 0x12, 0x2d, 0x0a, 0x07, 0x73, 0x73, 0x68, 0x41, 0x75, 0x74, 0x68, 0x18, 0x0d, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x13, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x53, 0x53, 0x48, 0x41, 0x75, 0x74, 0x68, 0x52, 0x07, 0x73, 0x73, 0x68, 0x41, 0x75, 0x74, 0x68,
+	0x22, 0x82, 0x02, 0x0a, 0x07, 0x53, 0x53, 0x48, 0x41, 0x75, 0x74, 0x68, 0x12, 0x20, 0x0a, 0x0b,
+	0x55, 0x73, 0x65, 0x72, 0x49, 0x44, 0x43, 0x6c, 0x61, 0x69, 0x6d, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0b, 0x55, 0x73, 0x65, 0x72, 0x49, 0x44, 0x43, 0x6c, 0x61, 0x69, 0x6d, 0x12, 0x28,
+	0x0a, 0x0f, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x55, 0x73, 0x65, 0x72,
+	0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0c, 0x52, 0x0f, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
+	0x7a, 0x65, 0x64, 0x55, 0x73, 0x65, 0x72, 0x73, 0x12, 0x4a, 0x0a, 0x0d, 0x6d, 0x61, 0x63, 0x68,
+	0x69, 0x6e, 0x65, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x25, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x53, 0x48,
+	0x41, 0x75, 0x74, 0x68, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x55, 0x73, 0x65, 0x72,
+	0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0c, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x55,
+	0x73, 0x65, 0x72, 0x73, 0x1a, 0x5f, 0x0a, 0x11, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x55,
+	0x73, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x34, 0x0a, 0x05, 0x76,
+	0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x55,
+	0x73, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x2e, 0x0a, 0x12, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
+	0x55, 0x73, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x69,
+	0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0d, 0x52, 0x07, 0x69, 0x6e,
+	0x64, 0x65, 0x78, 0x65, 0x73, 0x22, 0xf0, 0x01, 0x0a, 0x10, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65,
+	0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x1a, 0x0a, 0x08, 0x77, 0x67,
+	0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x77, 0x67,
+	0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x12, 0x1e, 0x0a, 0x0a, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65,
+	0x64, 0x49, 0x70, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0a, 0x61, 0x6c, 0x6c, 0x6f,
+	0x77, 0x65, 0x64, 0x49, 0x70, 0x73, 0x12, 0x33, 0x0a, 0x09, 0x73, 0x73, 0x68, 0x43, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x53, 0x48, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x52, 0x09, 0x73, 0x73, 0x68, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x66,
+	0x71, 0x64, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x66, 0x71, 0x64, 0x6e, 0x12,
+	0x22, 0x0a, 0x0c, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18,
+	0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72, 0x73,
+	0x69, 0x6f, 0x6e, 0x12, 0x33, 0x0a, 0x09, 0x6c, 0x61, 0x7a, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65,
+	0x18, 0x06, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x4c, 0x61, 0x7a, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x09, 0x6c,
+	0x61, 0x7a, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x22, 0x7e, 0x0a, 0x09, 0x53, 0x53, 0x48, 0x43,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x1e, 0x0a, 0x0a, 0x73, 0x73, 0x68, 0x45, 0x6e, 0x61, 0x62,
+	0x6c, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x73, 0x73, 0x68, 0x45, 0x6e,
+	0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x1c, 0x0a, 0x09, 0x73, 0x73, 0x68, 0x50, 0x75, 0x62, 0x4b,
+	0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x73, 0x73, 0x68, 0x50, 0x75, 0x62,
+	0x4b, 0x65, 0x79, 0x12, 0x33, 0x0a, 0x09, 0x6a, 0x77, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x4a, 0x57, 0x54, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x09, 0x6a,
+	0x77, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0x20, 0x0a, 0x1e, 0x44, 0x65, 0x76, 0x69,
+	0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46,
+	0x6c, 0x6f, 0x77, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0xbf, 0x01, 0x0a, 0x17, 0x44,
+	0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x12, 0x48, 0x0a, 0x08, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64,
+	0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68,
+	0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x2e, 0x70, 0x72,
+	0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x52, 0x08, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72,
+	0x12, 0x42, 0x0a, 0x0e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x52, 0x0e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x22, 0x16, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72,
+	0x12, 0x0a, 0x0a, 0x06, 0x48, 0x4f, 0x53, 0x54, 0x45, 0x44, 0x10, 0x00, 0x22, 0x1e, 0x0a, 0x1c,
+	0x50, 0x4b, 0x43, 0x45, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x5b, 0x0a, 0x15,
+	0x50, 0x4b, 0x43, 0x45, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x12, 0x42, 0x0a, 0x0e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65,
+	0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x76, 0x69,
+	0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0e, 0x50, 0x72, 0x6f, 0x76, 0x69,
+	0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0xbc, 0x03, 0x0a, 0x0e, 0x50, 0x72,
+	0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x1a, 0x0a, 0x08,
+	0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49, 0x44, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
+	0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49, 0x44, 0x12, 0x26, 0x0a, 0x0c, 0x43, 0x6c, 0x69, 0x65,
+	0x6e, 0x74, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x02,
+	0x18, 0x01, 0x52, 0x0c, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74,
+	0x12, 0x16, 0x0a, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x41, 0x75, 0x64, 0x69,
+	0x65, 0x6e, 0x63, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x41, 0x75, 0x64, 0x69,
+	0x65, 0x6e, 0x63, 0x65, 0x12, 0x2e, 0x0a, 0x12, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75,
+	0x74, 0x68, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x12, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x45, 0x6e, 0x64, 0x70,
+	0x6f, 0x69, 0x6e, 0x74, 0x12, 0x24, 0x0a, 0x0d, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x45, 0x6e, 0x64,
+	0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x54, 0x6f, 0x6b,
+	0x65, 0x6e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x53, 0x63,
+	0x6f, 0x70, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x53, 0x63, 0x6f, 0x70, 0x65,
+	0x12, 0x1e, 0x0a, 0x0a, 0x55, 0x73, 0x65, 0x49, 0x44, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x08,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x55, 0x73, 0x65, 0x49, 0x44, 0x54, 0x6f, 0x6b, 0x65, 0x6e,
+	0x12, 0x34, 0x0a, 0x15, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x15, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e,
+	0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x22, 0x0a, 0x0c, 0x52, 0x65, 0x64, 0x69, 0x72, 0x65,
+	0x63, 0x74, 0x55, 0x52, 0x4c, 0x73, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x52, 0x65,
+	0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x55, 0x52, 0x4c, 0x73, 0x12, 0x2e, 0x0a, 0x12, 0x44, 0x69,
+	0x73, 0x61, 0x62, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x4c, 0x6f, 0x67, 0x69, 0x6e,
+	0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x50,
+	0x72, 0x6f, 0x6d, 0x70, 0x74, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x1c, 0x0a, 0x09, 0x4c, 0x6f,
+	0x67, 0x69, 0x6e, 0x46, 0x6c, 0x61, 0x67, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x09, 0x4c,
+	0x6f, 0x67, 0x69, 0x6e, 0x46, 0x6c, 0x61, 0x67, 0x22, 0x93, 0x02, 0x0a, 0x05, 0x52, 0x6f, 0x75,
+	0x74, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x49, 0x44, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02,
+	0x49, 0x44, 0x12, 0x18, 0x0a, 0x07, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x07, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x12, 0x20, 0x0a, 0x0b,
+	0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x54, 0x79, 0x70, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x03, 0x52, 0x0b, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x54, 0x79, 0x70, 0x65, 0x12, 0x12,
+	0x0a, 0x04, 0x50, 0x65, 0x65, 0x72, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x50, 0x65,
+	0x65, 0x72, 0x12, 0x16, 0x0a, 0x06, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x18, 0x05, 0x20, 0x01,
+	0x28, 0x03, 0x52, 0x06, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x12, 0x1e, 0x0a, 0x0a, 0x4d, 0x61,
+	0x73, 0x71, 0x75, 0x65, 0x72, 0x61, 0x64, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a,
+	0x4d, 0x61, 0x73, 0x71, 0x75, 0x65, 0x72, 0x61, 0x64, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x4e, 0x65,
+	0x74, 0x49, 0x44, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x4e, 0x65, 0x74, 0x49, 0x44,
+	0x12, 0x18, 0x0a, 0x07, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28,
+	0x09, 0x52, 0x07, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x1c, 0x0a, 0x09, 0x6b, 0x65,
+	0x65, 0x70, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x18, 0x09, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x6b,
+	0x65, 0x65, 0x70, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x12, 0x24, 0x0a, 0x0d, 0x73, 0x6b, 0x69, 0x70,
+	0x41, 0x75, 0x74, 0x6f, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x0d, 0x73, 0x6b, 0x69, 0x70, 0x41, 0x75, 0x74, 0x6f, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x22, 0xde,
+	0x01, 0x0a, 0x09, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x24, 0x0a, 0x0d,
+	0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x08, 0x52, 0x0d, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x45, 0x6e, 0x61, 0x62,
+	0x6c, 0x65, 0x12, 0x47, 0x0a, 0x10, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72,
+	0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x52, 0x10, 0x4e, 0x61, 0x6d, 0x65, 0x53,
+	0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x38, 0x0a, 0x0b, 0x43,
+	0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x75,
+	0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x52, 0x0b, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d,
+	0x5a, 0x6f, 0x6e, 0x65, 0x73, 0x12, 0x28, 0x0a, 0x0d, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64,
+	0x65, 0x72, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x42, 0x02, 0x18, 0x01,
+	0x52, 0x0d, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x50, 0x6f, 0x72, 0x74, 0x22,
+	0xb8, 0x01, 0x0a, 0x0a, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x12, 0x16,
+	0x0a, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06,
+	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x32, 0x0a, 0x07, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64,
+	0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x69, 0x6d, 0x70, 0x6c, 0x65, 0x52, 0x65, 0x63, 0x6f, 0x72,
+	0x64, 0x52, 0x07, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x12, 0x32, 0x0a, 0x14, 0x53, 0x65,
+	0x61, 0x72, 0x63, 0x68, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c,
+	0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x14, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68,
+	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x2a,
+	0x0a, 0x10, 0x4e, 0x6f, 0x6e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x61, 0x74, 0x69,
+	0x76, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x4e, 0x6f, 0x6e, 0x41, 0x75, 0x74,
+	0x68, 0x6f, 0x72, 0x69, 0x74, 0x61, 0x74, 0x69, 0x76, 0x65, 0x22, 0x74, 0x0a, 0x0c, 0x53, 0x69,
+	0x6d, 0x70, 0x6c, 0x65, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x4e, 0x61,
+	0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x12,
+	0x0a, 0x04, 0x54, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x04, 0x54, 0x79,
+	0x70, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x05, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x12, 0x10, 0x0a, 0x03, 0x54, 0x54, 0x4c, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x03, 0x54, 0x54, 0x4c, 0x12, 0x14, 0x0a, 0x05, 0x52, 0x44,
+	0x61, 0x74, 0x61, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x52, 0x44, 0x61, 0x74, 0x61,
+	0x22, 0xb3, 0x01, 0x0a, 0x0f, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47,
+	0x72, 0x6f, 0x75, 0x70, 0x12, 0x38, 0x0a, 0x0b, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76,
+	0x65, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65,
+	0x72, 0x52, 0x0b, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x18,
+	0x0a, 0x07, 0x50, 0x72, 0x69, 0x6d, 0x61, 0x72, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x07, 0x50, 0x72, 0x69, 0x6d, 0x61, 0x72, 0x79, 0x12, 0x18, 0x0a, 0x07, 0x44, 0x6f, 0x6d, 0x61,
+	0x69, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x44, 0x6f, 0x6d, 0x61, 0x69,
+	0x6e, 0x73, 0x12, 0x32, 0x0a, 0x14, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x44, 0x6f, 0x6d, 0x61,
+	0x69, 0x6e, 0x73, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x14, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x45,
+	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x22, 0x48, 0x0a, 0x0a, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x12, 0x0e, 0x0a, 0x02, 0x49, 0x50, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x02, 0x49, 0x50, 0x12, 0x16, 0x0a, 0x06, 0x4e, 0x53, 0x54, 0x79, 0x70, 0x65, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x03, 0x52, 0x06, 0x4e, 0x53, 0x54, 0x79, 0x70, 0x65, 0x12, 0x12, 0x0a, 0x04,
+	0x50, 0x6f, 0x72, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52, 0x04, 0x50, 0x6f, 0x72, 0x74,
+	0x22, 0xfb, 0x02, 0x0a, 0x0c, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c,
+	0x65, 0x12, 0x1a, 0x0a, 0x06, 0x50, 0x65, 0x65, 0x72, 0x49, 0x50, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x42, 0x02, 0x18, 0x01, 0x52, 0x06, 0x50, 0x65, 0x65, 0x72, 0x49, 0x50, 0x12, 0x37, 0x0a,
+	0x09, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e,
+	0x32, 0x19, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75,
+	0x6c, 0x65, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x09, 0x44, 0x69, 0x72,
+	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x2e, 0x0a, 0x06, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06,
+	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x34, 0x0a, 0x08, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63,
+	0x6f, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63,
+	0x6f, 0x6c, 0x52, 0x08, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x12, 0x0a, 0x04,
+	0x50, 0x6f, 0x72, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x50, 0x6f, 0x72, 0x74,
+	0x12, 0x30, 0x0a, 0x08, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x18, 0x06, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x08, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e,
+	0x66, 0x6f, 0x12, 0x1a, 0x0a, 0x08, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x44, 0x18, 0x07,
+	0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x44, 0x12, 0x26,
+	0x0a, 0x0e, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c,
+	0x18, 0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0e, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x50, 0x72,
+	0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x26, 0x0a, 0x0e, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x65, 0x73, 0x18, 0x09, 0x20, 0x03, 0x28, 0x0c, 0x52, 0x0e,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x65, 0x73, 0x22, 0x38,
+	0x0a, 0x0e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73,
+	0x12, 0x14, 0x0a, 0x05, 0x6e, 0x65, 0x74, 0x49, 0x50, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x05, 0x6e, 0x65, 0x74, 0x49, 0x50, 0x12, 0x10, 0x0a, 0x03, 0x6d, 0x61, 0x63, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x03, 0x6d, 0x61, 0x63, 0x22, 0x1e, 0x0a, 0x06, 0x43, 0x68, 0x65, 0x63,
+	0x6b, 0x73, 0x12, 0x14, 0x0a, 0x05, 0x46, 0x69, 0x6c, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28,
+	0x09, 0x52, 0x05, 0x46, 0x69, 0x6c, 0x65, 0x73, 0x22, 0x96, 0x01, 0x0a, 0x08, 0x50, 0x6f, 0x72,
+	0x74, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x14, 0x0a, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0d, 0x48, 0x00, 0x52, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x32, 0x0a, 0x05, 0x72,
+	0x61, 0x6e, 0x67, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f,
+	0x2e, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x48, 0x00, 0x52, 0x05, 0x72, 0x61, 0x6e, 0x67, 0x65, 0x1a,
+	0x2f, 0x0a, 0x05, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x72,
+	0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x05, 0x73, 0x74, 0x61, 0x72, 0x74, 0x12, 0x10,
+	0x0a, 0x03, 0x65, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x03, 0x65, 0x6e, 0x64,
+	0x42, 0x0f, 0x0a, 0x0d, 0x70, 0x6f, 0x72, 0x74, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x22, 0x87, 0x03, 0x0a, 0x11, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x46, 0x69, 0x72, 0x65, 0x77,
+	0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x12, 0x22, 0x0a, 0x0c, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x12, 0x2e, 0x0a, 0x06, 0x61,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x16, 0x2e, 0x6d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c, 0x65, 0x41, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x20, 0x0a, 0x0b, 0x64,
+	0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x0b, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x34, 0x0a,
+	0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32,
+	0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75, 0x6c,
+	0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x63, 0x6f, 0x6c, 0x12, 0x30, 0x0a, 0x08, 0x70, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x18,
+	0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x08, 0x70, 0x6f, 0x72,
+	0x74, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x1c, 0x0a, 0x09, 0x69, 0x73, 0x44, 0x79, 0x6e, 0x61, 0x6d,
+	0x69, 0x63, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x69, 0x73, 0x44, 0x79, 0x6e, 0x61,
+	0x6d, 0x69, 0x63, 0x12, 0x18, 0x0a, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x07,
+	0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x26, 0x0a,
+	0x0e, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18,
+	0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0e, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x50, 0x72, 0x6f,
+	0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x1a, 0x0a, 0x08, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49,
+	0x44, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49,
+	0x44, 0x12, 0x18, 0x0a, 0x07, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x49, 0x44, 0x18, 0x0a, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x07, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x49, 0x44, 0x22, 0xf6, 0x01, 0x0a, 0x0e,
+	0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x12, 0x34,
+	0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e,
+	0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x75,
+	0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x3e, 0x0a, 0x0f, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49,
+	0x6e, 0x66, 0x6f, 0x52, 0x0f, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x50, 0x6f, 0x72, 0x74, 0x12, 0x2c, 0x0a, 0x11, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x6c, 0x61, 0x74,
+	0x65, 0x64, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52,
+	0x11, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x41, 0x64, 0x64, 0x72, 0x65,
+	0x73, 0x73, 0x12, 0x3c, 0x0a, 0x0e, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x6c, 0x61, 0x74, 0x65, 0x64,
+	0x50, 0x6f, 0x72, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f,
+	0x52, 0x0e, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x50, 0x6f, 0x72, 0x74,
+	0x3a, 0x02, 0x18, 0x01, 0x22, 0x8b, 0x02, 0x0a, 0x14, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x53,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x12, 0x0a,
+	0x04, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x04, 0x70, 0x6f, 0x72,
+	0x74, 0x12, 0x36, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x0e, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+	0x2e, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52,
+	0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x10, 0x0a, 0x03, 0x70, 0x69, 0x6e,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x70, 0x69, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x70,
+	0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70,
+	0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x1f, 0x0a, 0x0b, 0x75, 0x73, 0x65, 0x72, 0x5f,
+	0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0a, 0x75, 0x73,
+	0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61,
+	0x69, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
+	0x12, 0x1f, 0x0a, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x18,
+	0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6e, 0x61, 0x6d, 0x65, 0x50, 0x72, 0x65, 0x66, 0x69,
+	0x78, 0x12, 0x1f, 0x0a, 0x0b, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x5f, 0x70, 0x6f, 0x72, 0x74,
+	0x18, 0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0a, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x50, 0x6f,
+	0x72, 0x74, 0x22, 0xa1, 0x01, 0x0a, 0x15, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x53, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x21, 0x0a, 0x0c,
+	0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12,
+	0x1f, 0x0a, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x55, 0x72, 0x6c,
+	0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x2c, 0x0a, 0x12, 0x70, 0x6f, 0x72, 0x74,
+	0x5f, 0x61, 0x75, 0x74, 0x6f, 0x5f, 0x61, 0x73, 0x73, 0x69, 0x67, 0x6e, 0x65, 0x64, 0x18, 0x04,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x70, 0x6f, 0x72, 0x74, 0x41, 0x75, 0x74, 0x6f, 0x41, 0x73,
+	0x73, 0x69, 0x67, 0x6e, 0x65, 0x64, 0x22, 0x2c, 0x0a, 0x12, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x45,
+	0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x16, 0x0a, 0x06,
+	0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f,
+	0x6d, 0x61, 0x69, 0x6e, 0x22, 0x15, 0x0a, 0x13, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x45, 0x78, 0x70,
+	0x6f, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x2b, 0x0a, 0x11, 0x53,
+	0x74, 0x6f, 0x70, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x22, 0x14, 0x0a, 0x12, 0x53, 0x74, 0x6f, 0x70,
+	0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x9a,
+	0x01, 0x0a, 0x12, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x76,
+	0x65, 0x6c, 0x6f, 0x70, 0x65, 0x12, 0x3a, 0x0a, 0x04, 0x66, 0x75, 0x6c, 0x6c, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+	0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f,
+	0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x48, 0x00, 0x52, 0x04, 0x66, 0x75, 0x6c,
+	0x6c, 0x12, 0x3d, 0x0a, 0x05, 0x64, 0x65, 0x6c, 0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x25, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65,
+	0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e,
+	0x74, 0x73, 0x44, 0x65, 0x6c, 0x74, 0x61, 0x48, 0x00, 0x52, 0x05, 0x64, 0x65, 0x6c, 0x74, 0x61,
+	0x42, 0x09, 0x0a, 0x07, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x22, 0x96, 0x0f, 0x0a, 0x18,
 	0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e,
-	0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x74, 0x72,
-	0x79, 0x52, 0x13, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x6f, 0x6c, 0x69, 0x63,
-	0x69, 0x65, 0x73, 0x4d, 0x61, 0x70, 0x12, 0x6a, 0x0a, 0x14, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f,
-	0x69, 0x64, 0x5f, 0x74, 0x6f, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x14,
-	0x20, 0x03, 0x28, 0x0b, 0x32, 0x3a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
-	0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70,
-	0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x2e, 0x47, 0x72, 0x6f, 0x75, 0x70,
-	0x49, 0x64, 0x54, 0x6f, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79,
-	0x52, 0x10, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x54, 0x6f, 0x55, 0x73, 0x65, 0x72, 0x49,
-	0x64, 0x73, 0x12, 0x28, 0x0a, 0x10, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x5f, 0x75, 0x73,
-	0x65, 0x72, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x15, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x61, 0x6c,
-	0x6c, 0x6f, 0x77, 0x65, 0x64, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x73, 0x12, 0x6e, 0x0a, 0x14,
-	0x70, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x5f, 0x66, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x5f, 0x70,
-	0x65, 0x65, 0x72, 0x73, 0x18, 0x16, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x3c, 0x2e, 0x6d, 0x61, 0x6e,
+	0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x65, 0x72, 0x69,
+	0x61, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x06, 0x73, 0x65, 0x72, 0x69, 0x61, 0x6c,
+	0x12, 0x37, 0x0a, 0x0b, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0a, 0x70,
+	0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x34, 0x0a, 0x07, 0x6e, 0x65, 0x74,
+	0x77, 0x6f, 0x72, 0x6b, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x4e,
+	0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x12,
+	0x4d, 0x0a, 0x10, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x74, 0x69,
+	0x6e, 0x67, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x53, 0x65,
+	0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x0f, 0x61,
+	0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x41,
+	0x0a, 0x0c, 0x64, 0x6e, 0x73, 0x5f, 0x73, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x05,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x44, 0x4e, 0x53, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x43, 0x6f, 0x6d,
+	0x70, 0x61, 0x63, 0x74, 0x52, 0x0b, 0x64, 0x6e, 0x73, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67,
+	0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x64, 0x6e, 0x73, 0x5f, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18,
+	0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x64, 0x6e, 0x73, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
+	0x12, 0x2c, 0x0a, 0x12, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5f, 0x7a, 0x6f, 0x6e, 0x65, 0x5f,
+	0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x63, 0x75,
+	0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x25,
+	0x0a, 0x0e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x73,
+	0x18, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0d, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72,
+	0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x2d, 0x0a, 0x05, 0x70, 0x65, 0x65, 0x72, 0x73, 0x18, 0x09,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x05, 0x70,
+	0x65, 0x65, 0x72, 0x73, 0x12, 0x2e, 0x0a, 0x13, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x5f, 0x70,
+	0x65, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x18, 0x0a, 0x20, 0x03, 0x28,
+	0x0d, 0x52, 0x11, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x50, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64,
+	0x65, 0x78, 0x65, 0x73, 0x12, 0x35, 0x0a, 0x08, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73,
+	0x18, 0x0b, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63,
+	0x74, 0x52, 0x08, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x12, 0x30, 0x0a, 0x06, 0x67,
+	0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x0c, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x43, 0x6f,
+	0x6d, 0x70, 0x61, 0x63, 0x74, 0x52, 0x06, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x2c, 0x0a,
+	0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x0d, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65,
+	0x52, 0x61, 0x77, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x4b, 0x0a, 0x11, 0x6e,
+	0x61, 0x6d, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73,
+	0x18, 0x0e, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x47, 0x72,
+	0x6f, 0x75, 0x70, 0x52, 0x61, 0x77, 0x52, 0x10, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x65, 0x72, 0x76,
+	0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x40, 0x0a, 0x0f, 0x61, 0x6c, 0x6c, 0x5f,
+	0x64, 0x6e, 0x73, 0x5f, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x18, 0x0f, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53,
+	0x69, 0x6d, 0x70, 0x6c, 0x65, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x52, 0x0d, 0x61, 0x6c, 0x6c,
+	0x44, 0x6e, 0x73, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x12, 0x3b, 0x0a, 0x0d, 0x61, 0x63,
+	0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x7a, 0x6f, 0x6e, 0x65, 0x73, 0x18, 0x10, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43,
+	0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5a, 0x6f, 0x6e, 0x65, 0x52, 0x0c, 0x61, 0x63, 0x63, 0x6f, 0x75,
+	0x6e, 0x74, 0x5a, 0x6f, 0x6e, 0x65, 0x73, 0x12, 0x4b, 0x0a, 0x11, 0x6e, 0x65, 0x74, 0x77, 0x6f,
+	0x72, 0x6b, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x11, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52,
+	0x61, 0x77, 0x52, 0x10, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x73, 0x12, 0x55, 0x0a, 0x0b, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x73, 0x5f,
+	0x6d, 0x61, 0x70, 0x18, 0x12, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x34, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61,
+	0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x2e,
+	0x52, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x73, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52,
+	0x0a, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x73, 0x4d, 0x61, 0x70, 0x12, 0x71, 0x0a, 0x15, 0x72,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73,
+	0x5f, 0x6d, 0x61, 0x70, 0x18, 0x13, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x3d, 0x2e, 0x6d, 0x61, 0x6e,
 	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d,
 	0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c,
-	0x2e, 0x50, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x46, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x50, 0x65,
-	0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x12, 0x70, 0x6f, 0x73, 0x74, 0x75, 0x72,
-	0x65, 0x46, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x73, 0x12, 0x2c, 0x0a, 0x12,
-	0x64, 0x6e, 0x73, 0x5f, 0x66, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x5f, 0x70, 0x6f,
-	0x72, 0x74, 0x18, 0x17, 0x20, 0x01, 0x28, 0x03, 0x52, 0x10, 0x64, 0x6e, 0x73, 0x46, 0x6f, 0x72,
-	0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x37, 0x0a, 0x0b, 0x70, 0x72,
-	0x6f, 0x78, 0x79, 0x5f, 0x70, 0x61, 0x74, 0x63, 0x68, 0x18, 0x18, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f,
-	0x78, 0x79, 0x50, 0x61, 0x74, 0x63, 0x68, 0x52, 0x0a, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x61,
-	0x74, 0x63, 0x68, 0x12, 0x22, 0x0a, 0x0d, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x5f, 0x63,
-	0x6c, 0x61, 0x69, 0x6d, 0x18, 0x19, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x75, 0x73, 0x65, 0x72,
-	0x49, 0x64, 0x43, 0x6c, 0x61, 0x69, 0x6d, 0x1a, 0x5c, 0x0a, 0x0f, 0x52, 0x6f, 0x75, 0x74, 0x65,
-	0x72, 0x73, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65,
-	0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x33, 0x0a, 0x05,
-	0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
-	0x52, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75,
-	0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x5d, 0x0a, 0x18, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x74, 0x72,
-	0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03,
-	0x6b, 0x65, 0x79, 0x12, 0x2b, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x64, 0x73, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
-	0x3a, 0x02, 0x38, 0x01, 0x1a, 0x5b, 0x0a, 0x15, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x54,
-	0x6f, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a,
+	0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65,
+	0x73, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x13, 0x72, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x4d, 0x61, 0x70, 0x12, 0x6a,
+	0x0a, 0x14, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x5f, 0x74, 0x6f, 0x5f, 0x75, 0x73,
+	0x65, 0x72, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x14, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x3a, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72,
+	0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x46, 0x75,
+	0x6c, 0x6c, 0x2e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x54, 0x6f, 0x55, 0x73, 0x65, 0x72,
+	0x49, 0x64, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x10, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x49,
+	0x64, 0x54, 0x6f, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x73, 0x12, 0x28, 0x0a, 0x10, 0x61, 0x6c,
+	0x6c, 0x6f, 0x77, 0x65, 0x64, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x15,
+	0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x55, 0x73, 0x65,
+	0x72, 0x49, 0x64, 0x73, 0x12, 0x6e, 0x0a, 0x14, 0x70, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x5f,
+	0x66, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x5f, 0x70, 0x65, 0x65, 0x72, 0x73, 0x18, 0x16, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x3c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x6e,
+	0x65, 0x6e, 0x74, 0x73, 0x46, 0x75, 0x6c, 0x6c, 0x2e, 0x50, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65,
+	0x46, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79,
+	0x52, 0x12, 0x70, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x46, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x50,
+	0x65, 0x65, 0x72, 0x73, 0x12, 0x2c, 0x0a, 0x12, 0x64, 0x6e, 0x73, 0x5f, 0x66, 0x6f, 0x72, 0x77,
+	0x61, 0x72, 0x64, 0x65, 0x72, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x17, 0x20, 0x01, 0x28, 0x03,
+	0x52, 0x10, 0x64, 0x6e, 0x73, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x50, 0x6f,
+	0x72, 0x74, 0x12, 0x3b, 0x0a, 0x0b, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x5f, 0x70, 0x61, 0x74, 0x63,
+	0x68, 0x18, 0x18, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x61, 0x74, 0x63, 0x68, 0x42,
+	0x02, 0x18, 0x01, 0x52, 0x0a, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x61, 0x74, 0x63, 0x68, 0x12,
+	0x22, 0x0a, 0x0d, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x5f, 0x63, 0x6c, 0x61, 0x69, 0x6d,
+	0x18, 0x19, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x43, 0x6c,
+	0x61, 0x69, 0x6d, 0x1a, 0x5c, 0x0a, 0x0f, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x73, 0x4d, 0x61,
+	0x70, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x33, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x6f, 0x75, 0x74,
+	0x65, 0x72, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38,
+	0x01, 0x1a, 0x5d, 0x0a, 0x18, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x6f, 0x6c,
+	0x69, 0x63, 0x69, 0x65, 0x73, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a,
 	0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12,
-	0x2c, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x55, 0x73, 0x65, 0x72,
-	0x49, 0x44, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38,
-	0x01, 0x1a, 0x5f, 0x0a, 0x17, 0x50, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x46, 0x61, 0x69, 0x6c,
-	0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03,
-	0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x2e,
-	0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x18, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x49,
-	0x6e, 0x64, 0x65, 0x78, 0x53, 0x65, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02,
-	0x38, 0x01, 0x4a, 0x04, 0x08, 0x1a, 0x10, 0x33, 0x22, 0x87, 0x03, 0x0a, 0x0a, 0x50, 0x72, 0x6f,
-	0x78, 0x79, 0x50, 0x61, 0x74, 0x63, 0x68, 0x12, 0x32, 0x0a, 0x05, 0x70, 0x65, 0x65, 0x72, 0x73,
-	0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x52, 0x05, 0x70, 0x65, 0x65, 0x72, 0x73, 0x12, 0x41, 0x0a, 0x0d, 0x6f,
-	0x66, 0x66, 0x6c, 0x69, 0x6e, 0x65, 0x5f, 0x70, 0x65, 0x65, 0x72, 0x73, 0x18, 0x02, 0x20, 0x03,
+	0x2b, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x49, 0x64, 0x73, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01,
+	0x1a, 0x5b, 0x0a, 0x15, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x54, 0x6f, 0x55, 0x73, 0x65,
+	0x72, 0x49, 0x64, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x2c, 0x0a, 0x05, 0x76,
+	0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x49, 0x44, 0x4c, 0x69,
+	0x73, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x5f, 0x0a,
+	0x17, 0x50, 0x6f, 0x73, 0x74, 0x75, 0x72, 0x65, 0x46, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x50, 0x65,
+	0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x2e, 0x0a, 0x05, 0x76, 0x61,
+	0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x49, 0x6e, 0x64, 0x65, 0x78,
+	0x53, 0x65, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x4a, 0x04,
+	0x08, 0x1a, 0x10, 0x33, 0x22, 0x8b, 0x03, 0x0a, 0x0a, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x61,
+	0x74, 0x63, 0x68, 0x12, 0x32, 0x0a, 0x05, 0x70, 0x65, 0x65, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03,
 	0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
 	0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x52, 0x0c, 0x6f, 0x66, 0x66, 0x6c, 0x69, 0x6e, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73, 0x12, 0x3f,
-	0x0a, 0x0e, 0x66, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x5f, 0x72, 0x75, 0x6c, 0x65, 0x73,
-	0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65,
-	0x52, 0x0d, 0x66, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x12,
-	0x29, 0x0a, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32,
-	0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x6f, 0x75,
-	0x74, 0x65, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x4f, 0x0a, 0x14, 0x72, 0x6f,
-	0x75, 0x74, 0x65, 0x5f, 0x66, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x5f, 0x72, 0x75, 0x6c,
-	0x65, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x46, 0x69, 0x72, 0x65, 0x77,
-	0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x52, 0x12, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x46, 0x69,
-	0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x12, 0x45, 0x0a, 0x10, 0x66,
-	0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x5f, 0x72, 0x75, 0x6c, 0x65, 0x73, 0x18,
-	0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x2e, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c,
-	0x65, 0x52, 0x0f, 0x66, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c,
-	0x65, 0x73, 0x22, 0x94, 0x01, 0x0a, 0x16, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x53, 0x65,
+	0x52, 0x05, 0x70, 0x65, 0x65, 0x72, 0x73, 0x12, 0x41, 0x0a, 0x0d, 0x6f, 0x66, 0x66, 0x6c, 0x69,
+	0x6e, 0x65, 0x5f, 0x70, 0x65, 0x65, 0x72, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x6d, 0x6f,
+	0x74, 0x65, 0x50, 0x65, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0c, 0x6f, 0x66,
+	0x66, 0x6c, 0x69, 0x6e, 0x65, 0x50, 0x65, 0x65, 0x72, 0x73, 0x12, 0x3f, 0x0a, 0x0e, 0x66, 0x69,
+	0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x5f, 0x72, 0x75, 0x6c, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x52, 0x0d, 0x66, 0x69,
+	0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x12, 0x29, 0x0a, 0x06, 0x72,
+	0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x6d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x06,
+	0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x4f, 0x0a, 0x14, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x5f,
+	0x66, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x5f, 0x72, 0x75, 0x6c, 0x65, 0x73, 0x18, 0x05,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x52,
+	0x75, 0x6c, 0x65, 0x52, 0x12, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x46, 0x69, 0x72, 0x65, 0x77, 0x61,
+	0x6c, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x12, 0x45, 0x0a, 0x10, 0x66, 0x6f, 0x72, 0x77, 0x61,
+	0x72, 0x64, 0x69, 0x6e, 0x67, 0x5f, 0x72, 0x75, 0x6c, 0x65, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x46,
+	0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x52, 0x0f, 0x66,
+	0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x3a, 0x02,
+	0x18, 0x01, 0x22, 0x94, 0x01, 0x0a, 0x16, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x53, 0x65,
 	0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x12, 0x41, 0x0a,
 	0x1d, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x5f, 0x65, 0x78, 0x70, 0x69,
 	0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x01,
diff --git a/shared/management/proto/management.proto b/shared/management/proto/management.proto
index c3d75af11..f7febfe9a 100644
--- a/shared/management/proto/management.proto
+++ b/shared/management/proto/management.proto
@@ -471,7 +471,8 @@ message NetworkMap {
   // RoutesFirewallRulesIsEmpty indicates whether RouteFirewallRule array is empty or not to bypass protobuf null and empty array equality.
   bool routesFirewallRulesIsEmpty = 11;
 
-  repeated ForwardingRule forwardingRules = 12;
+  // Unused; the ingress port-forwarding feature was discontinued.
+  repeated ForwardingRule forwardingRules = 12 [deprecated = true];
 
   // SSHAuth represents SSH authorization configuration
   SSHAuth sshAuth = 13;
@@ -752,17 +753,13 @@ message RouteFirewallRule {
   string RouteID = 10;
 }
 
+// ForwardingRule is unused; the ingress port-forwarding feature was discontinued.
 message ForwardingRule {
-  // Protocol of the forwarding rule
+  option deprecated = true;
+
   RuleProtocol protocol = 1;
-
-  // portInfo is the ingress destination port information, where the traffic arrives in the gateway node
   PortInfo destinationPort = 2;
-
-  // IP address of the translated address (remote peer) to send traffic to
   bytes translatedAddress = 3;
-
-  // Translated port information, where the traffic should be forwarded to
   PortInfo translatedPort = 4;
 }
 
@@ -808,7 +805,7 @@ message StopExposeResponse {}
 // Component-based NetworkMap wire format (PeerCapabilityComponentNetworkMap).
 //
 // Peers that advertise this capability receive NetworkMap building blocks
-// (peers + groups + policies + routes + dns + ssh + forwarding) and run the
+// (peers + groups + policies + routes + dns + ssh) and run the
 // expansion (Calculate) locally instead of receiving a fully-expanded
 // NetworkMap from the server.
 // =====================================================================
@@ -826,8 +823,8 @@ message NetworkMapEnvelope {
 // client decodes it into a types.NetworkMapComponents and runs Calculate()
 // locally to produce the same NetworkMap the legacy server path would have
 // produced. Every field carries RAW component data — no server-side
-// expansion (firewall rules, DNS config, SSH auth, route firewall rules,
-// forwarding rules) is shipped; the client computes those itself.
+// expansion (firewall rules, DNS config, SSH auth, route firewall rules)
+// is shipped; the client computes those itself.
 message NetworkMapComponentsFull {
   uint64 serial = 1;
 
@@ -911,12 +908,8 @@ message NetworkMapComponentsFull {
   // versions; clients fold it into their Calculate() DNS output.
   int64 dns_forwarder_port = 23;
 
-  // Pre-expanded NetworkMap fragments injected post-Calculate by external
-  // controllers (BYOP / port-forwarding proxies). The receiving client
-  // merges these into its locally-computed NetworkMap the same way the
-  // legacy server does via NetworkMap.Merge — so downstream consumers see
-  // a unified merged result regardless of source.
-  ProxyPatch proxy_patch = 24;
+  // Unused; the ingress port-forwarding feature was discontinued.
+  ProxyPatch proxy_patch = 24 [deprecated = true];
 
   // SSH UserIDClaim — server-side HttpServerConfig.AuthUserIDClaim, or
   // "sub" by default. Populated in proto.SSHAuth.UserIDClaim when the
@@ -929,12 +922,10 @@ message NetworkMapComponentsFull {
   reserved 26 to 50;
 }
 
-// ProxyPatch carries NetworkMap fragments that don't fit the component-graph
-// model — they're pre-expanded by external controllers (BYOP /
-// port-forwarding proxies) and injected post-Calculate. Fields use the
-// legacy wire types because the proxy delivers them pre-formed; there is
-// no raw component shape to convert from. Empty when no proxy is active.
+// ProxyPatch is unused; the ingress port-forwarding feature was discontinued.
 message ProxyPatch {
+  option deprecated = true;
+
   repeated RemotePeerConfig peers = 1;
   repeated RemotePeerConfig offline_peers = 2;
   repeated FirewallRule firewall_rules = 3;
diff --git a/shared/management/types/network.go b/shared/management/types/network.go
index 1269bac4c..ab61d7cb2 100644
--- a/shared/management/types/network.go
+++ b/shared/management/types/network.go
@@ -1,13 +1,8 @@
 package types
 
 import (
-	"net"
-
-	"golang.org/x/exp/maps"
-
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
-	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
 const (
@@ -25,7 +20,6 @@ type NetworkMap struct {
 	OfflinePeers        []*nmdata.Peer
 	FirewallRules       []*FirewallRule
 	RoutesFirewallRules []*RouteFirewallRule
-	ForwardingRules     []*ForwardingRule
 	AuthorizedUsers     map[string]map[string]struct{}
 	EnableSSH           bool
 	// ForceRoutingPeerDNSResolution forces the peer to run/use routing-peer DNS
@@ -33,101 +27,3 @@ type NetworkMap struct {
 	// domain targets.
 	ForceRoutingPeerDNSResolution bool
 }
-
-func (nm *NetworkMap) Merge(other *NetworkMap) {
-	nm.Peers = mergeUniquePeersByID(nm.Peers, other.Peers)
-	nm.Routes = mergeUnique(nm.Routes, other.Routes)
-	nm.OfflinePeers = mergeUniquePeersByID(nm.OfflinePeers, other.OfflinePeers)
-	nm.FirewallRules = mergeUnique(nm.FirewallRules, other.FirewallRules)
-	nm.RoutesFirewallRules = mergeUnique(nm.RoutesFirewallRules, other.RoutesFirewallRules)
-	nm.ForwardingRules = mergeUnique(nm.ForwardingRules, other.ForwardingRules)
-	nm.ForceRoutingPeerDNSResolution = nm.ForceRoutingPeerDNSResolution || other.ForceRoutingPeerDNSResolution
-}
-
-func mergeUniquePeersByID(peers1, peers2 []*nmdata.Peer) []*nmdata.Peer {
-	result := make(map[string]*nmdata.Peer)
-	for _, peer := range peers1 {
-		result[peer.ID] = peer
-	}
-	for _, peer := range peers2 {
-		if _, ok := result[peer.ID]; !ok {
-			result[peer.ID] = peer
-		}
-	}
-
-	return maps.Values(result)
-}
-
-type ForwardingRule struct {
-	RuleProtocol      string
-	DestinationPorts  RulePortRange
-	TranslatedAddress net.IP
-	TranslatedPorts   RulePortRange
-}
-
-func (f *ForwardingRule) ToProto() *proto.ForwardingRule {
-	var protocol proto.RuleProtocol
-	switch f.RuleProtocol {
-	case "icmp":
-		protocol = proto.RuleProtocol_ICMP
-	case "tcp":
-		protocol = proto.RuleProtocol_TCP
-	case "udp":
-		protocol = proto.RuleProtocol_UDP
-	case "all":
-		protocol = proto.RuleProtocol_ALL
-	default:
-		protocol = proto.RuleProtocol_UNKNOWN
-	}
-	return &proto.ForwardingRule{
-		Protocol:          protocol,
-		DestinationPort:   f.DestinationPorts.ToProto(),
-		TranslatedAddress: ipToBytes(f.TranslatedAddress),
-		TranslatedPort:    f.TranslatedPorts.ToProto(),
-	}
-}
-
-func (f *ForwardingRule) Equal(other *ForwardingRule) bool {
-	return f.RuleProtocol == other.RuleProtocol &&
-		f.DestinationPorts.Equal(&other.DestinationPorts) &&
-		f.TranslatedAddress.Equal(other.TranslatedAddress) &&
-		f.TranslatedPorts.Equal(&other.TranslatedPorts)
-}
-
-func ipToBytes(ip net.IP) []byte {
-	if ip4 := ip.To4(); ip4 != nil {
-		return ip4
-	}
-	return ip.To16()
-}
-
-type comparableObject[T any] interface {
-	Equal(other T) bool
-}
-
-func mergeUnique[T comparableObject[T]](arr1, arr2 []T) []T {
-	var result []T
-
-	for _, item := range arr1 {
-		if !containsEqual(result, item) {
-			result = append(result, item)
-		}
-	}
-
-	for _, item := range arr2 {
-		if !containsEqual(result, item) {
-			result = append(result, item)
-		}
-	}
-
-	return result
-}
-
-func containsEqual[T comparableObject[T]](slice []T, element T) bool {
-	for _, item := range slice {
-		if item.Equal(element) {
-			return true
-		}
-	}
-	return false
-}
diff --git a/shared/management/types/network_test.go b/shared/management/types/network_test.go
deleted file mode 100644
index 631f38836..000000000
--- a/shared/management/types/network_test.go
+++ /dev/null
@@ -1,41 +0,0 @@
-package types
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-type mergeTestObject struct {
-	value int
-}
-
-func (t mergeTestObject) Equal(other mergeTestObject) bool {
-	return t.value == other.value
-}
-
-func Test_MergeUniqueArraysWithoutDuplicates(t *testing.T) {
-	arr1 := []mergeTestObject{{value: 1}, {value: 2}}
-	arr2 := []mergeTestObject{{value: 2}, {value: 3}}
-	result := mergeUnique(arr1, arr2)
-	assert.Len(t, result, 3)
-	assert.Contains(t, result, mergeTestObject{value: 1})
-	assert.Contains(t, result, mergeTestObject{value: 2})
-	assert.Contains(t, result, mergeTestObject{value: 3})
-}
-
-func Test_MergeUniqueHandlesEmptyArrays(t *testing.T) {
-	arr1 := []mergeTestObject{}
-	arr2 := []mergeTestObject{}
-	result := mergeUnique(arr1, arr2)
-	assert.Empty(t, result)
-}
-
-func Test_MergeUniqueHandlesOneEmptyArray(t *testing.T) {
-	arr1 := []mergeTestObject{{value: 1}, {value: 2}}
-	arr2 := []mergeTestObject{}
-	result := mergeUnique(arr1, arr2)
-	assert.Len(t, result, 2)
-	assert.Contains(t, result, mergeTestObject{value: 1})
-	assert.Contains(t, result, mergeTestObject{value: 2})
-}

From 51a9d32cfcf053b652e4588297e6c6ef8708ffac Mon Sep 17 00:00:00 2001
From: Edward <43848523+thomashacker@users.noreply.github.com>
Date: Tue, 6 Oct 2026 16:59:26 +0200
Subject: [PATCH 14/18] [client] Warn on missing translations and check
 placeholders (#8090)

---
 .github/workflows/ui-translations.yml |   5 +-
 client/ui/i18n/check-translations.mjs | 130 +++++++++++++++++++-------
 2 files changed, 99 insertions(+), 36 deletions(-)

diff --git a/.github/workflows/ui-translations.yml b/.github/workflows/ui-translations.yml
index 24b7c9de2..9ac524495 100644
--- a/.github/workflows/ui-translations.yml
+++ b/.github/workflows/ui-translations.yml
@@ -36,7 +36,8 @@ jobs:
         with:
           node-version: "22"
 
-      # English (en) is the source of truth for translation keys; every other
-      # locale declared in _index.json must carry the exact same key set.
+      # English (en) is the source of truth for translation keys. Locales declared
+      # in _index.json fail on orphaned keys or placeholder mismatches; missing
+      # keys only warn, since they fall back to English at runtime.
       - name: Check translation key parity
         run: node client/ui/i18n/check-translations.mjs
diff --git a/client/ui/i18n/check-translations.mjs b/client/ui/i18n/check-translations.mjs
index bd076e0e0..a6b666337 100644
--- a/client/ui/i18n/check-translations.mjs
+++ b/client/ui/i18n/check-translations.mjs
@@ -1,13 +1,20 @@
 #!/usr/bin/env node
-// Validates that every shipped translation bundle carries exactly the same set
-// of keys as the English source of truth. English (en) defines the keys; every
-// other locale declared in _index.json must match it 1:1:
+// Validates every shipped translation bundle against the English source of
+// truth. English (en) defines the keys; for every other locale declared in
+// _index.json:
 //
-//   - no missing keys — a missing key silently falls back to English at runtime
-//     (see i18n bundle fallback), so the gap never surfaces to users or CI
-//     without this check;
-//   - no orphaned keys — keys left behind after an English key is renamed or
-//     removed are dead weight and a sign the locale is drifting.
+//   - missing keys are reported as a warning, not a failure — a missing key
+//     falls back to English at runtime (see i18n bundle fallback), and Crowdin
+//     exports only translated strings (skip_untranslated_strings in
+//     crowdin.yml), so a locale is routinely behind English until translators
+//     catch up;
+//   - orphaned keys fail — keys left behind after an English key is renamed or
+//     removed are dead weight and a sign the locale is drifting;
+//   - empty messages fail — a present key with an empty, whitespace-only or
+//     missing message renders blank instead of falling back to English;
+//   - placeholder mismatches fail — a translation must use exactly the
+//     {placeholders} of its English string, otherwise a value silently never
+//     renders (or a literal "{name}" leaks into the UI).
 //
 // Pure Node, no dependencies, so it runs without installing the frontend
 // toolchain.
@@ -23,17 +30,40 @@ const SOURCE = "en";
 const localesDir = join(dirname(fileURLToPath(import.meta.url)), "locales");
 const isCI = Boolean(process.env.GITHUB_ACTIONS);
 
+// Matches the i18next interpolation configured in the frontend
+// (prefix "{", suffix "}") and the Go bundle's applyPlaceholders.
+const PLACEHOLDER = /\{([^{}\s]+)\}/g;
+
 function readJSON(path) {
     return JSON.parse(readFileSync(path, "utf8"));
 }
 
-function keysOf(langCode) {
-    return Object.keys(readJSON(join(localesDir, langCode, "common.json")));
+function messagesOf(langCode) {
+    const entries = readJSON(join(localesDir, langCode, "common.json"));
+    const messages = new Map();
+    for (const [key, entry] of Object.entries(entries)) {
+        // null marks an unusable entry (missing or non-string message).
+        messages.set(key, typeof entry?.message === "string" ? entry.message : null);
+    }
+    return messages;
 }
 
-// Emit a GitHub Actions annotation so failures render inline on the PR diff.
-function annotate(file, message) {
-    if (isCI) console.log(`::error file=${file}::${message}`);
+function placeholdersOf(message) {
+    // Code-point order: placeholder names are identifiers, not prose.
+    return [...new Set([...message.matchAll(PLACEHOLDER)].map((m) => m[1]))].sort((a, b) => {
+        if (a < b) return -1;
+        if (a > b) return 1;
+        return 0;
+    });
+}
+
+function formatPlaceholders(names) {
+    return names.length ? names.map((n) => `{${n}}`).join(", ") : "none";
+}
+
+// Emit a GitHub Actions annotation so findings render inline on the PR diff.
+function annotate(level, file, message) {
+    if (isCI) console.log(`::${level} file=${file}::${message}`);
 }
 
 const index = readJSON(join(localesDir, "_index.json"));
@@ -44,8 +74,13 @@ if (!declared.includes(SOURCE)) {
     process.exit(1);
 }
 
-const sourceKeys = keysOf(SOURCE);
-const sourceSet = new Set(sourceKeys);
+const source = messagesOf(SOURCE);
+const sourceKeys = [...source.keys()];
+const emptySource = sourceKeys.filter((k) => !source.get(k)?.trim());
+if (emptySource.length) {
+    console.error(`FATAL: ${SOURCE}/common.json has empty or missing messages: ${emptySource.join(", ")}`);
+    process.exit(1);
+}
 console.log(`Source of truth: ${SOURCE}/common.json — ${sourceKeys.length} keys\n`);
 
 let failed = false;
@@ -54,40 +89,67 @@ for (const code of declared) {
     if (code === SOURCE) continue;
     const file = `client/ui/i18n/locales/${code}/common.json`;
 
-    let keys;
+    let messages;
     try {
-        keys = keysOf(code);
+        messages = messagesOf(code);
     } catch (e) {
         failed = true;
         const msg = `bundle is declared in _index.json but common.json is missing or invalid (${e.message})`;
         console.error(`✗ ${code}: ${msg}`);
-        annotate("client/ui/i18n/locales/_index.json", `${code}: ${msg}`);
+        annotate("error", "client/ui/i18n/locales/_index.json", `${code}: ${msg}`);
         continue;
     }
 
-    const set = new Set(keys);
-    const missing = sourceKeys.filter((k) => !set.has(k));
-    const extra = keys.filter((k) => !sourceSet.has(k));
-
-    if (missing.length === 0 && extra.length === 0) {
-        console.log(`✓ ${code}: ${keys.length} keys`);
-        continue;
+    const missing = sourceKeys.filter((k) => !messages.has(k));
+    const extra = [...messages.keys()].filter((k) => !source.has(k));
+    const empty = [];
+    const badPlaceholders = [];
+    for (const [key, message] of messages) {
+        if (!source.has(key)) continue;
+        if (!message?.trim()) {
+            empty.push(key);
+            continue;
+        }
+        const want = placeholdersOf(source.get(key));
+        const got = placeholdersOf(message);
+        if (want.length !== got.length || want.some((name, i) => name !== got[i])) {
+            badPlaceholders.push(`${key} (expected ${formatPlaceholders(want)}, got ${formatPlaceholders(got)})`);
+        }
     }
 
-    failed = true;
-    console.error(`✗ ${code}: ${keys.length} keys (expected ${sourceKeys.length})`);
+    const translated = sourceKeys.length - missing.length - empty.length;
+    const coverage = Math.floor((translated / sourceKeys.length) * 100);
+    const hasErrors = extra.length > 0 || empty.length > 0 || badPlaceholders.length > 0;
+    let mark = "✓";
+    if (hasErrors) mark = "✗";
+    else if (missing.length) mark = "⚠";
+    const log = hasErrors ? console.error : console.log;
+    log(`${mark} ${code}: ${translated}/${sourceKeys.length} keys translated (${coverage}%)`);
+
     if (missing.length) {
-        console.error(`    missing ${missing.length}: ${missing.join(", ")}`);
-        annotate(file, `Missing ${missing.length} key(s) present in ${SOURCE}: ${missing.join(", ")}`);
+        console.warn(`    missing ${missing.length} (falls back to English): ${missing.join(", ")}`);
+        annotate("warning", file, `Missing ${missing.length} key(s) present in ${SOURCE}, shown in English: ${missing.join(", ")}`);
     }
     if (extra.length) {
+        failed = true;
         console.error(`    extra ${extra.length}: ${extra.join(", ")}`);
-        annotate(file, `Has ${extra.length} key(s) not present in ${SOURCE}: ${extra.join(", ")}`);
+        annotate("error", file, `Has ${extra.length} key(s) not present in ${SOURCE}: ${extra.join(", ")}`);
+    }
+    if (empty.length) {
+        failed = true;
+        console.error(`    empty message ${empty.length} (renders blank): ${empty.join(", ")}`);
+        annotate("error", file, `Empty or missing message in ${empty.length} key(s), renders blank: ${empty.join(", ")}`);
+    }
+    if (badPlaceholders.length) {
+        failed = true;
+        console.error(`    placeholder mismatch ${badPlaceholders.length}: ${badPlaceholders.join("; ")}`);
+        annotate("error", file, `Placeholders differ from ${SOURCE} in ${badPlaceholders.length} key(s): ${badPlaceholders.join("; ")}`);
     }
 }
 
-// Locale directories present on disk but not declared in _index.json are never
-// loaded by the app — surface them so dead translation files don't rot silently.
+// Locale directories present on disk but not declared in _index.json are not
+// offered in the language picker — surface them so dead translation files don't
+// rot silently.
 const onDisk = readdirSync(localesDir, { withFileTypes: true })
     .filter((e) => e.isDirectory())
     .map((e) => e.name);
@@ -98,7 +160,7 @@ if (undeclared.length) {
 
 console.log();
 if (failed) {
-    console.error("Translation check FAILED — every locale must match the English key set.");
+    console.error("Translation check FAILED — fix orphaned keys, empty messages and placeholder mismatches above.");
     process.exit(1);
 }
-console.log("Translation check passed — all locales match the English key set.");
+console.log("Translation check passed — no orphaned keys, empty messages or placeholder mismatches.");

From d3d27dc08d40959fc0685c4979c4da67a643257d Mon Sep 17 00:00:00 2001
From: Edward <43848523+thomashacker@users.noreply.github.com>
Date: Tue, 6 Oct 2026 17:00:21 +0200
Subject: [PATCH 15/18] [client] Only offer locales listed in _index.json
 (#8091)

---
 client/ui/frontend/src/lib/i18n.ts | 23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/client/ui/frontend/src/lib/i18n.ts b/client/ui/frontend/src/lib/i18n.ts
index 87cc996dd..25f2b282a 100644
--- a/client/ui/frontend/src/lib/i18n.ts
+++ b/client/ui/frontend/src/lib/i18n.ts
@@ -40,14 +40,29 @@ function detectBrowserLanguage(available: string[]): string | null {
     return null;
 }
 
-// An empty persisted language code is the Go-side signal for first run.
+// Only locales listed in _index.json are shipped. A bundle on disk without an
+// _index.json row (e.g. a new Crowdin language not released yet) must not be
+// auto-detected or loaded, matching the Go side, which rejects saving it.
+async function shippedLanguages(): Promise<string[]> {
+    const onDisk = Object.keys(resources);
+    try {
+        const listed = new Set<string>((await I18n.Languages()).map((l) => l.code));
+        return onDisk.filter((code) => listed.has(code));
+    } catch (e) {
+        console.warn("load shipped languages failed, using all bundled locales", e);
+        return onDisk;
+    }
+}
+
+// An empty persisted language code is the Go-side signal for first run. A
+// persisted code that is no longer shipped is treated the same way.
 export async function initI18n(): Promise<void> {
-    const available = Object.keys(resources);
+    const available = await shippedLanguages();
     let language = "en";
     let firstRun = false;
     try {
         const prefs = await Preferences.Get();
-        if (prefs?.language) {
+        if (prefs?.language && available.includes(prefs.language)) {
             language = prefs.language;
         } else {
             firstRun = true;
@@ -68,7 +83,7 @@ export async function initI18n(): Promise<void> {
         fallbackLng: "en",
         defaultNS: "common",
         ns: ["common"],
-        resources,
+        resources: Object.fromEntries(available.map((code) => [code, resources[code]])),
         interpolation: {
             prefix: "{",
             suffix: "}",

From 2b9c36dc4901d888f4f16c3feb45d223c4beacbc Mon Sep 17 00:00:00 2001
From: Zoltan Papp <zoltan.pmail@gmail.com>
Date: Tue, 6 Oct 2026 17:33:54 +0200
Subject: [PATCH 16/18] [client] Close the UI before InstallValidate in the MSI
 (#7395)

* [client] Close the UI before InstallValidate in the MSI

The WiX CloseApplication action runs deferred, right before InstallFiles.
By then InstallValidate has already asked Restart Manager about the files
in use. When msiexec runs as LocalSystem (third-party deployment tools,
scheduled tasks) and netbird-ui.exe runs in the interactive user's
session, Restart Manager reports a session mismatch, so the installer
schedules the UI binary for replacement on the next reboot and returns
3010. Killing the UI afterwards is too late, the file stays on the old
version until a real reboot happens.

Replace the CloseApplication with an immediate WixQuietExec custom action
running taskkill /F /IM netbird-ui.exe, scheduled before InstallValidate.
The file is no longer held open when the in-use check runs, InstallFiles
overwrites it directly and no reboot is scheduled. Return is ignored
because taskkill exits non-zero when no UI is running. The action also
runs on uninstall so removal does not require a reboot either.

* Keep the deferred UI close as a fallback for the immediate taskkill

The immediate taskkill runs with the token of whoever launched msiexec. A
non-SYSTEM install cannot terminate a UI running in another user's session,
so keep the deferred CloseApplication, which runs as LocalSystem, to stop it
before InstallFiles. When taskkill already succeeded it finds no process.

* Document why the UI kill runs before InstallValidate
---
 client/netbird.wxs | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/client/netbird.wxs b/client/netbird.wxs
index f30a7aa7e..156b4ff27 100644
--- a/client/netbird.wxs
+++ b/client/netbird.wxs
@@ -76,6 +76,14 @@
 		<util:CloseApplication Id="CloseNetBird" CloseMessage="no" Target="netbird.exe" RebootPrompt="no" />
 		<util:CloseApplication Id="CloseNetBirdUI" CloseMessage="no" Target="netbird-ui.exe" RebootPrompt="no" TerminateProcess="0" />
 
+		<!-- Kill the UI before InstallValidate, otherwise its Restart Manager
+		     check sees netbird-ui.exe in use and schedules the replacement for
+		     the next reboot (3010). Keep it immediate and before InstallValidate.
+		     CloseNetBirdUI above stays as a deferred LocalSystem fallback for UIs
+		     in other sessions that this action cannot terminate. -->
+		<SetProperty Id="WixQuietExecCmdLine" Value="&quot;[System64Folder]taskkill.exe&quot; /F /IM netbird-ui.exe" Before="KillNetBirdUI" Sequence="execute" />
+		<CustomAction Id="KillNetBirdUI" BinaryRef="Wix4UtilCA_$(sys.BUILDARCHSHORT)" DllEntry="WixQuietExec" Execute="immediate" Return="ignore" />
+
 		<!-- WebView2 evergreen runtime detection.
 		     Probe both the per-machine and per-user EdgeUpdate keys; if either
 		     reports a non-empty `pv` value the runtime is already installed
@@ -104,6 +112,7 @@
 			Return="check" />
 
 		<InstallExecuteSequence>
+			<Custom Action="KillNetBirdUI" Before="InstallValidate" />
 			<Custom Action="InstallWebView2" Before="InstallFinalize"
 				Condition="NOT WEBVIEW2_VERSION_HKLM AND NOT WEBVIEW2_VERSION_HKCU AND NOT REMOVE" />
 		</InstallExecuteSequence>

From e2a2d379c5c3cd24a1fb5ca2e758cc09d304294d Mon Sep 17 00:00:00 2001
From: Viktor Liu <17948409+lixmal@users.noreply.github.com>
Date: Wed, 7 Oct 2026 02:10:44 +0900
Subject: [PATCH 17/18] [infrastructure] Exempt Crowdin service PRs from title
 and docs checks (#7170)

---
 .github/workflows/docs-ack.yml       | 2 ++
 .github/workflows/pr-title-check.yml | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/.github/workflows/docs-ack.yml b/.github/workflows/docs-ack.yml
index 7e34e2f8a..edd1eebff 100644
--- a/.github/workflows/docs-ack.yml
+++ b/.github/workflows/docs-ack.yml
@@ -12,6 +12,8 @@ jobs:
   docs-ack:
     name: Require docs PR URL or explicit "not needed"
     runs-on: ubuntu-latest
+    # Crowdin's translation-sync service PRs are auto-generated without the PR template.
+    if: github.event.pull_request.user.login != 'netbirddev'
 
     steps:
       - name: Read PR body
diff --git a/.github/workflows/pr-title-check.yml b/.github/workflows/pr-title-check.yml
index 24d81b50f..5b769e2f7 100644
--- a/.github/workflows/pr-title-check.yml
+++ b/.github/workflows/pr-title-check.yml
@@ -7,6 +7,8 @@ on:
 jobs:
   check-title:
     runs-on: ubuntu-latest
+    # Crowdin's translation-sync service PRs are auto-generated with a fixed title.
+    if: github.event.pull_request.user.login != 'netbirddev'
     steps:
       - name: Validate PR title prefix
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

From ae7ad5e0c8a31638752c2838257353d31be874f2 Mon Sep 17 00:00:00 2001
From: dmitri-netbird <dmitri.external@netbird.io>
Date: Wed, 7 Oct 2026 10:21:24 +0200
Subject: [PATCH 18/18] [management] Return permission-denied error when setup
 key is expired or invalid (#8086)

* return permission-denied error when setup key is expired or invalid

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* fix tests, don't return permission-denied on internal errors

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* return not found error when key fetch failed

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* normalise errors returned from each call-site of GetSetupKeyBySecret

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* return PermissionDenied after isValid() check failure

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

---------

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
---
 management/server/peer.go                      | 8 ++++----
 management/server/peer_test.go                 | 6 +++++-
 management/server/store/sql_store_setup_key.go | 2 +-
 3 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/management/server/peer.go b/management/server/peer.go
index 8d99bebb0..f3a5ebf46 100644
--- a/management/server/peer.go
+++ b/management/server/peer.go
@@ -710,11 +710,11 @@ func (am *DefaultAccountManager) handleUserAddedPeer(ctx context.Context, accoun
 func (am *DefaultAccountManager) handleSetupKeyAddedPeer(ctx context.Context, encodedHashedKey string, peer *nbpeer.Peer, opEvent *activity.Event, config *peerAddAuthConfig) error {
 	sk, err := am.Store.GetSetupKeyBySecret(ctx, store.LockingStrengthNone, encodedHashedKey)
 	if err != nil {
-		return status.Errorf(status.NotFound, "couldn't add peer: setup key is invalid")
+		return err
 	}
 
 	if !sk.IsValid() {
-		return status.Errorf(status.NotFound, "couldn't add peer: setup key is invalid")
+		return status.Errorf(status.PermissionDenied, "couldn't add peer: setup key is invalid")
 	}
 
 	if !sk.AllowExtraDNSLabels && len(peer.ExtraDNSLabels) > 0 {
@@ -915,12 +915,12 @@ func (am *DefaultAccountManager) AddPeer(ctx context.Context, accountID, setupKe
 			case addedBySetupKey:
 				sk, err := transaction.GetSetupKeyBySecret(ctx, store.LockingStrengthUpdate, encodedHashedKey)
 				if err != nil {
-					return fmt.Errorf("failed to get setup key: %w", err)
+					return err
 				}
 
 				// we validate at the end to not block the setup key for too long
 				if !sk.IsValid() {
-					return status.Errorf(status.PreconditionFailed, "couldn't add peer: setup key is invalid")
+					return status.Errorf(status.PermissionDenied, "couldn't add peer: setup key is invalid")
 				}
 
 				err = transaction.IncrementSetupKeyUsage(ctx, peerAddConfig.SetupKeyID)
diff --git a/management/server/peer_test.go b/management/server/peer_test.go
index ec4f0ef01..fa3be9a58 100644
--- a/management/server/peer_test.go
+++ b/management/server/peer_test.go
@@ -1495,7 +1495,7 @@ func Test_RegisterPeerBySetupKey(t *testing.T) {
 			name:                      "Absent setup key",
 			existingSetupKeyID:        "AAAAAAAA-38F5-4553-B31E-DD66C696CEBB",
 			expectAddPeerError:        true,
-			errorType:                 status.NotFound,
+			errorType:                 status.PermissionDenied,
 			expectedErrorMsgSubstring: "couldn't add peer: setup key is invalid",
 		},
 	}
@@ -2642,6 +2642,8 @@ func TestHandleSetupKeyAddedPeer(t *testing.T) {
 
 		err = manager.handleSetupKeyAddedPeer(context.Background(), encodedHashedKey, peer, opEvent, config)
 		require.Error(t, err)
+		require.IsType(t, &status.Error{}, err)
+		require.Equal(t, err.(*status.Error).ErrorType, status.PermissionDenied)
 		assert.Contains(t, err.Error(), "setup key is invalid")
 	})
 
@@ -2662,6 +2664,8 @@ func TestHandleSetupKeyAddedPeer(t *testing.T) {
 
 		err = manager.handleSetupKeyAddedPeer(context.Background(), encodedHashedKey, peer, opEvent, config)
 		require.Error(t, err)
+		require.IsType(t, &status.Error{}, err)
+		require.Equal(t, err.(*status.Error).ErrorType, status.PermissionDenied)
 		assert.Contains(t, err.Error(), "setup key is invalid")
 	})
 
diff --git a/management/server/store/sql_store_setup_key.go b/management/server/store/sql_store_setup_key.go
index 3857f6e8c..ac42ef725 100644
--- a/management/server/store/sql_store_setup_key.go
+++ b/management/server/store/sql_store_setup_key.go
@@ -127,7 +127,7 @@ func (s *SqlStore) GetSetupKeyBySecret(ctx context.Context, lockStrength Locking
 
 	if result.Error != nil {
 		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.PreconditionFailed, "setup key not found")
+			return nil, status.Errorf(status.PermissionDenied, "couldn't add peer: setup key is invalid")
 		}
 		log.WithContext(ctx).Errorf("failed to get setup key by secret from store: %v", result.Error)
 		return nil, status.Errorf(status.Internal, "failed to get setup key by secret from store")